gh0strat | 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2022 20:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Size

28KB
MD5

c1101555cb3e0f55bf293caf6ec27034
SHA1

7c44a04dfc1b1ca839044f51b7cec7f918544451
SHA256

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4
SHA512

b44cbcf8541951834180e77f26e45032937270b87548d2d215b796895057245adbb4ddbfd9ea08e1b85f2f22b9d3f9dfd6987eb3fc2796453bc9a9d202762083
SSDEEP

192:QqNKGqvO5JaE9LhHBdb9E9ZhoynJLNgH9Sa2tZch4s9GRmd8MFA93M3pkR:kPEhhdb9whD+d/2tQ4s9Gwd5ASc

Score

10^/10

gh0strat purplefox evasion rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/1712-169-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral2/memory/1712-175-0x0000000000400000-0x0000000000547000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1712-169-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral2/memory/1712-175-0x0000000000400000-0x0000000000547000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Public\Documents\TASLoginBase.dll	acprotect
C:\Users\Public\Documents\TASLoginBase.dll	acprotect

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

k4.exek4.exedllhosts.exeunzip.exedllhosts.exek4.exe

pid process

3156 k4.exe
3744 k4.exe
4568 dllhosts.exe
1616 unzip.exe
1712 dllhosts.exe
1000 k4.exe

pid	process
3156	k4.exe
3744	k4.exe
4568	dllhosts.exe
1616	unzip.exe
1712	dllhosts.exe
1000	k4.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Public\Documents\TASLoginBase.dll	upx
C:\Users\Public\Documents\TASLoginBase.dll	upx
behavioral2/memory/4568-159-0x0000000010000000-0x0000000010032000-memory.dmp	upx
behavioral2/memory/1712-164-0x0000000000400000-0x0000000000547000-memory.dmp	upx
behavioral2/memory/1712-167-0x0000000000400000-0x0000000000547000-memory.dmp	upx
behavioral2/memory/1712-168-0x0000000000400000-0x0000000000547000-memory.dmp	upx
behavioral2/memory/1712-175-0x0000000000400000-0x0000000000547000-memory.dmp	upx
behavioral2/memory/4568-176-0x0000000010000000-0x0000000010032000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.execmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	cmd.exe

Drops startup file 3 IoCs

Processes:

unzip.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\	unzip.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\browser.lnk	unzip.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\browser.lnk	unzip.exe

Loads dropped DLL 2 IoCs

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exedllhosts.exe

pid process

4596 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
4568 dllhosts.exe

pid	process
4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
4568	dllhosts.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dllhosts.exe

description	ioc	process
File opened (read-only)	\??\L:	dllhosts.exe
File opened (read-only)	\??\R:	dllhosts.exe
File opened (read-only)	\??\T:	dllhosts.exe
File opened (read-only)	\??\U:	dllhosts.exe
File opened (read-only)	\??\E:	dllhosts.exe
File opened (read-only)	\??\F:	dllhosts.exe
File opened (read-only)	\??\M:	dllhosts.exe
File opened (read-only)	\??\N:	dllhosts.exe
File opened (read-only)	\??\P:	dllhosts.exe
File opened (read-only)	\??\G:	dllhosts.exe
File opened (read-only)	\??\K:	dllhosts.exe
File opened (read-only)	\??\I:	dllhosts.exe
File opened (read-only)	\??\J:	dllhosts.exe
File opened (read-only)	\??\O:	dllhosts.exe
File opened (read-only)	\??\V:	dllhosts.exe
File opened (read-only)	\??\X:	dllhosts.exe
File opened (read-only)	\??\Y:	dllhosts.exe
File opened (read-only)	\??\B:	dllhosts.exe
File opened (read-only)	\??\H:	dllhosts.exe
File opened (read-only)	\??\W:	dllhosts.exe
File opened (read-only)	\??\Z:	dllhosts.exe
File opened (read-only)	\??\Q:	dllhosts.exe
File opened (read-only)	\??\S:	dllhosts.exe

