ab848665d099cb50c939e27c37c04c009f66e21af789a15d2b96765dca832502

General

Target

Server2.ps1
Size

612KB
MD5

6bc00b50a62e3f2160b9edf1cb1cce8e
SHA1

1381fac090dcc9a5635e3e0ae4c6693f726c4dd5
SHA256

4ca62a1c904c5a12aac80ea69f09c4ba439a0eb786d23d384f76f42c32f0063c
SHA512

571b564613e8c6f72a951cbcafa5e5caf9043cb7fffa97f474c80e2bb50f9db281cdd4608c0bcb1a64ce15723f82af78290e76fb9bd50eb36fce7126fe9d1479

Score

10^/10

persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

POWERSHELL.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1548 568 POWERSHELL.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1548	568	POWERSHELL.exe

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe

Drops file in System32 directory 2 IoCs

Processes:

POWERSHELL.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	POWERSHELL.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Modifies registry class 4 IoCs

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000_CLASSES\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32\ = "C:\\IDontExist.dll"	reg.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

916 reg.exe
1836 reg.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exePOWERSHELL.exepowershell.exe

pid process

2020 powershell.exe
1584 powershell.exe
1548 POWERSHELL.exe
1804 powershell.exe

pid	process
916	reg.exe
1836	reg.exe

pid	process
2020	powershell.exe
1584	powershell.exe
1548	POWERSHELL.exe
1804	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exePOWERSHELL.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	1548	POWERSHELL.exe
Token: SeDebugPrivilege	1804	powershell.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

powershell.exepowershell.exePOWERSHELL.execmd.execmd.exe

description	pid	process	target process
PID 2020 wrote to memory of 1584	2020	powershell.exe	powershell.exe
PID 2020 wrote to memory of 1584	2020	powershell.exe	powershell.exe
PID 2020 wrote to memory of 1584	2020	powershell.exe	powershell.exe
PID 1584 wrote to memory of 1344	1584	powershell.exe	WScript.exe
PID 1584 wrote to memory of 1344	1584	powershell.exe	WScript.exe
PID 1584 wrote to memory of 1344	1584	powershell.exe	WScript.exe
PID 1548 wrote to memory of 1976	1548	POWERSHELL.exe	cmd.exe
PID 1548 wrote to memory of 1976	1548	POWERSHELL.exe	cmd.exe
PID 1548 wrote to memory of 1976	1548	POWERSHELL.exe	cmd.exe
PID 1976 wrote to memory of 916	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 916	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 916	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1836	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1836	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1836	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1996	1976	cmd.exe	cmd.exe
PID 1976 wrote to memory of 1996	1976	cmd.exe	cmd.exe
PID 1976 wrote to memory of 1996	1976	cmd.exe	cmd.exe
PID 1996 wrote to memory of 1804	1996	cmd.exe	powershell.exe
PID 1996 wrote to memory of 1804	1996	cmd.exe	powershell.exe
PID 1996 wrote to memory of 1804	1996	cmd.exe	powershell.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Server2.ps1
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "& 'C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.ps1'"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.vbs"
3⤵
PID:1344

C:\Windows\System32\WindowsPowerShell\v1.0\POWERSHELL.exe
POWERSHELL -NoProfile -ExecutionPolicy Bypass -Command C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.bat
1⤵
- Process spawned unexpected child process
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\cmd.exe
cmd /c ""C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec} /f
3⤵
- Modifies registry class
- Modifies registry key
PID:916

C:\Windows\system32\reg.exe
REG ADD HKCU\Software\Classes\CLSID\{fdb00e52-a214-4aa1-8fba-4357bb0072ec}\InProcServer32 /ve /t REG_SZ /d C:\IDontExist.dll /f
3⤵
- Registers COM server for autorun
- Modifies registry class
- Modifies registry key
PID:1836

C:\Windows\system32\cmd.exe
cMd.E"x"e /c =PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\JQEIQFWPUTYRZYJCTCTPUB.ps1'"
3⤵
- Suspicious use of WriteProcessMemory
PID:1996

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PoWerShelL"."eXe -noP -WIn hIdDen -ep ByPaSs -Command "& 'C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\JQEIQFWPUTYRZYJCTCTPUB.ps1'"
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.bat
Filesize
706B

MD5
6a90128893777a59d404d46d3e967104

SHA1
e2b70c13764f2f61aa8503999670542237046bc4

SHA256
b986b6412802dadf97cc3684372614c084a723c25ad5db606c59a7445914b319

SHA512
5e8ed2c486b6e0832fb1516d27a63e531355c61155259438f5d2ab220e0545786a76f3633499d721b94d5857e2d0ce2c04b6ae8918bc316ed639b926fdfa794c

Download Submit
C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.ps1
Filesize
3KB

MD5
43864d67842266f76a91dc4aee7338c7

SHA1
022259ecb6970f6790c329e36b94402ba815b5e0

SHA256
c9aee12c943156b698c5f5413fb0a6bbca87d0dec227d972e59dc974ac39decf

SHA512
32bb0b67d9ec8064b13a2db93940ed41ce8bc352364a0222dcef7fc6bef98b7c3a579f608fb3cb5d6b81db49a58b736600831f5c40651e058a635f7502d55980

Download Submit
C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\EOHXBXCWKDDRNGPNFSIAOH.vbs
Filesize
1KB

