zgrat | 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60

Analysis

max time kernel
144s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9A495517949AA4F4112EDA7460B6903C.exe
Size 1.9MB
Sample240302-ret9paed66
SHA256 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60
MD5 9a495517949aa4f4112eda7460b6903c
SHA1 2903a362bbde234152a8f12bc5ed028e3231538b
SHA512 bc7d5c93156f2a1fc47553e0f8455cb66aa1e02d352707d5925c23a0cc78195adcc4f0c059a49edf14f3fd6079cf0c5caac397aea9456aefab5684fffc525128
SSDEEP 24576:2TbBv5rUyXVNweJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+T:IBJNnl71zodgS1U8rZXpb7++IqRXz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002326e-10.dat	family_zgrat_v1
behavioral2/memory/1752-12-0x00000000005D0000-0x0000000000772000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\explorer.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\explorer.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\services.exe\", \"C:\\Recovery\\WindowsRE\\SearchApp.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\explorer.exe\", \"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\blockprovidercomponentreview.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files\\Uninstall Information\\services.exe\""	blockprovidercomponentreview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4440	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3272	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4036	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2296	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2916	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4576	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3304	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1700	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3956	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2304	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3280	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	4052	schtasks.exe	101
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1460	4052	schtasks.exe	101

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	9A495517949AA4F4112EDA7460B6903C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	blockprovidercomponentreview.exe

Executes dropped EXE 2 IoCs

pid	Process
1752	blockprovidercomponentreview.exe
2292	services.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\explorer.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Uninstall Information\\services.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchApp = "\"C:\\Recovery\\WindowsRE\\SearchApp.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\explorer.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Uninstall Information\\services.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\All Users\\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\\updates\\308046B0AF4A39CB\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC81D87F998C47D3946734921F3C4EA1.TMP	csc.exe
File created	\??\c:\Windows\System32\_iyiwy.exe	csc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC504E6862626F4F48A68FF246F69957AA.TMP	csc.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	csc.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\7a0fd90576e088	blockprovidercomponentreview.exe
File created	C:\Program Files\Uninstall Information\services.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Uninstall Information\c5b4cb5e9653cc	blockprovidercomponentreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1460	schtasks.exe
3272	schtasks.exe
2296	schtasks.exe
2916	schtasks.exe
2484	schtasks.exe
3304	schtasks.exe
2276	schtasks.exe
4440	schtasks.exe
4036	schtasks.exe
1876	schtasks.exe
4576	schtasks.exe
3956	schtasks.exe
2300	schtasks.exe
1700	schtasks.exe
3280	schtasks.exe
1768	schtasks.exe
2304	schtasks.exe
4772	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	9A495517949AA4F4112EDA7460B6903C.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	blockprovidercomponentreview.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2848	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4440	PING.EXE

