zgrat | c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

347KB
MD5

1cb742cb95699d994e1cc6810c6f7642
SHA1

103ea603322859742a3e51c5e517a927b9dcd40c
SHA256

c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
SHA512

79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP

6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF

Score

10^/10

zgrat evasion execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral3/files/0x0008000000023288-7.dat	family_zgrat_v1
behavioral3/files/0x0006000000022960-23.dat	family_zgrat_v1
behavioral3/memory/4936-25-0x0000000000C10000-0x0000000000FB2000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Sessionperf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\services.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\services.exe\", \"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Idle.exe\", \"C:\\Program Files (x86)\\MSBuild\\Microsoft\\upfc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\TextInputHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\TextInputHost.exe\", \"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\", \"C:\\Program Files (x86)\\Windows Defender\\services.exe\""	Sessionperf.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4924	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4340	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4028	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3372	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4904	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2636	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1916	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4564	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4588	2592	schtasks.exe	97
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	2592	schtasks.exe	97

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
396	powershell.exe
3644	powershell.exe
1076	powershell.exe
4704	powershell.exe
1360	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Loader.exeChecker.exeWScript.exeSessionperf.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Checker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Sessionperf.exe

Executes dropped EXE 3 IoCs

Processes:

Checker.exeSessionperf.exeservices.exe

pid	Process
4908	Checker.exe
4936	Sessionperf.exe
4780	services.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Sessionperf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\blockcontainerWincrtdll\\TextInputHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Program Files (x86)\\Google\\fontdrvhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\upfc.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TextInputHost = "\"C:\\blockcontainerWincrtdll\\TextInputHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Defender\\services.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\services = "\"C:\\Program Files (x86)\\Windows Defender\\services.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\MSBuild\\Microsoft\\upfc.exe\""	Sessionperf.exe

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	Process
File created	\??\c:\Windows\System32\CSC4AF017437F2A4355B99429D230817EF.TMP	csc.exe
File created	\??\c:\Windows\System32\taz5vb.exe	csc.exe

Drops file in Program Files directory 8 IoCs

Processes:

Sessionperf.exe

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\Microsoft\ea1d8f6d871115	Sessionperf.exe
File created	C:\Program Files (x86)\Google\fontdrvhost.exe	Sessionperf.exe
File created	C:\Program Files (x86)\Google\5b884080fd4f94	Sessionperf.exe
File created	C:\Program Files (x86)\Windows Defender\services.exe	Sessionperf.exe
File created	C:\Program Files (x86)\Windows Defender\c5b4cb5e9653cc	Sessionperf.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Idle.exe	Sessionperf.exe
File created	C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\6ccacd8608530f	Sessionperf.exe
File created	C:\Program Files (x86)\MSBuild\Microsoft\upfc.exe	Sessionperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
2400	schtasks.exe
4028	schtasks.exe
4564	schtasks.exe
4588	schtasks.exe
4132	schtasks.exe
4904	schtasks.exe
1916	schtasks.exe
2008	schtasks.exe
1724	schtasks.exe
3372	schtasks.exe
4396	schtasks.exe
4924	schtasks.exe
4340	schtasks.exe
2676	schtasks.exe
2636	schtasks.exe

Modifies registry class 2 IoCs

Processes:

Checker.exeSessionperf.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	Sessionperf.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
3948	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sessionperf.exe

pid	Process
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe
4936	Sessionperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

services.exe

pid	Process
4780	services.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Loader.exeSessionperf.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeservices.exe

description	pid	Process
Token: SeDebugPrivilege	4212	Loader.exe
Token: SeDebugPrivilege	4936	Sessionperf.exe
Token: SeDebugPrivilege	1076	powershell.exe
Token: SeDebugPrivilege	396	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	4780	services.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

