bd7020c913d0170d15354c8e693a4b2469d2332768ef477c702bd1c51e41887c

Analysis

max time kernel
92s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 23:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Pel.pptx
Size

487B
MD5

b508376c348b13291d124eab9cce3534
SHA1

26e23e157da1b214a98d84c581c103a97d2f4121
SHA256

a0a6240b767c17f2bbe16985044599f369fdee62ee626a4326e975edbb01a9b4
SHA512

018c7dcf04180da81065647d957e4d08e40ee7e6ca93fe70ab6bfa49ab8532fcd40fe9add8ddc09816e343f04174b1d3e3dc16ba4cd7c93545814fc1992256b8

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

POWERPNT.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

POWERPNT.EXE

pid process

2840 POWERPNT.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

POWERPNT.EXE

pid process

2840 POWERPNT.EXE
2840 POWERPNT.EXE
2840 POWERPNT.EXE
2840 POWERPNT.EXE

pid	process
2840	POWERPNT.EXE

pid	process
2840	POWERPNT.EXE
2840	POWERPNT.EXE
2840	POWERPNT.EXE
2840	POWERPNT.EXE

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Pel.pptx" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2840-0-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-1-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-2-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-3-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-4-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-5-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-6-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-7-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-8-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-9-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-10-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-11-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-14-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-13-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-15-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-12-0x00007FFA5D4E0000-0x00007FFA5D4F0000-memory.dmp

Filesize
64KB

Download
memory/2840-16-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-17-0x00007FFA5D4E0000-0x00007FFA5D4F0000-memory.dmp

Filesize
64KB

Download
memory/2840-19-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-20-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-18-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download
memory/2840-38-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-39-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-40-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-41-0x00007FFA5F5F0000-0x00007FFA5F600000-memory.dmp

Filesize
64KB

Download
memory/2840-42-0x00007FFA9F570000-0x00007FFA9F765000-memory.dmp

Filesize
2.0MB

Download