zgrat | c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 21:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

347KB
MD5

1cb742cb95699d994e1cc6810c6f7642
SHA1

103ea603322859742a3e51c5e517a927b9dcd40c
SHA256

c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
SHA512

79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP

6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF

Score

10^/10

zgrat evasion execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233f3-7.dat	family_zgrat_v1
behavioral2/files/0x00090000000233fb-23.dat	family_zgrat_v1
behavioral2/memory/4908-25-0x0000000000840000-0x0000000000BE2000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\sppsvc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\Sessionperf.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\Sessionperf.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\sihost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\Sessionperf.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\sihost.exe\", \"C:\\Windows\\GameBarPresenceWriter\\Registry.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\sppsvc.exe\", \"C:\\Program Files\\Mozilla Firefox\\browser\\features\\Sessionperf.exe\", \"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\sihost.exe\", \"C:\\Windows\\GameBarPresenceWriter\\Registry.exe\", \"C:\\Recovery\\WindowsRE\\sihost.exe\""	Sessionperf.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5100	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5096	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3828	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4420	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3644	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4240	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3712	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2624	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1108	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4864	1480	schtasks.exe	95
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	1480	schtasks.exe	95

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1628	powershell.exe
3140	powershell.exe
4560	powershell.exe
1596	powershell.exe
4484	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Sessionperf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	Checker.exe

Executes dropped EXE 3 IoCs

pid	Process
4244	Checker.exe
4908	Sessionperf.exe
4516	sihost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sessionperf = "\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\Sessionperf.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sessionperf = "\"C:\\Program Files\\Mozilla Firefox\\browser\\features\\Sessionperf.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\sihost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\VideoLAN\\VLC\\skins\\fonts\\sihost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\blockcontainerWincrtdll\\sppsvc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\GameBarPresenceWriter\\Registry.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\Windows\\GameBarPresenceWriter\\Registry.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Recovery\\WindowsRE\\sihost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\blockcontainerWincrtdll\\sppsvc.exe\""	Sessionperf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC7FA59B8A15CE411AA7FD2265F3558D79.TMP	csc.exe
File created	\??\c:\Windows\System32\fruvan.exe	csc.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\features\Sessionperf.exe	Sessionperf.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\af1d29713a7fc9	Sessionperf.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe	Sessionperf.exe
File created	C:\Program Files\VideoLAN\VLC\skins\fonts\66fc9ff0ee96c2	Sessionperf.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\GameBarPresenceWriter\Registry.exe	Sessionperf.exe
File created	C:\Windows\GameBarPresenceWriter\ee2ad38f3d4382	Sessionperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4240	schtasks.exe
5100	schtasks.exe
1108	schtasks.exe
1724	schtasks.exe
5096	schtasks.exe
3644	schtasks.exe
3712	schtasks.exe
4832	schtasks.exe
4864	schtasks.exe
4688	schtasks.exe
3828	schtasks.exe
4420	schtasks.exe
3300	schtasks.exe
2624	schtasks.exe
2428	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	Sessionperf.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2484	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe
4908	Sessionperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4516	sihost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3432	Loader.exe
Token: SeDebugPrivilege	4908	Sessionperf.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	3140	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4516	sihost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	sihost.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 4244	3432	Loader.exe	85
PID 3432 wrote to memory of 4244	3432	Loader.exe	85
PID 3432 wrote to memory of 4244	3432	Loader.exe	85
PID 4244 wrote to memory of 1688	4244	Checker.exe	87
PID 4244 wrote to memory of 1688	4244	Checker.exe	87
PID 4244 wrote to memory of 1688	4244	Checker.exe	87
PID 1688 wrote to memory of 3652	1688	WScript.exe	91
PID 1688 wrote to memory of 3652	1688	WScript.exe	91
PID 1688 wrote to memory of 3652	1688	WScript.exe	91
PID 3652 wrote to memory of 2484	3652	cmd.exe	93
PID 3652 wrote to memory of 2484	3652	cmd.exe	93
PID 3652 wrote to memory of 2484	3652	cmd.exe	93
PID 3652 wrote to memory of 4908	3652	cmd.exe	94
PID 3652 wrote to memory of 4908	3652	cmd.exe	94
PID 4908 wrote to memory of 5012	4908	Sessionperf.exe	99
PID 4908 wrote to memory of 5012	4908	Sessionperf.exe	99
PID 5012 wrote to memory of 4804	5012	csc.exe	101
PID 5012 wrote to memory of 4804	5012	csc.exe	101
PID 4908 wrote to memory of 4560	4908	Sessionperf.exe	114
PID 4908 wrote to memory of 4560	4908	Sessionperf.exe	114
PID 4908 wrote to memory of 3140	4908	Sessionperf.exe	115
PID 4908 wrote to memory of 3140	4908	Sessionperf.exe	115
PID 4908 wrote to memory of 1628	4908	Sessionperf.exe	116
PID 4908 wrote to memory of 1628	4908	Sessionperf.exe	116
PID 4908 wrote to memory of 4484	4908	Sessionperf.exe	117
PID 4908 wrote to memory of 4484	4908	Sessionperf.exe	117
PID 4908 wrote to memory of 1596	4908	Sessionperf.exe	118
PID 4908 wrote to memory of 1596	4908	Sessionperf.exe	118
PID 4908 wrote to memory of 2944	4908	Sessionperf.exe	124
PID 4908 wrote to memory of 2944	4908	Sessionperf.exe	124
PID 2944 wrote to memory of 3568	2944	cmd.exe	126
PID 2944 wrote to memory of 3568	2944	cmd.exe	126
PID 2944 wrote to memory of 4704	2944	cmd.exe	127
PID 2944 wrote to memory of 4704	2944	cmd.exe	127
PID 2944 wrote to memory of 4516	2944	cmd.exe	128
PID 2944 wrote to memory of 4516	2944	cmd.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Users\Admin\AppData\Roaming\Checker.exe
  "C:\Users\Admin\AppData\Roaming\Checker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4244
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:2484
    - - C:\blockcontainerWincrtdll\Sessionperf.exe
        