services.exe

pid	Process
4780	services.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

Loader.exeChecker.exeWScript.execmd.exeSessionperf.execsc.execmd.exe

description	pid	Process	procid_target
PID 4212 wrote to memory of 4908	4212	Loader.exe	85
PID 4212 wrote to memory of 4908	4212	Loader.exe	85
PID 4212 wrote to memory of 4908	4212	Loader.exe	85
PID 4908 wrote to memory of 3160	4908	Checker.exe	87
PID 4908 wrote to memory of 3160	4908	Checker.exe	87
PID 4908 wrote to memory of 3160	4908	Checker.exe	87
PID 3160 wrote to memory of 2488	3160	WScript.exe	89
PID 3160 wrote to memory of 2488	3160	WScript.exe	89
PID 3160 wrote to memory of 2488	3160	WScript.exe	89
PID 2488 wrote to memory of 3948	2488	cmd.exe	91
PID 2488 wrote to memory of 3948	2488	cmd.exe	91
PID 2488 wrote to memory of 3948	2488	cmd.exe	91
PID 2488 wrote to memory of 4936	2488	cmd.exe	92
PID 2488 wrote to memory of 4936	2488	cmd.exe	92
PID 4936 wrote to memory of 64	4936	Sessionperf.exe	101
PID 4936 wrote to memory of 64	4936	Sessionperf.exe	101
PID 64 wrote to memory of 3456	64	csc.exe	103
PID 64 wrote to memory of 3456	64	csc.exe	103
PID 4936 wrote to memory of 1360	4936	Sessionperf.exe	116
PID 4936 wrote to memory of 1360	4936	Sessionperf.exe	116
PID 4936 wrote to memory of 396	4936	Sessionperf.exe	117
PID 4936 wrote to memory of 396	4936	Sessionperf.exe	117
PID 4936 wrote to memory of 4704	4936	Sessionperf.exe	118
PID 4936 wrote to memory of 4704	4936	Sessionperf.exe	118
PID 4936 wrote to memory of 1076	4936	Sessionperf.exe	119
PID 4936 wrote to memory of 1076	4936	Sessionperf.exe	119
PID 4936 wrote to memory of 3644	4936	Sessionperf.exe	120
PID 4936 wrote to memory of 3644	4936	Sessionperf.exe	120
PID 4936 wrote to memory of 924	4936	Sessionperf.exe	125
PID 4936 wrote to memory of 924	4936	Sessionperf.exe	125
PID 924 wrote to memory of 3016	924	cmd.exe	128
PID 924 wrote to memory of 3016	924	cmd.exe	128
PID 924 wrote to memory of 3812	924	cmd.exe	129
PID 924 wrote to memory of 3812	924	cmd.exe	129
PID 924 wrote to memory of 4780	924	cmd.exe	133
PID 924 wrote to memory of 4780	924	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4212
- C:\Users\Admin\AppData\Roaming\Checker.exe
  "C:\Users\Admin\AppData\Roaming\Checker.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2488
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:3948
    - - C:\blockcontainerWincrtdll\Sessionperf.exe
        
        "C:\blockcontainerWincrtdll/Sessionperf.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4936
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m35viu3d\m35viu3d.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:64
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F6A.tmp" "c:\Windows\System32\CSC4AF017437F2A4355B99429D230817EF.TMP"
        7⤵
        
        PID:3456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockcontainerWincrtdll\TextInputHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1360
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Google\fontdrvhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Defender\services.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\MSBuild\Microsoft\upfc.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\fNu27ykjxs.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:924
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3016
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:3812
        
        C:\Program Files (x86)\Windows Defender\services.exe
        
        "C:\Program Files (x86)\Windows Defender\services.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 5 /tr "'C:\blockcontainerWincrtdll\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\blockcontainerWincrtdll\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 7 /tr "'C:\blockcontainerWincrtdll\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1724

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4028

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Defender\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Defender\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Defender\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\MSBuild\Microsoft\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\MSBuild\Microsoft\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
76692775e4781f0c9f0092f5804cfdb1

SHA1
6740e4e4110028c62282ee1e7eb8be576a2bc23a

SHA256
0c451ff3823450d544066237cbfb08556b7ca36c4a0ea085055f69ab35795b00

SHA512
6e0731e3736594d9e86da2fc33e08a663f29100074cc8d46e2716123c946b9eb150c804c7cf8428cac631e1cff984663d41ce3b5e1e77965bd8e2ecf0742af34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
59d97011e091004eaffb9816aa0b9abd

SHA1
1602a56b01dd4b7c577ca27d3117e4bcc1aa657b

SHA256
18f381e0db020a763b8c515c346ef58679ab9c403267eacfef5359e272f7e71d

SHA512
d9ca49c1a17580981e2c1a50d73c0eecaa7a62f8514741512172e395af2a3d80aeb0f71c58bc7f52c18246d57ba67af09b6bff4776877d6cc6f0245c30e092d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3F6A.tmp

