zgrat | b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09-05-2024 03:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe
Size

3.6MB
MD5

ae6fa9bafb66f9f7abef04452e02bc1c
SHA1

9ef051f253f58a97df773d3ab14654320191a08d
SHA256

b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f
SHA512

098dd73c9f75fd90ceb897f487d80c556456246ced0880057a317dd07c96900ab217cff500e363aa27e2debdde639f0be492ae84eabfd55846cbbf2b8cbd238c
SSDEEP

49152:IBJ7Cz5hm/qbhLLVAaM0+aSp0a+utgmvaIQLk7vsFMT2QbZCsL5A+rTpeZicE:ypCz5hvLqa3fSp0a+u6mt6cZnFDeEf

Score

10^/10

zgrat persistence rat

Malware Config

Signatures

Detect ZGRat V1 6 IoCs

resource	yara_rule
behavioral1/files/0x000f000000013432-10.dat	family_zgrat_v1
behavioral1/memory/2688-13-0x0000000000D90000-0x00000000010DA000-memory.dmp	family_zgrat_v1
behavioral1/memory/600-83-0x0000000000360000-0x00000000006AA000-memory.dmp	family_zgrat_v1
behavioral1/memory/1704-110-0x00000000009B0000-0x0000000000CFA000-memory.dmp	family_zgrat_v1
behavioral1/memory/2620-138-0x00000000002F0000-0x000000000063A000-memory.dmp	family_zgrat_v1
behavioral1/memory/1536-165-0x0000000000A10000-0x0000000000D5A000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\wininit.exe\", \"C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\winlogon.exe\", \"C:\\Recovery\\8f60a382-0d98-11ef-817d-5aba25856535\\csrss.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\wininit.exe\", \"C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\winlogon.exe\", \"C:\\Recovery\\8f60a382-0d98-11ef-817d-5aba25856535\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\csrss.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\wininit.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\", \"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\wininit.exe\", \"C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\winlogon.exe\""	BridgeWin.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1016	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	328	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1532	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1960	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1004	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2408	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	852	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3012	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	1008	schtasks.exe	32
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1008	schtasks.exe	32

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Detects executables packed with unregistered version of .NET Reactor 6 IoCs

resource	yara_rule
behavioral1/files/0x000f000000013432-10.dat	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/2688-13-0x0000000000D90000-0x00000000010DA000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/600-83-0x0000000000360000-0x00000000006AA000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1704-110-0x00000000009B0000-0x0000000000CFA000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/2620-138-0x00000000002F0000-0x000000000063A000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor
behavioral1/memory/1536-165-0x0000000000A10000-0x0000000000D5A000-memory.dmp	INDICATOR_EXE_Packed_DotNetReactor

Executes dropped EXE 5 IoCs

pid	Process
2688	BridgeWin.exe
600	winlogon.exe
1704	winlogon.exe
2620	winlogon.exe
1536	winlogon.exe