An obfuscated cmd.exe command-line is typically used to evade detection. 2 IoCs

Processes:

cmd.execmd.exe

pid process

1828 cmd.exe
1208 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

dllhosts.exe

description pid process target process

PID 4568 set thread context of 1712 4568 dllhosts.exe dllhosts.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4756 4568 WerFault.exe dllhosts.exe

pid	process
1828	cmd.exe
1208	cmd.exe

description	pid	process	target process
PID 4568 set thread context of 1712	4568	dllhosts.exe	dllhosts.exe

pid	pid_target	process	target process
4756	4568	WerFault.exe	dllhosts.exe

Checks SCSI registry key(s) 3 TTPs 2 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

k4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	k4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	k4.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dllhosts.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dllhosts.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dllhosts.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1384 taskkill.exe

pid	process
1384	taskkill.exe

Modifies registry class 2 IoCs

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dllhosts.exe

pid	process
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe
1712	dllhosts.exe

Suspicious behavior: SetClipboardViewer 1 IoCs

Processes:

mmc.exe

pid process

4900 mmc.exe

pid	process
4900	mmc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

taskkill.exemmc.exemmc.exek4.exedllhosts.exe

description	pid	process
Token: SeDebugPrivilege	1384	taskkill.exe
Token: 33	5080	mmc.exe
Token: SeIncBasePriorityPrivilege	5080	mmc.exe
Token: 33	5080	mmc.exe
Token: SeIncBasePriorityPrivilege	5080	mmc.exe
Token: 33	4900	mmc.exe
Token: SeIncBasePriorityPrivilege	4900	mmc.exe
Token: 33	4900	mmc.exe
Token: SeIncBasePriorityPrivilege	4900	mmc.exe
Token: SeLoadDriverPrivilege	1000	k4.exe
Token: 33	1712	dllhosts.exe
Token: SeIncBasePriorityPrivilege	1712	dllhosts.exe
Token: 33	1712	dllhosts.exe
Token: SeIncBasePriorityPrivilege	1712	dllhosts.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exemmc.exemmc.exe

pid process

4596 1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
5080 mmc.exe
5080 mmc.exe
4900 mmc.exe
4900 mmc.exe

pid	process
4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
5080	mmc.exe
5080	mmc.exe
4900	mmc.exe
4900	mmc.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.execmd.execmd.exemmc.exemmc.execmd.execmd.execmd.exedllhosts.exe

description	pid	process	target process
PID 4596 wrote to memory of 3156	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	k4.exe
PID 4596 wrote to memory of 3156	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	k4.exe
PID 4596 wrote to memory of 3744	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	k4.exe
PID 4596 wrote to memory of 3744	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	k4.exe
PID 4596 wrote to memory of 3748	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	cmd.exe
PID 4596 wrote to memory of 3748	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	cmd.exe
PID 4596 wrote to memory of 3748	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	cmd.exe
PID 3748 wrote to memory of 1384	3748	cmd.exe	taskkill.exe
PID 3748 wrote to memory of 1384	3748	cmd.exe	taskkill.exe
PID 3748 wrote to memory of 1384	3748	cmd.exe	taskkill.exe
PID 4596 wrote to memory of 5116	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	cmd.exe
PID 4596 wrote to memory of 5116	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	cmd.exe
PID 4596 wrote to memory of 5116	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	cmd.exe
PID 5116 wrote to memory of 3024	5116	cmd.exe	WScript.exe
PID 5116 wrote to memory of 3024	5116	cmd.exe	WScript.exe
PID 5116 wrote to memory of 3024	5116	cmd.exe	WScript.exe
PID 4596 wrote to memory of 808	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	WScript.exe
PID 4596 wrote to memory of 808	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	WScript.exe
PID 4596 wrote to memory of 808	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	WScript.exe
PID 5080 wrote to memory of 1828	5080	mmc.exe	cmd.exe
PID 5080 wrote to memory of 1828	5080	mmc.exe	cmd.exe
PID 4900 wrote to memory of 4568	4900	mmc.exe	dllhosts.exe
PID 4900 wrote to memory of 4568	4900	mmc.exe	dllhosts.exe
PID 4900 wrote to memory of 4568	4900	mmc.exe	dllhosts.exe
PID 1828 wrote to memory of 1208	1828	cmd.exe	cmd.exe
PID 1828 wrote to memory of 1208	1828	cmd.exe	cmd.exe
PID 1828 wrote to memory of 4892	1828	cmd.exe	cmd.exe
PID 1828 wrote to memory of 4892	1828	cmd.exe	cmd.exe
PID 4892 wrote to memory of 1604	4892	cmd.exe	cmd.exe
PID 4892 wrote to memory of 1604	4892	cmd.exe	cmd.exe
PID 1604 wrote to memory of 1616	1604	cmd.exe	unzip.exe
PID 1604 wrote to memory of 1616	1604	cmd.exe	unzip.exe
PID 1604 wrote to memory of 1616	1604	cmd.exe	unzip.exe
PID 4568 wrote to memory of 1712	4568	dllhosts.exe	dllhosts.exe
PID 4568 wrote to memory of 1712	4568	dllhosts.exe	dllhosts.exe
PID 4568 wrote to memory of 1712	4568	dllhosts.exe	dllhosts.exe
PID 4568 wrote to memory of 1712	4568	dllhosts.exe	dllhosts.exe
PID 4568 wrote to memory of 1712	4568	dllhosts.exe	dllhosts.exe
PID 4596 wrote to memory of 1000	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	k4.exe
PID 4596 wrote to memory of 1000	4596	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe	k4.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe

