3063285af5c7586ad04178c52b55da2bc1970cb7ae4fadba2195ad4a3fb8ac50

Analysis

max time kernel
600s
max time network
587s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/06/2026, 04:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PPT for Breifing at HQ Norther Command/PPT for Breifing at HQ Norther Command.pptx.lnk
Size 2KB
Sample260629-fb13aads9t
SHA256 3063285af5c7586ad04178c52b55da2bc1970cb7ae4fadba2195ad4a3fb8ac50
MD5 a1cc2e62b076b037fc403f112b755ed6
SHA1 dbcadfb99b1a36d3ddbdc83a6219ef5b77d0c6ff
SHA512 2e0f99018423e4079da84dfa0ff964ef78b2e85d3c69cbe82835c9b73310bdb6cf74b180dbc056bdde4ca3d21e3715f19744229024f5e746c18ca8aa68b3efeb
TLSH
T10551CD0327FA8355D2B34B3119B6D3A58A25FE6DA852CF1F4398568E1DB2700DC31736
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
932	jrnswry_acrhyis.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1592	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2568	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1592	powershell.exe
1592	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2568	POWERPNT.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1592	powershell.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2568	POWERPNT.EXE
2568	POWERPNT.EXE
2568	POWERPNT.EXE
2568	POWERPNT.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5192 wrote to memory of 2636	5192	cmd.exe	81
PID 2636 wrote to memory of 4076	2636	cmd.exe	82
PID 4076 wrote to memory of 2568	4076	cmd.exe	84
PID 4076 wrote to memory of 1896	4076	cmd.exe	85
PID 4076 wrote to memory of 1592	4076	cmd.exe	86
PID 4076 wrote to memory of 932	4076	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PPT for Breifing at HQ Norther Command\PPT for Breifing at HQ Norther Command.pptx.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:5192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /MIN excel\excel.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K excel\excel.bat
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\ProgramData\PPT_for_Breifing_at_HQ_Norther_Command.pptx" /ou ""
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2568
  - - C:\Windows\system32\xcopy.exe
      xcopy excel\excel C:\ProgramData\ /Y /C /Q
      4⤵
      PID:1896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Unblock-File - Path C:\ProgramData\excel
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1592
  - - C:\Users\Admin\AppData\Roaming\jrnswry_acrhyis.exe
      "C:\Users\Admin\AppData\Roaming\jrnswry_acrhyis.exe"
      4⤵
      Executes dropped EXE
      PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PPT_for_Breifing_at_HQ_Norther_Command.pptx

Path C:\ProgramData\PPT_for_Breifing_at_HQ_Norther_Command.pptx
Size 9.2MB
SHA256 853ed3a26188e4cd89db50ebf50dd0c7b9392c056f637ba3af042c0156877a65
MD5 d0b3d38a9f3527ad2e972e236616f2f2
SHA1 5915d322f191cbea4066961243eb23524c8e0b90
SHA512 5230f774591652dedf6c02bb89a588fbaf782505b657aab15d58f9a8343a4a0fca2fd86624f0e0273f76b0dee534b20ee814b704693f4cdc42b979fe53a7be5f
SSDEEP 196608:c2g8s86LIFe1lS15LFYHEUlgHlqfeRGoC4L:c2g8s86LIFyU1NUBDIL
TLSH
T15CA63338D75224FBCA2A52364CFFA95044711DB067D9A28C7288FA447BFD6534870BAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

excel

Path C:\ProgramData\excel
Size 25.5MB
SHA256 abfac8026d1974220871568caf9344cbffed19a184ff098c0912ffbb4f1e42d5
MD5 c6409e078bad9094ab4b26dad5219f6c
SHA1 f372511e07d474f2b4488603cc0a6fd4c780cd7e
SHA512 5e981b64b3c0decd0b141fad55444e831eecaef2ef3b211e636e0997d5c42cac8644ce9c5a6903d3c4d1cecfd5d505288cb75942cdfad3d234deb2116d7de114
SSDEEP 12288:vgeLTQTFTFTtTQTFTFTgTQTFTFTgTQTFTFTgTQTFTFTtTQTFTFTgTQTFTFTgTQT3:vPjxg
TLSH
T14F47C0CD484DA326D892DD2510ED2E2E275C24BBC94A2FB4ECBB3621D70D1D7DA234D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1qa2lfzz.cfa.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1qa2lfzz.cfa.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 343B
SHA256 4ae20f6ed8de58e86937ea7a25061db83b1ba799c2e4e6858037b58ca5412b2c
MD5 9b55230610860ee62dbe423ba625ee61
SHA1 4abb6e269e2383a9efe6e5fddd592667668e983b
SHA512 5857c0952cd4cfb01321dd2748b1856373871f96ae337c38f5bfa740b87e8c0a64bae99bbc345146d46fd88d7727e5d509525bba5d48e05d37386f92a0ddfca1
TLSH
T12AE04F1B5338C7F2CB7C62B1B5B59DD5CAF29848C6BA40222DD46CC10D4254731E7C00
MD5 SHA1 SHA512 TLSH

Submit Download

d00655d2aa12ff6d.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms
Size 24B
SHA256 90bf6baa6f968a285f88620fbf91e1f5aa3e66e2bad50fd16f37913280ad8228
MD5 4fcb2a3ee025e4a10d21e1b154873fe2
SHA1 57658e2fa594b7d0b99d02e041d0f3418e58856b
SHA512 4e85d48db8c0ee5c4dd4149ab01d33e4224456c3f3e3b0101544a5ca87a0d74b3ccd8c0509650008e2abed65efd1e140b1e65ae5215ab32de6f6a49c9d3ec3ff
MD5 SHA1 SHA512

Submit Download

d00655d2aa12ff6d.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d00655d2aa12ff6d.customDestinations-ms
Size 815B
SHA256 711f496c72690547eee410b1f92568f429f36271f8bda96f8585cd6921bf98b8
MD5 f4f3113e7a1e08e8f765774a67344e66
SHA1 7133fec851fd8490072d76c536619cc27a70866c
SHA512 23f88cacda7821c5686f67c9d084f2d3a0fff8f13b166e2ac19b0b04dba17d460c3298215dc0d783138c60bd87dcde339a06f702b74988c8239d63ac7c4ae285
TLSH
T15901FE412B7A1B22F0960330217A6726EA20BDD1C748910FA9C4390E4872D412B98F27
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-40-0x000001C7EB060000-0x000001C7EC9E8000-memory.dmp

Download

memory/1592-37-0x0000019F9D310000-0x0000019F9DDD2000-memory.dmp

Download

memory/1592-20-0x0000019FB6470000-0x0000019FB6492000-memory.dmp

Download

memory/2568-22-0x00007FFCD61B0000-0x00007FFCD61C0000-memory.dmp

Download

memory/2568-21-0x00007FFCD61B0000-0x00007FFCD61C0000-memory.dmp

Download

memory/2568-10-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/2568-7-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/2568-9-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/2568-8-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download

memory/2568-6-0x00007FFCD8B10000-0x00007FFCD8B20000-memory.dmp

Download