        "C:\blockcontainerWincrtdll/Sessionperf.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ketfyx1u\ketfyx1u.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A16.tmp" "c:\Windows\System32\CSC7FA59B8A15CE411AA7FD2265F3558D79.TMP"
        7⤵
        
        PID:4804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockcontainerWincrtdll\sppsvc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\browser\features\Sessionperf.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3140
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1628
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\GameBarPresenceWriter\Registry.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\sihost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1596
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\lPpTKfy7SP.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2944
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3568
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4704
        
        C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe
        
        "C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4516

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 5 /tr "'C:\blockcontainerWincrtdll\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\blockcontainerWincrtdll\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\blockcontainerWincrtdll\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SessionperfS" /sc MINUTE /mo 7 /tr "'C:\Program Files\Mozilla Firefox\browser\features\Sessionperf.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Sessionperf" /sc ONLOGON /tr "'C:\Program Files\Mozilla Firefox\browser\features\Sessionperf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SessionperfS" /sc MINUTE /mo 8 /tr "'C:\Program Files\Mozilla Firefox\browser\features\Sessionperf.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4240

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 13 /tr "'C:\Program Files\VideoLAN\VLC\skins\fonts\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 13 /tr "'C:\Windows\GameBarPresenceWriter\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\GameBarPresenceWriter\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\Windows\GameBarPresenceWriter\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5A16.tmp

Filesize
1KB

MD5
ee7317fc53aa466fc41a34c66de98cc3

SHA1
2c0497ad61c3408deffd3fae1755ffab6dd2de81

SHA256
25eeb205a9c3c9bb41c3137ee0592ce0b761ba8cefefe7d66b1a0c0697c90e9b

SHA512
21a6fd7d4f67afcab02038e042bd4ed292d30760e0f1d45a9a437841cc79b35387017bc5ca62961be09164dc7aadf1b071665e5394180ceda9a48acde4896cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_smhxszdw.dzt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\lPpTKfy7SP.bat

