zgrat | 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9A495517949AA4F4112EDA7460B6903C.exe
Size 1.9MB
Sample240302-rfmagaeb3t
SHA256 137f811a64808946b6f03fa54450fa9a4fe77eacfb7afa39f0a1a7a1ce659a60
MD5 9a495517949aa4f4112eda7460b6903c
SHA1 2903a362bbde234152a8f12bc5ed028e3231538b
SHA512 bc7d5c93156f2a1fc47553e0f8455cb66aa1e02d352707d5925c23a0cc78195adcc4f0c059a49edf14f3fd6079cf0c5caac397aea9456aefab5684fffc525128
SSDEEP 24576:2TbBv5rUyXVNweJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+T:IBJNnl71zodgS1U8rZXpb7++IqRXz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

zgrat evasion persistence rat

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002318a-10.dat	family_zgrat_v1
behavioral2/memory/1236-12-0x00000000004D0000-0x0000000000672000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\", \"C:\\Users\\Public\\Music\\System.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Users\\Default User\\SppExtComObj.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Users\\Default User\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\", \"C:\\Users\\Public\\Music\\System.exe\", \"C:\\Recovery\\WindowsRE\\upfc.exe\", \"C:\\Users\\Default User\\SppExtComObj.exe\", \"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\", \"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4032	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4316	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3220	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2656	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4076	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1412	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2740	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2932	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4284	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3948	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1440	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4796	3204	schtasks.exe	98
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	3204	schtasks.exe	98

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Disables Task Manager via registry modification
evasion

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	9A495517949AA4F4112EDA7460B6903C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	blockprovidercomponentreview.exe

Executes dropped EXE 2 IoCs

pid	Process
1236	blockprovidercomponentreview.exe
2748	dwm.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Default User\\SppExtComObj.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\blockprovidercomponentreview = "\"C:\\Users\\Admin\\AppData\\Roaming\\PortProvider\\blockprovidercomponentreview.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Music\\System.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Recovery\\WindowsRE\\upfc.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Users\\Default User\\SppExtComObj.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Reference Assemblies\\RuntimeBroker.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\fr-FR\\dwm.exe\""	blockprovidercomponentreview.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\Public\\Music\\System.exe\""	blockprovidercomponentreview.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC2B3C10F4587F4EE585A7915EA3CE6D25.TMP	csc.exe
File created	\??\c:\Windows\System32\wezuc9.exe	csc.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Reference Assemblies\RuntimeBroker.exe	blockprovidercomponentreview.exe
File opened for modification	C:\Program Files\Reference Assemblies\RuntimeBroker.exe	blockprovidercomponentreview.exe
File created	C:\Program Files\Reference Assemblies\9e8d7a4ca61bd9	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dwm.exe	blockprovidercomponentreview.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\fr-FR\6cb0b6c459d5d3	blockprovidercomponentreview.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Boot\DVD\PCAT\conhost.exe	blockprovidercomponentreview.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4032	schtasks.exe
4316	schtasks.exe
4076	schtasks.exe
1412	schtasks.exe
4796	schtasks.exe
3096	schtasks.exe
2740	schtasks.exe
4832	schtasks.exe
4696	schtasks.exe
2956	schtasks.exe
2932	schtasks.exe
4284	schtasks.exe
3948	schtasks.exe
1440	schtasks.exe
3220	schtasks.exe
2656	schtasks.exe
2720	schtasks.exe
2360	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	9A495517949AA4F4112EDA7460B6903C.exe
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	blockprovidercomponentreview.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4264	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4396	PING.EXE

