Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2024 00:13
Static task
static1
Behavioral task
behavioral1
Sample
e04e60efc406faefb13b0fd319e2251f.exe
Resource
win7-20231129-en
General
-
Target
e04e60efc406faefb13b0fd319e2251f.exe
-
Size
632KB
-
MD5
e04e60efc406faefb13b0fd319e2251f
-
SHA1
9e0f221915f81e639a52eeaf76dc96f95ab05e4d
-
SHA256
61cb3345fb32835c6be148fbcd92812c80cc168affea782936055ff62ca4dd4b
-
SHA512
07b848691b0976b40411672b98030de36b4f10f1181f248f3150600a336cf3461ba1a2af2484399d2c43faeb5c474146edb206430990ca90f36684444cb77485
-
SSDEEP
12288:0pacPt3R/dbmXv4k8OIpLaNrv/TFUVo6QyPa+DAB3YWLSiRw3K:K1KXL8hYFv/TmnibBzdp
Malware Config
Extracted
nanocore
1.2.2.0
sys2021.linkpc.net:11940
23.94.82.41:11940
de7e01ad-963b-4e14-81aa-08dfb351f0fe
-
activate_away_mode
false
-
backup_connection_host
23.94.82.41
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2021-04-24T08:14:59.254967636Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
11940
-
default_group
Do
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
de7e01ad-963b-4e14-81aa-08dfb351f0fe
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
sys2021.linkpc.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
asyncrat
0.5.2
sys2021.linkpc.net:6606
cd6-c2e0e3fbeef6
-
delay
0
-
install
true
-
install_file
notepad.exe
-
install_folder
%AppData%
Signatures
-
Contains code to disable Windows Defender 3 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exe disable_win_def behavioral2/memory/3576-1992-0x0000000000CA0000-0x0000000000CC4000-memory.dmp disable_win_def C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exe disable_win_def -
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/2768-51-0x0000000006880000-0x00000000068F4000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-52-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-53-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-55-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-57-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-59-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-61-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-63-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-65-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-67-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-69-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-71-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-73-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-75-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-77-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-79-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-81-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-83-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-85-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-87-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-89-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-91-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-93-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-95-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-97-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-99-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-101-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-103-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-105-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-107-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-109-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-111-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-113-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 behavioral2/memory/2768-115-0x0000000006880000-0x00000000068EE000-memory.dmp family_zgrat_v1 -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\google\\chrome.exe\"," e04e60efc406faefb13b0fd319e2251f.exe -
Async RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exe family_asyncrat C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exe family_asyncrat -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Edthlzkghxuafibmavvextdclient startup.exeWScript.exee04e60efc406faefb13b0fd319e2251f.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation Edthlzkghxuafibmavvextdclient startup.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation e04e60efc406faefb13b0fd319e2251f.exe Key value queried \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 2 IoCs
Processes:
Edthlzkghxuafibmavvextdclient startup.exenotepad.exepid process 3576 Edthlzkghxuafibmavvextdclient startup.exe 3332 notepad.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Manager = "C:\\Program Files (x86)\\ARP Manager\\arpmgr.exe" e04e60efc406faefb13b0fd319e2251f.exe -
Processes:
e04e60efc406faefb13b0fd319e2251f.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA e04e60efc406faefb13b0fd319e2251f.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exedescription pid process target process PID 2768 set thread context of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe -
Drops file in Program Files directory 2 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exedescription ioc process File created C:\Program Files (x86)\ARP Manager\arpmgr.exe e04e60efc406faefb13b0fd319e2251f.exe File opened for modification C:\Program Files (x86)\ARP Manager\arpmgr.exe e04e60efc406faefb13b0fd319e2251f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 2 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exeEdthlzkghxuafibmavvextdclient startup.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings e04e60efc406faefb13b0fd319e2251f.exe Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\Local Settings Edthlzkghxuafibmavvextdclient startup.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exee04e60efc406faefb13b0fd319e2251f.exee04e60efc406faefb13b0fd319e2251f.exeEdthlzkghxuafibmavvextdclient startup.exenotepad.exepid process 1968 powershell.exe 1968 powershell.exe 1588 powershell.exe 1588 powershell.exe 1588 powershell.exe 2768 e04e60efc406faefb13b0fd319e2251f.exe 2768 e04e60efc406faefb13b0fd319e2251f.exe 4012 e04e60efc406faefb13b0fd319e2251f.exe 4012 e04e60efc406faefb13b0fd319e2251f.exe 4012 e04e60efc406faefb13b0fd319e2251f.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3576 Edthlzkghxuafibmavvextdclient startup.exe 3332 notepad.exe 3332 notepad.exe 3332 notepad.exe 3332 notepad.exe 3332 notepad.exe 3332 notepad.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exepid process 4012 e04e60efc406faefb13b0fd319e2251f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1968 powershell.exe Token: SeIncreaseQuotaPrivilege 1968 powershell.exe Token: SeSecurityPrivilege 1968 powershell.exe Token: SeTakeOwnershipPrivilege 1968 powershell.exe Token: SeLoadDriverPrivilege 1968 powershell.exe Token: SeSystemProfilePrivilege 1968 powershell.exe Token: SeSystemtimePrivilege 1968 powershell.exe Token: SeProfSingleProcessPrivilege 1968 powershell.exe Token: SeIncBasePriorityPrivilege 1968 powershell.exe Token: SeCreatePagefilePrivilege 1968 powershell.exe Token: SeBackupPrivilege 1968 powershell.exe Token: SeRestorePrivilege 1968 powershell.exe Token: SeShutdownPrivilege 1968 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeSystemEnvironmentPrivilege 1968 powershell.exe Token: SeRemoteShutdownPrivilege 1968 powershell.exe Token: SeUndockPrivilege 1968 powershell.exe Token: SeManageVolumePrivilege 1968 powershell.exe Token: 33 1968 powershell.exe Token: 34 1968 powershell.exe Token: 35 1968 powershell.exe Token: 36 1968 powershell.exe Token: SeIncreaseQuotaPrivilege 1968 powershell.exe Token: SeSecurityPrivilege 1968 powershell.exe Token: SeTakeOwnershipPrivilege 1968 powershell.exe Token: SeLoadDriverPrivilege 1968 powershell.exe Token: SeSystemProfilePrivilege 1968 powershell.exe Token: SeSystemtimePrivilege 1968 powershell.exe Token: SeProfSingleProcessPrivilege 1968 powershell.exe Token: SeIncBasePriorityPrivilege 1968 powershell.exe Token: SeCreatePagefilePrivilege 1968 powershell.exe Token: SeBackupPrivilege 1968 powershell.exe Token: SeRestorePrivilege 1968 powershell.exe Token: SeShutdownPrivilege 1968 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeSystemEnvironmentPrivilege 1968 powershell.exe Token: SeRemoteShutdownPrivilege 1968 powershell.exe Token: SeUndockPrivilege 1968 powershell.exe Token: SeManageVolumePrivilege 1968 powershell.exe Token: 33 1968 powershell.exe Token: 34 1968 powershell.exe Token: 35 1968 powershell.exe Token: 36 1968 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeIncreaseQuotaPrivilege 1588 powershell.exe Token: SeSecurityPrivilege 1588 powershell.exe Token: SeTakeOwnershipPrivilege 1588 powershell.exe Token: SeLoadDriverPrivilege 1588 powershell.exe Token: SeSystemProfilePrivilege 1588 powershell.exe Token: SeSystemtimePrivilege 1588 powershell.exe Token: SeProfSingleProcessPrivilege 1588 powershell.exe Token: SeIncBasePriorityPrivilege 1588 powershell.exe Token: SeCreatePagefilePrivilege 1588 powershell.exe Token: SeBackupPrivilege 1588 powershell.exe Token: SeRestorePrivilege 1588 powershell.exe Token: SeShutdownPrivilege 1588 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeSystemEnvironmentPrivilege 1588 powershell.exe Token: SeRemoteShutdownPrivilege 1588 powershell.exe Token: SeUndockPrivilege 1588 powershell.exe Token: SeManageVolumePrivilege 1588 powershell.exe Token: 33 1588 powershell.exe Token: 34 1588 powershell.exe Token: 35 1588 powershell.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