Loads dropped DLL 2 IoCs

pid	Process
2704	cmd.exe
2704	cmd.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\Idle.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\winlogon.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\wininit.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft Sync Framework\\v1.0\\Runtime\\x86\\wininit.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Java\\jre7\\bin\\dtplugin\\winlogon.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\8f60a382-0d98-11ef-817d-5aba25856535\\csrss.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\8f60a382-0d98-11ef-817d-5aba25856535\\csrss.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\csrss.exe\""	BridgeWin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\csrss.exe\""	BridgeWin.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSCEDB5FC9FC77B459ABBA87BD8A62AF982.TMP	csc.exe
File created	\??\c:\Windows\System32\bsgne1.exe	csc.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	BridgeWin.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe	BridgeWin.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe	BridgeWin.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\56085415360792	BridgeWin.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe	BridgeWin.exe
File created	C:\Program Files\Java\jre7\bin\dtplugin\cc11b995f2a76d	BridgeWin.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\csrss.exe	BridgeWin.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\886983d96e3d3e	BridgeWin.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\6ccacd8608530f	BridgeWin.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2676	schtasks.exe
2588	schtasks.exe
1960	schtasks.exe
1004	schtasks.exe
2464	schtasks.exe
2800	schtasks.exe
2408	schtasks.exe
1016	schtasks.exe
1532	schtasks.exe
852	schtasks.exe
3012	schtasks.exe
328	schtasks.exe
2152	schtasks.exe
1036	schtasks.exe
2232	schtasks.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
1840	PING.EXE
1652	PING.EXE
2136	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe
2688	BridgeWin.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	BridgeWin.exe
Token: SeDebugPrivilege	600	winlogon.exe
Token: SeDebugPrivilege	1704	winlogon.exe
Token: SeDebugPrivilege	2620	winlogon.exe
Token: SeDebugPrivilege	1536	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 1752	1920	b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe	28
PID 1920 wrote to memory of 1752	1920	b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe	28
PID 1920 wrote to memory of 1752	1920	b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe	28
PID 1920 wrote to memory of 1752	1920	b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe	28
PID 1752 wrote to memory of 2704	1752	WScript.exe	29
PID 1752 wrote to memory of 2704	1752	WScript.exe	29
PID 1752 wrote to memory of 2704	1752	WScript.exe	29
PID 1752 wrote to memory of 2704	1752	WScript.exe	29
PID 2704 wrote to memory of 2688	2704	cmd.exe	31
PID 2704 wrote to memory of 2688	2704	cmd.exe	31
PID 2704 wrote to memory of 2688	2704	cmd.exe	31
PID 2704 wrote to memory of 2688	2704	cmd.exe	31
PID 2688 wrote to memory of 2016	2688	BridgeWin.exe	36
PID 2688 wrote to memory of 2016	2688	BridgeWin.exe	36
PID 2688 wrote to memory of 2016	2688	BridgeWin.exe	36
PID 2016 wrote to memory of 2380	2016	csc.exe	38
PID 2016 wrote to memory of 2380	2016	csc.exe	38
PID 2016 wrote to memory of 2380	2016	csc.exe	38
PID 2688 wrote to memory of 484	2688	BridgeWin.exe	51
PID 2688 wrote to memory of 484	2688	BridgeWin.exe	51
PID 2688 wrote to memory of 484	2688	BridgeWin.exe	51
PID 484 wrote to memory of 952	484	cmd.exe	53
PID 484 wrote to memory of 952	484	cmd.exe	53
PID 484 wrote to memory of 952	484	cmd.exe	53
PID 484 wrote to memory of 1652	484	cmd.exe	54
PID 484 wrote to memory of 1652	484	cmd.exe	54
PID 484 wrote to memory of 1652	484	cmd.exe	54
PID 484 wrote to memory of 600	484	cmd.exe	55
PID 484 wrote to memory of 600	484	cmd.exe	55
PID 484 wrote to memory of 600	484	cmd.exe	55
PID 600 wrote to memory of 2104	600	winlogon.exe	58
PID 600 wrote to memory of 2104	600	winlogon.exe	58
PID 600 wrote to memory of 2104	600	winlogon.exe	58
PID 2104 wrote to memory of 572	2104	cmd.exe	60
PID 2104 wrote to memory of 572	2104	cmd.exe	60
PID 2104 wrote to memory of 572	2104	cmd.exe	60
PID 2104 wrote to memory of 2132	2104	cmd.exe	61
PID 2104 wrote to memory of 2132	2104	cmd.exe	61
PID 2104 wrote to memory of 2132	2104	cmd.exe	61
PID 2104 wrote to memory of 1704	2104	cmd.exe	62
PID 2104 wrote to memory of 1704	2104	cmd.exe	62
PID 2104 wrote to memory of 1704	2104	cmd.exe	62
PID 1704 wrote to memory of 608	1704	winlogon.exe	63
PID 1704 wrote to memory of 608	1704	winlogon.exe	63
PID 1704 wrote to memory of 608	1704	winlogon.exe	63
PID 608 wrote to memory of 2976	608	cmd.exe	65
PID 608 wrote to memory of 2976	608	cmd.exe	65
PID 608 wrote to memory of 2976	608	cmd.exe	65
PID 608 wrote to memory of 1636	608	cmd.exe	66
PID 608 wrote to memory of 1636	608	cmd.exe	66
PID 608 wrote to memory of 1636	608	cmd.exe	66
PID 608 wrote to memory of 2620	608	cmd.exe	67
PID 608 wrote to memory of 2620	608	cmd.exe	67
PID 608 wrote to memory of 2620	608	cmd.exe	67
PID 2620 wrote to memory of 1816	2620	winlogon.exe	68
PID 2620 wrote to memory of 1816	2620	winlogon.exe	68
PID 2620 wrote to memory of 1816	2620	winlogon.exe	68
PID 1816 wrote to memory of 1900	1816	cmd.exe	70
PID 1816 wrote to memory of 1900	1816	cmd.exe	70
PID 1816 wrote to memory of 1900	1816	cmd.exe	70
PID 1816 wrote to memory of 2136	1816	cmd.exe	71
PID 1816 wrote to memory of 2136	1816	cmd.exe	71
PID 1816 wrote to memory of 2136	1816	cmd.exe	71
PID 1816 wrote to memory of 1536	1816	cmd.exe	72

