83fd3eb8248b4a41ab7bcbbe193d93e57bc0034d20259c6e21dc6a427cfe0dcd

Resubmissions

07/09/2024, 19:16

240907-xytp6azemk

07/09/2024, 19:13

240907-xxe6dazdpl7

Analysis

max time kernel
73s
max time network
73s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
07/09/2024, 19:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
out.exe
Size 12.4MB
Sample240907-xxe6dazdpl
SHA256 e04408b170ad5d3c6fbaccd59cd06a661ff3eeac5a756f9de37b5cfa2173f731
MD5 b84a00b9ec2dd01e4ae753c8fd37176c
SHA1 54563fdafe6a03bd0b6456a6c96aac7f1ec6f195
SHA512 3f1aaa40b2c385540c3d350dc17a1afe21519b2477f726eddde771117a6cd413994b1ee7c1ffea30c8f0d6acf5e716fa46807bd1039ca0ff528b5de32ae4612a
SSDEEP 196608:4KJhO+tzTV9VIbFxCWGoHAEwpD+SlEmZC:4KzOj5cxMSlE4C
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
2840	POWERPNT.EXE
1716	POWERPNT.EXE
1916	POWERPNT.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2840	POWERPNT.EXE
2840	POWERPNT.EXE
1716	POWERPNT.EXE
1716	POWERPNT.EXE
1916	POWERPNT.EXE
1916	POWERPNT.EXE

C:\Users\Admin\AppData\Local\Temp\out.exe
"C:\Users\Admin\AppData\Local\Temp\out.exe"
1⤵
PID:2800

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\SubmitWait.ppsm" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2840

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\UninstallLock.ppsm" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\ReceiveRemove.pps" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UndoPop.bat" "
1⤵
PID:696

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C4
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 471B
SHA256 23fc6347e5fff488988c56c5e52fec4f0355c77ef54e165d7e5aeba6f73d327f
MD5 a39348aff3bf117f0f611385fa9fc251
SHA1 f1f75ba9b3d6ed36270f0e1c499578594cfe383e
SHA512 c0b94ec245bc4c2eff7909a861aec93b08a887ca326d927696b4912c2ef9c0c9cc0f367bff3935f2a0d4efb5092ffd26492ce3669ebb59ad720492320130aba9
MD5 SHA1 SHA512

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A
Size 412B
SHA256 6fce38b0f270d116ab10097636c16655746a194134743b5111c1de4a45714300
MD5 cd75c61e112dd128746ed6cc805a40f1
SHA1 2299c3035916b0fe8eb95c48e7a85af7d99aa046
SHA512 b971de82eea8dd75b9efe36ccf63155082504cf65e55c51df4aca2c339c95f77aeca539b0cd27f13e0bdf3b665e37bcd182737ab63739a405cb24a717e7b3f3d
MD5 SHA1 SHA512

Submit Download

Powerpoint.CampaignStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Powerpoint.CampaignStates.json
Size 21B
SHA256 138e49660d259061d8152137abd8829acdfb78b69179890beb489fe3ffe23e0c
MD5 f1b59332b953b3c99b3c95a44249c0d2
SHA1 1b16a2ca32bf8481e18ff8b7365229b598908991
SHA512 3c1f99ecc394df3741be875fbe8d95e249d1d9ac220805794a22caf81620d5fdd3cce19260d94c0829b3160b28a2b4042e46b56398e60f72134e49254e9679a4
MD5 SHA1 SHA512

Submit Download

Powerpoint.GovernedChannelStates.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Powerpoint.GovernedChannelStates.json
Size 417B
SHA256 200e8cc8dd12e22c9720be73092eafb620435d4569dbdcdba9404ace2aa4343c
MD5 c56ff60fbd601e84edd5a0ff1010d584
SHA1 342abb130dabeacde1d8ced806d67a3aef00a749
SHA512 acd2054fddb33b55b58b870edd4eb6a3cdd3131dfe6139cb3d27054ac2b2a460694c9be9c2a1da0f85606e95e7f393cf16868b6c654e78a664799bc3418da86e
MD5 SHA1 SHA512

Submit Download

Powerpoint.Settings.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Powerpoint.Settings.json
Size 87B
SHA256 6034f27b0823b2a6a76fe296e851939fd05324d0af9d55f249c79af118b0eb31
MD5 e4e83f8123e9740b8aa3c3dfa77c1c04
SHA1 5281eae96efde7b0e16a1d977f005f0d3bd7aad0
SHA512 bd6b33fd2bbce4a46991bc0d877695d16f7e60b1959a0defc79b627e569e5c6cac7b4ad4e3e1d8389a08584602a51cf84d44cf247f03beb95f7d307fbba12bb9
MD5 SHA1 SHA512

