zgrat | 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9A495517949AA4F4112EDA7460B6903C.exe
Size 1.9MB
Sample240302-reeh8sed64
SHA256 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60
MD5 9a495517949aa4f4112eda7460b6903c
SHA1 2903a362bbde234152a8f12bc5ed028e3231538b
SHA512 bc7d5c93156f2a1fc47553e0f8455cb66aa1e02d352707d5925c23a0cc78195adcc4f0c059a49edf14f3fd6079cf0c5caac397aea9456aefab5684fffc525128
SSDEEP 24576:2TbBv5rUyXVNweJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+T:IBJNnl71zodgS1U8rZXpb7++IqRXz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/files/0x001000000002316d-10.dat	family_zgrat_v1
behavioral2/memory/4916-12-0x0000000000D50000-0x0000000000EF2000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\spoolsv.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\spoolsv.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\lib\\OfficeClickToRun.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\", \"C:\\odt\\Registry.exe\", \"C:\\Program Files\\Windows Photo Viewer\\spoolsv.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\lib\\OfficeClickToRun.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\", \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\", \"C:\\odt\\Registry.exe\""	blockprovidercomponentreview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2888	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1252	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4744	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1824	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3128	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1888	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	692	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4792	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3116	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	776	schtasks.exe	100
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	776	schtasks.exe	100

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	9A495517949AA4F4112EDA7460B6903C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	blockprovidercomponentreview.exe

Executes dropped EXE 2 IoCs

pid	Process
4916	blockprovidercomponentreview.exe
3080	unsecapp.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Windows Photo Viewer\\spoolsv.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Java\\jdk-1.8\\lib\\OfficeClickToRun.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files\\Windows Defender\\uk-UA\\unsecapp.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Setup Files\\spoolsv.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Windows Photo Viewer\\spoolsv.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Program Files\\Java\\jdk-1.8\\lib\\OfficeClickToRun.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCD14B69D2343B4D1FAA71A5EFDE1F3C3.TMP	csc.exe
File created	\??\c:\Windows\System32\qjn76k.exe	csc.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\lib\OfficeClickToRun.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Windows Defender\uk-UA\29c1c3cc0f7685	blockprovidercomponentreview.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\lib\OfficeClickToRun.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Java\jdk-1.8\lib\e6c9b481da804f	blockprovidercomponentreview.exe
File created	C:\Program Files\Windows Photo Viewer\spoolsv.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Windows Photo Viewer\f3b6ecef712a24	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\spoolsv.exe	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\f3b6ecef712a24	blockprovidercomponentreview.exe
File created	C:\Program Files\Windows Defender\uk-UA\unsecapp.exe	blockprovidercomponentreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2040	schtasks.exe
1824	schtasks.exe
4792	schtasks.exe
4892	schtasks.exe
3488	schtasks.exe
5020	schtasks.exe
1588	schtasks.exe
2888	schtasks.exe
3128	schtasks.exe
1888	schtasks.exe
4744	schtasks.exe
692	schtasks.exe
3116	schtasks.exe
5072	schtasks.exe
4064	schtasks.exe
1948	schtasks.exe
4592	schtasks.exe
1252	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	9A495517949AA4F4112EDA7460B6903C.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	blockprovidercomponentreview.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3472	reg.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

