zgrat | 5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Size

2.0MB
MD5

9026338fce277581062754cab87462e7
SHA1

191b8d92c18b84fdef03f691583d8b89598cb7da
SHA256

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f
SHA512

8be58979eec71fe69408aa621e756d76b58db496da456dad533fb88ad800ecf8d8e5933baedda4742c1dc4e5095f8fe7c3071f0339b056f54a378adb08908fca
SSDEEP

24576:aSLLyDf1/7HnFZnA83kJTwJiYYfbeQYPXI3IDyVZqVhTEmkz3UzKzMlJ6wwLI:aSXM/dUJ8SDeQYvI3IGmhTZYlwlJJM

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3948-0-0x0000000000310000-0x0000000000512000-memory.dmp	family_zgrat_v1
C:\Users\Default\Downloads\winlogon.exe	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\PLA\\System\\sihost.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\PLA\\System\\sihost.exe\", \"C:\\Users\\Default\\Downloads\\winlogon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\TextInputHost.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\TextInputHost.exe\", \"C:\\Recovery\\WindowsRE\\sysmon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2320	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1184	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5020	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5080	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4636	4472	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	4472	schtasks.exe

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Executes dropped EXE 1 IoCs

Processes:

sihost.exe

pid process

1168 sihost.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1168	sihost.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Microsoft Office\\Updates\\TextInputHost.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Program Files\\Microsoft Office\\Updates\\TextInputHost.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\PLA\\System\\sihost.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Windows\\PLA\\System\\sihost.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default\\Downloads\\winlogon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Users\\Default\\Downloads\\winlogon.exe\""	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

15 ipinfo.io
16 ipinfo.io
65 ipinfo.io

flow	ioc
15	ipinfo.io
16	ipinfo.io
65	ipinfo.io

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	process
File created	\??\c:\Windows\System32\CSC5635A93DFDD449818435975EFA965946.TMP	csc.exe
File created	\??\c:\Windows\System32\12t9_p.exe	csc.exe

Drops file in Program Files directory 2 IoCs

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\Updates\TextInputHost.exe	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
File created	C:\Program Files\Microsoft Office\Updates\22eafd247d37c3	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Drops file in Windows directory 2 IoCs

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

description	ioc	process
File created	C:\Windows\PLA\System\sihost.exe	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
File created	C:\Windows\PLA\System\66fc9ff0ee96c2	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2320	schtasks.exe
2776	schtasks.exe
2428	schtasks.exe
4588	schtasks.exe
4268	schtasks.exe
3032	schtasks.exe
864	schtasks.exe
5020	schtasks.exe
5080	schtasks.exe
3132	schtasks.exe
4552	schtasks.exe
1184	schtasks.exe
4636	schtasks.exe
2040	schtasks.exe
1592	schtasks.exe

Modifies registry class 1 IoCs

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

pid	process
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exesihost.exe

description	pid	process
Token: SeDebugPrivilege	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
Token: SeDebugPrivilege	4192	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	3628	powershell.exe
Token: SeDebugPrivilege	1484	powershell.exe
Token: SeDebugPrivilege	3604	powershell.exe
Token: SeDebugPrivilege	1168	sihost.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.execsc.execmd.exe

description	pid	process	target process
PID 3948 wrote to memory of 4420	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	csc.exe
PID 3948 wrote to memory of 4420	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	csc.exe
PID 4420 wrote to memory of 4356	4420	csc.exe	cvtres.exe
PID 4420 wrote to memory of 4356	4420	csc.exe	cvtres.exe
PID 3948 wrote to memory of 3604	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 3604	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 1484	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 1484	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 4092	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 4092	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 4192	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 4192	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 3628	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 3628	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	powershell.exe
PID 3948 wrote to memory of 3012	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	cmd.exe
PID 3948 wrote to memory of 3012	3948	5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe	cmd.exe
PID 3012 wrote to memory of 4076	3012	cmd.exe	chcp.com
PID 3012 wrote to memory of 4076	3012	cmd.exe	chcp.com
PID 3012 wrote to memory of 5068	3012	cmd.exe	w32tm.exe
PID 3012 wrote to memory of 5068	3012	cmd.exe	w32tm.exe
PID 3012 wrote to memory of 1168	3012	cmd.exe	sihost.exe
PID 3012 wrote to memory of 1168	3012	cmd.exe	sihost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe
"C:\Users\Admin\AppData\Local\Temp\5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wy1xzio3\wy1xzio3.cmdline"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4420

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E41.tmp" "c:\Windows\System32\CSC5635A93DFDD449818435975EFA965946.TMP"
3⤵
PID:4356

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1484

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sysmon.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\PLA\System\sihost.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Downloads\winlogon.exe'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KVxftshWje.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\system32\chcp.com
chcp 65001
3⤵
PID:4076

