Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    05-07-2024 22:24

General

  • Target

    barchan.pptx

  • Size

    38KB

  • MD5

    92eff45ae68fef7d74adde110468d5f1

  • SHA1

    bb3ad15f03f70960374f3c495d69d26c6c9f09b9

  • SHA256

    0dbddf219a27ab1311e62aeb0158f95eb53bedede62cd69f065a39d73a44990a

  • SHA512

    cd4764b69f5969eb5d26f4d17b8e15cccf4c91710a63015a6c604b4951a2bdee1772b052e2bdfa00307c65cdf3d67d40adcc05c5fc7b402edabe105cf19ff147

  • SSDEEP

    768:Vcub1spIlH4pwRLXoGYGUDhVqUoWONslN8CUjG/rC/dFwj/Zv5P9aQWN:SncXmWDsmj2/j/l5Ip

Score
1/10

Malware Config

Signatures

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\barchan.pptx"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3056
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:2488

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3056-0-0x000000002D761000-0x000000002D762000-memory.dmp

      Filesize

      4KB

    • memory/3056-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3056-2-0x000000007299D000-0x00000000729A8000-memory.dmp

      Filesize

      44KB

    • memory/3056-4-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/3056-5-0x000000007299D000-0x00000000729A8000-memory.dmp

      Filesize

      44KB