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
1752	blockprovidercomponentreview.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe
2292	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	blockprovidercomponentreview.exe
Token: SeDebugPrivilege	2292	services.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4580	4464	9A495517949AA4F4112EDA7460B6903C.exe	99
PID 4464 wrote to memory of 4580	4464	9A495517949AA4F4112EDA7460B6903C.exe	99
PID 4464 wrote to memory of 4580	4464	9A495517949AA4F4112EDA7460B6903C.exe	99
PID 4580 wrote to memory of 1932	4580	WScript.exe	102
PID 4580 wrote to memory of 1932	4580	WScript.exe	102
PID 4580 wrote to memory of 1932	4580	WScript.exe	102
PID 1932 wrote to memory of 2848	1932	cmd.exe	104
PID 1932 wrote to memory of 2848	1932	cmd.exe	104
PID 1932 wrote to memory of 2848	1932	cmd.exe	104
PID 1932 wrote to memory of 1752	1932	cmd.exe	105
PID 1932 wrote to memory of 1752	1932	cmd.exe	105
PID 1752 wrote to memory of 4852	1752	blockprovidercomponentreview.exe	111
PID 1752 wrote to memory of 4852	1752	blockprovidercomponentreview.exe	111
PID 4852 wrote to memory of 3336	4852	csc.exe	113
PID 4852 wrote to memory of 3336	4852	csc.exe	113
PID 1752 wrote to memory of 3696	1752	blockprovidercomponentreview.exe	114
PID 1752 wrote to memory of 3696	1752	blockprovidercomponentreview.exe	114
PID 3696 wrote to memory of 3952	3696	csc.exe	116
PID 3696 wrote to memory of 3952	3696	csc.exe	116
PID 1752 wrote to memory of 3732	1752	blockprovidercomponentreview.exe	132
PID 1752 wrote to memory of 3732	1752	blockprovidercomponentreview.exe	132
PID 3732 wrote to memory of 4320	3732	cmd.exe	134
PID 3732 wrote to memory of 4320	3732	cmd.exe	134
PID 3732 wrote to memory of 4440	3732	cmd.exe	135
PID 3732 wrote to memory of 4440	3732	cmd.exe	135
PID 3732 wrote to memory of 2292	3732	cmd.exe	136
PID 3732 wrote to memory of 2292	3732	cmd.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe
"C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:2848
  - - C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
      "C:\Users\Admin\AppData\Roaming\PortProvider/blockprovidercomponentreview.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\skcsbgrw\skcsbgrw.cmdline"
        5⤵
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:4852
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES773E.tmp" "c:\Program Files (x86)\Microsoft\Edge\Application\CSC504E6862626F4F48A68FF246F69957AA.TMP"
        6⤵
        
        PID:3336
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k2mu3e3e\k2mu3e3e.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3696
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7848.tmp" "c:\Windows\System32\CSC81D87F998C47D3946734921F3C4EA1.TMP"
        6⤵
        
        PID:3952
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bseJIQx2C3.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3732
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4320
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4440
      - C:\Program Files\Uninstall Information\services.exe
        
        "C:\Program Files\Uninstall Information\services.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4048 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:4556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 12 /tr "'C:\Program Files\Uninstall Information\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files\Uninstall Information\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4576

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 9 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES773E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES773E.tmp
Size 1KB
SHA256 ca646855909866aa26936e34a74e9d2ec1cf5f4b6d03a51d9e1cce43df863e99
MD5 4e29320aa62d10f5d1d409494ec91b1f
SHA1 0a94771155ad0df02d8e736bfeee91c005133cd9
SHA512 009205a8c575c5ad140a33833316af8d73434cefb07a4ef28959b55408e375bc9895020e16e6551638027cbe3989c4d9b7ede607a4e76b4679b5f0a573e85694
MD5 SHA1 SHA512

Submit Download

RES7848.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7848.tmp
Size 1KB
SHA256 1ea4bab44cf15754ea0458796a56cfa047b5f34e8cb6bc2dc6849b48eb820e34
MD5 d74b4fb8257f0a7a5d1a698d1ed407de
SHA1 1fbb49e070523082a0f4d6cea7a8d5944e39a913
SHA512 7121de5ef4fbacde9f283f034f80b9651c496040a9d58b85c0fc85ae79602b56682420089986ad821cebbb6835fc74d5a5eae73f2a71ca6d721605552afb2da7
MD5 SHA1 SHA512

Submit Download

bseJIQx2C3.bat

Path C:\Users\Admin\AppData\Local\Temp\bseJIQx2C3.bat
Size 179B
SHA256 2227a7c183ce5ff510d13d5a6e6aa22880c9c7fa028a9d6d010f7f86c6fe9736
MD5 bb3a5efb5f28067342209a76d5494def
SHA1 99b85504fa62e565377427df43e574650a4b4d4e
SHA512 6793dd9012e5410e7eb22d29b0bbdf038827bf4536b6c7fe08845154fc8b462698ddb155e64d8670f564614807f5919891b45925b15cbd230e09332fd58157d1
MD5 SHA1 SHA512

