zgrat | 914e752bafce2960257ed71a9cdb217ca0ac62da5d8010f3e4611e1ca892f153

Analysis

max time kernel
143s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
18-01-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe
Size

2.2MB
MD5

506cd587919d4bb571795ea1c1e64d80
SHA1

c04c19373251eb40197975fbf901ff802e92e22d
SHA256

1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256
SHA512

ab9577410cb2eb1e0fd3e71c2c5d3d13a38563db70e7017734f5067171442b561b1297bf339ddfa54ae266c720a383c7e4c7a63b23a6cdb433651b7ed8cbc30b
SSDEEP

24576:2TbBv5rUyXVl6fDEs25370/5lJHI2cxaSzXykO0eW66f3XEWpEmEQ/2VmCthZ2yt:IBJEECrHjxdXZsUWzuUQME46LMEQ70

Score

10^/10

zgrat evasion persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 9 IoCs

resource	yara_rule
behavioral1/files/0x000c000000015605-9.dat	family_zgrat_v1
behavioral1/files/0x000c000000015605-12.dat	family_zgrat_v1
behavioral1/files/0x000c000000015605-11.dat	family_zgrat_v1
behavioral1/files/0x000c000000015605-10.dat	family_zgrat_v1
behavioral1/memory/2592-13-0x0000000001260000-0x000000000144C000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0007000000015d31-42.dat	family_zgrat_v1
behavioral1/files/0x0006000000015f7a-66.dat	family_zgrat_v1
behavioral1/files/0x0006000000015f7a-67.dat	family_zgrat_v1
behavioral1/memory/844-68-0x0000000000CD0000-0x0000000000EBC000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\audiodg.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\audiodg.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\audiodg.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\audiodg.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\audiodg.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\audiodg.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\audiodg.exe\", \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\", \"C:\\Program Files (x86)\\Uninstall Information\\audiodg.exe\", \"C:\\Program Files\\Uninstall Information\\lsm.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\", \"C:\\HyperchainserverRefBroker\\hyperportServerFontdhcp.exe\""	hyperportServerFontdhcp.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2976	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2552	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2812	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1124	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1604	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2064	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1144	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	2484	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	2484	schtasks.exe	33

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2592	hyperportServerFontdhcp.exe
844	audiodg.exe

