Overview
overview
10Static
static
3New Setup ...up.exe
windows7-x64
10New Setup ...up.exe
windows10-2004-x64
10New Setup ...er.dll
windows7-x64
1New Setup ...er.dll
windows10-2004-x64
1New Setup ...h.xlsx
windows7-x64
1New Setup ...h.xlsx
windows10-2004-x64
1New Setup ...ib.dll
windows7-x64
1New Setup ...ib.dll
windows10-2004-x64
1New Setup ...er.exe
windows7-x64
1New Setup ...er.exe
windows10-2004-x64
1New Setup ...or.exe
windows7-x64
1New Setup ...or.exe
windows10-2004-x64
1New Setup ...1].exe
windows7-x64
1New Setup ...1].exe
windows10-2004-x64
1New Setup ...st.dll
windows7-x64
1New Setup ...st.dll
windows10-2004-x64
1New Setup ...1].exe
windows7-x64
1New Setup ...1].exe
windows10-2004-x64
3New Setup ...1].exe
windows7-x64
1New Setup ...1].exe
windows10-2004-x64
1New Setup ...er.dll
windows7-x64
1New Setup ...er.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1New Setup ...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
143s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 16:22
Static task
static1
Behavioral task
behavioral1
Sample
New Setup File/Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
New Setup File/Setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
New Setup File/WebView2Loader.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
New Setup File/WebView2Loader.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
New Setup File/sasquatch.xlsx
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
New Setup File/sasquatch.xlsx
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
New Setup File/x64/AzureKeyVaultDgssLib.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
New Setup File/x64/AzureKeyVaultDgssLib.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
New Setup File/x64/BugReporter.exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
New Setup File/x64/BugReporter.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
New Setup File/x64/ComExtractor.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
New Setup File/x64/ComExtractor.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
New Setup File/x64/HDHelper_[0MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
New Setup File/x64/HDHelper_[0MB]_[1].exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
New Setup File/x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
New Setup File/x64/Microsoft.Toolkit.Win32.UI.XamlHost.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
New Setup File/x64/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
New Setup File/x64/NvStereoUtilityOGL_[1MB]_[1].exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
New Setup File/x64/VSLauncher_[0MB]_[1].exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
New Setup File/x64/VSLauncher_[0MB]_[1].exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
New Setup File/x64/WinUiBootstrapper.dll
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
New Setup File/x64/WinUiBootstrapper.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
New Setup File/x64/api-ms-win-core-console-l1-1-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral24
Sample
New Setup File/x64/api-ms-win-core-console-l1-2-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
New Setup File/x64/api-ms-win-core-datetime-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral26
Sample
New Setup File/x64/api-ms-win-core-debug-l1-1-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
New Setup File/x64/api-ms-win-core-errorhandling-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
New Setup File/x64/api-ms-win-core-fibers-l1-1-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
New Setup File/x64/api-ms-win-core-file-l1-1-0.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral30
Sample
New Setup File/x64/api-ms-win-core-file-l1-2-0.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
New Setup File/x64/api-ms-win-core-file-l2-1-0.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
New Setup File/x64/api-ms-win-core-handle-l1-1-0.dll
Resource
win10v2004-20240426-en
General
-
Target
New Setup File/Setup.exe
-
Size
1.1MB
-
MD5
c047ae13fc1e25bc494b17ca10aa179e
-
SHA1
e293c7815c0eb8fbc44d60a3e9b27bd91b44b522
-
SHA256
6c30c8a2e827f48fcfc934dd34fb2cb10acb8747fd11faae085d8ad352c01fbf
-
SHA512
0cfb96d23b043bcb954cc307f85e5bbc349c0c8a0c6eaa335ea9a8fa19ce65b047f30ed0049562d40880400d4f70e3bb28975d6970f3ae4af6da1ba06e36d48c
-
SSDEEP
12288:a9hZPq27B7+x3dPC4gvgdVwTzDxsVyY4YoUwpf5kpRG6xsfJAYo2R0B5YD5sW91A:STS27B7+x3E4tdS/Dxkd4YoDfZ90gLS
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
CLVIEW.EXEdescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE is not expected to spawn this process 2888 1480 CLVIEW.EXE POWERPNT.EXE -
Processes:
POWERPNT.EXECLVIEW.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main CLVIEW.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" CLVIEW.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch CLVIEW.EXE -
Suspicious behavior: AddClipboardFormatListener 3 IoCs
Processes:
POWERPNT.EXEPOWERPNT.EXEPOWERPNT.EXEpid process 2716 POWERPNT.EXE 1576 POWERPNT.EXE 1480 POWERPNT.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Setup.exepid process 2044 Setup.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
POWERPNT.EXEPOWERPNT.EXEPOWERPNT.EXECLVIEW.EXEpid process 2716 POWERPNT.EXE 1576 POWERPNT.EXE 1480 POWERPNT.EXE 2888 CLVIEW.EXE 2888 CLVIEW.EXE 2888 CLVIEW.EXE 2888 CLVIEW.EXE 2888 CLVIEW.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
POWERPNT.EXEPOWERPNT.EXEdescription pid process target process PID 2716 wrote to memory of 2912 2716 POWERPNT.EXE splwow64.exe PID 2716 wrote to memory of 2912 2716 POWERPNT.EXE splwow64.exe PID 2716 wrote to memory of 2912 2716 POWERPNT.EXE splwow64.exe PID 2716 wrote to memory of 2912 2716 POWERPNT.EXE splwow64.exe PID 1480 wrote to memory of 2888 1480 POWERPNT.EXE CLVIEW.EXE PID 1480 wrote to memory of 2888 1480 POWERPNT.EXE CLVIEW.EXE PID 1480 wrote to memory of 2888 1480 POWERPNT.EXE CLVIEW.EXE PID 1480 wrote to memory of 2888 1480 POWERPNT.EXE CLVIEW.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Setup File\Setup.exe"C:\Users\Admin\AppData\Local\Temp\New Setup File\Setup.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\InstallPop.ppsx"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2912
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2740
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\StartInstall.pps"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1576
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\StartInstall.pps"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE"C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE" "POWERPNT" "Microsoft PowerPoint"2⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\MsOfficeHelp14\MOH2D59.tmp\ClientViewerSettings.xml
Filesize7KB
MD588fbdbf0b8ed30038abb141e26ad42b6
SHA1e867446eeef83f11ec0b9c3fee7499442923d9a3
SHA25663a2227b104139265e9d2f43e5e4c8c61aabcd92ffee838fbbe18e987e911c68
SHA512e3924be97958268b1ed49e396965b901121ac4c1c04e8fbc209517b00c9f2de386c821703e31a7d85383055f381a0191a59f0aad159b94e5071a81325eb4d25d