C:\Users\Admin\AppData\Local\Temp\1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe
"C:\Users\Admin\AppData\Local\Temp\1d329207cc0e0ae6649dfa5ae77f3a70c67e2a3a0d1ef5a609c937deac271cf4.exe"
1⤵
- UAC bypass
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4596

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe
2⤵
- Executes dropped EXE
PID:3156

C:\Users\Public\Documents\k4.exe
C:/Users/Public/Documents/k4.exe /D
2⤵
- Executes dropped EXE
PID:3744

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /t /im k4.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /t /im k4.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1384

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Public\Documents\2022060125.vbe
2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\2022060125.vbe"
3⤵
PID:3024

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\Documents\sch.vbe"
2⤵
PID:808

C:\Users\Public\Documents\k4.exe
"C:\Users\Public\Documents\k4.exe" /E
2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080

C:\WINDOWS\system32\cmd.exe
"C:\WINDOWS\system32\cmd.exe" /c ^c^M^D, , /v^:O ,/R " , ( , (S^ET ^l^U=^-), )&(^sET N^aV=\^Public^\Docu^m^en^t)& (^s^eT ^S^m^KR=^ver)&&(, ,, , , (^sET idZ^S=cmd ^/c C:\^U^sers^\Publi^c\Do^cu) ,)&& (sE^t ^ ^5UR2=s\^unz^ip.^d^a^t -d)&&(^sET ^b^Vx=xe^ ^-^o)& ( , (^Set ^PXyG=^e^rver^^^^^^^>Se^r) )&(s^ET ^ w^GR=:\^U^sers)&( , , , , , (^SE^t G^2T=^ ), )& (^Se^T ^78=^men^ts^\un^zip.e)& (^Set B^X=^ ""%ap^pda^ta%"")& (^SEt p^1vS=P^ )&(S^et DBh^u=^^^^^^^&^e^cho ^S)&& S^ET ^u^Yw^J=""&&( , (^SET 7D3^y=^.^dll) , )& ( ,(^SET ^ ^gE=^C) , )&& ( , (SE^T ^ ^2^R^X=Start^u^p8^888 ) , , , )& , C^All,S^E^T 4Zb=%idZ^S%%^78%%^b^Vx%%G^2T%%^l^U%%p^1vS%%^2^R^X%%^gE%%w^GR%%N^aV%%^5UR2%%B^X%%DBh^u%%^PXyG%%^S^m^KR%%7D3^y%&&, , ^CaLL , , E^CHo , %4^Z^b:""^=!uY^wJ:~0, ^-1!%"|,%pubLic:~ 14%MD,
2⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\system32\cmd.exe
cMD , , /v:O ,/R " , ( , (S^ET ^l^U=^-), )&(^sET N^aV=\^Public^\Docu^m^en^t)& (^s^eT ^S^m^KR=^ver)&&(, ,, , , (^sET idZ^S=cmd ^/c C:\^U^sers^\Publi^c\Do^cu) ,)&& (sE^t ^ ^5UR2=s\^unz^ip.^d^a^t -d)&&(^sET ^b^Vx=xe^ ^-^o)& ( , (^Set ^PXyG=^e^rver^^^^^^^>Se^r) )&(s^ET ^ w^GR=:\^U^sers)&( , , , , , (^SE^t G^2T=^ ), )& (^Se^T ^78=^men^ts^\un^zip.e)& (^Set B^X=^ ""%ap^pda^ta%"")& (^SEt p^1vS=P^ )&(S^et DBh^u=^^^^^^^&^e^cho ^S)&& S^ET ^u^Yw^J=""&&( , (^SET 7D3^y=^.^dll) , )& ( ,(^SET ^ ^gE=^C) , )&& ( , (SE^T ^ ^2^R^X=Start^u^p8^888 ) , , , )& , C^All,S^E^T 4Zb=%idZ^S%%^78%%^b^Vx%%G^2T%%^l^U%%p^1vS%%^2^R^X%%^gE%%w^GR%%N^aV%%^5UR2%%B^X%%DBh^u%%^PXyG%%^S^m^KR%%7D3^y%&&, , ^CaLL , , E^CHo , %4^Z^b:""^=!uY^wJ:~0, ^-1!%"
3⤵
- An obfuscated cmd.exe command-line is typically used to evade detection.
PID:1208