pid	Process
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
4916	blockprovidercomponentreview.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe
3080	unsecapp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3080	unsecapp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	blockprovidercomponentreview.exe
Token: SeDebugPrivilege	3080	unsecapp.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3392	4140	9A495517949AA4F4112EDA7460B6903C.exe	91
PID 4140 wrote to memory of 3392	4140	9A495517949AA4F4112EDA7460B6903C.exe	91
PID 4140 wrote to memory of 3392	4140	9A495517949AA4F4112EDA7460B6903C.exe	91
PID 3392 wrote to memory of 1768	3392	WScript.exe	96
PID 3392 wrote to memory of 1768	3392	WScript.exe	96
PID 3392 wrote to memory of 1768	3392	WScript.exe	96
PID 1768 wrote to memory of 3472	1768	cmd.exe	98
PID 1768 wrote to memory of 3472	1768	cmd.exe	98
PID 1768 wrote to memory of 3472	1768	cmd.exe	98
PID 1768 wrote to memory of 4916	1768	cmd.exe	99
PID 1768 wrote to memory of 4916	1768	cmd.exe	99
PID 4916 wrote to memory of 4160	4916	blockprovidercomponentreview.exe	104
PID 4916 wrote to memory of 4160	4916	blockprovidercomponentreview.exe	104
PID 4160 wrote to memory of 3524	4160	csc.exe	106
PID 4160 wrote to memory of 3524	4160	csc.exe	106
PID 4916 wrote to memory of 2612	4916	blockprovidercomponentreview.exe	122
PID 4916 wrote to memory of 2612	4916	blockprovidercomponentreview.exe	122
PID 2612 wrote to memory of 3660	2612	cmd.exe	124
PID 2612 wrote to memory of 3660	2612	cmd.exe	124
PID 2612 wrote to memory of 216	2612	cmd.exe	125
PID 2612 wrote to memory of 216	2612	cmd.exe	125
PID 2612 wrote to memory of 3080	2612	cmd.exe	127
PID 2612 wrote to memory of 3080	2612	cmd.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe
"C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:3472
  - - C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
      "C:\Users\Admin\AppData\Roaming\PortProvider/blockprovidercomponentreview.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ocfbjyh3\ocfbjyh3.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4160
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA41F.tmp" "c:\Windows\System32\CSCD14B69D2343B4D1FAA71A5EFDE1F3C3.TMP"
        6⤵
        
        PID:3524
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\yXvG37C0SW.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2612
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3660
      - C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        6⤵
        
        PID:216
      - C:\Program Files\Windows Defender\uk-UA\unsecapp.exe
        
        "C:\Program Files\Windows Defender\uk-UA\unsecapp.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows Defender\uk-UA\unsecapp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\uk-UA\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\uk-UA\unsecapp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1824

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 8 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Photo Viewer\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:692

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Photo Viewer\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\Program Files\Java\jdk-1.8\lib\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\lib\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Program Files\Java\jdk-1.8\lib\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA41F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA41F.tmp
Size 1KB
SHA256 ab1835b362febe5b2de018234b21ed7e6d4cfb9c40ef1003c6057293125f6a8f
MD5 3bb42f36f3b9041ae5a012a39d61c007
SHA1 3134d5fbaeca64a1c226ac1f0abf50e0f32bc315
SHA512 2230e428020a3ff64c465db76c8adf6129298475a1025b377be5bd447f5f278e761b2db453782c441b592a66dbf12c2730b8bceaba90b58019543a00de81d6b0
MD5 SHA1 SHA512

Submit Download

yXvG37C0SW.bat

Path C:\Users\Admin\AppData\Local\Temp\yXvG37C0SW.bat
Size 228B
SHA256 b0fec9f306cb745a196c51a9cdd8597d9b99f53c0685a8621102740640a4f59f
MD5 4d0ecaba260c064e640065d0ce7f3a75
SHA1 768a194d0ff6d45840ea727634efd7b8ac3b203b
SHA512 4ab327e3da2c3c9a47f04ce180b3ee86bea87c472cdaab7aaf158527f98b48c041e25ddfb99a86251864af95ca891b7e805474a68fd982efbc075ab3efa6a62e
MD5 SHA1 SHA512

Submit Download

BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat

Path C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat
Size 199B
SHA256 fcd1252465f440248ccf4375f9f27c79d44a9f096e732ce39e63a6b7260c6bc8
MD5 cf3c88c160c5fce5a7cab7a94a8b6ba3
SHA1 8cec4cc3347bab81f47700dc8144e885ff44d69e
SHA512 d91ac93c6f6c04a79ffb791ba3e3b88780081e774afe1ffd5fd6b6435fe19a56647ddd292db8e6f72a6e8723d0bb1c64ceea9ffa13a21e1280ea04835fc60ad4
MD5 SHA1 SHA512

Submit Download

DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe

Path C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe
Size 247B
SHA256 69bfc93ec86b53320016e735c354f7f06666d30598c05fb40d0589b29a9b88ee
MD5 51e5afa5fa9c00bbcf1db9d18b3b9184
SHA1 f3a880c1e068c07f9ba2973840c9f26886d714b2
SHA512 020b68e028b33acc23a7cd76a1f61189a9bf3d8c39de801522c8631ef0e2889ef1870659731e5c7e3d2714fc06948e1824b48bb69def37b478d93b203e4c64eb
MD5 SHA1 SHA512

