61d4ffa8f628b886b63e70a83fc7fcaf89cfe976ef1554f20d481487e5da94fe

Analysis

max time kernel
149s
max time network
151s
platform
windows10_x64
resource
win10v20201028
submitted
17/11/2020, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7bca80dd5c19443aa59f1e1d32a14986.exe
Size 1.0MB
Sample201117-vg9krmzesj
SHA256 61d4ffa8f628b886b63e70a83fc7fcaf89cfe976ef1554f20d481487e5da94fe
MD5 a4eeeca0638de7188fc51993ded01fea
SHA1 9ddf88b0a022e6ca1e70f450126b6d3c27cbb573
SHA512 335e22ec69fc84715d4d28367e71bd8fc57e0538982375c86d3d0c5d4d0a8a3b0b616bf434873742c97855d5bc64adce17bb2f8a70e71cbfe0b1862b5c6858e3
MD5 SHA1 SHA512

Score

10^/10

discovery evasion spyware trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Executes dropped EXE 3 IoCs

pid	Process
3304	2ORAPNk7URLRiqa3hnDm.exe
3848	reviewruntime.exe
2516	fontdrvhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	ipinfo.io
22	ipinfo.io

Suspicious use of NtSetInformationThreadHideFromDebugger 25 IoCs

pid	Process
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1484	schtasks.exe
1696	schtasks.exe
1948	schtasks.exe
2236	schtasks.exe
2460	schtasks.exe
1096	schtasks.exe
1056	schtasks.exe
1244	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	7bca80dd5c19443aa59f1e1d32a14986.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	2ORAPNk7URLRiqa3hnDm.exe

Suspicious behavior: EnumeratesProcesses 132 IoCs

pid	Process
3848	reviewruntime.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2400	powershell.exe
2400	powershell.exe
2516	fontdrvhost.exe
2400	powershell.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2928	powershell.exe
2516	fontdrvhost.exe
4580	powershell.exe
4496	powershell.exe
4580	powershell.exe
2928	powershell.exe
2928	powershell.exe
4496	powershell.exe
4496	powershell.exe
4580	powershell.exe
4580	powershell.exe
4708	powershell.exe
4708	powershell.exe
3836	powershell.exe
3836	powershell.exe
4496	powershell.exe
3128	powershell.exe
2928	powershell.exe
3128	powershell.exe
4708	powershell.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
3936	powershell.exe
3936	powershell.exe
4708	powershell.exe
1860	powershell.exe
1860	powershell.exe
4400	powershell.exe
4400	powershell.exe
3836	powershell.exe
1468	powershell.exe
1468	powershell.exe
2300	powershell.exe
2300	powershell.exe
3128	powershell.exe
4344	powershell.exe
4344	powershell.exe
3936	powershell.exe
2516	fontdrvhost.exe
3836	powershell.exe
3836	powershell.exe
1860	powershell.exe
3128	powershell.exe
3128	powershell.exe
4400	powershell.exe
3936	powershell.exe
1468	powershell.exe
2300	powershell.exe
4344	powershell.exe
1860	powershell.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
4400	powershell.exe
1468	powershell.exe
2300	powershell.exe
4344	powershell.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe
2516	fontdrvhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2516	fontdrvhost.exe