C:\Windows\system32\cmd.exe
cMD ,
3⤵
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Public\Documents\unzip.exe -o -P Startup8888 C:\Users\Public\Documents\unzip.dat -d "C:\Users\Admin\AppData\Roaming"
4⤵
- Suspicious use of WriteProcessMemory
PID:1604

C:\Users\Public\Documents\unzip.exe
C:\Users\Public\Documents\unzip.exe -o -P Startup8888 C:\Users\Public\Documents\unzip.dat -d "C:\Users\Admin\AppData\Roaming"
5⤵
- Executes dropped EXE
- Drops startup file
PID:1616

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Suspicious behavior: SetClipboardViewer
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4900

C:\Users\Public\Documents\dllhosts.exe
"C:\Users\Public\Documents\dllhosts.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4568

C:\Users\Public\Documents\dllhosts.exe
C:\Users\Public\Documents\dllhosts.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 228
3⤵
- Program crash
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4568 -ip 4568
1⤵
PID:2436

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\Documents\2022060125.vbe
Filesize
180B

MD5
d66c7e77096d4f4c406170b6ca0ad123

SHA1
9bb461061c7276ebe2a493f690d72263c0da8962

SHA256
cd0a0ac1315f1f473f4a42bed62fad7033fe68a3e0cf72a7b354a7e3dd78e8a8

SHA512
015788021b53eb278be1238b26a01499dcb809d93ee747bc89208f8d3570a7b0b813c70ea054e70584b536da4811f0a58ef38c96a984e6b3a54654774e5c7592

Download Submit
C:\Users\Public\Documents\RDSv1.dll
Filesize
31KB

MD5
f90de519c9a8c75dea55263ba6d15af9

SHA1
b80eeb44d0025e9025d055ab68a5fef66e27a623

SHA256
3429d3cd36053b6406bb1aa970e52e5dc9d705133fb3edaf19ab8528d374229e

SHA512
c5ea29ce32efed5706fcda6de3e839eaa27afb8ac8c8899fe239742fc2e59bc35e68ec72391112176ddbd1114e923fe265fa5915661b823d5a08cc7bb17a193e

Download Submit
C:\Users\Public\Documents\TASLoginBase.dll
Filesize
79KB

MD5
f30d412bc73c187d3b26b50f1af7ef5c

SHA1
7f2729e78e025dd9b482ce6f7dd4a94c4cce1b65

SHA256
e19d86e1511786d33f868fd86765fa33a3c73530678129ce32876b1032318d07

SHA512
92ec368a9bf38e7e5fbeb77999a653b30c57574bb8a60ffcb21a54a7daaef1ae30191b4f9f9d72085083a1c926c0577580fd135017480b1e5f980bec9a5c30d9