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:5068

C:\Windows\PLA\System\sihost.exe
"C:\Windows\PLA\System\sihost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 13 /tr "'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 6 /tr "'C:\Program Files\Microsoft Office\Updates\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1184

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Windows\PLA\System\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Windows\PLA\System\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Windows\PLA\System\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Downloads\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Users\Default\Downloads\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 14 /tr "'C:\Users\Default\Downloads\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
35967cf5ed9a95ec4fe527dd96567a02

SHA1
6a7439c241a30ec540d5d204e02a4cbb2a464737

SHA256
4394552922777081d43fb523126cf176d5a676602a5435713320942034f6b3cf

SHA512
419b3c336a67ef964bc166d1267cea146ed5878f98304d6e39fb9a3c0394d75693810a9ddc101cdda5e3196ad7d603df01a3260705cf9ef7cf8d4b252df01f45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\KVxftshWje.bat
Filesize
208B

MD5
f0069c2626c1b4508fcbd1617c1d7835

SHA1
aa4b8b03cc95b9e1a9d71e7e275192857152ca12

SHA256
14af0aa791aabb6b8fa761736175d36f5c16678104e26cd0a658caa1979f360a

SHA512
417474956dc68c7e58852a4524e68ed81b5f2ef56dacf71d8bd6dbe8c0d2912b51e160996ddbcf356ad5e17c00f9b8e7e239d4eba8759397bb69a0800e23d647

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3E41.tmp
Filesize
1KB

MD5
bb4614454c217ba0fffd80abca2559fd

SHA1
634ff35a0b0d714be43f00de6b1abebfbfbe181a

SHA256
d039886b1baae4320604ae114daaf2d90738b62d345f1a88542a392f1935ab95

SHA512
f97bcc74b055a7d6aee67fa5e773378eb529f136e28c3d71e274d3d6de26dafca660815b2bfd883a4233d2ab320893769bd857e9b264b2d1a3e2439c5e00e720

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivaqbifv.xk1.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Default\Downloads\winlogon.exe
Filesize
2.0MB

MD5
9026338fce277581062754cab87462e7

SHA1
191b8d92c18b84fdef03f691583d8b89598cb7da

SHA256
5565710131f195b46fb7c0b124d16df72ec5e0aafdd22590eaff7885aead636f

SHA512
8be58979eec71fe69408aa621e756d76b58db496da456dad533fb88ad800ecf8d8e5933baedda4742c1dc4e5095f8fe7c3071f0339b056f54a378adb08908fca

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wy1xzio3\wy1xzio3.0.cs
Filesize
364B

MD5
d6d7162e3fb2d0d4ad9aed821993f1a5

SHA1
4a64eff67f7c594330139aade3875f6d6d881270

SHA256
85983ea3f2e7ec76e88da1d6b066482653f4cb7a9aea70717767b8e0c3d41d7e

SHA512
6b6d62a9b02eac06fb0f23526056a31d6d218fc3cf3c52385505fb7bcecf3c739e83b2930dfaa190f42ead3c54841f4a5886f2918423e6d740303f92c3c52225

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wy1xzio3\wy1xzio3.cmdline
Filesize
235B

MD5
df68cabab954501e39c549e7b37fcefd

SHA1
f773e6f90bd2230be19d38ddc962b15c0bec2f84

SHA256
ee4bc156bdd730d84668094bc7b0a78e1104ba7e9f772981200769c5691dbdd6

SHA512
71afb049efaa1db0b0f7e372298b5470f24e0abbf47e21472d67e7203ac90a7e70a3585d3c9c46ae3817902fded66958cc883a99ea5e58afffa2d61757af0145

Download Submit
\??\c:\Windows\System32\CSC5635A93DFDD449818435975EFA965946.TMP
Filesize
1KB

MD5
aea5592009f71ee26b76c7abe8cfee35

SHA1
8199ec6bd0fd8c65d4cfae10b57fcddfb00dc678

SHA256
9541b21b121d43cdc09059fdb080c7124722b5a339529036ee0c2c1b71c3a225

SHA512
c28bbf38818ec5492f7c54a9239347e023edb076d7f936e65f2d4d2e1bee1bd8fb94c62d9c4d12f3c4c59e6cff98fe8655941da72afea554069e9f5592934185

Download Submit
memory/1168-157-0x00000000011D0000-0x00000000011D1000-memory.dmp

Filesize
4KB

Download
memory/1168-161-0x00007FFF5D400000-0x00007FFF5D401000-memory.dmp

Filesize
4KB

Download
memory/1168-220-0x000000001BB60000-0x000000001BBCB000-memory.dmp

Filesize
428KB

Download
memory/1168-217-0x000000001BB60000-0x000000001BBCB000-memory.dmp

Filesize
428KB

Download
memory/1168-156-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/1168-158-0x000000001B630000-0x000000001B640000-memory.dmp

Filesize
64KB

Download
memory/1168-186-0x000000001BB60000-0x000000001BBCB000-memory.dmp

Filesize
428KB

Download
memory/1168-162-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/1168-160-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/1484-130-0x00000264F1320000-0x00000264F1330000-memory.dmp