Suspicious use of AdjustPrivilegeToken 288 IoCs

description	pid	Process
Token: SeDebugPrivilege	3848	reviewruntime.exe
Token: SeDebugPrivilege	2516	fontdrvhost.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeIncreaseQuotaPrivilege	2400	powershell.exe
Token: SeSecurityPrivilege	2400	powershell.exe
Token: SeTakeOwnershipPrivilege	2400	powershell.exe
Token: SeLoadDriverPrivilege	2400	powershell.exe
Token: SeSystemProfilePrivilege	2400	powershell.exe
Token: SeSystemtimePrivilege	2400	powershell.exe
Token: SeProfSingleProcessPrivilege	2400	powershell.exe
Token: SeIncBasePriorityPrivilege	2400	powershell.exe
Token: SeCreatePagefilePrivilege	2400	powershell.exe
Token: SeBackupPrivilege	2400	powershell.exe
Token: SeRestorePrivilege	2400	powershell.exe
Token: SeShutdownPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeSystemEnvironmentPrivilege	2400	powershell.exe
Token: SeRemoteShutdownPrivilege	2400	powershell.exe
Token: SeUndockPrivilege	2400	powershell.exe
Token: SeManageVolumePrivilege	2400	powershell.exe
Token: 33	2400	powershell.exe
Token: 34	2400	powershell.exe
Token: 35	2400	powershell.exe
Token: 36	2400	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeIncreaseQuotaPrivilege	4580	powershell.exe
Token: SeSecurityPrivilege	4580	powershell.exe
Token: SeTakeOwnershipPrivilege	4580	powershell.exe
Token: SeLoadDriverPrivilege	4580	powershell.exe
Token: SeSystemProfilePrivilege	4580	powershell.exe
Token: SeSystemtimePrivilege	4580	powershell.exe
Token: SeProfSingleProcessPrivilege	4580	powershell.exe
Token: SeIncBasePriorityPrivilege	4580	powershell.exe
Token: SeCreatePagefilePrivilege	4580	powershell.exe
Token: SeBackupPrivilege	4580	powershell.exe
Token: SeRestorePrivilege	4580	powershell.exe
Token: SeShutdownPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeSystemEnvironmentPrivilege	4580	powershell.exe
Token: SeRemoteShutdownPrivilege	4580	powershell.exe
Token: SeUndockPrivilege	4580	powershell.exe
Token: SeManageVolumePrivilege	4580	powershell.exe
Token: 33	4580	powershell.exe
Token: 34	4580	powershell.exe
Token: 35	4580	powershell.exe
Token: 36	4580	powershell.exe
Token: SeIncreaseQuotaPrivilege	4496	powershell.exe
Token: SeSecurityPrivilege	4496	powershell.exe
Token: SeTakeOwnershipPrivilege	4496	powershell.exe
Token: SeLoadDriverPrivilege	4496	powershell.exe
Token: SeSystemProfilePrivilege	4496	powershell.exe
Token: SeSystemtimePrivilege	4496	powershell.exe
Token: SeProfSingleProcessPrivilege	4496	powershell.exe
Token: SeIncBasePriorityPrivilege	4496	powershell.exe
Token: SeCreatePagefilePrivilege	4496	powershell.exe
Token: SeBackupPrivilege	4496	powershell.exe
Token: SeRestorePrivilege	4496	powershell.exe
Token: SeShutdownPrivilege	4496	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeSystemEnvironmentPrivilege	4496	powershell.exe
Token: SeRemoteShutdownPrivilege	4496	powershell.exe
Token: SeUndockPrivilege	4496	powershell.exe
Token: SeManageVolumePrivilege	4496	powershell.exe
Token: 33	4496	powershell.exe
Token: 34	4496	powershell.exe
Token: 35	4496	powershell.exe
Token: 36	4496	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeIncreaseQuotaPrivilege	2928	powershell.exe
Token: SeSecurityPrivilege	2928	powershell.exe
Token: SeTakeOwnershipPrivilege	2928	powershell.exe
Token: SeLoadDriverPrivilege	2928	powershell.exe
Token: SeSystemProfilePrivilege	2928	powershell.exe
Token: SeSystemtimePrivilege	2928	powershell.exe
Token: SeProfSingleProcessPrivilege	2928	powershell.exe
Token: SeIncBasePriorityPrivilege	2928	powershell.exe
Token: SeCreatePagefilePrivilege	2928	powershell.exe
Token: SeBackupPrivilege	2928	powershell.exe
Token: SeRestorePrivilege	2928	powershell.exe
Token: SeShutdownPrivilege	2928	powershell.exe
Token: SeDebugPrivilege	2928	powershell.exe
Token: SeSystemEnvironmentPrivilege	2928	powershell.exe
Token: SeRemoteShutdownPrivilege	2928	powershell.exe
Token: SeUndockPrivilege	2928	powershell.exe
Token: SeManageVolumePrivilege	2928	powershell.exe
Token: 33	2928	powershell.exe
Token: 34	2928	powershell.exe
Token: 35	2928	powershell.exe