e04e60efc406faefb13b0fd319e2251f.exeWScript.exeEdthlzkghxuafibmavvextdclient startup.exeWScript.exedescription pid process target process PID 2768 wrote to memory of 1968 2768 e04e60efc406faefb13b0fd319e2251f.exe powershell.exe PID 2768 wrote to memory of 1968 2768 e04e60efc406faefb13b0fd319e2251f.exe powershell.exe PID 2768 wrote to memory of 1968 2768 e04e60efc406faefb13b0fd319e2251f.exe powershell.exe PID 2768 wrote to memory of 1588 2768 e04e60efc406faefb13b0fd319e2251f.exe powershell.exe PID 2768 wrote to memory of 1588 2768 e04e60efc406faefb13b0fd319e2251f.exe powershell.exe PID 2768 wrote to memory of 1588 2768 e04e60efc406faefb13b0fd319e2251f.exe powershell.exe PID 2768 wrote to memory of 4432 2768 e04e60efc406faefb13b0fd319e2251f.exe WScript.exe PID 2768 wrote to memory of 4432 2768 e04e60efc406faefb13b0fd319e2251f.exe WScript.exe PID 2768 wrote to memory of 4432 2768 e04e60efc406faefb13b0fd319e2251f.exe WScript.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 2768 wrote to memory of 4012 2768 e04e60efc406faefb13b0fd319e2251f.exe e04e60efc406faefb13b0fd319e2251f.exe PID 4432 wrote to memory of 3576 4432 WScript.exe Edthlzkghxuafibmavvextdclient startup.exe PID 4432 wrote to memory of 3576 4432 WScript.exe Edthlzkghxuafibmavvextdclient startup.exe PID 3576 wrote to memory of 4788 3576 Edthlzkghxuafibmavvextdclient startup.exe WScript.exe PID 3576 wrote to memory of 4788 3576 Edthlzkghxuafibmavvextdclient startup.exe WScript.exe PID 4788 wrote to memory of 512 4788 WScript.exe schtasks.exe PID 4788 wrote to memory of 512 4788 WScript.exe schtasks.exe PID 3576 wrote to memory of 3332 3576 Edthlzkghxuafibmavvextdclient startup.exe notepad.exe PID 3576 wrote to memory of 3332 3576 Edthlzkghxuafibmavvextdclient startup.exe notepad.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e04e60efc406faefb13b0fd319e2251f.exe"C:\Users\Admin\AppData\Local\Temp\e04e60efc406faefb13b0fd319e2251f.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.82⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.82⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Vzvcyragywwvopuhbwi.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exe"C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tmpBCC3.tmp.vbs"4⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc onlogon /rl highest /tn notepad.exe /tr "C:\Users\Admin\AppData\Roaming\notepad.exe5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\notepad.exe"C:\Users\Admin\AppData\Roaming\notepad.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\e04e60efc406faefb13b0fd319e2251f.exeC:\Users\Admin\AppData\Local\Temp\e04e60efc406faefb13b0fd319e2251f.exe2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\e04e60efc406faefb13b0fd319e2251f.exe.logFilesize
1KB
MD57ebe314bf617dc3e48b995a6c352740c
SHA1538f643b7b30f9231a3035c448607f767527a870
SHA25648178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8
SHA5120ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD50774a05ce5ee4c1af7097353c9296c62
SHA1658ff96b111c21c39d7ad5f510fb72f9762114bb
SHA256d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4
SHA512104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5b7786073f65c2079779b6c6fe9532411
SHA194fd5c9512edc3fdc880b35b9630654fbd4961e6
SHA2563286467c46ad5c1672531fdca2de73f672fb3224cba9ec6124072a2f4d133934
SHA5129f8806cf5222b8aaca2f23a017a7db510d710612cbd96ced542cb3a5cbd09cb1437ca94c419c6e6a7895dcace5ffc2b00bee254aeb3a07928e5c45fdedc8ec0e
-
C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exeFilesize
64KB
MD5f5847b7c3f0867e3cdb33a14a40447fd
SHA1ed5ccaa5062257f4ffee344496cff427fff98c59
SHA2562bdada87b2d838d6b383c1705a0f1393fb0cc7b56af83fe80a1a9edd98164cf6
SHA512a74fa23ab033badf04051a05f24550447071897c5d9cb65b6181cac27b5762317c9fa8e5399954be503b4e40f055d9e7b8db0d592f7e31f98ba8e34d9b04a02f
-
C:\Users\Admin\AppData\Local\Temp\Edthlzkghxuafibmavvextdclient startup.exeFilesize
119KB
MD57c065aaedcccc8330d30dd098e2d080a
SHA1d8e1a9251e02062264229d2b92366b33cba3615e
SHA2568892f38077963d30d807e405177ca889e327e447473066ba7dbddacc58a5562c
SHA512a193e0f337a16965726b0481324eda249e9f53ab0d24b48d63d736be35ff7208cab29fb6a5a6fc7c31dc34ddbba5423a2d4d4c1ecaf1f50c29f336c1fcb12469
-
C:\Users\Admin\AppData\Local\Temp\Vzvcyragywwvopuhbwi.vbsFilesize
125B
MD5e43caabb477eff9358b404c0658ea4b8
SHA1ff9530a0a971b26d85323abe290427a32f135fe4
SHA256796965acba70efdb0bc8d6633f5d35e745ce49d09f6600d8ff151545563c9430
SHA5127eb32002d2a08d9342020bb0f073d21772f9569b9133a0f36334f3acaaefab2aab8c52f3b27ee4fc23148bab3ebd8cbdc15f7a1656ae9bf67997e3cc891383a8
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bams1sm3.4ed.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpBCC3.tmp.vbsFilesize
216B
MD53fd8d047dc23e8fe24f9cf58c7cd2b55
SHA157cf93639c8ed34f5bc06c4a7d795d712d3b8648
SHA2564b207de241dc5c2ae5904d574fcccfbd2a85153c7b13f667055e96d15ad9eaec
SHA5125d36a0ac43f312f8a6fc51e290aa56c687b1ff9a813f87a3f019452fc4db2a25ecb7596eda917db2748257c6d814eb14668b8ba16a1f630f0ae36723a6a35d8b
-
memory/1588-31-0x0000000002290000-0x00000000022A0000-memory.dmpFilesize
64KB
-
memory/1588-30-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/1588-49-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/1968-25-0x0000000006120000-0x000000000616C000-memory.dmpFilesize
304KB
-
memory/1968-26-0x0000000007090000-0x0000000007126000-memory.dmpFilesize
600KB
-
memory/1968-13-0x0000000005A40000-0x0000000005AA6000-memory.dmpFilesize
408KB
-
