zgrat | 81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d

Analysis

max time kernel
121s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
06-05-2024 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Size

1.8MB
MD5

15b75648ad8160565cfd4008ae223ce0
SHA1

2800a25191362b57c9762c74fc668960f11937bc
SHA256

81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d
SHA512

25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b
SSDEEP

24576:pRr3fEcKSoIu4cMlay9GvZsk8ynlK01Pi5LO1K4Bb/8GeAyb1L5ZXMUJcapQKS3L:TAUpQ8yU26a1KU8ZAyb15ea61pFWcig

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/memory/1688-1-0x0000000000C70000-0x0000000000E4A000-memory.dmp	family_zgrat_v1
behavioral1/files/0x00070000000155f3-26.dat	family_zgrat_v1
behavioral1/memory/1344-49-0x0000000000910000-0x0000000000AEA000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\", \"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\dwm.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\", \"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\", \"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\dwm.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\", \"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\", \"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\spoolsv.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\", \"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\", \"C:\\Program Files\\Windows NT\\Accessories\\spoolsv.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2828	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2772	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2940	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2880	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2956	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3052	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	808	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2180	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2788	2660	schtasks.exe	28
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	2660	schtasks.exe	28

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Executes dropped EXE 1 IoCs

pid	Process
1344	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Windows NT\\Accessories\\spoolsv.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\dwm.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0_NEAS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0_NEAS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\dwm.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0_NEAS = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\15b75648ad8160565cfd4008ae223ce0_NEAS = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Esl\\15b75648ad8160565cfd4008ae223ce0_NEAS.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files\\Windows Photo Viewer\\es-ES\\services.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Program Files\\Windows NT\\Accessories\\spoolsv.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwm = "\"C:\\Program Files (x86)\\Windows Portable Devices\\dwm.exe\""	15b75648ad8160565cfd4008ae223ce0_NEAS.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC30FB504C11244C50BCE9404FA30EB81.TMP	csc.exe
File created	\??\c:\Windows\System32\slsogk.exe	csc.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Portable Devices\dwm.exe	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files (x86)\Windows Portable Devices\6cb0b6c459d5d3	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files\Windows NT\Accessories\spoolsv.exe	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files\Windows NT\Accessories\f3b6ecef712a24	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\services.exe	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files\Windows Photo Viewer\es-ES\c5b4cb5e9653cc	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\15b75648ad8160565cfd4008ae223ce0_NEAS.exe	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\98d67b138911ac	15b75648ad8160565cfd4008ae223ce0_NEAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2820	schtasks.exe
2940	schtasks.exe
2508	schtasks.exe
1920	schtasks.exe
3052	schtasks.exe
1240	schtasks.exe
2828	schtasks.exe
2880	schtasks.exe
2732	schtasks.exe
2956	schtasks.exe
2856	schtasks.exe
808	schtasks.exe
2180	schtasks.exe
2784	schtasks.exe
2772	schtasks.exe
1372	schtasks.exe
2788	schtasks.exe
2264	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2960	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe
Token: SeDebugPrivilege	1344	services.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2632	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe	32
PID 1688 wrote to memory of 2632	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe	32
PID 1688 wrote to memory of 2632	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe	32
PID 2632 wrote to memory of 2484	2632	csc.exe	34
PID 2632 wrote to memory of 2484	2632	csc.exe	34
PID 2632 wrote to memory of 2484	2632	csc.exe	34
PID 1688 wrote to memory of 1900	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe	50
PID 1688 wrote to memory of 1900	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe	50
PID 1688 wrote to memory of 1900	1688	15b75648ad8160565cfd4008ae223ce0_NEAS.exe	50
PID 1900 wrote to memory of 2556	1900	cmd.exe	52
PID 1900 wrote to memory of 2556	1900	cmd.exe	52
PID 1900 wrote to memory of 2556	1900	cmd.exe	52
PID 1900 wrote to memory of 2960	1900	cmd.exe	53
PID 1900 wrote to memory of 2960	1900	cmd.exe	53
PID 1900 wrote to memory of 2960	1900	cmd.exe	53
PID 1900 wrote to memory of 1344	1900	cmd.exe	54
PID 1900 wrote to memory of 1344	1900	cmd.exe	54
PID 1900 wrote to memory of 1344	1900	cmd.exe	54

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0_NEAS.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dhdteea0\dhdteea0.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBA.tmp" "c:\Windows\System32\CSC30FB504C11244C50BCE9404FA30EB81.TMP"
    3⤵
    PID:2484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\BjxzCtqrkZ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:2556
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:2960
- - C:\Program Files\Windows Photo Viewer\es-ES\services.exe
    "C:\Program Files\Windows Photo Viewer\es-ES\services.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1344

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0_NEAS1" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\15b75648ad8160565cfd4008ae223ce0_NEAS.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0_NEAS" /sc ONLOGON /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\15b75648ad8160565cfd4008ae223ce0_NEAS.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0_NEAS1" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Adobe\Reader 9.0\Esl\15b75648ad8160565cfd4008ae223ce0_NEAS.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Photo Viewer\es-ES\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1920