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
1236	blockprovidercomponentreview.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe
2748	dwm.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	blockprovidercomponentreview.exe
Token: SeDebugPrivilege	2748	dwm.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2060	2624	9A495517949AA4F4112EDA7460B6903C.exe	91
PID 2624 wrote to memory of 2060	2624	9A495517949AA4F4112EDA7460B6903C.exe	91
PID 2624 wrote to memory of 2060	2624	9A495517949AA4F4112EDA7460B6903C.exe	91
PID 2060 wrote to memory of 2552	2060	WScript.exe	94
PID 2060 wrote to memory of 2552	2060	WScript.exe	94
PID 2060 wrote to memory of 2552	2060	WScript.exe	94
PID 2552 wrote to memory of 4264	2552	cmd.exe	96
PID 2552 wrote to memory of 4264	2552	cmd.exe	96
PID 2552 wrote to memory of 4264	2552	cmd.exe	96
PID 2552 wrote to memory of 1236	2552	cmd.exe	97
PID 2552 wrote to memory of 1236	2552	cmd.exe	97
PID 1236 wrote to memory of 3380	1236	blockprovidercomponentreview.exe	102
PID 1236 wrote to memory of 3380	1236	blockprovidercomponentreview.exe	102
PID 3380 wrote to memory of 4944	3380	csc.exe	104
PID 3380 wrote to memory of 4944	3380	csc.exe	104
PID 1236 wrote to memory of 5076	1236	blockprovidercomponentreview.exe	120
PID 1236 wrote to memory of 5076	1236	blockprovidercomponentreview.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe
"C:\Users\Admin\AppData\Local\Temp\9A495517949AA4F4112EDA7460B6903C.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat" "
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:4264
  - - C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
      "C:\Users\Admin\AppData\Roaming\PortProvider/blockprovidercomponentreview.exe"
      4⤵
      Modifies WinLogon for persistence
      Checks computer location settings
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1236
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aqqenu1j\aqqenu1j.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3380
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA0C4.tmp" "c:\Windows\System32\CSC2B3C10F4587F4EE585A7915EA3CE6D25.TMP"
        6⤵
        
        PID:4944
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hP307H76Et.bat"
        5⤵
        
        PID:5076
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:1400
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:4396
      - C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dwm.exe
        
        "C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dwm.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Photo Viewer\fr-FR\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\Public\Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Users\Public\Music\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2740

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreview" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "blockprovidercomponentreviewb" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA0C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA0C4.tmp
Size 1KB
SHA256 2614f11725d5a86afed3da0c65349f1597bf0c962965c4d8596f3d5d7473cc18
MD5 8a4f30c8e382b62bbeba44c6252b7146
SHA1 e03594291ce685ae49ba7bb38b425ea950299ad7
SHA512 fe622390bc183bc49e8eeb3a672ebe46daa436387ab45026c22cef21e3e3fbd779e3d86e2d1a0e8bc5c36b44f805453924001fd64a4ad98b9fa7ebf277b48555
MD5 SHA1 SHA512

Submit Download

BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat

Path C:\Users\Admin\AppData\Roaming\PortProvider\BUCYdXdBqjiHoqAbv0mbdlZThQaACdO5DnnKmo2kaGCknouSO.bat
Size 199B
SHA256 fcd1252465f440248ccf4375f9f27c79d44a9f096e732ce39e63a6b7260c6bc8
MD5 cf3c88c160c5fce5a7cab7a94a8b6ba3
SHA1 8cec4cc3347bab81f47700dc8144e885ff44d69e
SHA512 d91ac93c6f6c04a79ffb791ba3e3b88780081e774afe1ffd5fd6b6435fe19a56647ddd292db8e6f72a6e8723d0bb1c64ceea9ffa13a21e1280ea04835fc60ad4
MD5 SHA1 SHA512

Submit Download

DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe

Path C:\Users\Admin\AppData\Roaming\PortProvider\DzCwpCkJdr4koY7MC7MVjsek9PHrJLIJ9gAk8e9Xk.vbe
Size 247B
SHA256 69bfc93ec86b53320016e735c354f7f06666d30598c05fb40d0589b29a9b88ee
MD5 51e5afa5fa9c00bbcf1db9d18b3b9184
SHA1 f3a880c1e068c07f9ba2973840c9f26886d714b2
SHA512 020b68e028b33acc23a7cd76a1f61189a9bf3d8c39de801522c8631ef0e2889ef1870659731e5c7e3d2714fc06948e1824b48bb69def37b478d93b203e4c64eb
MD5 SHA1 SHA512

Submit Download

blockprovidercomponentreview.exe

Path C:\Users\Admin\AppData\Roaming\PortProvider\blockprovidercomponentreview.exe
Size 1.6MB
SHA256 1fee0ec11b24c8382c5e53e7bbb469f9226d06e84600d3d6ef8c890b3aa09438
MD5 3df27ae34cb970a928dab4b290ea18e3
SHA1 cc9a7b65a1e4cf6cd99c5cecea65aebd825f06ad
SHA512 c44194a1e83a309843c01a342f3aea52245bc8ee8684d2b8eb6150a11454368acd6dd783cea8315698f325eafa28ca71967cf5b5c2ca0278203df6ea206b4a61
SSDEEP 24576:8weJZ7rsW7aB61THQZEDLRBoQwexZS1U1Cr2Egkfu6XFTLbB5xo+1JkqvKnGmoD5:8nl71zodgS1U8rZXpb7++IqRX
MD5 SHA1 SHA512 SSDEEP