Submit Download

BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat

Path C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat
Size 199B
SHA256 fcd1252465f440248ccf4375f9f27c79d44a9f096e732ce39e63a6b7260c6bc8
MD5 cf3c88c160c5fce5a7cab7a94a8b6ba3
SHA1 8cec4cc3347bab81f47700dc8144e885ff44d69e
SHA512 d91ac93c6f6c04a79ffb791ba3e3b88780081e774afe1ffd5fd6b6435fe19a56647ddd292db8e6f72a6e8723d0bb1c64ceea9ffa13a21e1280ea04835fc60ad4
MD5 SHA1 SHA512

Submit Download

DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe

Path C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe
Size 247B
SHA256 69bfc93ec86b53320016e735c354f7f06666d30598c05fb40d0589b29a9b88ee
MD5 51e5afa5fa9c00bbcf1db9d18b3b9184
SHA1 f3a880c1e068c07f9ba2973840c9f26886d714b2
SHA512 020b68e028b33acc23a7cd76a1f61189a9bf3d8c39de801522c8631ef0e2889ef1870659731e5c7e3d2714fc06948e1824b48bb69def37b478d93b203e4c64eb
MD5 SHA1 SHA512

Submit Download

blockprovidercomponentreview.exe

Path C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
Size 1.6MB
SHA256 1fee0ec11b24c8382c5e53e7bbb469f9226d06e84600d3d6ef8c890b3aa09438
MD5 3df27ae34cb970a928dab4b290ea18e3
SHA1 cc9a7b65a1e4cf6cd99c5cecea65aebd825f06ad
SHA512 c44194a1e83a309843c01a342f3aea52245bc8ee8684d2b8eb6150a11454368acd6dd783cea8315698f325eafa28ca71967cf5b5c2ca0278203df6ea206b4a61
SSDEEP 24576:8weJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+1JkqvKnGmoD5:8nl71zodgS1U8rZXpb7++IqRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC504E6862626F4F48A68FF246F69957AA.TMP

Path \??\c:\Program Files (x86)\Microsoft\Edge\Application\CSC504E6862626F4F48A68FF246F69957AA.TMP
Size 1KB
SHA256 e1984ba1e3ff8b071f7a320a6f1f18e1d5f4f337d31dc30d5bdfb021df39060f
MD5 b5189fb271be514bec128e0d0809c04e
SHA1 5dd625d27ed30fca234ec097ad66f6c13a7edcbe
SHA512 f0fcb8f97279579beb59f58ea89527ee0d86a64c9de28300f14460bec6c32dda72f0e6466573b6654a1e992421d6fe81ae7cce50f27059f54cf9fdca6953602e
MD5 SHA1 SHA512

Submit Download

k2mu3e3e.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\k2mu3e3e\k2mu3e3e.0.cs
Size 383B
SHA256 e9dc8440439aed76b77e98a599a668186afa1197d2996d96bdef9916331c8a3d
MD5 cb0a48da0669cb431255fdbfa718589c
SHA1 1df86c7ba0033410fa8acf5d3eefc7023c60752d
SHA512 6389782f0a137fc3cf933d714fba10cc977688bca209d874f805ddb4448f8ae50cbd13bd7ef9b5d54929a5aa032b8933d05cd56d950bbdab85f631595c2f6fc1
MD5 SHA1 SHA512

Submit Download

k2mu3e3e.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\k2mu3e3e\k2mu3e3e.cmdline
Size 235B
SHA256 519ea8b83c4f335c0146684e115a1d345e36df0f7c77d593a2cf85ef48511bf5
MD5 49e1a96ec633bf772ea8e8900d5304ba
SHA1 9a602eb8fb183503c01fc25472949cb8fc93bb05
SHA512 b0e1d61a90c066a20f2b8ed5f85f4c49d68b71a4643bdcd44f6bc67051228e102be4db0f9e87824ee641b5e993a072ee92452beda27b98055648a68c4e396d21
MD5 SHA1 SHA512

