zgrat | 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60

Analysis

max time kernel
120s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9A495517949AA4F4112EDA7460B6903C.exe
Size 1.9MB
Sample240302-ret9paed66
SHA256 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60
MD5 9a495517949aa4f4112eda7460b6903c
SHA1 2903a362bbde234152a8f12bc5ed028e3231538b
SHA512 bc7d5c93156f2a1fc47553e0f8455cb66aa1e02d352707d5925c23a0cc78195adcc4f0c059a49edf14f3fd6079cf0c5caac397aea9456aefab5684fffc525128
SSDEEP 24576:2TbBv5rUyXVNweJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+T:IBJNnl71zodgS1U8rZXpb7++IqRXz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x000f000000014698-9.dat	family_zgrat_v1
behavioral1/memory/2252-13-0x00000000010E0000-0x0000000001282000-memory.dmp	family_zgrat_v1
behavioral1/memory/1848-54-0x0000000000A80000-0x0000000000C22000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\", \"C:\\Users\\Public\\Downloads\\smss.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\", \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\Program Files\\Internet Explorer\\fr-FR\\Idle.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\", \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\Program Files\\Internet Explorer\\fr-FR\\Idle.exe\", \"C:\\Users\\Default User\\taskhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\", \"C:\\Users\\Public\\Downloads\\smss.exe\", \"C:\\Program Files\\Internet Explorer\\fr-FR\\Idle.exe\", \"C:\\Users\\Default User\\taskhost.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	240	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2716	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1964	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1452	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2280	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1104	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2088	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3044	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	1420	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	1420	schtasks.exe	35

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Executes dropped EXE 2 IoCs

pid	Process
2252	blockprovidercomponentreview.exe
1848	dwm.exe

Loads dropped DLL 2 IoCs

pid	Process
2104	cmd.exe
2104	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Users\\Default User\\taskhost.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Downloads\\smss.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Internet Explorer\\fr-FR\\Idle.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Users\\Public\\Downloads\\smss.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Internet Explorer\\fr-FR\\Idle.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-0044-0409-0000-0000000FF1CE}-C\\dwm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Recovery\\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCDBC7F2147D1B40A9A056CA4F74337FA.TMP	csc.exe
File created	\??\c:\Windows\System32\fixmxn.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\fr-FR\Idle.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Internet Explorer\fr-FR\6ccacd8608530f	blockprovidercomponentreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1104	schtasks.exe
2216	schtasks.exe
2088	schtasks.exe
3044	schtasks.exe
1696	schtasks.exe
2720	schtasks.exe
1964	schtasks.exe
1452	schtasks.exe
2280	schtasks.exe
1764	schtasks.exe
2100	schtasks.exe
2944	schtasks.exe
1268	schtasks.exe
240	schtasks.exe
2716	schtasks.exe
1476	schtasks.exe
2044	schtasks.exe
2996	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2616	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
792	PING.EXE