memory/1968-8-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/1968-23-0x0000000005BB0000-0x0000000005F04000-memory.dmpFilesize
3.3MB
-
memory/1968-24-0x00000000060D0000-0x00000000060EE000-memory.dmpFilesize
120KB
-
memory/1968-6-0x0000000002790000-0x00000000027C6000-memory.dmpFilesize
216KB
-
memory/1968-12-0x00000000059D0000-0x0000000005A36000-memory.dmpFilesize
408KB
-
memory/1968-27-0x00000000065D0000-0x00000000065EA000-memory.dmpFilesize
104KB
-
memory/1968-28-0x0000000006620000-0x0000000006642000-memory.dmpFilesize
136KB
-
memory/1968-29-0x0000000008310000-0x000000000898A000-memory.dmpFilesize
6.5MB
-
memory/1968-11-0x0000000005830000-0x0000000005852000-memory.dmpFilesize
136KB
-
memory/1968-9-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/1968-10-0x00000000051C0000-0x00000000057E8000-memory.dmpFilesize
6.2MB
-
memory/1968-7-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/1968-45-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/2768-79-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-103-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-32-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/2768-50-0x00000000067E0000-0x0000000006854000-memory.dmpFilesize
464KB
-
memory/2768-51-0x0000000006880000-0x00000000068F4000-memory.dmpFilesize
464KB
-
memory/2768-52-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-53-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-55-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-57-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-59-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-61-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-63-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-65-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-67-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-69-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-71-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-73-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-75-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-77-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-91-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-1-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/2768-0-0x0000000000AE0000-0x0000000000B84000-memory.dmpFilesize
656KB
-
memory/2768-85-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-87-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-89-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-83-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-93-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-95-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-97-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-99-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-101-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-46-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB
-
memory/2768-105-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-107-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-109-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-111-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-113-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-115-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-5-0x00000000055A0000-0x00000000055AA000-memory.dmpFilesize
40KB
-
memory/2768-4-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB
-
memory/2768-1985-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/2768-81-0x0000000006880000-0x00000000068EE000-memory.dmpFilesize
440KB
-
memory/2768-2-0x0000000005AC0000-0x0000000006064000-memory.dmpFilesize
5.6MB
-
memory/2768-3-0x00000000055B0000-0x0000000005642000-memory.dmpFilesize
584KB
-
memory/3332-2019-0x00007FFCA83B0000-0x00007FFCA8E71000-memory.dmpFilesize
10.8MB
-
memory/3332-2024-0x000000001AFD0000-0x000000001AFE0000-memory.dmpFilesize
64KB
-
memory/3332-2023-0x00007FFCA83B0000-0x00007FFCA8E71000-memory.dmpFilesize
10.8MB
-
memory/3332-2020-0x000000001AFD0000-0x000000001AFE0000-memory.dmpFilesize
64KB
-
memory/3576-1993-0x00007FFCA83B0000-0x00007FFCA8E71000-memory.dmpFilesize
10.8MB
-
memory/3576-1999-0x000000001BA40000-0x000000001BA50000-memory.dmpFilesize
64KB
-
memory/3576-2018-0x00007FFCA83B0000-0x00007FFCA8E71000-memory.dmpFilesize
10.8MB
-
memory/3576-1992-0x0000000000CA0000-0x0000000000CC4000-memory.dmpFilesize
144KB
-
memory/4012-1987-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4012-1997-0x0000000005120000-0x000000000513E000-memory.dmpFilesize
120KB
-
memory/4012-1998-0x0000000005D10000-0x0000000005D1A000-memory.dmpFilesize
40KB
-
memory/4012-1996-0x0000000005110000-0x000000000511A000-memory.dmpFilesize
40KB
-
memory/4012-1986-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/4012-2021-0x0000000075070000-0x0000000075820000-memory.dmpFilesize
7.7MB
-
memory/4012-2022-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB
-
memory/4012-1990-0x0000000005010000-0x00000000050AC000-memory.dmpFilesize
624KB
-
memory/4012-1991-0x0000000004F00000-0x0000000004F10000-memory.dmpFilesize
64KB