Filesize
64KB

Download
memory/1484-133-0x00000264F1320000-0x00000264F1330000-memory.dmp

Filesize
64KB

Download
memory/1484-124-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/1484-149-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3604-134-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3604-136-0x0000023C59290000-0x0000023C592A0000-memory.dmp

Filesize
64KB

Download
memory/3604-135-0x0000023C59290000-0x0000023C592A0000-memory.dmp

Filesize
64KB

Download
memory/3604-152-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3628-131-0x00000258CABA0000-0x00000258CABB0000-memory.dmp

Filesize
64KB

Download
memory/3628-129-0x00000258CABA0000-0x00000258CABB0000-memory.dmp

Filesize
64KB

Download
memory/3628-118-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3628-144-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-25-0x0000000002660000-0x000000000266E000-memory.dmp

Filesize
56KB

Download
memory/3948-18-0x00007FFF5D3A0000-0x00007FFF5D3A1000-memory.dmp

Filesize
4KB

Download
memory/3948-41-0x00007FFF5D170000-0x00007FFF5D171000-memory.dmp

Filesize
4KB

Download
memory/3948-40-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/3948-39-0x00000000026F0000-0x00000000026FC000-memory.dmp

Filesize
48KB

Download
memory/3948-65-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/3948-70-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/3948-73-0x000000001B880000-0x000000001B8EB000-memory.dmp

Filesize
428KB

Download
memory/3948-1-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-74-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/3948-2-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Filesize
4KB

Download
memory/3948-37-0x00007FFF5D180000-0x00007FFF5D181000-memory.dmp

Filesize
4KB

Download
memory/3948-3-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/3948-4-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/3948-7-0x0000000000E40000-0x0000000000E4E000-memory.dmp

Filesize
56KB

Download
memory/3948-94-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-5-0x00007FFF5D400000-0x00007FFF5D401000-memory.dmp

Filesize
4KB

Download
memory/3948-8-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/3948-36-0x00007FFF5D820000-0x00007FFF5D8DE000-memory.dmp

Filesize
760KB

Download
memory/3948-35-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download
memory/3948-32-0x0000000002680000-0x000000000268E000-memory.dmp

Filesize
56KB

Download
memory/3948-33-0x00007FFF5D360000-0x00007FFF5D361000-memory.dmp

Filesize
4KB

Download
memory/3948-29-0x0000000002670000-0x000000000267C000-memory.dmp

Filesize
48KB

Download
memory/3948-30-0x00007FFF5D370000-0x00007FFF5D371000-memory.dmp

Filesize
4KB

Download
memory/3948-27-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/3948-0-0x0000000000310000-0x0000000000512000-memory.dmp

Filesize
2.0MB

Download
memory/3948-26-0x00007FFF5D380000-0x00007FFF5D381000-memory.dmp

Filesize
4KB

Download
memory/3948-22-0x00007FFF5D390000-0x00007FFF5D391000-memory.dmp

Filesize
4KB

Download
memory/3948-23-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/3948-21-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/3948-20-0x0000000000E60000-0x0000000000E6C000-memory.dmp

Filesize
48KB

Download
memory/3948-17-0x0000000000E50000-0x0000000000E5E000-memory.dmp

Filesize
56KB

Download
memory/3948-11-0x00007FFF5D3C0000-0x00007FFF5D3C1000-memory.dmp

Filesize
4KB

Download
memory/3948-10-0x0000000002620000-0x000000000263C000-memory.dmp

Filesize
112KB

Download
memory/3948-42-0x000000001B0E0000-0x000000001B0F0000-memory.dmp

Filesize
64KB

Download
memory/3948-15-0x0000000002640000-0x0000000002658000-memory.dmp

Filesize
96KB

Download
memory/3948-13-0x00007FFF5D3B0000-0x00007FFF5D3B1000-memory.dmp

Filesize
4KB

Download
memory/3948-12-0x0000000002690000-0x00000000026E0000-memory.dmp

Filesize
320KB

Download
memory/4092-145-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4092-99-0x0000021424A90000-0x0000021424AA0000-memory.dmp

Filesize
64KB

Download
memory/4092-81-0x000002140C7E0000-0x000002140C802000-memory.dmp

Filesize
136KB

Download
memory/4092-97-0x0000021424A90000-0x0000021424AA0000-memory.dmp

Filesize
64KB

Download
memory/4092-75-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4192-146-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4192-98-0x0000021C3DCA0000-0x0000021C3DCB0000-memory.dmp

Filesize
64KB

Download
memory/4192-95-0x0000021C3DCA0000-0x0000021C3DCB0000-memory.dmp

Filesize
64KB

Download
memory/4192-72-0x00007FFF40030000-0x00007FFF40AF1000-memory.dmp

Filesize
10.8MB

Download