Filesize
228B

MD5
7a45593f90c04a5297f5771ccd5f6374

SHA1
6c5f284be54367348fbf7d7778d7dfed7112cf60

SHA256
f2bd7f7d67808960219b4347ffd043615efb7ca233f6ce9357d68a0ea472e3a1

SHA512
ebe2b5cfc9345bf50dc0ff1c47e0f43a492be8aae8fda72007420c59868b0938249c8fc43b867bd9655ead0a2d66cb5d280d03a61ff06896229931866803fe41

Download Submit
C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
3.9MB

MD5
1003b37d9d942d41a38a83670eaa285c

SHA1
a4ee7ef69fc681caf1116d59578667abb9080ad6

SHA256
d822b616ee7e10b00fead9be9eb0cf9780fdb0b3fec3001ff31c9ce0cb7255ae

SHA512
0c6f4e063cc22ee3c076c95bf5ea1cb593e5b6f40e4f2b8d3723a5c18c14eeecf568dad2a16599967c56588f4918cecd996e475fd20615b07c99de4800309f9a

Download Submit
C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe

Filesize
228B

MD5
4f702b152f4098393712e3fe99b04fbd

SHA1
fec2f913e1fac5053127e175f1ba048c9d8dd25c

SHA256
f0e2bfb22d22aed8ac10eff5a010fad081a5798706b3a6fd7764798cab716eb2

SHA512
7c0844d6591b694d77ecf3d070eb3f70fd99427e41d62167aa58c98c1966a8065d90beb82ab0aa0a42bb80edb3c205dd07bb1d4fc03d989a0cb4df8993635fbf

Download Submit
C:\blockcontainerWincrtdll\Sessionperf.exe

Filesize
3.6MB

MD5
bf0f63bb48eb95aaec6fc6a001c974ce

SHA1
19baab2b0c129ecbd6a1aa21bada3e2e5cdd1136

SHA256
bbb080aed81b8f4d0f5d590c7cb0e56e68da5a27d32d964c32e50e1cb2015edc

SHA512
130f08a7c4901ef47e7d21effe83c19fa442f2ade97967c11e646f949a9e8c2c46e8272a31a5b75f6c279009530cd101a562f1ab31a28fe410273cd69bf6c28c

Download Submit
C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat

Filesize
201B

MD5
159297f9e35114bf97d74622097780d8

SHA1
2aaaf993b9ecb9bae43ccd41585734512ff08355

SHA256
650c37c1afde471e40f77d7aec8603382214e9ec318b7f08ab7653f9c4e87f81

SHA512
a82faa2f64caf669d44eac03705e34bea213c9a74ed73950bd8d2158d1c256ca290b7ffece866c3a03c36a091be70d92157353782061e184e5d44ac937949f69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ketfyx1u\ketfyx1u.0.cs

Filesize
369B

MD5
58fe4566df54bd00bbd07c5ae72de431

SHA1
373f149bae371006328f3aebaef77584508bc7e8

SHA256
6f3632dac03cb8df55d49b47664eba5ec2eb91b2d83019806993c4d713f52003

SHA512
8cf1514f52cbfc432368e882c0f8a9029fda86039e7a3e918c5fc74d4ca6d0dc327db73f6b39bf8e164781cf65f42f229280db38c86caee2e8f06ad4d7714810

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ketfyx1u\ketfyx1u.cmdline

Filesize
235B

MD5
08f67f72baa50a240901f72d5db60f18

SHA1
785cd1eac8f154ada4d5b6e8c043cdccaf775c19

SHA256
3d8567e1154a43fd9d1fd849f942a693fa53cec542f8c7e02f0c328ec406dbab

SHA512
d141ad811d584515e6b62858f72edde6b912a47b300b9870e15a1d3acc4a19b4594806b694a12a4348bc01f6b7874905b729521908693be1649d9e0e86c61721

Download Submit
\??\c:\Windows\System32\CSC7FA59B8A15CE411AA7FD2265F3558D79.TMP

Filesize
1KB

MD5
d52087709e2274a5a9381789082a9d03

SHA1
e1f693bc2b4cd35e7abdea93dc0bb77ef6ddce59

SHA256
f4091edfc561d6d16cdb8f686a10ebade8c6a9239730fddb9c652a1c005790c2

SHA512
5e448e07b49f301dd1d815818527f88d32cac7e869cd8120651b940783a29a18c2b4ec87ad18ce3a85c6973e4b676d9499068e3b805c972b6a95660a3c7dae12