Loads dropped DLL 2 IoCs

pid	Process
3008	cmd.exe
3008	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\audiodg.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Uninstall Information\\audiodg.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Uninstall Information\\lsm.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\MSOCache\\All Users\\audiodg.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\audiodg = "\"C:\\Program Files (x86)\\Uninstall Information\\audiodg.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Program Files\\Uninstall Information\\lsm.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\smss.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\hyperportServerFontdhcp = "\"C:\\HyperchainserverRefBroker\\hyperportServerFontdhcp.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hyperportServerFontdhcp = "\"C:\\HyperchainserverRefBroker\\hyperportServerFontdhcp.exe\""	hyperportServerFontdhcp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\System.exe\""	hyperportServerFontdhcp.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCD8034E72C4A8452BA6A4642BD0985D4.TMP	csc.exe
File created	\??\c:\Windows\System32\slsogk.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Uninstall Information\lsm.exe	hyperportServerFontdhcp.exe
File created	C:\Program Files\Uninstall Information\101b941d020240	hyperportServerFontdhcp.exe
File created	C:\Program Files (x86)\Uninstall Information\audiodg.exe	hyperportServerFontdhcp.exe
File created	C:\Program Files (x86)\Uninstall Information\42af1c969fbb7b	hyperportServerFontdhcp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1744	schtasks.exe
2064	schtasks.exe
1144	schtasks.exe
3020	schtasks.exe
692	schtasks.exe
2944	schtasks.exe
2524	schtasks.exe
2560	schtasks.exe
2552	schtasks.exe
2812	schtasks.exe
1124	schtasks.exe
1160	schtasks.exe
1924	schtasks.exe
2752	schtasks.exe
2348	schtasks.exe
1604	schtasks.exe
2320	schtasks.exe
2976	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2604	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1660	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe
2592	hyperportServerFontdhcp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
844	audiodg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	hyperportServerFontdhcp.exe
Token: SeDebugPrivilege	844	audiodg.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2780	2216	1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe	28
PID 2216 wrote to memory of 2780	2216	1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe	28
PID 2216 wrote to memory of 2780	2216	1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe	28
PID 2216 wrote to memory of 2780	2216	1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe	28
PID 2780 wrote to memory of 3008	2780	WScript.exe	29
PID 2780 wrote to memory of 3008	2780	WScript.exe	29
PID 2780 wrote to memory of 3008	2780	WScript.exe	29
PID 2780 wrote to memory of 3008	2780	WScript.exe	29
PID 3008 wrote to memory of 2604	3008	cmd.exe	31
PID 3008 wrote to memory of 2604	3008	cmd.exe	31
PID 3008 wrote to memory of 2604	3008	cmd.exe	31
PID 3008 wrote to memory of 2604	3008	cmd.exe	31
PID 3008 wrote to memory of 2592	3008	cmd.exe	32
PID 3008 wrote to memory of 2592	3008	cmd.exe	32
PID 3008 wrote to memory of 2592	3008	cmd.exe	32
PID 3008 wrote to memory of 2592	3008	cmd.exe	32
PID 2592 wrote to memory of 1876	2592	hyperportServerFontdhcp.exe	38
PID 2592 wrote to memory of 1876	2592	hyperportServerFontdhcp.exe	38
PID 2592 wrote to memory of 1876	2592	hyperportServerFontdhcp.exe	38
PID 1876 wrote to memory of 1912	1876	csc.exe	58
PID 1876 wrote to memory of 1912	1876	csc.exe	58
PID 1876 wrote to memory of 1912	1876	csc.exe	58
PID 2592 wrote to memory of 1216	2592	hyperportServerFontdhcp.exe	48
PID 2592 wrote to memory of 1216	2592	hyperportServerFontdhcp.exe	48
PID 2592 wrote to memory of 1216	2592	hyperportServerFontdhcp.exe	48
PID 1216 wrote to memory of 1988	1216	cmd.exe	45
PID 1216 wrote to memory of 1988	1216	cmd.exe	45
PID 1216 wrote to memory of 1988	1216	cmd.exe	45
PID 1216 wrote to memory of 1660	1216	cmd.exe	46
PID 1216 wrote to memory of 1660	1216	cmd.exe	46
PID 1216 wrote to memory of 1660	1216	cmd.exe	46
PID 1216 wrote to memory of 844	1216	cmd.exe	59
PID 1216 wrote to memory of 844	1216	cmd.exe	59
PID 1216 wrote to memory of 844	1216	cmd.exe	59

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe
"C:\Users\Admin\AppData\Local\Temp\1991d51d2e2c4d278e49edbfc045461bb208504d759e91eb9c14f26ad4ac6256.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\HyperchainserverRefBroker\15rdJvHs8fLqyO2NujCXYGmVvYkYhVqPlDU.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\HyperchainserverRefBroker\aChfOVIZNk46BVBd6tQOJDuZO9i8SfzQwF1KcbSw3gaIMh1jz.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2604
  - - C:\HyperchainserverRefBroker\hyperportServerFontdhcp.exe
      "C:\HyperchainserverRefBroker/hyperportServerFontdhcp.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jzxlpwyh\jzxlpwyh.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1876
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19E7.tmp" "c:\Windows\System32\CSCD8034E72C4A8452BA6A4642BD0985D4.TMP"
        6⤵
        
        PID:1912
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Z8HBMNttbe.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1216
      - C:\MSOCache\All Users\audiodg.exe
        
        "C:\MSOCache\All Users\audiodg.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\MSOCache\All Users\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2348

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperportServerFontdhcph" /sc MINUTE /mo 14 /tr "'C:\HyperchainserverRefBroker\hyperportServerFontdhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1124