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe
"C:\Users\Admin\AppData\Local\Temp\b86ca52b5137070fecf0f62413e67427bb325b68c67677085b4945394edb416f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\ChainProvider\jpxBqgIRsq2SLG1PgyDmjdYOwbC.vbe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\ChainProvider\Ue6DPbuBmrgvvM.bat" "
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\ChainProvider\BridgeWin.exe
      "C:\ChainProvider/BridgeWin.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wecdgk2q\wecdgk2q.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2016
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59D3.tmp" "c:\Windows\System32\CSCEDB5FC9FC77B459ABBA87BD8A62AF982.TMP"
        6⤵
        
        PID:2380
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\3gjbg6SrjC.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:484
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:952
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        Runs ping.exe
        
        PID:1652
      - C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe
        
        "C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:600
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7vUbsmDZqq.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:572
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:2132
        
        C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe
        
        "C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1704
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\tLBDHjzlZn.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:608
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:2976
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        10⤵
        
        PID:1636
        
        C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe
        
        "C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:1816
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1900
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        12⤵
        Runs ping.exe
        
        PID:2136
        
        C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe
        
        "C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1536
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\L3SaAS0x6v.bat"
        13⤵
        
        PID:2716
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:1824
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        14⤵
        Runs ping.exe
        
        PID:1840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2408

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\Java\jre7\bin\dtplugin\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\8f60a382-0d98-11ef-817d-5aba25856535\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3012

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ChainProvider\BridgeWin.exe

Filesize
3.3MB

MD5
08efce1648b0191ab668a92693f404d2

SHA1
8e0e2293ac8a05c4ead1db9f35131814af0f0838

SHA256
4a9ccd37881052fa211713f88560e534684dc38bf54869b89e044f1606924191

SHA512
86a7f9f8dd555408de32ebbc43825da2d01bdf1504d0ccd7d087195586f0276726444c11b1e6cc5c4c2bb7aaf3e7ec1ccd885ded7168b2f800c42aa012169186

Download Submit
C:\ChainProvider\Ue6DPbuBmrgvvM.bat

Filesize
65B

MD5
6c93675d5528de536918490f2a030831

SHA1
ea764eee1b3bde0450319ef30b2433a9a46d4186

SHA256
0fef681907e2cf1e93b3ed1f68439901833d5ada3c70aa374e024560bfc86d64

SHA512
c935abd4d5390841784dee4edb8941b26a7fb5091b6d38e329959e70626fa19bb600d957456f079a95ab6ff2ba2f5059ae4ecfebe360d18aaf1ad61edccd6679

