Analysis
-
max time kernel
0s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 00:10
Static task
static1
Behavioral task
behavioral1
Sample
PowerPoint.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PowerPoint.exe
Resource
win10v2004-20230220-en
Errors
General
-
Target
PowerPoint.exe
-
Size
136KB
-
MD5
70108103a53123201ceb2e921fcfe83c
-
SHA1
c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
-
SHA256
9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
-
SHA512
996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
SSDEEP
1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sys3.exepid process 912 sys3.exe -
Loads dropped DLL 2 IoCs
Processes:
PowerPoint.exepid process 1472 PowerPoint.exe 1472 PowerPoint.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
sys3.exePowerPoint.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 sys3.exe File opened for modification \??\PHYSICALDRIVE0 PowerPoint.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sys3.exedescription pid process Token: SeShutdownPrivilege 912 sys3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
PowerPoint.exedescription pid process target process PID 1472 wrote to memory of 912 1472 PowerPoint.exe sys3.exe PID 1472 wrote to memory of 912 1472 PowerPoint.exe sys3.exe PID 1472 wrote to memory of 912 1472 PowerPoint.exe sys3.exe PID 1472 wrote to memory of 912 1472 PowerPoint.exe sys3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PowerPoint.exe"C:\Users\Admin\AppData\Local\Temp\PowerPoint.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeC:\Users\Admin\AppData\Local\Temp\\sys3.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
C:\Users\Admin\AppData\Local\Temp\systm.txtFilesize
48B
MD5aa142cb69ceb2968adc611552d279441
SHA1ce306e86d2a19a7b7a71cd64aefcee4df54d4e1f
SHA256751ad9c6ef87948d1d4bb1e6ca4d8317dbbead9df007606686fa3ac28c20e5a9
SHA512e12d96dc6ab640b3d5648566f10b0b71cc97a622290f621e76b7042f99767a7c38e9d1bf056cdf718a9fdc6c90ed2df297a660c8e4d03931022dfac0423066a8
-
\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
memory/1472-63-0x000000002AA00000-0x000000002AA24000-memory.dmpFilesize
144KB