Download Submit
memory/3140-112-0x00000242B73F0000-0x00000242B7412000-memory.dmp

Filesize
136KB

Download
memory/3432-0-0x00007FF816413000-0x00007FF816415000-memory.dmp

Filesize
8KB

Download
memory/3432-11-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-2-0x00007FF816410000-0x00007FF816ED1000-memory.dmp

Filesize
10.8MB

Download
memory/3432-1-0x0000000000710000-0x000000000076E000-memory.dmp

Filesize
376KB

Download
memory/4516-188-0x000000001D160000-0x000000001D275000-memory.dmp

Filesize
1.1MB

Download
memory/4908-52-0x000000001BB80000-0x000000001BB96000-memory.dmp

Filesize
88KB

Download
memory/4908-73-0x000000001BBF0000-0x000000001BBFC000-memory.dmp

Filesize
48KB

Download
memory/4908-48-0x000000001BAC0000-0x000000001BACC000-memory.dmp

Filesize
48KB

Download
memory/4908-54-0x000000001BBA0000-0x000000001BBB2000-memory.dmp

Filesize
72KB

Download
memory/4908-55-0x000000001C0F0000-0x000000001C618000-memory.dmp

Filesize
5.2MB

Download
memory/4908-57-0x000000001BB30000-0x000000001BB3E000-memory.dmp

Filesize
56KB

Download
memory/4908-59-0x000000001BB60000-0x000000001BB70000-memory.dmp

Filesize
64KB

Download
memory/4908-61-0x000000001BB70000-0x000000001BB80000-memory.dmp

Filesize
64KB

Download
memory/4908-63-0x000000001BC20000-0x000000001BC7A000-memory.dmp

Filesize
360KB

Download
memory/4908-65-0x000000001BBC0000-0x000000001BBCE000-memory.dmp

Filesize
56KB

Download
memory/4908-67-0x000000001BBD0000-0x000000001BBE0000-memory.dmp

Filesize
64KB

Download
memory/4908-69-0x000000001BBE0000-0x000000001BBEE000-memory.dmp

Filesize
56KB

Download
memory/4908-71-0x000000001BC80000-0x000000001BC98000-memory.dmp

Filesize
96KB

Download
memory/4908-50-0x000000001BB20000-0x000000001BB30000-memory.dmp

Filesize
64KB

Download
memory/4908-75-0x000000001BCF0000-0x000000001BD3E000-memory.dmp

Filesize
312KB

Download
memory/4908-46-0x000000001BB40000-0x000000001BB52000-memory.dmp

Filesize
72KB

Download
memory/4908-44-0x000000001BAB0000-0x000000001BABE000-memory.dmp

Filesize
56KB

Download
memory/4908-42-0x000000001BAA0000-0x000000001BAAE000-memory.dmp

Filesize
56KB

Download
memory/4908-40-0x000000001BA50000-0x000000001BA60000-memory.dmp

Filesize
64KB

Download
memory/4908-38-0x000000001BA40000-0x000000001BA50000-memory.dmp

Filesize
64KB

Download
memory/4908-36-0x000000001BA80000-0x000000001BA98000-memory.dmp

Filesize
96KB

Download
memory/4908-34-0x0000000002DD0000-0x0000000002DE0000-memory.dmp

Filesize
64KB

Download
memory/4908-32-0x000000001BAD0000-0x000000001BB20000-memory.dmp

Filesize
320KB

Download
memory/4908-31-0x000000001BA60000-0x000000001BA7C000-memory.dmp

Filesize
112KB

Download
memory/4908-29-0x0000000002DC0000-0x0000000002DCE000-memory.dmp

Filesize
56KB

Download
memory/4908-27-0x000000001B700000-0x000000001B726000-memory.dmp

Filesize
152KB

Download
memory/4908-25-0x0000000000840000-0x0000000000BE2000-memory.dmp

Filesize
3.6MB

Download