zgrat | 81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d

Analysis

max time kernel
129s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15b75648ad8160565cfd4008ae223ce0.exe
Size

1.8MB
MD5

15b75648ad8160565cfd4008ae223ce0
SHA1

2800a25191362b57c9762c74fc668960f11937bc
SHA256

81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d
SHA512

25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b
SSDEEP

24576:pRr3fEcKSoIu4cMlay9GvZsk8ynlK01Pi5LO1K4Bb/8GeAyb1L5ZXMUJcapQKS3L:TAUpQ8yU26a1KU8ZAyb15ea61pFWcig

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/2764-1-0x0000000001260000-0x000000000143A000-memory.dmp	family_zgrat_v1
behavioral1/files/0x0006000000016d29-24.dat	family_zgrat_v1
behavioral1/memory/2072-49-0x0000000000010000-0x00000000001EA000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\", \"C:\\Windows\\Migration\\WTR\\Idle.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\", \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\es-ES\\smss.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\", \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\es-ES\\smss.exe\", \"C:\\Users\\All Users\\Start Menu\\wininit.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\", \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\es-ES\\smss.exe\", \"C:\\Users\\All Users\\Start Menu\\wininit.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsm.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\", \"C:\\Windows\\Migration\\WTR\\Idle.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\es-ES\\smss.exe\", \"C:\\Users\\All Users\\Start Menu\\wininit.exe\", \"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsm.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0.exe\""	15b75648ad8160565cfd4008ae223ce0.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2192	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2728	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2868	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2864	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2196	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1932	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1308	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1976	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2040	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2044	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2344	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	784	2588	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	268	2588	schtasks.exe	28

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
2072	Idle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Migration\\WTR\\Idle.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Sidebar\\es-ES\\smss.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\All Users\\Start Menu\\wininit.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Users\\All Users\\Start Menu\\wininit.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\Idle.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\Migration\\WTR\\Idle.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files (x86)\\Windows Sidebar\\es-ES\\smss.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsm.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\Recovery\\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\\lsm.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0.exe\""	15b75648ad8160565cfd4008ae223ce0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC6BCCD7C08435416D8E47131E6C86CA93.TMP	csc.exe
File created	\??\c:\Windows\System32\u7e72d.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Program Files (x86)\Windows Sidebar\es-ES\69ddcba757bf72	15b75648ad8160565cfd4008ae223ce0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Migration\WTR\Idle.exe	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Windows\Migration\WTR\6ccacd8608530f	15b75648ad8160565cfd4008ae223ce0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2728	schtasks.exe
2864	schtasks.exe
2196	schtasks.exe
2040	schtasks.exe
2044	schtasks.exe
2192	schtasks.exe
2464	schtasks.exe
2868	schtasks.exe
1036	schtasks.exe
592	schtasks.exe
1308	schtasks.exe
1976	schtasks.exe
268	schtasks.exe
1668	schtasks.exe
1932	schtasks.exe
2232	schtasks.exe
2344	schtasks.exe
784	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1684	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2764	15b75648ad8160565cfd4008ae223ce0.exe
2072	Idle.exe
2072	Idle.exe
2072	Idle.exe
2072	Idle.exe
2072	Idle.exe
2072	Idle.exe
2072	Idle.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	15b75648ad8160565cfd4008ae223ce0.exe
Token: SeDebugPrivilege	2072	Idle.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2600	2764	15b75648ad8160565cfd4008ae223ce0.exe	32
PID 2764 wrote to memory of 2600	2764	15b75648ad8160565cfd4008ae223ce0.exe	32
PID 2764 wrote to memory of 2600	2764	15b75648ad8160565cfd4008ae223ce0.exe	32
PID 2600 wrote to memory of 2452	2600	csc.exe	34
PID 2600 wrote to memory of 2452	2600	csc.exe	34
PID 2600 wrote to memory of 2452	2600	csc.exe	34
PID 2764 wrote to memory of 2692	2764	15b75648ad8160565cfd4008ae223ce0.exe	50
PID 2764 wrote to memory of 2692	2764	15b75648ad8160565cfd4008ae223ce0.exe	50
PID 2764 wrote to memory of 2692	2764	15b75648ad8160565cfd4008ae223ce0.exe	50
PID 2692 wrote to memory of 1572	2692	cmd.exe	52
PID 2692 wrote to memory of 1572	2692	cmd.exe	52
PID 2692 wrote to memory of 1572	2692	cmd.exe	52
PID 2692 wrote to memory of 1684	2692	cmd.exe	53
PID 2692 wrote to memory of 1684	2692	cmd.exe	53
PID 2692 wrote to memory of 1684	2692	cmd.exe	53
PID 2692 wrote to memory of 2072	2692	cmd.exe	54
PID 2692 wrote to memory of 2072	2692	cmd.exe	54
PID 2692 wrote to memory of 2072	2692	cmd.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe
"C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0h3eyuss\0h3eyuss.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2EBE.tmp" "c:\Windows\System32\CSC6BCCD7C08435416D8E47131E6C86CA93.TMP"
    3⤵
    PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Zxrt9fY3QQ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:1572
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:1684
- - C:\Windows\Migration\WTR\Idle.exe
    "C:\Windows\Migration\WTR\Idle.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Windows\Migration\WTR\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows Sidebar\es-ES\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Users\All Users\Start Menu\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Users\All Users\Start Menu\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Users\All Users\Start Menu\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 6 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\lsm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsml" /sc MINUTE /mo 9 /tr "'C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\lsm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce01" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce01" /sc MINUTE /mo 10 /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\84917bc2-d02e-11ee-b7c7-ea6b8212ffd3\Idle.exe

