Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
f23000a51a7ac80b39bab71e83c3983a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
Aggiogati.pptx
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
Aggiogati.pptx
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
Fresco.pptx
Resource
win7-20231129-en
Behavioral task
behavioral5
Sample
Fresco.pptx
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
Pel.pptx
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
Pel.pptx
Resource
win10v2004-20240412-en
Behavioral task
behavioral8
Sample
Seduce.pptx
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
Seduce.pptx
Resource
win10v2004-20240412-en
General
-
Target
Aggiogati.pptx
-
Size
872KB
-
MD5
f435197ac66954c9aaa768c402bb2f6e
-
SHA1
81cb16becf08ab1cb2d88c1a0d51872aac7af78f
-
SHA256
682c0c70fdc6522a9ee445de9439348405b945ef9707b983ddf3e88c869ea576
-
SHA512
ca39a95f003340290b4ae5037313432061c1213f976253bbda8b5149f0f1e295cacbc43dbe63fa1cc54e5336a3161eac7962f73afad775a4122ad23f0330117b
-
SSDEEP
12288:CpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:CT3E53Myyzl0hMf1tr7Caw8M01
Malware Config
Signatures
-
Processes:
POWERPNT.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 1736 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
POWERPNT.EXEpid process 1736 POWERPNT.EXE 1736 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 1736 wrote to memory of 1944 1736 POWERPNT.EXE splwow64.exe PID 1736 wrote to memory of 1944 1736 POWERPNT.EXE splwow64.exe PID 1736 wrote to memory of 1944 1736 POWERPNT.EXE splwow64.exe PID 1736 wrote to memory of 1944 1736 POWERPNT.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Aggiogati.pptx"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1736-0-0x000000002D7B1000-0x000000002D7B2000-memory.dmpFilesize
4KB
-
memory/1736-1-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1736-2-0x0000000071FFD000-0x0000000072008000-memory.dmpFilesize
44KB
-
memory/1736-5-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1736-6-0x0000000071FFD000-0x0000000072008000-memory.dmpFilesize
44KB