Download Submit
C:\Users\Public\Documents\TASLoginBase.dll
Filesize
79KB

MD5
f30d412bc73c187d3b26b50f1af7ef5c

SHA1
7f2729e78e025dd9b482ce6f7dd4a94c4cce1b65

SHA256
e19d86e1511786d33f868fd86765fa33a3c73530678129ce32876b1032318d07

SHA512
92ec368a9bf38e7e5fbeb77999a653b30c57574bb8a60ffcb21a54a7daaef1ae30191b4f9f9d72085083a1c926c0577580fd135017480b1e5f980bec9a5c30d9

Download Submit
C:\Users\Public\Documents\dllhosts.exe
Filesize
411KB

MD5
66557b2bd93e70a2804e983b279ab473

SHA1
4e58505689fd9643b5011880ce94b22cbfadf917

SHA256
a63c9e3f7256e38224f7256307d954d4a6baa9f023f6ac49d8cface7b2658e31

SHA512
b08d8b2872f4ebdbab7b15bd96f5d185f05030983c2d704497d30fe5f610874b5ec362f0e3e55800031edcd29b812d9b58214e76012a85df074310f36e0f33f4

Download Submit
C:\Users\Public\Documents\dllhosts.exe
Filesize
411KB

MD5
66557b2bd93e70a2804e983b279ab473

SHA1
4e58505689fd9643b5011880ce94b22cbfadf917

SHA256
a63c9e3f7256e38224f7256307d954d4a6baa9f023f6ac49d8cface7b2658e31

SHA512
b08d8b2872f4ebdbab7b15bd96f5d185f05030983c2d704497d30fe5f610874b5ec362f0e3e55800031edcd29b812d9b58214e76012a85df074310f36e0f33f4

Download Submit
C:\Users\Public\Documents\dllhosts.exe
Filesize
411KB

MD5
66557b2bd93e70a2804e983b279ab473

SHA1
4e58505689fd9643b5011880ce94b22cbfadf917

SHA256
a63c9e3f7256e38224f7256307d954d4a6baa9f023f6ac49d8cface7b2658e31

SHA512
b08d8b2872f4ebdbab7b15bd96f5d185f05030983c2d704497d30fe5f610874b5ec362f0e3e55800031edcd29b812d9b58214e76012a85df074310f36e0f33f4

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\k4.exe
Filesize
892KB

MD5
33e29221e2825001d32f78632217d250

SHA1
9122127fc91790a1edb78003e9b58a9b00355ed5

SHA256
65d0b20a4dc4911fbb91683eb6488d3d3493fa4584bbdfb4e942f203bef0030d

SHA512
01d5c6ded3a83d81371e94fefb1debabb1d003c86ab3cf7145d28fb15fcfd4f8b763f6711f99c5afd9bf90f02a7af993efa5945d4f8bb6a3649b5fd86414ae93

Download Submit
C:\Users\Public\Documents\sch.vbe
Filesize
179B

MD5
d569f44ce5792ee816b4182e3c7bc7da

SHA1
f16a402cd6030b5c7faa5c85ade3005d66d5232a

SHA256
59ff328647ccee11ad437e02b6e84c12511333553837b6fa270eefd21a3eccbf

SHA512
bb0f888ff00038d1787e6cce8b09b61761d93594cbfe08d2dbf650c1802938d6df7b4b854c1af97ad405fb3b1460aab339e636852d51dc6b6849d27a5af9560b

Download Submit
C:\Users\Public\Documents\unzip.dat
Filesize
1KB

MD5
e1fafb36f4da2c3be5dc9be1ad0b9805

SHA1
7d64a899e0ab62f3cd6ebf5bdade782c99c00713

SHA256
a862acb112f57458ad35e5e5fc90f0d270a7600af694a6b7052d161806e5dd69

SHA512
5c530b09b6459f34072dfccb7ccec5cbb791fc6cdc2633993da91fbef9c4d1172aec51ace3fb3cb8ac25b6721b4e6f5f1fd1a8fac7d95abbad8f6430e4abbc3e

Download Submit
C:\Users\Public\Documents\unzip.exe
Filesize
164KB

MD5
75375c22c72f1beb76bea39c22a1ed68

SHA1
e1652b058195db3f5f754b7ab430652ae04a50b8

SHA256
8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a

SHA512
1b396e78e189185eefb8c6058aa7e6dfe1b8f2dff8babfe4ffbee93805467bf45760eea6efb8d9bb2040d0eaa56841d457b1976dcfe13ed67931ade01419f55a

