Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
f23000a51a7ac80b39bab71e83c3983a_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral2
Sample
Aggiogati.pptx
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
Aggiogati.pptx
Resource
win10v2004-20240412-en
Behavioral task
behavioral4
Sample
Fresco.pptx
Resource
win7-20231129-en
Behavioral task
behavioral5
Sample
Fresco.pptx
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
Pel.pptx
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
Pel.pptx
Resource
win10v2004-20240412-en
Behavioral task
behavioral8
Sample
Seduce.pptx
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
Seduce.pptx
Resource
win10v2004-20240412-en
General
-
Target
Seduce.pptx
-
Size
634KB
-
MD5
c5a42d35b245941d0acde1ecc0858cd2
-
SHA1
d34859da52fe96c5ea0b580d24dd05404af91a89
-
SHA256
0f7917bc1c77ced2004a06f52195e492fcbc4a1bee59f345dd8210df14e12e4c
-
SHA512
a6d283988467152fe85fa9bac1f6dbd7fa88631af90198d10b912b5589186b1a8920ec3f8a6fee5ce3c58c415c860ab429b10c1d1c77de2a3f4c91843ee63564
-
SSDEEP
12288:apP74pS2FftpNhsbIvSwPW99EJlCI4pNBZo63Q6EG3hk1V0f71CWobeFXbN+D:8ktfttsbIM2JlCIqfhgc3sV471RseFJk
Malware Config
Signatures
-
Processes:
POWERPNT.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel POWERPNT.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt POWERPNT.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" POWERPNT.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" POWERPNT.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
POWERPNT.EXEpid process 2024 POWERPNT.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
POWERPNT.EXEpid process 2024 POWERPNT.EXE 2024 POWERPNT.EXE 2024 POWERPNT.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
POWERPNT.EXEdescription pid process target process PID 2024 wrote to memory of 2956 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 2956 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 2956 2024 POWERPNT.EXE splwow64.exe PID 2024 wrote to memory of 2956 2024 POWERPNT.EXE splwow64.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\Seduce.pptx"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-0-0x000000002DB31000-0x000000002DB32000-memory.dmpFilesize
4KB
-
memory/2024-1-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2024-2-0x0000000071EDD000-0x0000000071EE8000-memory.dmpFilesize
44KB
-
memory/2024-5-0x0000000071EDD000-0x0000000071EE8000-memory.dmpFilesize
44KB
-
memory/2024-6-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2024-7-0x0000000071EDD000-0x0000000071EE8000-memory.dmpFilesize
44KB