Token: 36	2928	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeIncreaseQuotaPrivilege	4708	powershell.exe
Token: SeSecurityPrivilege	4708	powershell.exe
Token: SeTakeOwnershipPrivilege	4708	powershell.exe
Token: SeLoadDriverPrivilege	4708	powershell.exe
Token: SeSystemProfilePrivilege	4708	powershell.exe
Token: SeSystemtimePrivilege	4708	powershell.exe
Token: SeProfSingleProcessPrivilege	4708	powershell.exe
Token: SeIncBasePriorityPrivilege	4708	powershell.exe
Token: SeCreatePagefilePrivilege	4708	powershell.exe
Token: SeBackupPrivilege	4708	powershell.exe
Token: SeRestorePrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeSystemEnvironmentPrivilege	4708	powershell.exe
Token: SeRemoteShutdownPrivilege	4708	powershell.exe
Token: SeUndockPrivilege	4708	powershell.exe
Token: SeManageVolumePrivilege	4708	powershell.exe
Token: 33	4708	powershell.exe
Token: 34	4708	powershell.exe
Token: 35	4708	powershell.exe
Token: 36	4708	powershell.exe
Token: SeIncreaseQuotaPrivilege	3836	powershell.exe
Token: SeSecurityPrivilege	3836	powershell.exe
Token: SeTakeOwnershipPrivilege	3836	powershell.exe
Token: SeLoadDriverPrivilege	3836	powershell.exe
Token: SeSystemProfilePrivilege	3836	powershell.exe
Token: SeSystemtimePrivilege	3836	powershell.exe
Token: SeProfSingleProcessPrivilege	3836	powershell.exe
Token: SeIncBasePriorityPrivilege	3836	powershell.exe
Token: SeCreatePagefilePrivilege	3836	powershell.exe
Token: SeBackupPrivilege	3836	powershell.exe
Token: SeRestorePrivilege	3836	powershell.exe
Token: SeShutdownPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeSystemEnvironmentPrivilege	3836	powershell.exe
Token: SeRemoteShutdownPrivilege	3836	powershell.exe
Token: SeUndockPrivilege	3836	powershell.exe
Token: SeManageVolumePrivilege	3836	powershell.exe
Token: 33	3836	powershell.exe
Token: 34	3836	powershell.exe
Token: 35	3836	powershell.exe
Token: 36	3836	powershell.exe
Token: SeIncreaseQuotaPrivilege	3128	powershell.exe
Token: SeSecurityPrivilege	3128	powershell.exe
Token: SeTakeOwnershipPrivilege	3128	powershell.exe
Token: SeLoadDriverPrivilege	3128	powershell.exe
Token: SeSystemProfilePrivilege	3128	powershell.exe
Token: SeSystemtimePrivilege	3128	powershell.exe
Token: SeProfSingleProcessPrivilege	3128	powershell.exe
Token: SeIncBasePriorityPrivilege	3128	powershell.exe
Token: SeCreatePagefilePrivilege	3128	powershell.exe
Token: SeBackupPrivilege	3128	powershell.exe
Token: SeRestorePrivilege	3128	powershell.exe
Token: SeShutdownPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeSystemEnvironmentPrivilege	3128	powershell.exe
Token: SeRemoteShutdownPrivilege	3128	powershell.exe
Token: SeUndockPrivilege	3128	powershell.exe
Token: SeManageVolumePrivilege	3128	powershell.exe
Token: 33	3128	powershell.exe
Token: 34	3128	powershell.exe
Token: 35	3128	powershell.exe
Token: 36	3128	powershell.exe
Token: SeIncreaseQuotaPrivilege	3936	powershell.exe
Token: SeSecurityPrivilege	3936	powershell.exe
Token: SeTakeOwnershipPrivilege	3936	powershell.exe
Token: SeLoadDriverPrivilege	3936	powershell.exe
Token: SeSystemProfilePrivilege	3936	powershell.exe
Token: SeSystemtimePrivilege	3936	powershell.exe
Token: SeProfSingleProcessPrivilege	3936	powershell.exe
Token: SeIncBasePriorityPrivilege	3936	powershell.exe
Token: SeCreatePagefilePrivilege	3936	powershell.exe
Token: SeBackupPrivilege	3936	powershell.exe
Token: SeRestorePrivilege	3936	powershell.exe
Token: SeShutdownPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeSystemEnvironmentPrivilege	3936	powershell.exe
Token: SeRemoteShutdownPrivilege	3936	powershell.exe
Token: SeUndockPrivilege	3936	powershell.exe
Token: SeManageVolumePrivilege	3936	powershell.exe
Token: 33	3936	powershell.exe
Token: 34	3936	powershell.exe
Token: 35	3936	powershell.exe
Token: 36	3936	powershell.exe
Token: SeIncreaseQuotaPrivilege	1860	powershell.exe
Token: SeSecurityPrivilege	1860	powershell.exe
Token: SeTakeOwnershipPrivilege	1860	powershell.exe
Token: SeLoadDriverPrivilege	1860	powershell.exe
Token: SeSystemProfilePrivilege	1860	powershell.exe
Token: SeSystemtimePrivilege	1860	powershell.exe
