648eb3dd8252073b53f16887084c5415f56e90877aee69d29393efe1382679b4

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/12/2024, 20:40 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eicar-standard-antivirus-test-files/eicar-powerpoint-action-macro-msgbox.pptm
Size

31KB
MD5

72a4f5208fffbf6df1db5f3de168df08
SHA1

d983ff33101aa44b57da0ff0e410c8eef9d2b76d
SHA256

25e4642a087257cc6e1467e5e7536e0f90033425c60d47866c329607919226e6
SHA512

fac8e2c429e49a85596871ec64e8e935bef017c59fc664effc2105cbe4e5636ea993b3d1b4728309e3469221938d55b95b5a08036bfc575af38d9eb77267ad1e
SSDEEP

768:LlgVFy4S0JS00SneS0yS07jS0MS0bS02S03SPRDYmWlLv2Gt6j23IGC1unAiMB0m:h4q0JGEeAvhPY/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2548	POWERPNT.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	POWERPNT.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2156	2548	POWERPNT.EXE	30
PID 2548 wrote to memory of 2156	2548	POWERPNT.EXE	30
PID 2548 wrote to memory of 2156	2548	POWERPNT.EXE	30
PID 2548 wrote to memory of 2156	2548	POWERPNT.EXE	30

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\eicar-standard-antivirus-test-files\eicar-powerpoint-action-macro-msgbox.pptm"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2548-0-0x000000002D9E1000-0x000000002D9E2000-memory.dmp

Filesize
4KB

Download
memory/2548-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2548-2-0x000000007246D000-0x0000000072478000-memory.dmp

Filesize
44KB

Download
memory/2548-3-0x000000007246D000-0x0000000072478000-memory.dmp

Filesize
44KB

Download