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:1988

C:\Windows\system32\PING.EXE
ping -n 10 localhost
1⤵
- Runs ping.exe
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperportServerFontdhcp" /sc ONLOGON /tr "'C:\HyperchainserverRefBroker\hyperportServerFontdhcp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "hyperportServerFontdhcph" /sc MINUTE /mo 13 /tr "'C:\HyperchainserverRefBroker\hyperportServerFontdhcp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Uninstall Information\audiodg.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2524

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\HyperchainserverRefBroker\15rdJvHs8fLqyO2NujCXYGmVvYkYhVqPlDU.vbe

Filesize
252B

MD5
4a61f0d242786b7e9caa34fa552a0791

SHA1
47a7114f25574bf8ba482e561c395c2d942f40d8

SHA256
5db96d7ae442161d7e6b12f9bd1380030d7e951cdebfb198bdd3bf76ce514c2f

SHA512
4262524a95b9a7756d327ae338d065565c38dd3548679b21ed7593293f2e8703084439dff9fb44d7c8667115adeda4f262ccbbe43dd39e215d77e51369ddd042

Download Submit
C:\HyperchainserverRefBroker\aChfOVIZNk46BVBd6tQOJDuZO9i8SfzQwF1KcbSw3gaIMh1jz.bat

Filesize
210B

MD5
bdec11d125abfe788f5249bd9f8e8453

SHA1
e5850a47337f36270fdc5bb49c57a4f81358730b

SHA256
836e8052513d49530612a8f405e1eeef196834e6431b345eaebd09dc23693c50

SHA512
9c8418bec2565a82f200d40cf9254d3219f9f81da1a55e1d4c88bab0de3947986c94168c4db53c6e49191030c81c9284ecb4c3429d3d0cfe48421a26de7c623f

Download Submit
C:\HyperchainserverRefBroker\hyperportServerFontdhcp.exe

Filesize
611KB

MD5
f77765e7bae242dead92b0bfd9f4f28a

SHA1
6135d7937a24f69519fef8f56f6fe888b514e457

SHA256
9e72d49bd0b8796f88346448f85dbb34ef59294e842e9544a6496017eda8704e

SHA512
4635a0ea802a6ede44b554195b6e61ee900ed81491f7c2f7bbb1bd69f71ed84b4c7a1378ad7cfa399c3dc6ab0bfaf259c8d7491f67405ffdfce0eefefa92e00d

Download Submit
C:\HyperchainserverRefBroker\hyperportServerFontdhcp.exe

Filesize
552KB

MD5
53fcd61bfa58d229051aa3bfe7a644b4

SHA1
d6c7c8b24173bb4a0a9430dba7c52d7c015e896d

SHA256
211d77880a6f18e6307ac87704222918f8287c3aeb397e5ea00e33fa9b27b5cf

SHA512
bf6339b10f50673705fed5880a173725d79593b02695e5da8fe472738974f859ed46d6a8889e354510ba3faff02badff8e942b3578acf42e0c49f50fe0b89d5d

Download Submit
C:\MSOCache\All Users\audiodg.exe

Filesize
1.1MB

MD5
dfdc27573faf32baa37ee3d7d8928754

SHA1
d1a04b6da47b1f5f3be65464da3808a4e03b2f6a

SHA256
58c74642aff93dc24801ab348c4c731f795727a4059a23c51ed375b752f0ca39

SHA512
7f7215ab313b6deb09b5ed8509cb4b68332d9feca5686bc14d3825fafb20671e61b6a7eb05b73484e9c8f8b911c0068a42af9bbc2e4a93dd847106c875efae60

Download Submit
C:\MSOCache\All Users\audiodg.exe

Filesize
923KB

MD5
75004db81702a9f9f3a2ad313b304781

SHA1
d770e611d51d42217a667effc50e91101dfbd65d

SHA256
3a95805a703ab21dca070966b86702629c27a2e94939497ae4e95301739bc349

SHA512
4225b1e685270859e0f94156a347ed60fa1f058bf2f9cb633fdf9d54b4ae2fb9b5f8e2370a7c18f6838e61f476e7c2a2d4d732719ec6e47b62d4dcc357e1c4b3