MD5
d6a5f499f7164e0d61a5b8a0b4900fba

SHA1
054352e97c7aa7cf0eb3b0cf2ded905fc22a70b9

SHA256
5b5e07e5a147d23983fe0adb7fed1c95f76ffe9443bd1394d4a8248a80ad2e44

SHA512
2129eb026a406fc52057f1efb9c81e1e8696971ff738093671e1c794c4cb77022bcb8b980c4fc7b1705451e9b86d2cdec87ad35b198d002035cf95dc904ebec2

Download Submit
C:\ProgramData\EOHXBXCWKDDRNGPNFSIAOH\JQEIQFWPUTYRZYJCTCTPUB.ps1
Filesize
604KB

MD5
ab1fce3ab2f6f211da8f8dc30c2b3060

SHA1
ae0dff660b20f9209a66029d44b048a63cc80336

SHA256
7cb280def1092d641ad3449dd05713c155788034c6e1649d423039c867b562ca

SHA512
ed741014733c2bf70bb82e539324a3a8ebca5b56a427675c9ce7ffdbb28d4f113c2d20e6a083ba8580d891e2586190842d6cea1b7cfb5450af02a694b14b5b85

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
52d80c9bd46a8b21b4561d375bab7d36

SHA1
d5e58f8fbac713bb35968875486e3db45d545428

SHA256
e6805c061ea8eb57defa4ac9e71b678a753aa786bca3675d18e36e63e4086795

SHA512
f48259b19e6d8f098c29bc1c6a77a91fe2e85ba4fb85ecb4eeb3aeee6c29b2485dce8e169271f251ed790f0fef4abace75ef40c1a53e9d380952c2df8ec3fd8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
06bd5f5073eadd8d9d84baba0ba25749

SHA1
7aeee4235efca80ac72967f7b9bd4845ff8069d1

SHA256
f92718626065fbbfd193b38b691ac2696a47978cb3b8a6474a11d7353c911258

SHA512
56d9597573b9d4f8355d4e942fe8cb1dce4e64fe3d1a12593737318477a74c5583951882b58870e0d9ad09c9339511c248bdd7b223dedd6d708a0f4179e92a96

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
06bd5f5073eadd8d9d84baba0ba25749

SHA1
7aeee4235efca80ac72967f7b9bd4845ff8069d1

SHA256
f92718626065fbbfd193b38b691ac2696a47978cb3b8a6474a11d7353c911258

SHA512
56d9597573b9d4f8355d4e942fe8cb1dce4e64fe3d1a12593737318477a74c5583951882b58870e0d9ad09c9339511c248bdd7b223dedd6d708a0f4179e92a96

Download Submit
memory/916-82-0x0000000000000000-mapping.dmp

Download
memory/1344-69-0x0000000000000000-mapping.dmp

Download
memory/1548-76-0x000007FEF3700000-0x000007FEF4123000-memory.dmp

Filesize
10.1MB

Download
memory/1548-77-0x000007FEF2BA0000-0x000007FEF36FD000-memory.dmp

Filesize
11.4MB

Download
memory/1548-90-0x0000000002320000-0x00000000023A0000-memory.dmp

Filesize
512KB

Download
memory/1548-79-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1548-78-0x0000000002320000-0x00000000023A0000-memory.dmp

Filesize
512KB

Download
memory/1584-66-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

Filesize
11.4MB

Download
memory/1584-67-0x0000000002334000-0x0000000002337000-memory.dmp

Filesize
12KB

Download
memory/1584-62-0x0000000000000000-mapping.dmp

Download
memory/1584-65-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

Filesize
10.1MB

Download
memory/1584-72-0x000000000233B000-0x000000000235A000-memory.dmp

Filesize
124KB

Download
memory/1584-71-0x0000000002334000-0x0000000002337000-memory.dmp

Filesize
12KB

Download
memory/1804-88-0x000007FEF3700000-0x000007FEF4123000-memory.dmp

Filesize
10.1MB

Download
memory/1804-89-0x000007FEF2BA0000-0x000007FEF36FD000-memory.dmp

Filesize
11.4MB

Download
memory/1804-96-0x00000000028DB000-0x00000000028FA000-memory.dmp

Filesize
124KB

Download
memory/1804-95-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1804-94-0x00000000028DB000-0x00000000028FA000-memory.dmp

Filesize
124KB

Download
memory/1804-92-0x000000001B710000-0x000000001BA0F000-memory.dmp

Filesize
3.0MB

Download
memory/1804-85-0x0000000000000000-mapping.dmp

Download
memory/1804-91-0x00000000028D4000-0x00000000028D7000-memory.dmp

Filesize
12KB

Download
memory/1836-83-0x0000000000000000-mapping.dmp

Download
memory/1976-81-0x0000000000000000-mapping.dmp

Download
memory/1996-84-0x0000000000000000-mapping.dmp

Download
memory/2020-57-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Filesize
3.0MB

Download
memory/2020-60-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/2020-61-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/2020-56-0x000007FEF3540000-0x000007FEF409D000-memory.dmp

Filesize
11.4MB

Download
memory/2020-58-0x00000000028E4000-0x00000000028E7000-memory.dmp

Filesize
12KB

Download
memory/2020-55-0x000007FEF40A0000-0x000007FEF4AC3000-memory.dmp

Filesize
10.1MB

Download
memory/2020-54-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download
memory/2020-59-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download
memory/2020-75-0x00000000028EB000-0x000000000290A000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads