Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-08-2024 16:43

General

  • Target

    JUZGADO PENAL/bikini.pptx

  • Size

    70KB

  • MD5

    24fec7f3f13b3a944e02878b284cdd2f

  • SHA1

    7e5d135c16e8d7558e18b778224fc55c3ac35d26

  • SHA256

    64ce8379e4d91d2ba599e7b643399c67f6d256c8513feb97dc24c404ef752ea7

  • SHA512

    7594696fb51916ee30855cc513f028bc491c62d63a524f43a2de89d661ca7fab58ae2cff6208aa50f8a4b8998dc89e8c512109a43cf9aca629a8a79ab257b080

  • SSDEEP

    1536:WghD5gv2J3lzVYA3TmtFZ5LyGXqV1hJEHaBNskwdd7Uh8:WgQvIyPtF72zvhak0dd7

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\JUZGADO PENAL\bikini.pptx" /ou ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/556-0-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-1-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-3-0x00007FFA682AD000-0x00007FFA682AE000-memory.dmp

    Filesize

    4KB

  • memory/556-2-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-4-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-5-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-6-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-7-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-9-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-16-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-15-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-17-0x00007FFA26230000-0x00007FFA26240000-memory.dmp

    Filesize

    64KB

  • memory/556-14-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-12-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-11-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-10-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-8-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-13-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB

  • memory/556-18-0x00007FFA26230000-0x00007FFA26240000-memory.dmp

    Filesize

    64KB

  • memory/556-39-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-41-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-42-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-40-0x00007FFA28290000-0x00007FFA282A0000-memory.dmp

    Filesize

    64KB

  • memory/556-43-0x00007FFA68210000-0x00007FFA68405000-memory.dmp

    Filesize

    2.0MB