Submit Download

aqqenu1j.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aqqenu1j\aqqenu1j.0.cs
Size 389B
SHA256 6190c66b4f86aed5b84444bb734f0738cdb0670098106cd68fb398b06f6f3add
MD5 269a1e7964c18cf4aca657612077133b
SHA1 410c565cd93ea9b61782b3a5ddcb9983db7fc6c5
SHA512 fdb7aa34d491271a8ec4b4b7825936419b886ef36846fec59dcc5235544f50079ce7b46f8499e00fed9d0b65100718d6b311db206478cfec4711259f8a86a89b
MD5 SHA1 SHA512

Submit Download

aqqenu1j.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aqqenu1j\aqqenu1j.cmdline
Size 235B
SHA256 5bbd4dbf16e18bfd4547236507ca7d10bcef47b2211a55b09828c7784c8121be
MD5 75f8434ed6970a44daaa8aadf0c37c8c
SHA1 25b321b67d29a9cfb609f0f44eb74d84a9cb1682
SHA512 f2f288e3f106fc0ca99c148a91aeac60f94482825d46617c7dec52e0b211e747af5a9e781bd5c4c8c68965ced4e488af7dbbeec4d3ce5c5b76b1ee563fdcfe2c
MD5 SHA1 SHA512

Submit Download

CSC2B3C10F4587F4EE585A7915EA3CE6D25.TMP

Path \??\c:\Windows\System32\CSC2B3C10F4587F4EE585A7915EA3CE6D25.TMP
Size 1KB
SHA256 52d3d04552662aaa188ceb209548cc034e47949a5a790a1f5d6b442694a144ae
MD5 25b0924c6fa0a93e5a796fc9523602f1
SHA1 2491e1b75bd4f12ff9b2e202abf37282898df725
SHA512 abaaaa6754e451f730cd6c52ba6a74bae56c15fd98fdf371425afab58bae4c027c7b230f00ddef1239e1f777051c57aa3a11e71511b6e6f155d24b32c87981d8
MD5 SHA1 SHA512

Submit Download

memory/1236-51-0x00007FFA7C000000-0x00007FFA7C0BE000-memory.dmp

Download

memory/1236-18-0x00007FFA7C000000-0x00007FFA7C0BE000-memory.dmp

Download

memory/1236-19-0x00007FFA7C000000-0x00007FFA7C0BE000-memory.dmp

Download

memory/1236-20-0x00007FFA7BFF0000-0x00007FFA7BFF1000-memory.dmp

Download

memory/1236-21-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/1236-17-0x0000000002840000-0x000000000284E000-memory.dmp

Download

memory/1236-15-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/1236-14-0x000000001B3B0000-0x000000001B3C0000-memory.dmp

Download

memory/1236-13-0x00007FFA5ED80000-0x00007FFA5F841000-memory.dmp

Download

memory/1236-12-0x00000000004D0000-0x0000000000672000-memory.dmp

Download

memory/1236-52-0x00007FFA5ED80000-0x00007FFA5F841000-memory.dmp

Download

memory/2748-57-0x0000000000EC0000-0x0000000000EC1000-memory.dmp

Download

memory/2748-63-0x00007FFA5ED80000-0x00007FFA5F841000-memory.dmp

Download

memory/2748-55-0x00007FFA5ED80000-0x00007FFA5F841000-memory.dmp

Download

memory/2748-58-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/2748-60-0x00007FFA7C000000-0x00007FFA7C0BE000-memory.dmp

Download

memory/2748-61-0x00007FFA7BFF0000-0x00007FFA7BFF1000-memory.dmp

Download

memory/2748-62-0x00007FFA7C000000-0x00007FFA7C0BE000-memory.dmp

Download

memory/2748-56-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/2748-64-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/2748-65-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/2748-66-0x00007FFA7C000000-0x00007FFA7C0BE000-memory.dmp

Download

memory/2748-67-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/2748-68-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download

memory/2748-69-0x000000001B3A0000-0x000000001B3B0000-memory.dmp

Download