Download Submit
C:\Program Files (x86)\Uninstall Information\audiodg.exe

Filesize
574KB

MD5
c43bf3a41db4df8877244f6785647ab7

SHA1
8213b1ff53681a069d72200be62202bcbbba40c8

SHA256
d08412ff2219d8eec39f2d8eb7b29018df07646d42ad58e3cae86c623bf8b06f

SHA512
857ca1f6c54aeef9814f098a1e66a253a1889f1f935119a8189ea5b0cf5146ad7473239eed9b7e9f88deb737047516825e47ad383b29b2a90fa51dd5ebc73714

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES19E7.tmp

Filesize
1KB

MD5
07196fae7b06e47f6dcea15c20a0ce45

SHA1
3c19cd74603129291e3057bcf4fa1ab295f35de7

SHA256
c8ebfe6d7cb563908a0b56a37803a21fd6b5c57cfd64f988682057c92c68ecf4

SHA512
e5b1937303bb85d88ec85d87b0f4a8d517c75486b0cc949343b92f0726db17ae4e93ff60fb9f2ad3151d1640f0de06e16457b884b722be7654e25681452b5629

Download Submit
C:\Users\Admin\AppData\Local\Temp\Z8HBMNttbe.bat

Filesize
161B

MD5
2bbb4511e9d388c749d068b641179324

SHA1
bc9e5d0a91df8bdf01c1b94eec92da202b091fa8

SHA256
1f1630d8ba23d17b9423e26d68eefe1cd2087d7b3ca113e0b954bcf131cc2eb4

SHA512
581ecced19dc9d7387379ce8e38854e4a0743de3ade85f47d3a670ca8b04ba0c57821abcd5bb14bd578560464755d17a0ae2177e3152298bb3d7ea9fafc9f885

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jzxlpwyh\jzxlpwyh.0.cs

Filesize
365B

MD5
e27f70ee267e36afee068bfcb7b8e8f4

SHA1
ce0f8742792e715abb2c57da9b4ee7703c6fb9a2

SHA256
70c8619aaeb2086fa181d29a41ebaa30ea1519e1dbc74d8bddc188777cfda636

SHA512
50d23a62bdffc140e4a90736e1bcbe1f94a17282ee74de5e43665495acf18dc5a885815754fab83d6dcfa9e553624787f40502c22f4801b826b6494363607a37

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jzxlpwyh\jzxlpwyh.cmdline

Filesize
235B

MD5
c1a1006bbf6fa1aead242d0114cbe948

SHA1
44db79d34fbd25607232525f8614f23a1bf0ea4b

SHA256
176226675ae0ca146fc708837e1ed48eaf61db748db7af812fe02f917ac5f4df

SHA512
6a615a3eeb1aa36408ee8f137bbe73d5c55bfa23ce004edf546fcbc6ec4582f6e883a5cd9daadc22cc707a98b9b85aeed2d1f3345271a6c7ef02f86458d2ecc2

Download Submit
\??\c:\Windows\System32\CSCD8034E72C4A8452BA6A4642BD0985D4.TMP

Filesize
1KB

MD5
3fcb2bd8a227751c0367dff5940613bb

SHA1
bcca174ab4499de5713d836fbc368966aa1f5b2c

SHA256
aca1f364ec354097cdecc50336698c1180b10ae84fc6051eab154482e0965e8c

SHA512
c7357bb6ee27df96ba39066e893ce8521cb1d5c550be24ced7f860e11cc36ecc04fbec14f61da920bca04e0ae150df8dbc53de0c4a6880afa6067bccfe767672

Download Submit
\HyperchainserverRefBroker\hyperportServerFontdhcp.exe

Filesize
636KB

MD5
78a58254bb08ed85490d5950cafba3bc

SHA1
bdb7ff19afb2ec691226ba904029c5767d949669

SHA256
31dc93030238a95280b5f6fa049560c7103260ff13d09338e6a64090f2033ce2

SHA512
118b0c02e767e9f2fdfffcba3bb9f3198ca8b44738fdef2f0fc20a65b3e5a3da3fdad2bc0330a6262b5e8d2f808de0980be5b8cf7d0863866e95e57bd14c50f0

