Overview
overview
10Static
static
3Manifest/DuiLib_u.dll
windows7-x64
3Manifest/DuiLib_u.dll
windows10-2004-x64
3Manifest/S...in.exe
windows7-x64
10Manifest/S...in.exe
windows10-2004-x64
10Manifest/basinful.odp
windows7-x64
3Manifest/basinful.odp
windows10-2004-x64
1Manifest/msvcp140.dll
windows7-x64
3Manifest/msvcp140.dll
windows10-2004-x64
3Manifest/v...40.dll
windows7-x64
3Manifest/v...40.dll
windows10-2004-x64
3Analysis
-
max time kernel
133s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
18-02-2025 07:52
Static task
static1
Behavioral task
behavioral1
Sample
Manifest/DuiLib_u.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
Manifest/DuiLib_u.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
Manifest/SplashWin.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Manifest/SplashWin.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
Manifest/basinful.odp
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
Manifest/basinful.odp
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
Manifest/msvcp140.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Manifest/msvcp140.dll
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
Manifest/vcruntime140.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Manifest/vcruntime140.dll
Resource
win10v2004-20250217-en
General
-
Target
Manifest/basinful.odp
-
Size
58KB
-
MD5
984e6cd075b61eb5993f0a103c37e6cd
-
SHA1
8ef89a1fe86c6b5e34b50962738bee7fd1f40cae
-
SHA256
37cfc0ece89f5b3acd99a90d56357f1bf27d35a10977bb2fac6a1d2ddc649258
-
SHA512
af0c3625c29e95c9693ba7f2164941453d1e0aec74eddda1f74ec412e732a697987074ca29c9d0c6b5b7571014a212f4295d19cb10be7616c1feca032bdf321c
-
SSDEEP
1536:jQY3ruZuYgWqNzYsZ2bQJqHGBOl/Fm2LianahD:jQoEuYgW8FMQYmM66r4
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2928 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2928 POWERPNT.EXE 2928 POWERPNT.EXE 2928 POWERPNT.EXE 2928 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Manifest\basinful.odp" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2928