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\Accessories\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2880

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files\Windows NT\Accessories\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2732

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Program Files\Windows NT\Accessories\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2784

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2788

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2180

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Portable Devices\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3052

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0_NEAS1" /sc MINUTE /mo 8 /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0_NEAS.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0_NEAS" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0_NEAS.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "15b75648ad8160565cfd4008ae223ce0_NEAS1" /sc MINUTE /mo 13 /tr "'C:\Users\Admin\AppData\Local\Temp\15b75648ad8160565cfd4008ae223ce0_NEAS.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\Esl\15b75648ad8160565cfd4008ae223ce0_NEAS.exe

Filesize
1.8MB

MD5
15b75648ad8160565cfd4008ae223ce0

SHA1
2800a25191362b57c9762c74fc668960f11937bc

SHA256
81e18d35c83b04e7ee6288294cdfc7ef57af3c44d44788a21577e808b3a99a9d

SHA512
25eb48fd2ea9a2781b6ed82ebc00b6d4df2ddbe57dee366dd39f67f8dcf9c02cf675c9578b11057d07ae0c6d8cc65371971f51df8eac27cc36e0e27d42bc9b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\BjxzCtqrkZ.bat

Filesize
184B

MD5
d02759ee457e48fd002fd70b3ff8e6f2

SHA1
e3028f4950ac224bbacd12c4e3fcfd0b205ae973

SHA256
c5c43f5a382035cd60ee8d96bc98c09c1d38535c1e29941bd22f44c8b6d99e0b

SHA512
6ef75bff207631a11f3a445ae1d76d029edf2e4d76cdc1785c85959ecd061ba8243d3fc0ce66fd582451afec024765cd0354625ee4b3768fab207148091bb211

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFBA.tmp

Filesize
1KB

MD5
ae72d54150d4984a513fda83b6b44a62

SHA1
f30ec45d064d0910e76f1cbd8ebf75d3247cb3a7

SHA256
e98a74fffe425848580e8b9ea598db1add984ff6826c7a70783e5e2ee8253a3a

SHA512
49a86612cfc166dc6db1272716b8155c3a33968e720ef47655c21d9472f837a7c9eb6e1e1ec1873094ab28043e72923119d3442858e02d8eda5784fbda96caf6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dhdteea0\dhdteea0.0.cs

Filesize
417B

MD5
426e2d9ff8d8cabc89d5dd4505c5461f

SHA1
b0402567d22cc35029801349e1c88d4c3d8fddb3

SHA256
15cfa94522a00248f8b461aeb7c89f0f6cb8aeafd2d0f70270c1d50b2a21c759

SHA512
f3c5d8e6127f8ad8d33ae0a004c148d19944dac96cd4d213c1b51ad6ff333cad39a9928f34991e63fc81eb958edbd8a7233bccc492b88a5d2df34dd085636d21

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\dhdteea0\dhdteea0.cmdline

Filesize
235B

MD5
6b5b1ed169e59274c6c741f042be9df1

SHA1
0570875f683088aaf95820a91b2fb58b21435c7b

SHA256
1b1c2e3f874176360125c713cf7100ad75be437a2baec1fbca9c6dda1ef76832

SHA512
b7435fa37be9334eafdf1562341f386e0d84a0de8e3888bd5bbf3f8da05bc895576c1a151092b7cd7d995d4228d2c7748dc3a0a1c6b12f0f6f2e0bb636481fc3

Download Submit
\??\c:\Windows\System32\CSC30FB504C11244C50BCE9404FA30EB81.TMP

Filesize
1KB

MD5
3fcb2bd8a227751c0367dff5940613bb

SHA1
bcca174ab4499de5713d836fbc368966aa1f5b2c

SHA256
aca1f364ec354097cdecc50336698c1180b10ae84fc6051eab154482e0965e8c

SHA512
c7357bb6ee27df96ba39066e893ce8521cb1d5c550be24ced7f860e11cc36ecc04fbec14f61da920bca04e0ae150df8dbc53de0c4a6880afa6067bccfe767672

Download Submit
memory/1344-49-0x0000000000910000-0x0000000000AEA000-memory.dmp

Filesize
1.9MB

Download
memory/1688-6-0x0000000000510000-0x000000000051E000-memory.dmp

Filesize
56KB

Download
memory/1688-9-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-15-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-14-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-17-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-13-0x0000000000520000-0x000000000052C000-memory.dmp

Filesize
48KB

Download
memory/1688-28-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-11-0x0000000000A90000-0x0000000000AA8000-memory.dmp

Filesize
96KB

Download
memory/1688-8-0x0000000000540000-0x000000000055C000-memory.dmp

Filesize
112KB

Download
memory/1688-0-0x000007FEF50B3000-0x000007FEF50B4000-memory.dmp

Filesize
4KB

Download
memory/1688-4-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-3-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-46-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-2-0x000007FEF50B0000-0x000007FEF5A9C000-memory.dmp

Filesize
9.9MB

Download
memory/1688-1-0x0000000000C70000-0x0000000000E4A000-memory.dmp

Filesize
1.9MB

Download