Download Submit
C:\Users\Public\Documents\unzip.exe
Filesize
164KB

MD5
75375c22c72f1beb76bea39c22a1ed68

SHA1
e1652b058195db3f5f754b7ab430652ae04a50b8

SHA256
8d9b5190aace52a1db1ac73a65ee9999c329157c8e88f61a772433323d6b7a4a

SHA512
1b396e78e189185eefb8c6058aa7e6dfe1b8f2dff8babfe4ffbee93805467bf45760eea6efb8d9bb2040d0eaa56841d457b1976dcfe13ed67931ade01419f55a

Download Submit
C:\Users\Public\Documents\unzip.lnk
Filesize
2KB

MD5
7503a871168c07ca47a87c933f004f66

SHA1
764d09fe3b1f756a467e4a96d5cc3453732c3cfb

SHA256
8a3d404f5cdd1611433ea97e8a5ebf8696d8cdcf805331201a4fb4f7203023de

SHA512
4f7bbab0fcdb150cf368ab9fa2d23f26082ae1ac1d1a4cebc7ea9b2724125c7f5e013b2180a08a3f0002e416e6be5e6233f47fb7f5dbebd1b503f09a5ea24831

Download Submit
C:\Users\Public\Documents\update.lnk
Filesize
1KB

MD5
3af508a542bdfa6927737a2d91d74f40

SHA1
433f04e960f68ce05358af2d672a9b649de4e3ce

SHA256
e7e3e44142369b3a312005313f8569f2bcd45bcdc8ea9e141616654bcd090b60

SHA512
b35ad011ca3770c1a1e2a655a614e91ebd96ce29099969c727a69e77a390b91078512ce55883d7290e4dd46c5f04f0461b2833f568d23da1fc4d91ea4633d3bc

Download Submit
C:\Users\Public\Documents\update.log
Filesize
539KB

MD5
460bf7211a5a99f5d4b0d9219cb0f7cd

SHA1
75e077aed35431b2670f4db2647eef12b4666b44

SHA256
a0118b861305f981f12b6922f15cfe2d39cd2e55cbd22378d461c8aa314d826f

SHA512
5bd21eba6ecdde2ca637f6969486dc33fd868ae58d07dec42d2acaf22857df96d75964f45c0b44356941738c3f4c5c2a9e4e8fb4e110ec32bfbc9ac52d8a1c9c

Download Submit
memory/808-142-0x0000000000000000-mapping.dmp

Download
memory/1000-177-0x0000000000000000-mapping.dmp

Download
memory/1208-154-0x0000000000000000-mapping.dmp

Download
memory/1384-139-0x0000000000000000-mapping.dmp

Download
memory/1604-156-0x0000000000000000-mapping.dmp

Download
memory/1616-157-0x0000000000000000-mapping.dmp

Download
memory/1712-175-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1712-169-0x0000000010000000-0x000000001019F000-memory.dmp

Filesize
1.6MB

Download
memory/1712-168-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1712-167-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1712-163-0x0000000000000000-mapping.dmp

Download
memory/1712-164-0x0000000000400000-0x0000000000547000-memory.dmp

Filesize
1.3MB

Download
memory/1828-148-0x0000000000000000-mapping.dmp

Download
memory/3024-143-0x0000000000000000-mapping.dmp

Download
memory/3156-133-0x0000000000000000-mapping.dmp

Download
memory/3744-136-0x0000000000000000-mapping.dmp

Download
memory/3748-138-0x0000000000000000-mapping.dmp

Download
memory/4568-159-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/4568-158-0x0000000000400000-0x0000000000490000-memory.dmp

Filesize
576KB

Download
memory/4568-149-0x0000000000000000-mapping.dmp

Download
memory/4568-176-0x0000000010000000-0x0000000010032000-memory.dmp

Filesize
200KB

Download
memory/4892-155-0x0000000000000000-mapping.dmp

Download
memory/5116-140-0x0000000000000000-mapping.dmp

Download