zgrat | 81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15b75648ad8160565cfd4008ae223ce0.exe
Size

1.8MB
MD5

15b75648ad8160565cfd4008ae223ce0
SHA1

2800a25191362b57c9762c74fc668960f11937bc
SHA256

81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d
SHA512

25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b
SSDEEP

24576:pRr3fEcKSoIu4cMlay9GvZsk8ynlK01Pi5LO1K4Bb/8GeAyb1L5ZXMUJcapQKS3L:TAUpQ8yU26a1KU8ZAyb15ea61pFWcig

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/1660-1-0x0000000000430000-0x000000000060A000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000a000000023ba3-26.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\Fonts\\sppsvc.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\Fonts\\sppsvc.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhostw.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\Fonts\\sppsvc.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\Fonts\\sppsvc.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\Windows\\en-US\\sppsvc.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\sysmon.exe\", \"C:\\Windows\\Fonts\\sppsvc.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhostw.exe\", \"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\", \"C:\\Windows\\en-US\\sppsvc.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0.exe\""	15b75648ad8160565cfd4008ae223ce0.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3804	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3500	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3472	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3896	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2360	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5052	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2556	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4180	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2876	4180	schtasks.exe	85

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	15b75648ad8160565cfd4008ae223ce0.exe

Executes dropped EXE 1 IoCs

pid	Process
3044	sppsvc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Fonts\\sppsvc.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\backgroundTaskHost = "\"C:\\Program Files (x86)\\Windows NT\\Accessories\\en-US\\backgroundTaskHost.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\en-US\\sppsvc.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Recovery\\WindowsRE\\sysmon.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\Fonts\\sppsvc.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhostw.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files (x86)\\Internet Explorer\\fr-FR\\taskhostw.exe\""	15b75648ad8160565cfd4008ae223ce0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Windows\\en-US\\sppsvc.exe\""	15b75648ad8160565cfd4008ae223ce0.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCB796E1A5B43E47C2A2C05F13D11B6848.TMP	csc.exe
File created	\??\c:\Windows\System32\wj3gg0.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\en-US\eddb19405b7ce1	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\taskhostw.exe	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Program Files (x86)\Internet Explorer\fr-FR\ea9f0e6c9e2dcd	15b75648ad8160565cfd4008ae223ce0.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\en-US\sppsvc.exe	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Windows\en-US\0a1fd5f707cd16	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Windows\Fonts\sppsvc.exe	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Windows\Fonts\0a1fd5f707cd16	15b75648ad8160565cfd4008ae223ce0.exe
File created	C:\Windows\en-US\sppsvc.exe	15b75648ad8160565cfd4008ae223ce0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3804	schtasks.exe
3500	schtasks.exe
2460	schtasks.exe
3472	schtasks.exe
3896	schtasks.exe
3476	schtasks.exe
1076	schtasks.exe
2700	schtasks.exe
2244	schtasks.exe
2360	schtasks.exe
776	schtasks.exe
3964	schtasks.exe
1292	schtasks.exe
5036	schtasks.exe
5052	schtasks.exe
2556	schtasks.exe
1312	schtasks.exe
2876	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings	15b75648ad8160565cfd4008ae223ce0.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe
1660	15b75648ad8160565cfd4008ae223ce0.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1660	15b75648ad8160565cfd4008ae223ce0.exe
Token: SeDebugPrivilege	3044	sppsvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 388	1660	15b75648ad8160565cfd4008ae223ce0.exe	89
PID 1660 wrote to memory of 388	1660	15b75648ad8160565cfd4008ae223ce0.exe	89
PID 388 wrote to memory of 3068	388	csc.exe	92
PID 388 wrote to memory of 3068	388	csc.exe	92
PID 1660 wrote to memory of 4856	1660	15b75648ad8160565cfd4008ae223ce0.exe	108
PID 1660 wrote to memory of 4856	1660	15b75648ad8160565cfd4008ae223ce0.exe	108
PID 4856 wrote to memory of 3848	4856	cmd.exe	110
PID 4856 wrote to memory of 3848	4856	cmd.exe	110
PID 4856 wrote to memory of 3432	4856	cmd.exe	111
PID 4856 wrote to memory of 3432	4856	cmd.exe	111
PID 4856 wrote to memory of 3044	4856	cmd.exe	112
PID 4856 wrote to memory of 3044	4856	cmd.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe
"C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nuy30ccj\nuy30ccj.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:388
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4258.tmp" "c:\Windows\System32\CSCB796E1A5B43E47C2A2C05F13D11B6848.TMP"
    3⤵
    PID:3068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GNPB8OF4mZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:3848
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:3432
- - C:\Windows\Fonts\sppsvc.exe
    "C:\Windows\Fonts\sppsvc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3500