Token: SeProfSingleProcessPrivilege	1860	powershell.exe
Token: SeIncBasePriorityPrivilege	1860	powershell.exe
Token: SeCreatePagefilePrivilege	1860	powershell.exe
Token: SeBackupPrivilege	1860	powershell.exe
Token: SeRestorePrivilege	1860	powershell.exe
Token: SeShutdownPrivilege	1860	powershell.exe
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeSystemEnvironmentPrivilege	1860	powershell.exe
Token: SeRemoteShutdownPrivilege	1860	powershell.exe
Token: SeUndockPrivilege	1860	powershell.exe
Token: SeManageVolumePrivilege	1860	powershell.exe
Token: 33	1860	powershell.exe
Token: 34	1860	powershell.exe
Token: 35	1860	powershell.exe
Token: 36	1860	powershell.exe
Token: SeIncreaseQuotaPrivilege	4400	powershell.exe
Token: SeSecurityPrivilege	4400	powershell.exe
Token: SeTakeOwnershipPrivilege	4400	powershell.exe
Token: SeLoadDriverPrivilege	4400	powershell.exe
Token: SeSystemProfilePrivilege	4400	powershell.exe
Token: SeSystemtimePrivilege	4400	powershell.exe
Token: SeProfSingleProcessPrivilege	4400	powershell.exe
Token: SeIncBasePriorityPrivilege	4400	powershell.exe
Token: SeCreatePagefilePrivilege	4400	powershell.exe
Token: SeBackupPrivilege	4400	powershell.exe
Token: SeRestorePrivilege	4400	powershell.exe
Token: SeShutdownPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeSystemEnvironmentPrivilege	4400	powershell.exe
Token: SeRemoteShutdownPrivilege	4400	powershell.exe
Token: SeUndockPrivilege	4400	powershell.exe
Token: SeManageVolumePrivilege	4400	powershell.exe
Token: 33	4400	powershell.exe
Token: 34	4400	powershell.exe
Token: 35	4400	powershell.exe
Token: 36	4400	powershell.exe
Token: SeIncreaseQuotaPrivilege	2300	powershell.exe
Token: SeSecurityPrivilege	2300	powershell.exe
Token: SeTakeOwnershipPrivilege	2300	powershell.exe
Token: SeLoadDriverPrivilege	2300	powershell.exe
Token: SeSystemProfilePrivilege	2300	powershell.exe
Token: SeSystemtimePrivilege	2300	powershell.exe
Token: SeProfSingleProcessPrivilege	2300	powershell.exe
Token: SeIncBasePriorityPrivilege	2300	powershell.exe
Token: SeCreatePagefilePrivilege	2300	powershell.exe
Token: SeBackupPrivilege	2300	powershell.exe
Token: SeRestorePrivilege	2300	powershell.exe
Token: SeShutdownPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeSystemEnvironmentPrivilege	2300	powershell.exe
Token: SeRemoteShutdownPrivilege	2300	powershell.exe
Token: SeUndockPrivilege	2300	powershell.exe
Token: SeManageVolumePrivilege	2300	powershell.exe
Token: 33	2300	powershell.exe
Token: 34	2300	powershell.exe
Token: 35	2300	powershell.exe
Token: 36	2300	powershell.exe
Token: SeIncreaseQuotaPrivilege	1468	powershell.exe
Token: SeSecurityPrivilege	1468	powershell.exe
Token: SeTakeOwnershipPrivilege	1468	powershell.exe
Token: SeLoadDriverPrivilege	1468	powershell.exe
Token: SeSystemProfilePrivilege	1468	powershell.exe
Token: SeSystemtimePrivilege	1468	powershell.exe
Token: SeProfSingleProcessPrivilege	1468	powershell.exe
Token: SeIncBasePriorityPrivilege	1468	powershell.exe
Token: SeCreatePagefilePrivilege	1468	powershell.exe
Token: SeBackupPrivilege	1468	powershell.exe
Token: SeRestorePrivilege	1468	powershell.exe
Token: SeShutdownPrivilege	1468	powershell.exe
Token: SeDebugPrivilege	1468	powershell.exe
Token: SeSystemEnvironmentPrivilege	1468	powershell.exe
Token: SeRemoteShutdownPrivilege	1468	powershell.exe
Token: SeUndockPrivilege	1468	powershell.exe
Token: SeManageVolumePrivilege	1468	powershell.exe
Token: 33	1468	powershell.exe
Token: 34	1468	powershell.exe
Token: 35	1468	powershell.exe
Token: 36	1468	powershell.exe
Token: SeIncreaseQuotaPrivilege	4344	powershell.exe
Token: SeSecurityPrivilege	4344	powershell.exe
Token: SeTakeOwnershipPrivilege	4344	powershell.exe
Token: SeLoadDriverPrivilege	4344	powershell.exe
Token: SeSystemProfilePrivilege	4344	powershell.exe
Token: SeSystemtimePrivilege	4344	powershell.exe
Token: SeProfSingleProcessPrivilege	4344	powershell.exe
Token: SeIncBasePriorityPrivilege	4344	powershell.exe
Token: SeCreatePagefilePrivilege	4344	powershell.exe
Token: SeBackupPrivilege	4344	powershell.exe
