717374926f2d2a078ef2a541497ce30e7a0283add5b111251ec8a41ecd200bb2

Analysis

max time kernel
140s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Indrejser/Blewits/Gonadic131.pot
Size

35KB
MD5

2f5f902edfecac3a9d4116df30075d69
SHA1

416fa1751926a7b755b8ad5fbeb72a5e98e8deb2
SHA256

6c301208b1202c52ce208546d634a55c5e58b4515bee44c11f377f2d6a931fc8
SHA512

e8b13a13e548f142186b0ae81601d7bd1dedd0a6d1e4af30e477edae6880721e90e8256e2d0cbce5478a1bb3602c6169e09ebd872f7663a7d81e709a9c6d8984
SSDEEP

768:HpRboDcBs+WIpxtRQfCJM2I/rg8AT5uin0:fqfiefx/MQ

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1628	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1628	POWERPNT.EXE
1628	POWERPNT.EXE
1628	POWERPNT.EXE
1628	POWERPNT.EXE

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Indrejser\Blewits\Gonadic131.pot" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-0-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-1-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-3-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-4-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-5-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-7-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-8-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-6-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-2-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-9-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-10-0x00007FFF74030000-0x00007FFF74040000-memory.dmp

Filesize
64KB

Download
memory/1628-11-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-12-0x00007FFF74030000-0x00007FFF74040000-memory.dmp

Filesize
64KB

Download
memory/1628-13-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-14-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-15-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-16-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-17-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-18-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-20-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-19-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-21-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-23-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-22-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-44-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-45-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-46-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-48-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download
memory/1628-47-0x00007FFF76750000-0x00007FFF76760000-memory.dmp

Filesize
64KB

Download
memory/1628-49-0x00007FFFB66D0000-0x00007FFFB68C5000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads