zgrat | 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60

Analysis

max time kernel
147s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9A495517949AA4F4112EDA7460B6903C.exe
Size 1.9MB
Sample240302-reeh8sed64
SHA256 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60
MD5 9a495517949aa4f4112eda7460b6903c
SHA1 2903a362bbde234152a8f12bc5ed028e3231538b
SHA512 bc7d5c93156f2a1fc47553e0f8455cb66aa1e02d352707d5925c23a0cc78195adcc4f0c059a49edf14f3fd6079cf0c5caac397aea9456aefab5684fffc525128
SSDEEP 24576:2TbBv5rUyXVNweJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+T:IBJNnl71zodgS1U8rZXpb7++IqRXz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x000e0000000153cf-9.dat	family_zgrat_v1
behavioral1/memory/2576-13-0x00000000003A0000-0x0000000000542000-memory.dmp	family_zgrat_v1
behavioral1/memory/2076-54-0x0000000000AB0000-0x0000000000C52000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\", \"C:\\Users\\Admin\\NetHood\\lsm.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\conhost.exe\", \"C:\\Windows\\LiveKernelReports\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\", \"C:\\Users\\Admin\\NetHood\\lsm.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\conhost.exe\", \"C:\\Windows\\LiveKernelReports\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\blockprovidercomponentreview.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\", \"C:\\Users\\Admin\\NetHood\\lsm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\", \"C:\\Users\\Admin\\NetHood\\lsm.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\conhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\", \"C:\\Users\\Admin\\NetHood\\lsm.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\conhost.exe\", \"C:\\Windows\\LiveKernelReports\\conhost.exe\""	blockprovidercomponentreview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2892	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2948	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2488	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	112	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2708	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1504	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1028	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2252	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	2752	schtasks.exe	33
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1396	2752	schtasks.exe	33

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2576	blockprovidercomponentreview.exe
2076	lsm.exe

Loads dropped DLL 2 IoCs

pid	Process
2700	cmd.exe
2700	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\conhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\conhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\LiveKernelReports\\conhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Windows\\LiveKernelReports\\conhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\cmd.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Admin\\NetHood\\lsm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Users\\Admin\\NetHood\\lsm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC8AA882C2C2724CB6A18F4C25C1B227C.TMP	csc.exe
File created	\??\c:\Windows\System32\tcszo9.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\blockprovidercomponentreview.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\02c62c1e14423d	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\ebf1f9fa8afd6d	blockprovidercomponentreview.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\blockprovidercomponentreview.exe	blockprovidercomponentreview.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\LiveKernelReports\conhost.exe	blockprovidercomponentreview.exe
File created	C:\Windows\LiveKernelReports\088424020bedd6	blockprovidercomponentreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1028	schtasks.exe
1996	schtasks.exe
1412	schtasks.exe
1396	schtasks.exe
2488	schtasks.exe
2708	schtasks.exe
1504	schtasks.exe
2024	schtasks.exe
2232	schtasks.exe
1864	schtasks.exe
268	schtasks.exe
2612	schtasks.exe
1508	schtasks.exe
112	schtasks.exe
2244	schtasks.exe
2252	schtasks.exe
2892	schtasks.exe
2948	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2500	reg.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2576	blockprovidercomponentreview.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe
2076	lsm.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2076	lsm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	blockprovidercomponentreview.exe
Token: SeDebugPrivilege	2076	lsm.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3008	2156	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2156 wrote to memory of 3008	2156	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2156 wrote to memory of 3008	2156	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2156 wrote to memory of 3008	2156	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 3008 wrote to memory of 2700	3008	WScript.exe	29
PID 3008 wrote to memory of 2700	3008	WScript.exe	29
PID 3008 wrote to memory of 2700	3008	WScript.exe	29
PID 3008 wrote to memory of 2700	3008	WScript.exe	29
PID 2700 wrote to memory of 2500	2700	cmd.exe	31
PID 2700 wrote to memory of 2500	2700	cmd.exe	31
PID 2700 wrote to memory of 2500	2700	cmd.exe	31
PID 2700 wrote to memory of 2500	2700	cmd.exe	31
PID 2700 wrote to memory of 2576	2700	cmd.exe	32
PID 2700 wrote to memory of 2576	2700	cmd.exe	32
PID 2700 wrote to memory of 2576	2700	cmd.exe	32
PID 2700 wrote to memory of 2576	2700	cmd.exe	32
PID 2576 wrote to memory of 2736	2576	blockprovidercomponentreview.exe	37
PID 2576 wrote to memory of 2736	2576	blockprovidercomponentreview.exe	37
PID 2576 wrote to memory of 2736	2576	blockprovidercomponentreview.exe	37
PID 2736 wrote to memory of 836	2736	csc.exe	39
PID 2736 wrote to memory of 836	2736	csc.exe	39
PID 2736 wrote to memory of 836	2736	csc.exe	39
PID 2576 wrote to memory of 2436	2576	blockprovidercomponentreview.exe	55
PID 2576 wrote to memory of 2436	2576	blockprovidercomponentreview.exe	55
PID 2576 wrote to memory of 2436	2576	blockprovidercomponentreview.exe	55
PID 2436 wrote to memory of 1464	2436	cmd.exe	57
PID 2436 wrote to memory of 1464	2436	cmd.exe	57
PID 2436 wrote to memory of 1464	2436	cmd.exe	57
PID 2436 wrote to memory of 888	2436	cmd.exe	58
PID 2436 wrote to memory of 888	2436	cmd.exe	58
PID 2436 wrote to memory of 888	2436	cmd.exe	58
PID 2436 wrote to memory of 2076	2436	cmd.exe	59
PID 2436 wrote to memory of 2076	2436	cmd.exe	59
PID 2436 wrote to memory of 2076	2436	cmd.exe	59

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe
"C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2500
  - - C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
      "C:\Users\Admin\AppData\Roaming\PortProvider/blockprovidercomponentreview.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2576
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wv1wpcra\wv1wpcra.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2736
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75DB.tmp" "c:\Windows\System32\CSC8AA882C2C2724CB6A18F4C25C1B227C.TMP"
        6⤵
        
        PID:836
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fjuDwulKea.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2436
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1464
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:888
      - C:\Users\Admin\NetHood\lsm.exe
        
        "C:\Users\Admin\NetHood\lsm.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\NetHood\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Users\Admin\NetHood\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\Users\Admin\NetHood\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1504

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\LiveKernelReports\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\LiveKernelReports\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Windows\LiveKernelReports\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 12 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES75DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES75DB.tmp
Size 1KB
SHA256 e40bd935abefed326771199c52e8a48ebc6a776e8408da015aba022032327d55
MD5 19ccac2fec217a117003d01aa9217af1
SHA1 ed62d5c7b50f7e9ecf9e9ee28f39110b47294bd9
SHA512 723a163cceb72da4cbe8e28c6accf2eade691017438f79e7e867bfdb60a516947a5f70b7aee71b82a8c2d2e22e971e1bd863af3f53b50573532ad35a0bd49ace
MD5 SHA1 SHA512

Submit Download

fjuDwulKea.bat

Path C:\Users\Admin\AppData\Local\Temp\fjuDwulKea.bat
Size 206B
SHA256 fb82472e068af02e8c82a8ab4a669ea1ee421e0af1fd4cf03ce3bfd71eb2be64
MD5 d0028168367d973ef4b6f5d5c6115a1c
SHA1 1588239726a8a135e7d7f659cf780ff4725054d8
SHA512 3cfbfbc4f8c03e066b0401fe5f3e1908eddca8d484ecf3210974997e5f41acfc0a4da8db23f3483b4cab93d4f85a0313278e9174c8dabf237ca66afbd5dab27b
MD5 SHA1 SHA512

Submit Download

BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat

Path C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat
Size 199B
SHA256 fcd1252465f440248ccf4375f9f27c79d44a9f096e732ce39e63a6b7260c6bc8
MD5 cf3c88c160c5fce5a7cab7a94a8b6ba3
SHA1 8cec4cc3347bab81f47700dc8144e885ff44d69e
SHA512 d91ac93c6f6c04a79ffb791ba3e3b88780081e774afe1ffd5fd6b6435fe19a56647ddd292db8e6f72a6e8723d0bb1c64ceea9ffa13a21e1280ea04835fc60ad4
MD5 SHA1 SHA512