Token: SeRestorePrivilege	4344	powershell.exe
Token: SeShutdownPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeSystemEnvironmentPrivilege	4344	powershell.exe
Token: SeRemoteShutdownPrivilege	4344	powershell.exe
Token: SeUndockPrivilege	4344	powershell.exe
Token: SeManageVolumePrivilege	4344	powershell.exe
Token: 33	4344	powershell.exe
Token: 34	4344	powershell.exe
Token: 35	4344	powershell.exe
Token: 36	4344	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2516	fontdrvhost.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 3560	4644	7bca80dd5c19443aa59f1e1d32a14986.exe	75
PID 4644 wrote to memory of 3560	4644	7bca80dd5c19443aa59f1e1d32a14986.exe	75
PID 4644 wrote to memory of 3560	4644	7bca80dd5c19443aa59f1e1d32a14986.exe	75
PID 3560 wrote to memory of 3084	3560	WScript.exe	76
PID 3560 wrote to memory of 3084	3560	WScript.exe	76
PID 3560 wrote to memory of 3084	3560	WScript.exe	76
PID 3084 wrote to memory of 3304	3084	cmd.exe	78
PID 3084 wrote to memory of 3304	3084	cmd.exe	78
PID 3084 wrote to memory of 3304	3084	cmd.exe	78
PID 3304 wrote to memory of 3536	3304	2ORAPNk7URLRiqa3hnDm.exe	79
PID 3304 wrote to memory of 3536	3304	2ORAPNk7URLRiqa3hnDm.exe	79
PID 3304 wrote to memory of 3536	3304	2ORAPNk7URLRiqa3hnDm.exe	79
PID 3536 wrote to memory of 3512	3536	WScript.exe	80
PID 3536 wrote to memory of 3512	3536	WScript.exe	80
PID 3536 wrote to memory of 3512	3536	WScript.exe	80
PID 3512 wrote to memory of 3848	3512	cmd.exe	82
PID 3512 wrote to memory of 3848	3512	cmd.exe	82
PID 3848 wrote to memory of 1096	3848	reviewruntime.exe	87
PID 3848 wrote to memory of 1096	3848	reviewruntime.exe	87
PID 3848 wrote to memory of 1056	3848	reviewruntime.exe	89
PID 3848 wrote to memory of 1056	3848	reviewruntime.exe	89
PID 3848 wrote to memory of 1244	3848	reviewruntime.exe	91
PID 3848 wrote to memory of 1244	3848	reviewruntime.exe	91
PID 3848 wrote to memory of 1484	3848	reviewruntime.exe	93
PID 3848 wrote to memory of 1484	3848	reviewruntime.exe	93
PID 3848 wrote to memory of 1696	3848	reviewruntime.exe	95
PID 3848 wrote to memory of 1696	3848	reviewruntime.exe	95
PID 3848 wrote to memory of 1948	3848	reviewruntime.exe	97
PID 3848 wrote to memory of 1948	3848	reviewruntime.exe	97
PID 3848 wrote to memory of 2236	3848	reviewruntime.exe	99
PID 3848 wrote to memory of 2236	3848	reviewruntime.exe	99
PID 3848 wrote to memory of 2460	3848	reviewruntime.exe	101
PID 3848 wrote to memory of 2460	3848	reviewruntime.exe	101
PID 3848 wrote to memory of 2516	3848	reviewruntime.exe	103
PID 3848 wrote to memory of 2516	3848	reviewruntime.exe	103
PID 2516 wrote to memory of 2400	2516	fontdrvhost.exe	104
PID 2516 wrote to memory of 2400	2516	fontdrvhost.exe	104
PID 2516 wrote to memory of 2928	2516	fontdrvhost.exe	107
PID 2516 wrote to memory of 2928	2516	fontdrvhost.exe	107
PID 2516 wrote to memory of 4580	2516	fontdrvhost.exe	109
PID 2516 wrote to memory of 4580	2516	fontdrvhost.exe	109
PID 2516 wrote to memory of 4496	2516	fontdrvhost.exe	111
PID 2516 wrote to memory of 4496	2516	fontdrvhost.exe	111
PID 2516 wrote to memory of 4708	2516	fontdrvhost.exe	113
PID 2516 wrote to memory of 4708	2516	fontdrvhost.exe	113
PID 2516 wrote to memory of 3836	2516	fontdrvhost.exe	115
PID 2516 wrote to memory of 3836	2516	fontdrvhost.exe	115
PID 2516 wrote to memory of 3128	2516	fontdrvhost.exe	117
PID 2516 wrote to memory of 3128	2516	fontdrvhost.exe	117
PID 2516 wrote to memory of 3936	2516	fontdrvhost.exe	119
PID 2516 wrote to memory of 3936	2516	fontdrvhost.exe	119
PID 2516 wrote to memory of 1860	2516	fontdrvhost.exe	121
PID 2516 wrote to memory of 1860	2516	fontdrvhost.exe	121
PID 2516 wrote to memory of 4400	2516	fontdrvhost.exe	123
PID 2516 wrote to memory of 4400	2516	fontdrvhost.exe	123
PID 2516 wrote to memory of 1468	2516	fontdrvhost.exe	125
PID 2516 wrote to memory of 1468	2516	fontdrvhost.exe	125
PID 2516 wrote to memory of 2300	2516	fontdrvhost.exe	127
PID 2516 wrote to memory of 2300	2516	fontdrvhost.exe	127
PID 2516 wrote to memory of 4344	2516	fontdrvhost.exe	129
PID 2516 wrote to memory of 4344	2516	fontdrvhost.exe	129