Suspicious behavior: EnumeratesProcesses 50 IoCs

pid	Process
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
2252	blockprovidercomponentreview.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe
1848	dwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2252	blockprovidercomponentreview.exe
Token: SeDebugPrivilege	1848	dwm.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2560	2660	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2660 wrote to memory of 2560	2660	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2660 wrote to memory of 2560	2660	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2660 wrote to memory of 2560	2660	9A495517949AA4F4112EDA7460B6903C.exe	28
PID 2560 wrote to memory of 2104	2560	WScript.exe	29
PID 2560 wrote to memory of 2104	2560	WScript.exe	29
PID 2560 wrote to memory of 2104	2560	WScript.exe	29
PID 2560 wrote to memory of 2104	2560	WScript.exe	29
PID 2104 wrote to memory of 2616	2104	cmd.exe	31
PID 2104 wrote to memory of 2616	2104	cmd.exe	31
PID 2104 wrote to memory of 2616	2104	cmd.exe	31
PID 2104 wrote to memory of 2616	2104	cmd.exe	31
PID 2104 wrote to memory of 2252	2104	cmd.exe	32
PID 2104 wrote to memory of 2252	2104	cmd.exe	32
PID 2104 wrote to memory of 2252	2104	cmd.exe	32
PID 2104 wrote to memory of 2252	2104	cmd.exe	32
PID 2252 wrote to memory of 2140	2252	blockprovidercomponentreview.exe	39
PID 2252 wrote to memory of 2140	2252	blockprovidercomponentreview.exe	39
PID 2252 wrote to memory of 2140	2252	blockprovidercomponentreview.exe	39
PID 2140 wrote to memory of 2256	2140	csc.exe	41
PID 2140 wrote to memory of 2256	2140	csc.exe	41
PID 2140 wrote to memory of 2256	2140	csc.exe	41
PID 2252 wrote to memory of 1040	2252	blockprovidercomponentreview.exe	57
PID 2252 wrote to memory of 1040	2252	blockprovidercomponentreview.exe	57
PID 2252 wrote to memory of 1040	2252	blockprovidercomponentreview.exe	57
PID 1040 wrote to memory of 1812	1040	cmd.exe	59
PID 1040 wrote to memory of 1812	1040	cmd.exe	59
PID 1040 wrote to memory of 1812	1040	cmd.exe	59
PID 1040 wrote to memory of 792	1040	cmd.exe	60
PID 1040 wrote to memory of 792	1040	cmd.exe	60
PID 1040 wrote to memory of 792	1040	cmd.exe	60
PID 1040 wrote to memory of 1848	1040	cmd.exe	61
PID 1040 wrote to memory of 1848	1040	cmd.exe	61
PID 1040 wrote to memory of 1848	1040	cmd.exe	61

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe
"C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2616
  - - C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
      "C:\Users\Admin\AppData\Roaming\PortProvider/blockprovidercomponentreview.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mmwgob4b\mmwgob4b.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESED0D.tmp" "c:\Windows\System32\CSCDBC7F2147D1B40A9A056CA4F74337FA.TMP"
        6⤵
        
        PID:2256
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\WNePB0Q2Xd.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1040
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1812
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:792
      - C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe
        
        "C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0044-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 5 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 9 /tr "'C:\Recovery\8f9e55a2-d10b-11ee-8d36-fdfbfcab7b96\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\Users\Public\Downloads\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Downloads\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\Internet Explorer\fr-FR\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Internet Explorer\fr-FR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Program Files\Internet Explorer\fr-FR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2088

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESED0D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESED0D.tmp
Size 1KB
SHA256 f75c20a178aa8be2355480779db25f4a79ae14e0de4d636e918fd23507da511d
MD5 0a22ffb7fccce0d432a8675854044b89
SHA1 f1bec0773635c22df060d59985b877e6691a7d62
SHA512 cc1ebe5fe70ae90efea2ce8b755475c95a27692289e1a526283b5d4f63942d7b7837b5a490325bd75e69d2c52ccaccbda0f5924e4b76416dbcbf40c529ab957a
MD5 SHA1 SHA512

Submit Download

WNePB0Q2Xd.bat

Path C:\Users\Admin\AppData\Local\Temp\WNePB0Q2Xd.bat
Size 198B
SHA256 8245d02b5d98797d8131227d743371e2ef3b225ad61395a0c440e63798cbc82e
MD5 35cfe14ffa10702e984d132b991b74b5
SHA1 3d0075ee5fbe974ec1516cd890565dda46edc485
SHA512 0222e3d0677e2e329b4387d9413ed51388cc264f9122f70988bdcae1afa6e47c380c48e89971fccbec1be89b4b35593e60f08206746293ddb5226de5c8c24f9c
MD5 SHA1 SHA512

Submit Download

BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat

Path C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat
Size 199B
SHA256 fcd1252465f440248ccf4375f9f27c79d44a9f096e732ce39e63a6b7260c6bc8
MD5 cf3c88c160c5fce5a7cab7a94a8b6ba3
SHA1 8cec4cc3347bab81f47700dc8144e885ff44d69e
SHA512 d91ac93c6f6c04a79ffb791ba3e3b88780081e774afe1ffd5fd6b6435fe19a56647ddd292db8e6f72a6e8723d0bb1c64ceea9ffa13a21e1280ea04835fc60ad4
MD5 SHA1 SHA512

Submit Download

DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe

Path C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe
Size 247B
SHA256 69bfc93ec86b53320016e735c354f7f06666d30598c05fb40d0589b29a9b88ee
MD5 51e5afa5fa9c00bbcf1db9d18b3b9184
SHA1 f3a880c1e068c07f9ba2973840c9f26886d714b2
SHA512 020b68e028b33acc23a7cd76a1f61189a9bf3d8c39de801522c8631ef0e2889ef1870659731e5c7e3d2714fc06948e1824b48bb69def37b478d93b203e4c64eb
MD5 SHA1 SHA512

Submit Download

mmwgob4b.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\mmwgob4b\mmwgob4b.0.cs
Size 402B
SHA256 a14ba9c9350f9cba961a7973e4b2454bdd1d1a79c368c6a0eaa7f1a8d4b73914
MD5 27ead91f62fef511ddf2348387473271
SHA1 ab05a4bde837d523c5e84da957df5950fe7b28ce
SHA512 0dd3b26048b91b0018c27226642d03a041d78eac512f9cfb2ab2eff9a4195d126f4029f34205245dd2e418b37184ea207c992f014a6275477f3c53653c54e7d9
MD5 SHA1 SHA512

Submit Download

mmwgob4b.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\mmwgob4b\mmwgob4b.cmdline
Size 235B
SHA256 c6b45d9223890b618c633ba5f0a42edf600c764d476aafc87ae29d16d644f26d
MD5 2831d82c356646e280236e23a9616e78
SHA1 fcd7384ae748782f06ce3a8635046438d9f73272
SHA512 7f7deb433660223d8afce529be0d6f63909ae4869de68e637482f1ccb66529b34ba124085167ec54ca618793f9f8c37888da6ac4fe740c1ddcdea9c0c384cf14
MD5 SHA1 SHA512

Submit Download

CSCDBC7F2147D1B40A9A056CA4F74337FA.TMP

Path \??\c:\Windows\System32\CSCDBC7F2147D1B40A9A056CA4F74337FA.TMP
Size 1KB
SHA256 f9849247b878573d5341c81a0a0e86d847df757f114504854ec9a55a63b790a0
MD5 8520d952d96303e0f8a259972c09583d
SHA1 c6425e72597d55ad2a3cee1e3d321d8b3712c3b9
SHA512 cdf94448c3a5e94fbc260d2cdd813f30976fe55165e30447cc0e2ae3ab2d6254619494b482b62f4875c419ecb21efefeadefb7d369560cb2e64a83c16735149e
MD5 SHA1 SHA512

Submit Download

blockprovidercomponentreview.exe

Path \Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
Size 1.6MB
SHA256 1fee0ec11b24c8382c5e53e7bbb469f9226d06e84600d3d6ef8c890b3aa09438
MD5 3df27ae34cb970a928dab4b290ea18e3
SHA1 cc9a7b65a1e4cf6cd99c5cecea65aebd825f06ad
SHA512 c44194a1e83a309843c01a342f3aea52245bc8ee8684d2b8eb6150a11454368acd6dd783cea8315698f325eafa28ca71967cf5b5c2ca0278203df6ea206b4a61
SSDEEP 24576:8weJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+1JkqvKnGmoD5:8nl71zodgS1U8rZXpb7++IqRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1848-58-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-62-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp

Download

memory/1848-67-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-66-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-65-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-64-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-63-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-60-0x0000000077220000-0x0000000077221000-memory.dmp

Download

memory/1848-59-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-54-0x0000000000A80000-0x0000000000C22000-memory.dmp

Download

memory/1848-55-0x000007FEF4E20000-0x000007FEF580C000-memory.dmp

Download

memory/1848-56-0x000000001B3C0000-0x000000001B440000-memory.dmp

Download

memory/1848-57-0x00000000002B0000-0x00000000002B1000-memory.dmp

Download

memory/2252-13-0x00000000010E0000-0x0000000001282000-memory.dmp

Download

memory/2252-51-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Download

memory/2252-14-0x000007FEF5810000-0x000007FEF61FC000-memory.dmp

Download

memory/2252-19-0x0000000077220000-0x0000000077221000-memory.dmp

Download

memory/2252-15-0x000000001B5B0000-0x000000001B630000-memory.dmp

Download

memory/2252-16-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2252-17-0x000000001B5B0000-0x000000001B630000-memory.dmp

Download

memory/2252-18-0x000000001B5B0000-0x000000001B630000-memory.dmp

Download

memory/2252-21-0x0000000000270000-0x000000000027E000-memory.dmp

Download