Submit Download

skcsbgrw.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\skcsbgrw\skcsbgrw.0.cs
Size 413B
SHA256 63da2615fe5d7370d139a9e9b98e0634f95fc1e5970da820ebe5cd5c765c31dc
MD5 482b0f2f900c9d9fe5cd4298646af877
SHA1 4ff5cb5cc854fd6ddcedb0a35ae628090a56b69c
SHA512 cfdd6b1bd4129064191a44c15a34f84133e555db5aaf46faba141b8ddf5069cf93016472ccbec5b847ca38c718e04c27497dd9343da17f6cd53cf450a60977d5
MD5 SHA1 SHA512

Submit Download

skcsbgrw.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\skcsbgrw\skcsbgrw.cmdline
Size 265B
SHA256 4efee621d10f48d77ed5c8599a0a0fc55264d25205cc6424c0034b5f22be62fc
MD5 a6191bed815a5aab4a730559ef795400
SHA1 642064c09b9ee22545b92b4441fa0ea1dcb6ce82
SHA512 377b869f177a5ebc517c3ef97a6a187173c49b8a05c16ad3da218ad510eb20e8860ffe062bf66d2b82edd42f4cb59747037eee41c0c03654ea7581227e182cfc
MD5 SHA1 SHA512

Submit Download

CSC81D87F998C47D3946734921F3C4EA1.TMP

Path \??\c:\Windows\System32\CSC81D87F998C47D3946734921F3C4EA1.TMP
Size 1KB
SHA256 1bf68148c555d0e84720c497dcf3ad708da300ee7472df12c9307a3acd4abde1
MD5 188249e3f31caa0264351fc374794895
SHA1 323a707d1a37ac8cbae6d6e502cc850f69ae2e15
SHA512 28a0d97e83b6b6d10c0114166e8f23845663a34c8f262aa5a31ffb885abe232badb6f95bba99b8688559cac81f8ff93c3609ac363d8903d35f535d7c5e1e02d5
MD5 SHA1 SHA512

Submit Download

memory/1752-16-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/1752-64-0x00007FFE92F50000-0x00007FFE93A11000-memory.dmp

Download

memory/1752-20-0x00007FFEB17F0000-0x00007FFEB17F1000-memory.dmp

Download

memory/1752-19-0x00007FFEB1800000-0x00007FFEB18BE000-memory.dmp

Download

memory/1752-18-0x0000000000F50000-0x0000000000F5E000-memory.dmp

Download

memory/1752-15-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/1752-14-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/1752-13-0x00007FFE92F50000-0x00007FFE93A11000-memory.dmp

Download

memory/1752-12-0x00000000005D0000-0x0000000000772000-memory.dmp

Download

memory/1752-21-0x00007FFEB1800000-0x00007FFEB18BE000-memory.dmp

Download

memory/1752-65-0x00007FFEB1800000-0x00007FFEB18BE000-memory.dmp

Download

memory/2292-69-0x00007FFE92F50000-0x00007FFE93A11000-memory.dmp

Download

memory/2292-70-0x000000001ADD0000-0x000000001ADD1000-memory.dmp

Download

memory/2292-72-0x00007FFEB1800000-0x00007FFEB18BE000-memory.dmp

Download

memory/2292-73-0x00007FFEB17F0000-0x00007FFEB17F1000-memory.dmp

Download

memory/2292-74-0x00007FFEB1800000-0x00007FFEB18BE000-memory.dmp

Download

memory/2292-75-0x00007FFE92F50000-0x00007FFE93A11000-memory.dmp

Download

memory/2292-76-0x00007FFEB1800000-0x00007FFEB18BE000-memory.dmp

Download