Filesize
1.8MB

MD5
15b75648ad8160565cfd4008ae223ce0

SHA1
2800a25191362b57c9762c74fc668960f11937bc

SHA256
81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d

SHA512
25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2EBE.tmp

Filesize
1KB

MD5
621c988ecfe2c3c5ec16dfccb61c6fc9

SHA1
457c840b632011daf28f8fe84889c9cf20d9b4f8

SHA256
afd257d7455d475036d19e141f6768628984a54e66c5ef6c9f984f4792cde110

SHA512
70ca21b95aff8a1ee900b60701a3ebbda82e128b3d4270075595d1209f9bf18f1ae88c05832a3d7947e8e0267d5ec2bfecfde5b48e3c16de74aedde208d1115c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zxrt9fY3QQ.bat

Filesize
161B

MD5
38f864a77c1f27b01c884d547c15f733

SHA1
f8db4473572eb11bcab6363a8b046a75a91dcbe8

SHA256
261889fcb59b0c5588482e3f18ace23a0e39888b0f87696eb6013aed2d48ca35

SHA512
7285477cdddf9b2d04d11c7a0fc9f4445f2613b334ca2acc413ccbef83ae1f564361bdff67d3edb85b6c4b27467be0c70e09bdea92270e73dfcb0a01049c87c7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0h3eyuss\0h3eyuss.0.cs

Filesize
389B

MD5
5af43db4b68ca5aa4ef9aa4e4f7d9457

SHA1
59cb79ebc1e63e0f8d1a36825d010a17545bb619

SHA256
7397c32f32023391e3563ca3483e90445c7fa423238a76c61c2d4c9225fdb7d8

SHA512
2bfac92b297287054d0b19fde573da4c8d78643a8efe8d8420fb4ed1fdcc227a11a5562dc5e319a498cfb309eff3f164345cb00a57a9b34e5a2578cd56374efd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\0h3eyuss\0h3eyuss.cmdline

Filesize
235B

MD5
b9584ade48b65adda073b4b06062d9f8

SHA1
41e11a7a1fdf86c561214ff5ef8732133a35da06

SHA256
324b873656fba3bdbb4a86131c0a0506be6fb9c24c8d75c5e314cb29b0c8db08

SHA512
abd8c4e4d159c70af81f6e290feaec80515900d503df457a9300b882c5919d9d4fe30e2ab5399d7d26128906ffb786bdca9966c8ffa25a17ab910f844009c296

Download Submit
\??\c:\Windows\System32\CSC6BCCD7C08435416D8E47131E6C86CA93.TMP

Filesize
1KB

MD5
984924caf6574026769de34f35c2358e

SHA1
6dd41e492235d812252231912aa025f47fa7a9e7

SHA256
2bf5f65c8161575847113a1b4194625204c6ddce042f9b3432011c31348bb986

SHA512
5918fdc8d27ff5421dea1455df93c6cf85738e94c5079701ba7fded59b01bda482b70e2a500ba2c2aebedb6d2b0815d094d9bb271133de738f9e630167f6be46

Download Submit
memory/2072-49-0x0000000000010000-0x00000000001EA000-memory.dmp

Filesize
1.9MB

Download
memory/2764-6-0x0000000000280000-0x000000000028E000-memory.dmp

Filesize
56KB

Download
memory/2764-28-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-13-0x0000000000290000-0x000000000029C000-memory.dmp

Filesize
48KB

Download
memory/2764-14-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-8-0x00000000002B0000-0x00000000002CC000-memory.dmp

Filesize
112KB

Download
memory/2764-26-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-27-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-11-0x0000000000370000-0x0000000000388000-memory.dmp

Filesize
96KB

Download
memory/2764-9-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-0-0x000007FEF59F3000-0x000007FEF59F4000-memory.dmp

Filesize
4KB

Download
memory/2764-4-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-3-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-2-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-46-0x000007FEF59F0000-0x000007FEF63DC000-memory.dmp

Filesize
9.9MB

Download
memory/2764-1-0x0000000001260000-0x000000000143A000-memory.dmp

Filesize
1.9MB

Download