Download Submit
C:\ChainProvider\jpxBqgIRsq2SLG1PgyDmjdYOwbC.vbe

Filesize
206B

MD5
55e5be814935518dd671f62280d31bf7

SHA1
5b2fe2c2bc5b928a1225cf5b01c05dba98384812

SHA256
4e6b3324992136821adcecafa68aa60e1ec41664737ed1a75e96de82c3abd979

SHA512
873f644b249cebdf2a666e30eb1c06b8e276a5311d72f7c17af7fdad5ff767577c1a1cc2b9d9d84bfee28898e179356aa334aa29596a57549770f737c3d555b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3gjbg6SrjC.bat

Filesize
180B

MD5
7892eeadec314a82b0f45ce5b30fe4a0

SHA1
6ba1ac82b73d6775f07fbae26b2a03f12f26a32a

SHA256
7424d52ee356f1a12bf28d774670c9e689015513dcfd46c8c4c5436cde589b73

SHA512
8266671c5e92f9d9de45b5959495f32d8d4824416ea3032f2e7cd1dff3d79f84be879b7365950633ba51ab87c730e750f2feb032a4664a57b7dc39b83e5f9ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\6UZvaQo7Ba.bat

Filesize
180B

MD5
cf4195e782bc4413323733d3f95e7969

SHA1
2bb31f6d7c6dc493bf9b043bae12a00b395bb3e0

SHA256
de2946b5aa55831c7e68c161d3e99389fb2dabf3a740a7bf6454ef509fa5c221

SHA512
5563b97f5c3bfe5229f62b8a235d1572b0ea513cd2feaa8107af574e6ba0c21a771a30839dacd3ecea2a971b4a0b3aee5db687eb0800054e26350233d7ba8df5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7vUbsmDZqq.bat

Filesize
228B

MD5
2243f87f2d0ed0491232578e913cc321

SHA1
01b7fa38d052c01fd439c03e8a37477f57e54322

SHA256
55791bd34a6625f880d09aabd4499945f5e28e37077a71a595d4989c98d3b232

SHA512
152abc04793e72382108c30a131057b00a5cbacdecc2eba4caf45818f8943e1e85a5a6b858df315857e133be15a24e0037efe9723b70675f2b56acdf48763249

Download Submit
C:\Users\Admin\AppData\Local\Temp\L3SaAS0x6v.bat

Filesize
180B

MD5
b7051b4e80a227534529c9206df4dd45

SHA1
86535922177bd967b160be840cf5d490c54b82ff

SHA256
061be9cb196ff370e9fbd799484eaed80d7041ec389223e64d23168f331038dd

SHA512
7147f256c3cc98691e65071750597cf80bdaed4d7e2a7408171db4ba07d43665d17a50eee0c835a17909b3eca86c019983cf1cc01276fd1baaccf568abe013de

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES59D3.tmp

Filesize
1KB

MD5
75a445e119178f427996f0fae9d52e35

SHA1
20ebbe97dea871e81114dd4e4d63868b20ec5cde

SHA256
4f857562993092c249f943d972c402971069c9b19fdb90b6952287039fb439a9

SHA512
7ee0bf147100682a60820dd8345a5f00b56e10f82c07c247950ff498cae08f4a94d04812a9a906281f332bcf8c94ce234d0463235dc77295b5268ac2ac5126b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tLBDHjzlZn.bat

Filesize
228B

MD5
fd02e30ba2f0c4df62ba55d4872e669c

SHA1
bbb1d95f50ed93d12a09d3b36dce8e8bbdaef412

SHA256
32f195505e3835260d78b82d39bfb1f504dc109cc4eaef03495edebb0dd74ac8

SHA512
baf20030ccb27151c4dda92ee6728d84acaa01f0c9abed28f3cb648b0d9465e4bcd1747d92c9fc5a58fc298e144109f224e6f596256cc40efab25c2c013cfe2b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wecdgk2q\wecdgk2q.0.cs

Filesize
396B

MD5
05c05e646bdc37c948a053bd3fd6c91a

SHA1
fe536465bae1847e6f5ff4460ddf5ceff6ae29f0

SHA256
9db53cd239fee24147c2994efe5e6528726e115f0fe3e4c3b141c51c0d91dc6b

SHA512
88712dd341414535f3928eabb8c8e0eab9764383578a9a80a5efe1983e0800a6d3f2dc4e769f299c5e29eaac6d3e05a53890d3fd23807ab18467cabada8517e5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\wecdgk2q\wecdgk2q.cmdline