Submit Download

Powerpoint.SurveyHistoryStats.json

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\Floodgate\Powerpoint.SurveyHistoryStats.json
Size 14B
SHA256 88301f0b7e96132a2699a8bce47d120855c7f0a37054540019e3204d6bcbaba3
MD5 6ca4960355e4951c72aa5f6364e459d5
SHA1 2fd90b4ec32804dff7a41b6e63c8b0a40b592113
SHA512 8544cd778717788b7484faf2001f463320a357db63cb72715c1395ef19d32eec4278bab07f15de3f4fed6af7e4f96c41908a0c45be94d5cdd8121877eccf310d
MD5 SHA1 SHA512

Submit Download

C6FAF38A-54BE-4914-ABB7-F4E4D7A081A7

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\C6FAF38A-54BE-4914-ABB7-F4E4D7A081A7
Size 170KB
SHA256 2396f6e5c0d6d3b225741d4af821c50d07fe684c6ee9a65cc5ecb737669cfd97
MD5 ba4f0663fdd16d8edbe79b3d167e2b2d
SHA1 5a11552e5522d7a9b5c406656cdb8614bfbe5453
SHA512 5e235bb2fadc7e248a3cf30631fbf14e6a96c21037271c27bbde44349ef05a44df5bddf452f3e0728ec3767cceb0beb5e90aa3bf767fd2bea4311d45b186e8db
SSDEEP 1536:Ii2XPRAqXbH41gwEpLe7HW8bM/hMYcAZl1p5ihs7EXXBEAD2Odac:I5e7HW8bM/kXWkD
MD5 SHA1 SHA512 SSDEEP

Submit Download

powerpnt.exe_Rules.xml

Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\powerpnt.exe_Rules.xml
Size 371KB
SHA256 e6e361b0652debef9850931222360c37526a2c0db7dee06e9a16c92875c0d433
MD5 b74eb161d37d710b9b22271584485c1a
SHA1 1d88603f131117064de0400089891100ed121fc3
SHA512 7db4e9e491ba6136947581c6aa66b5d7297520b0e11f4874e0d44dea034ce16e2ea3234bf593167acea944e8ea03cfd03a37a84838e11b9232944447dcd41849
SSDEEP 1536:42/zod+LU6KPo+DUvcYx8nW1u6uSivsUQK75IthveLT2Xu8:V3U6KPo+DUv+W1u6uSivsUQK75Ith5XV
MD5 SHA1 SHA512 SSDEEP

Submit Download

powerpnt.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db
Size 24KB
SHA256 5f72c11fd2fa88d8b8bfae1214551f8d5ee07b8895df824fa717ebbcec118a6c
MD5 a6064fc9ce640751e063d9af443990da
SHA1 367a3a7d57bfb3e9a6ec356dfc411a5f14dfde2a
SHA512 0e42dd8e341e2334eda1e19e1a344475ed3a0539a21c70ba2247f480c706ab8e2ff6dbeb790614cbde9fb547699b24e69c85c54e99ed77a08fe7e1d1b4b488d0
SSDEEP 12:TjnvqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:Tzqt8VtbDBtDi4kZERDEe
MD5 SHA1 SHA512 SSDEEP

Submit Download

powerpnt.exe.db

Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\powerpnt.exe.db
Size 24KB
SHA256 b5cbae5c48721295a51896f05abd4c9566be7941cda7b8c2aecb762e6e94425f
MD5 8665de22b67e46648a5a147c1ed296ca
SHA1 b289a96fee9fa77dd8e045ae8fd161debd376f48
SHA512 bb03ea9347d302abf3b6fece055cdae0ad2d7c074e8517f230a90233f628e5803928b9ba7ba79c343e58dacb3e7a6fc16b94690a5ab0c71303959654a18bb5da
SSDEEP 12:TCmqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TDqt8VtbDBtDi4kZERDEe
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2840-10-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-45-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-12-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-13-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-15-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-20-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-24-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-23-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-22-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-21-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-19-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-18-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-17-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-16-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-14-0x00007FFDE1350000-0x00007FFDE1360000-memory.dmp

Download

memory/2840-11-0x00007FFDE1350000-0x00007FFDE1360000-memory.dmp

Download

memory/2840-46-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-48-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-47-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-49-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-1-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-8-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-9-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-4-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-6-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-7-0x00007FFE234E0000-0x00007FFE236E9000-memory.dmp

Download

memory/2840-3-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-5-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-2-0x00007FFDE3570000-0x00007FFDE3580000-memory.dmp

Download

memory/2840-0-0x00007FFE23583000-0x00007FFE23584000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads