A3BC7C27473789A4DDA4379A748286413CA2C99933DC71ABDAF7F9C67649D854

MALICIOUS

SUSPICIOUS

• The process executes VB scripts

  • WinRAR.exe (PID: 2436)

• Base64-obfuscated command line is found

  • wscript.exe (PID: 2020)
  • powershell.exe (PID: 236)
  • powershell.exe (PID: 1200)

• Found IP address in command line

  • powershell.exe (PID: 236)

• Starts CMD.EXE for commands execution

  • powershell.exe (PID: 236)

• Starts POWERSHELL.EXE for commands execution

  • powershell.exe (PID: 1200)
  • powershell.exe (PID: 236)
  • wscript.exe (PID: 2020)

• Application launched itself

  • powershell.exe (PID: 1200)
  • powershell.exe (PID: 236)

• Downloads file from URI via Powershell

  • powershell.exe (PID: 236)

• BASE64 encoded PowerShell command has been detected

  • powershell.exe (PID: 236)

• Probably obfuscated PowerShell command line is found

  • wscript.exe (PID: 2020)
  • powershell.exe (PID: 1200)

• Connects to unusual port

  • AddInProcess32.exe (PID: 3896)

INFO

• Found Base64 encoded network access via PowerShell (YARA)

  • powershell.exe (PID: 1200)

• Found Base64 encoded file access via PowerShell (YARA)

  • powershell.exe (PID: 1200)

• Found Base64 encoded text manipulation via PowerShell (YARA)

  • powershell.exe (PID: 1200)

• Found Base64 encoded reflection usage via PowerShell (YARA)

  • powershell.exe (PID: 1200)