Download Submit
\HyperchainserverRefBroker\hyperportServerFontdhcp.exe

Filesize
1.3MB

MD5
c27b78933127b54aa18c33e4683ca483

SHA1
a321d87d34b6af6aae6250835f87a420422994e1

SHA256
7be51fa54cc1f6122ac36a92c18a2dddacc4892330309d21e210ef977bcf3c59

SHA512
c290deaffb20d515f66775e7065419fbccce79543511bd07f1ee4eab6eb4c358acf5466ff0d6a449e68250efd264c5c10ace5536bc4e4b7ac7d310b13b85bff9

Download Submit
memory/844-85-0x0000000076CD0000-0x0000000076CD1000-memory.dmp

Filesize
4KB

Download
memory/844-70-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-78-0x0000000076D10000-0x0000000076D11000-memory.dmp

Filesize
4KB

Download
memory/844-83-0x0000000076CE0000-0x0000000076CE1000-memory.dmp

Filesize
4KB

Download
memory/844-81-0x0000000076D00000-0x0000000076D01000-memory.dmp

Filesize
4KB

Download
memory/844-74-0x0000000076D20000-0x0000000076D21000-memory.dmp

Filesize
4KB

Download
memory/844-76-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-72-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-71-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/844-84-0x0000000076CF0000-0x0000000076CF1000-memory.dmp

Filesize
4KB

Download
memory/844-68-0x0000000000CD0000-0x0000000000EBC000-memory.dmp

Filesize
1.9MB

Download
memory/844-69-0x000007FEF4B40000-0x000007FEF552C000-memory.dmp

Filesize
9.9MB

Download
memory/844-87-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-86-0x000007FEF4B40000-0x000007FEF552C000-memory.dmp

Filesize
9.9MB

Download
memory/844-88-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-89-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-106-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/844-108-0x000000001AA20000-0x000000001AAA0000-memory.dmp

Filesize
512KB

Download
memory/2592-22-0x0000000076D10000-0x0000000076D11000-memory.dmp

Filesize
4KB

Download
memory/2592-65-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-19-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/2592-20-0x0000000076D20000-0x0000000076D21000-memory.dmp

Filesize
4KB

Download
memory/2592-21-0x000000001B3D0000-0x000000001B450000-memory.dmp

Filesize
512KB

Download
memory/2592-32-0x0000000000540000-0x000000000054E000-memory.dmp

Filesize
56KB

Download
memory/2592-33-0x0000000076CE0000-0x0000000076CE1000-memory.dmp

Filesize
4KB

Download
memory/2592-36-0x0000000076CD0000-0x0000000076CD1000-memory.dmp

Filesize
4KB

Download
memory/2592-35-0x0000000000A30000-0x0000000000A3C000-memory.dmp

Filesize
48KB

Download
memory/2592-26-0x0000000000A10000-0x0000000000A28000-memory.dmp

Filesize
96KB

Download
memory/2592-28-0x0000000076CF0000-0x0000000076CF1000-memory.dmp

Filesize
4KB

Download
memory/2592-30-0x0000000000530000-0x000000000053C000-memory.dmp

Filesize
48KB

Download
memory/2592-27-0x0000000076D00000-0x0000000076D01000-memory.dmp

Filesize
4KB

Download
memory/2592-24-0x0000000000550000-0x000000000056C000-memory.dmp

Filesize
112KB

Download
memory/2592-17-0x000000001B3D0000-0x000000001B450000-memory.dmp

Filesize
512KB

Download
memory/2592-16-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2592-15-0x000000001B3D0000-0x000000001B450000-memory.dmp

Filesize
512KB

Download
memory/2592-14-0x000007FEF5530000-0x000007FEF5F1C000-memory.dmp

Filesize
9.9MB

Download
memory/2592-13-0x0000000001260000-0x000000000144C000-memory.dmp

Filesize
1.9MB

Download