Overview
overview
10Static
static
3df8a640b27...b2.exe
windows7-x64
10df8a640b27...b2.exe
windows10-2004-x64
10Chiedergli.ppt
windows7-x64
1Chiedergli.ppt
windows10-2004-x64
1Ricordate.ppt
windows7-x64
1Ricordate.ppt
windows10-2004-x64
1Sfaldavano.ppt
windows7-x64
1Sfaldavano.ppt
windows10-2004-x64
1Tenue.ppt
windows7-x64
1Tenue.ppt
windows10-2004-x64
1Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2024 15:52
Static task
static1
Behavioral task
behavioral1
Sample
df8a640b27ba57ed68bd74d105225fb2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
df8a640b27ba57ed68bd74d105225fb2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Chiedergli.ppt
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
Chiedergli.ppt
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Ricordate.ppt
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Ricordate.ppt
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Sfaldavano.ppt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Sfaldavano.ppt
Resource
win10v2004-20240319-en
Behavioral task
behavioral9
Sample
Tenue.ppt
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
Tenue.ppt
Resource
win10v2004-20240226-en
General
-
Target
Sfaldavano.ppt
-
Size
634KB
-
MD5
583b1b8e296e1ac5c9bfbbea75535ae2
-
SHA1
99fce7f722eee8a5e6008a55ba7f91f80ea772d3
-
SHA256
bbcd3d461757a7bc3313eed80243e13a03672b534caae3cd91779f2716196758
-
SHA512
7dfe528f7d5f9d1e066b7c892ec565b1c85e393bd95c8decd14e6013146405fa5d23f0e803bdce3c2694309160125f3af8f79ed0ed87d397a12cdaac86225701
-
SSDEEP
12288:+cffSgwsGAe7BTq+MqtfwnI364yT1Jra9/Ydzmmq+pcXrPoPZGYPbUrAomRd/xLe:a/sGAe7RqSoI364Zid78PJrAH55G7/Y6
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString POWERPNT.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
POWERPNT.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily POWERPNT.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 764 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
POWERPNT.EXEpid process 764 POWERPNT.EXE 764 POWERPNT.EXE 764 POWERPNT.EXE 764 POWERPNT.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Sfaldavano.ppt" /ou ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4140 --field-trial-handle=2320,i,3025503729105798828,9325691672526736153,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/764-0-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-1-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-2-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-3-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-5-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-6-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-7-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-4-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-8-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-9-0x00007FF993AC0000-0x00007FF993AD0000-memory.dmpFilesize
64KB
-
memory/764-10-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-11-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-13-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-14-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-12-0x00007FF993AC0000-0x00007FF993AD0000-memory.dmpFilesize
64KB
-
memory/764-15-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-17-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-18-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-19-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-20-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-16-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-21-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-44-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-45-0x00007FF9D5EB0000-0x00007FF9D60A5000-memory.dmpFilesize
2.0MB
-
memory/764-43-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-42-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB
-
memory/764-41-0x00007FF995F30000-0x00007FF995F40000-memory.dmpFilesize
64KB