Submit Download

blockprovidercomponentreview.exe

Path C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
Size 1.6MB
SHA256 1fee0ec11b24c8382c5e53e7bbb469f9226d06e84600d3d6ef8c890b3aa09438
MD5 3df27ae34cb970a928dab4b290ea18e3
SHA1 cc9a7b65a1e4cf6cd99c5cecea65aebd825f06ad
SHA512 c44194a1e83a309843c01a342f3aea52245bc8ee8684d2b8eb6150a11454368acd6dd783cea8315698f325eafa28ca71967cf5b5c2ca0278203df6ea206b4a61
SSDEEP 24576:8weJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+1JkqvKnGmoD5:8nl71zodgS1U8rZXpb7++IqRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

ocfbjyh3.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ocfbjyh3\ocfbjyh3.0.cs
Size 384B
SHA256 f1cf6974a160770c8a78a1fefa89f7ec6c953c9998841b4ebb8fb8cbc7fd7b04
MD5 978366d01289e9d95a1d8e54d76d756a
SHA1 dc28415b26b849e5752d7393c8ed3fa48b55f195
SHA512 9c05c5c57fa1d4fdb252c92e742c8baaa4580ede7085078bfa23a55383417924f0a9cf307b87daba512b66eac3349e9a657737455e7ad369a903f5e4d073ef11
MD5 SHA1 SHA512

Submit Download

ocfbjyh3.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ocfbjyh3\ocfbjyh3.cmdline
Size 235B
SHA256 964cba368d26b002494d61be512923e006e47e21ac87a02a269fc34234f39021
MD5 6f3485e1c9d12e2cd0e6f3753074a99a
SHA1 30fb41dc26c6aa2576349eafd65dd6ff35975798
SHA512 8b82038c301d2c54c437b1bc55f3662f6587fc3e8f65eb5d06a845ffe9dd8f8cb723c7be0d539657e64fc7984604516aba0c43f5f65ea05fbdb0a2e757467245
MD5 SHA1 SHA512

Submit Download

CSCD14B69D2343B4D1FAA71A5EFDE1F3C3.TMP

Path \??\c:\Windows\System32\CSCD14B69D2343B4D1FAA71A5EFDE1F3C3.TMP
Size 1KB
SHA256 a20d42bbecd683556a645d5a4978e85a9dd36fde0fd646399f15fdc38b1cc43b
MD5 36c40e7b465f62956725681aa9bdaac9
SHA1 2b13dcc9137a58c122976a34ec9f080dd46a8da9
SHA512 0b2cd0e7b0810583acab7897c893a977540208dc7c98a7efac1c867fa93ba394404f677c02f53df39debe331264cd754a990cfde99bd09aba7a6aa1bb9031ee6
MD5 SHA1 SHA512

Submit Download

memory/3080-70-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-72-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-65-0x00007FFED1A70000-0x00007FFED2531000-memory.dmp

Download

memory/3080-64-0x00000000023B0000-0x00000000023B8000-memory.dmp

Download

memory/3080-67-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-69-0x00007FFEEED30000-0x00007FFEEEDEE000-memory.dmp

Download

memory/3080-60-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-66-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-63-0x00007FFEEECC0000-0x00007FFEEECC1000-memory.dmp

Download

memory/3080-62-0x00007FFEEED30000-0x00007FFEEEDEE000-memory.dmp

Download

memory/3080-75-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-57-0x00007FFED1A70000-0x00007FFED2531000-memory.dmp

Download

memory/3080-58-0x000000001B010000-0x000000001B020000-memory.dmp

Download

memory/3080-59-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/4916-19-0x00007FFEEECC0000-0x00007FFEEECC1000-memory.dmp

Download

memory/4916-52-0x00007FFED1A70000-0x00007FFED2531000-memory.dmp

Download

memory/4916-51-0x00007FFEEED30000-0x00007FFEEEDEE000-memory.dmp

Download

memory/4916-21-0x00007FFEEED30000-0x00007FFEEEDEE000-memory.dmp

Download

memory/4916-20-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

Download

memory/4916-18-0x000000001B9B0000-0x000000001B9BE000-memory.dmp

Download

memory/4916-16-0x00007FFEEED30000-0x00007FFEEEDEE000-memory.dmp

Download

memory/4916-15-0x000000001BCD0000-0x000000001BCE0000-memory.dmp

Download

memory/4916-14-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/4916-13-0x00007FFED1A70000-0x00007FFED2531000-memory.dmp

Download

memory/4916-12-0x0000000000D50000-0x0000000000EF2000-memory.dmp

Download