Filesize
235B

MD5
000685f8fdba1068a2d74ff18ad04024

SHA1
b3da3bd64e75e70019419efe0b70dc17c6396854

SHA256
751792f5da05ceb99cf0d19c18ed9440d6fc42ce30f3636f6e1392f6c32c54a4

SHA512
6a837a8701eec9ae5f42208915fcc93d7b92e406c0ebcd4d6a27686778eaf3a22b18719f8f87a5885e2342552ebb4b4ea1cb775a2db666d38640ef384b5c308d

Download Submit
\??\c:\Windows\System32\CSCEDB5FC9FC77B459ABBA87BD8A62AF982.TMP

Filesize
1KB

MD5
dc62d02b56d310e294d158c225b91f50

SHA1
844e69b5ff0328e80441c54dbdff39d82c3263ba

SHA256
be8b5c97dc2eb2b7a62245da79d879ac20bb8e123c06b565f27e330bfe4fa0f8

SHA512
23e9004baf3f7dc17611fa3fa65e5c8dbd0c49cb43b831688eec9b938c28a3ca6029d737de77810271ac9f0779c27f62db123d2831aee13527d0a3088c39c209

Download Submit
memory/600-83-0x0000000000360000-0x00000000006AA000-memory.dmp

Filesize
3.3MB

Download
memory/1536-165-0x0000000000A10000-0x0000000000D5A000-memory.dmp

Filesize
3.3MB

Download
memory/1704-110-0x00000000009B0000-0x0000000000CFA000-memory.dmp

Filesize
3.3MB

Download
memory/2620-138-0x00000000002F0000-0x000000000063A000-memory.dmp

Filesize
3.3MB

Download
memory/2688-25-0x00000000003E0000-0x00000000003EE000-memory.dmp

Filesize
56KB

Download
memory/2688-33-0x0000000000420000-0x0000000000430000-memory.dmp

Filesize
64KB

Download
memory/2688-45-0x0000000000C40000-0x0000000000C9A000-memory.dmp

Filesize
360KB

Download
memory/2688-47-0x0000000000640000-0x0000000000650000-memory.dmp

Filesize
64KB

Download
memory/2688-49-0x0000000000650000-0x000000000065E000-memory.dmp

Filesize
56KB

Download
memory/2688-51-0x0000000000660000-0x000000000066C000-memory.dmp

Filesize
48KB

Download
memory/2688-53-0x00000000009F0000-0x0000000000A3E000-memory.dmp

Filesize
312KB

Download
memory/2688-41-0x0000000000440000-0x0000000000450000-memory.dmp

Filesize
64KB

Download
memory/2688-39-0x0000000000430000-0x000000000043C000-memory.dmp

Filesize
48KB

Download
memory/2688-37-0x0000000000610000-0x0000000000622000-memory.dmp

Filesize
72KB

Download
memory/2688-35-0x00000000005F0000-0x0000000000606000-memory.dmp

Filesize
88KB

Download
memory/2688-43-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2688-31-0x00000000005D0000-0x00000000005E2000-memory.dmp

Filesize
72KB

Download
memory/2688-29-0x0000000000410000-0x000000000041E000-memory.dmp

Filesize
56KB

Download
memory/2688-27-0x00000000003F0000-0x00000000003FE000-memory.dmp

Filesize
56KB

Download
memory/2688-23-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2688-21-0x00000000001A0000-0x00000000001B0000-memory.dmp

Filesize
64KB

Download
memory/2688-19-0x00000000003B0000-0x00000000003C8000-memory.dmp

Filesize
96KB

Download
memory/2688-17-0x0000000000180000-0x000000000019C000-memory.dmp

Filesize
112KB

Download
memory/2688-15-0x0000000000170000-0x000000000017E000-memory.dmp

Filesize
56KB

Download
memory/2688-13-0x0000000000D90000-0x00000000010DA000-memory.dmp

Filesize
3.3MB

Download