C:\Users\Admin\AppData\Local\Temp\7bca80dd5c19443aa59f1e1d32a14986.exe
"C:\Users\Admin\AppData\Local\Temp\7bca80dd5c19443aa59f1e1d32a14986.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\brokernet\tpMDQ4PywPQzcvfRXV4ZglMEfSHxJ6.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\brokernet\pnotGSxdh5CXKZwArEdYL4V4nAwV2V.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\brokernet\2ORAPNk7URLRiqa3hnDm.exe
      2ORAPNk7URLRiqa3hnDm.exe -p3429224301224079efb02d13ea4e8140761d094e
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3304
    - - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\brokernet\ZIH4iAr0ojQw4M3djezMReyfj8zlug.vbe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3536
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\brokernet\ZFrWPPoku5WymlXeSwM2KOsbP5Cd03.bat" "
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3512
        
        C:\brokernet\reviewruntime.exe
        
        "C:\brokernet\reviewruntime.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Public\Pictures\Idle.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1096
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\OfficeClickToRun.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1056
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "sppsvc" /sc ONLOGON /tr "'C:\brokernet\sppsvc.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1244
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\odt\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1484
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1696
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\PerfLogs\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:1948
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "'C:\odt\svchost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:2236
        
        C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\ProgramData\Microsoft OneDrive\setup\fontdrvhost.exe'" /rl HIGHEST /f
        8⤵
        Creates scheduled task(s)
        
        PID:2460
        
        C:\ProgramData\Microsoft OneDrive\setup\fontdrvhost.exe
        
        "C:\ProgramData\Microsoft OneDrive\setup\fontdrvhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4708
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3836
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3128
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3936
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1860
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4400
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1468
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2300
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-78-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/1860-65-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/2300-81-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/2400-47-0x0000026473310000-0x0000026473311000-memory.dmp

Download

memory/2400-46-0x00000264727C0000-0x00000264727C1000-memory.dmp

Download

memory/2400-45-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/2516-43-0x000001B19A530000-0x000001B19A531000-memory.dmp

Download

memory/2516-39-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/2928-53-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/3128-62-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/3836-59-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/3848-24-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/3848-25-0x0000029AA1630000-0x0000029AA1631000-memory.dmp

Download

memory/3848-27-0x0000029AA1BE0000-0x0000029AA1BE1000-memory.dmp

Download

memory/3936-64-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/4344-84-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/4400-72-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/4496-56-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/4580-55-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download

memory/4644-3-0x00000000031B0000-0x00000000031B1000-memory.dmp

Download

memory/4708-58-0x00007FFBDF060000-0x00007FFBDFA4C000-memory.dmp

Download