Analysis
-
max time kernel
0s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2023 21:47
Static task
static1
Behavioral task
behavioral1
Sample
Revised Posting Policy Offrs by HQ Dec 2023 final.ppam
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
Revised Posting Policy Offrs by HQ Dec 2023 final.ppam
Resource
win10v2004-20231130-en
General
-
Target
Revised Posting Policy Offrs by HQ Dec 2023 final.ppam
-
Size
3.6MB
-
MD5
e05cfdcd11105776fb13edd620795551
-
SHA1
5b4584c6a419b08bb107e274d0ed2f24411ddbcc
-
SHA256
da298e4d09a9e151c6bf60e8ebfdd8fc2e633d078c705db768e3284acdad0678
-
SHA512
925df1bf84404597bddb82db83896206435aaaca39a62846abe3ce3b1dbddc9b198f7caf76eac7294384682f49c0057d12b0b5ac81383f6ee8f51138781e4519
-
SSDEEP
98304:/S/mMAQoSERBI9w//t2M7rv/GkBqAnimQNX:LM/tQI9wXt2MjGEqAnINX
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
POWERPNT.EXEpid Process 1204 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Revised Posting Policy Offrs by HQ Dec 2023 final.ppam" /ou ""1⤵
- Suspicious use of SetWindowsHookEx
PID:1204 -
C:\Users\Admin\Documents\522147\jevisvmansr.exeC:\Users\Admin\Documents\522147\jevisvmansr.exe2⤵PID:2800
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
307B
MD50a81e877953a15a7fc5789f31bc4180a
SHA1246cef05362a4eb5a4bcdb6d4e4554cbcfe1b037
SHA2566bc0b0bff2ffc0feab541722b462326af6f509e542833d4aa6b1f2c8ef9fcff2
SHA512ddd9ead1eb23eb74742ffde0b14973e2b312ecb9ee2409a239eade11a3b9c1e4e748e76cc87d1a6183867f380c79a41b229379376f932491245dafb17d93aadd
-
Filesize
13KB
MD5e26c4cdd2fc8dbe389cc11fb9b94bb4c
SHA1f466f44ad94be333981126a737bfd0b25f95a8f7
SHA2565a97a910c0b6f4b86dca1f3af657afc477300dfc5af49446946f4cb034485c0a
SHA512c02083334070ebab3724d8b1e2bca5b9fdf8d800d162db52b4644d3dd1e777affedc8b139c3f51e03982babef5ae9868058756d2a929b1dcbf5174a4aeed3083
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
41KB
MD5c76b5043e6aba876a3adae104b5a153a
SHA11ba06a7e98dbe00dfdc6a846ae19833ae28aa03c
SHA256fc6b8e359740308b3db1b27ed566c052157c2812485a0e289c23224ce21bac18
SHA512e124c9845a4524e9ce8877c24deb3e8c66e31ff2a46326046eb837c740623b998e4a24196a6ca2a454ecb3e57fb1c20169a28e45cacb66acc8973715c5fee679
-
Filesize
20KB
MD529edacc24c536ba0a2c837aced608bf9
SHA1847e8145a026a0d763a30fe8144799c6cfb4390f
SHA256546934157d4b75be45ab1fd4bfcd240b0532d3b69f81c4a2527e0db647b311bf
SHA512fa03c24f5b537ea4ae43f2820abd393d95d06608e5e08bf9ca3e5c0f1065296a96f676919e2988ee6b6dab6efe47b74e4af62d5137d9b5a3822f8545e7697922
-
Filesize
4KB
MD531e6a85bb1a5f4602efa8ee059b86ac7
SHA1d52fe20fd819e62b6c99048d10d38e0428d2a272
SHA256f7ebe6cad57412100b1240b5e016af0f0e87f465a157dff9f63d87b6404c66bf
SHA512564880518de94ac66470646580e0c4dc4d0981cbff09d4bace1b48795470415bb92db68913543e1382331963523e6f60dcdadcad5853d2e35dc21f793cf64bb6
-
Filesize
24KB
MD5e7dd281b2f3c47da1f1fe1757e9a25d3
SHA1747e668b8989d2f47151cd2a03053cdf8c85ba66
SHA2561d5936da68e735d136e3e20f5aa114f9282731a66bfc9c92decb8ee7c5e87c89
SHA512b807a124cb5b4f6636d251d4ac614d0a970054ec8bd765a970ac622670cde7aac0b7d6a88e82eb8b1893079ca164d17a527eaa89297152acb2e567f7ab652eac
-
Filesize
5KB
MD5a4b91f12842845f395b4d3b6419b2f35
SHA14213e6e5279e11b35740dec0c81a772244cd1bac
SHA2565c951803c20d4e80faf9a963cd0e691264958cc18187491e652b3f00251c327f
SHA512fefab4db9a2d8631e9bc9fda7238ecb20323de6072e918f8fbcc0996b2605494efc5199e3b9ccd13ece44e0644037a0b34306df3c37dfd032a4f27ea774e4bc9
-
Filesize
120KB
MD53e63821c99e1216d487b813abd1a972c
SHA1aff6801ce0839b800e1735e45685636565b92ad9
SHA256d293495dc7e1ea64a9319b03dcabffe807475d1fe413d18dc18f510fb2019cc7
SHA5129b3a91c6109857cc63a7e1e635d5519f5cb387fc604a502f2ddde0f769e85d537115ef95eefefdd3c8c05d6ac9c23aa83f21ddbde1c4b67171dab3b6f6b9d7ac