Submit Download

DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe

Path C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe
Size 247B
SHA256 69bfc93ec86b53320016e735c354f7f06666d30598c05fb40d0589b29a9b88ee
MD5 51e5afa5fa9c00bbcf1db9d18b3b9184
SHA1 f3a880c1e068c07f9ba2973840c9f26886d714b2
SHA512 020b68e028b33acc23a7cd76a1f61189a9bf3d8c39de801522c8631ef0e2889ef1870659731e5c7e3d2714fc06948e1824b48bb69def37b478d93b203e4c64eb
MD5 SHA1 SHA512

Submit Download

wv1wpcra.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wv1wpcra\wv1wpcra.0.cs
Size 393B
SHA256 41859d5a4235e2fdd8896da8b520044a6525b7cb7e971cb71491cd653b82658e
MD5 f79a7e61fc93acecf9489981630bdb8f
SHA1 86d5e6c5514eadc6e776b31c11a0ebea4c5e4e84
SHA512 ad5d5e911a3d73738fdfd0902a4015a291042a6ebeb884dc50271a01082c296d8a169d9655d0a394e0efe91a0e0859363a3c54cae40532d6d8ca482412b57b05
MD5 SHA1 SHA512

Submit Download

wv1wpcra.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wv1wpcra\wv1wpcra.cmdline
Size 235B
SHA256 f5c921c4c8214ab0cd917016ca358d3f6aa631c917bd6c3195a1ced9ad355c44
MD5 d933143ac650d6acfd284680609ff9e2
SHA1 284f5409be25437e10641bf877bd232dc6bd7720
SHA512 85d86894e8fdf48a245e4e86e014dc79326516e54a42e1996d07faffcada1a93467845eca363f134f0d52f32dd5460d757b8011f2a440799ae0d35300fb53c62
MD5 SHA1 SHA512

Submit Download

CSC8AA882C2C2724CB6A18F4C25C1B227C.TMP

Path \??\c:\Windows\System32\CSC8AA882C2C2724CB6A18F4C25C1B227C.TMP
Size 1KB
SHA256 67e68135a985b6d3a0d63df5c6795567cbc1d5b8f124d65662e463af4da65823
MD5 d8db284f657dc7249f8d2e9798f16b87
SHA1 2c9e00cba50091d4239c90f375509c8d58408ec1
SHA512 4330f819da94bcb38b930d39f016c5989e68a20780b74de751f59b759e46de031244be9186261bb245507e9ca816c1655049575a03e85339b5fc596f5b7cfd39
MD5 SHA1 SHA512

Submit Download

blockprovidercomponentreview.exe

Path \Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
Size 1.6MB
SHA256 1fee0ec11b24c8382c5e53e7bbb469f9226d06e84600d3d6ef8c890b3aa09438
MD5 3df27ae34cb970a928dab4b290ea18e3
SHA1 cc9a7b65a1e4cf6cd99c5cecea65aebd825f06ad
SHA512 c44194a1e83a309843c01a342f3aea52245bc8ee8684d2b8eb6150a11454368acd6dd783cea8315698f325eafa28ca71967cf5b5c2ca0278203df6ea206b4a61
SSDEEP 24576:8weJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+1JkqvKnGmoD5:8nl71zodgS1U8rZXpb7++IqRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2076-58-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-62-0x000007FEF4F80000-0x000007FEF596C000-memory.dmp

Download

memory/2076-67-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-66-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-65-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-64-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-63-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-61-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2076-60-0x0000000077240000-0x0000000077241000-memory.dmp

Download

memory/2076-55-0x000007FEF4F80000-0x000007FEF596C000-memory.dmp

Download

memory/2076-54-0x0000000000AB0000-0x0000000000C52000-memory.dmp

Download

memory/2076-57-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/2076-56-0x000000001A8D0000-0x000000001A950000-memory.dmp

Download

memory/2576-13-0x00000000003A0000-0x0000000000542000-memory.dmp

Download

memory/2576-14-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Download

memory/2576-50-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Download

memory/2576-20-0x0000000077240000-0x0000000077241000-memory.dmp

Download

memory/2576-15-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/2576-16-0x00000000002C0000-0x00000000002C1000-memory.dmp

Download

memory/2576-17-0x000000001B490000-0x000000001B510000-memory.dmp

Download

memory/2576-19-0x0000000000310000-0x000000000031E000-memory.dmp

Download

memory/2576-21-0x000000001B490000-0x000000001B510000-memory.dmp

Download