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Windows\Fonts\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3472

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Windows\Fonts\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3896

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Internet Explorer\fr-FR\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2360

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "backgroundTaskHostb" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Windows NT\Accessories\en-US\backgroundTaskHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\en-US\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Windows\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Windows\en-US\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce01" /sc MINUTE /mo 12 /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce01" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\sysmon.exe

Filesize
1.8MB

MD5
15b75648ad8160565cfd4008ae223ce0

SHA1
2800a25191362b57c9762c74fc668960f11937bc

SHA256
81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d

SHA512
25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GNPB8OF4mZ.bat

Filesize
203B

MD5
d49a803ea32ba208884e90ff9ca2d343

SHA1
60d0c588cf1ca72759d9ece3c8c36bce10b0bd1a

SHA256
9a524b1293d54415c4d1f883aeb34851e12c470bca838c8fe5b4a59e9ccaa304

SHA512
1577e7d923b846af9ce24ec66ac674d7e9b161b95c9d5b998225a5e6fc15b12490cf1698d7c252b990630d1abd08fde19cc6ee911ab22593eb67b774273b9de0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4258.tmp

Filesize
1KB

MD5
f05391d00cb1abf5975eaf3233ca6892

SHA1
e7844c64d37098f16bc0cea9883b45f6b4a26b75

SHA256
27a2b5738a3e0487c920dcfbd040db8cb2c8d49cd190111cd825e97499c29099

SHA512
3b3a94a272e3e7bdb82c52d3fecc775eabe2bdd1bd9878cdabf4751efc164375b7d175f24bd991b6e7cce6e484ea6ca8ed19b69c60a793bfe310fa5cf1b172cf

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nuy30ccj\nuy30ccj.0.cs

Filesize
364B

MD5
cc7362ff4b5b1ddd57b58b088d9b7e10

SHA1
7e5d0418a8df657f2511b8568805197e4fba7532

SHA256
8eca007cddd87ae420feb030bdc030ca2b7d12a6eade68b52bedea8ed816cf49

SHA512
1a6f1236412740ace8ccb34109bd09e26701b5a10b3f6536c330b7fc0b68c8c69e2b0a6971f5f2247da36795a97400fc4938881bf5d7f7664deb1359885b3d0b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\nuy30ccj\nuy30ccj.cmdline

Filesize
235B

MD5
37cbbdfb0832a03c7d4b19418e302235

SHA1
6774fbd786ec5125fff0d5ccc471e5938b9be21b

SHA256
041558d29861d32f8dfc81257348df94b27b4e350193445f1013566c1e468e19

SHA512
aacb45e4d1d2c3c8172a9e0b0c0b87be1cac0082719e13fafdba2c933f044b5a74c53c841c9968c2b2cb7b54e1b14c34c01bf72d49094ef7decd015d1ffb91e5

Download Submit
\??\c:\Windows\System32\CSCB796E1A5B43E47C2A2C05F13D11B6848.TMP

Filesize
1KB

MD5
fc8059b5255b923f4956fbb9fde49aa2

SHA1
cee42442f0945012958fdd60f08a5b0f4d953608

SHA256
dfc8527fe4ce4eb1d97eeefcaeb02cbd320da16e4515171e2688228ee99fc4ae

SHA512
b3aa1009a05ee4ac931b2797e9fbf035a6f6f30975cab9e1724edcf2da9705c349d40db4710adfe140f90e5be65fc272f94616e89dc7cdf204aae58b957cb05d

Download Submit
memory/1660-10-0x0000000002860000-0x000000000287C000-memory.dmp

Filesize
112KB

Download
memory/1660-32-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-11-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-12-0x000000001B610000-0x000000001B660000-memory.dmp

Filesize
320KB

Download
memory/1660-14-0x0000000002880000-0x0000000002898000-memory.dmp

Filesize
96KB

Download
memory/1660-16-0x0000000000E50000-0x0000000000E5C000-memory.dmp

Filesize
48KB

Download
memory/1660-0-0x00007FFE2C2F3000-0x00007FFE2C2F5000-memory.dmp

Filesize
8KB

Download
memory/1660-7-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-30-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-8-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-6-0x0000000000DF0000-0x0000000000DFE000-memory.dmp

Filesize
56KB

Download
memory/1660-4-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-35-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-3-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-2-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-43-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-49-0x00007FFE2C2F0000-0x00007FFE2CDB1000-memory.dmp

Filesize
10.8MB

Download
memory/1660-1-0x0000000000430000-0x000000000060A000-memory.dmp

Filesize
1.9MB

Download