Filesize
1KB

MD5
71b6e60a3455cd11f0c7c60d56997965

SHA1
4bfdc3391cc88a6631b3e90e7b31ac6eb63fb222

SHA256
75c2d54fda133994fe83aadf0856d49334196059c87b2d096dccf6b506e53fd4

SHA512
7512e11c13a71e076759e8887f456840e561673ed4f80295c26b059abe7b88c444b2b3d5ecb8a8e08cb2ea6a227a7f2cbbc8eda8b29e8e9862841ec9c77221f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_taahyuhx.qvx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fNu27ykjxs.bat

Filesize
228B

MD5
c69e0812fb7633835fbf0de1c588488d

SHA1
2a667907e522a335ca10a9ed8d8fa81da8c8b0f1

SHA256
ac9c468d1a1ca146cb0dd5a0a48903790815e5be75aa834455cc453e3163490f

SHA512
fe42d8ba77c9b3c58df97a639a08149bb4e02094e6cce9dadf237f9ff8c00e876c3a902426d270fc2bf757e194064816c76abd91af374da88129269eae338ce1

Download Submit
C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
3.9MB

MD5
1003b37d9d942d41a38a83670eaa285c

SHA1
a4ee7ef69fc681caf1116d59578667abb9080ad6

SHA256
d822b616ee7e10b00fead9be9eb0cf9780fdb0b3fec3001ff31c9ce0cb7255ae

SHA512
0c6f4e063cc22ee3c076c95bf5ea1cb593e5b6f40e4f2b8d3723a5c18c14eeecf568dad2a16599967c56588f4918cecd996e475fd20615b07c99de4800309f9a

Download Submit
C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe

Filesize
228B

MD5
4f702b152f4098393712e3fe99b04fbd

SHA1
fec2f913e1fac5053127e175f1ba048c9d8dd25c

SHA256
f0e2bfb22d22aed8ac10eff5a010fad081a5798706b3a6fd7764798cab716eb2

SHA512
7c0844d6591b694d77ecf3d070eb3f70fd99427e41d62167aa58c98c1966a8065d90beb82ab0aa0a42bb80edb3c205dd07bb1d4fc03d989a0cb4df8993635fbf

Download Submit
C:\blockcontainerWincrtdll\Sessionperf.exe

Filesize
3.6MB

MD5
bf0f63bb48eb95aaec6fc6a001c974ce

SHA1
19baab2b0c129ecbd6a1aa21bada3e2e5cdd1136

SHA256
bbb080aed81b8f4d0f5d590c7cb0e56e68da5a27d32d964c32e50e1cb2015edc

SHA512
130f08a7c4901ef47e7d21effe83c19fa442f2ade97967c11e646f949a9e8c2c46e8272a31a5b75f6c279009530cd101a562f1ab31a28fe410273cd69bf6c28c

Download Submit
C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat

Filesize
201B

MD5
159297f9e35114bf97d74622097780d8

SHA1
2aaaf993b9ecb9bae43ccd41585734512ff08355

SHA256
650c37c1afde471e40f77d7aec8603382214e9ec318b7f08ab7653f9c4e87f81

SHA512
a82faa2f64caf669d44eac03705e34bea213c9a74ed73950bd8d2158d1c256ca290b7ffece866c3a03c36a091be70d92157353782061e184e5d44ac937949f69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m35viu3d\m35viu3d.0.cs

Filesize
376B

MD5
d9f14fbf22c66423576584d636342006

SHA1
3e7335627760369b4113eac3b165bc83495bcfe5

SHA256
f33e7d3e2285430f0a3dcbfcde1ece2e8d3fc2eca90af210f02427c6fdaed421

SHA512
587551108831d59ab8df10d9df61aa36c04d02342b1c94e9abd72b7989d6c62bf8d8b475ac4d3a274dd9b1e9e53256a9e24a6a4227ce156a8d56570870b12c52

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\m35viu3d\m35viu3d.cmdline

Filesize
235B

MD5
bdca2dcb29727538199f11613f4164db

SHA1
4fedda97cd602e41277f312dd5125a4dcfe76739

SHA256
fec80b8c159deb142135ecb2169e8fce209393e33280dd8f0a51febc96e5f4a6

SHA512
25d24c1a75314698fa86228343d8721073fc3be50dd9359eb1137477b2ee0db0be00e15e1c933fcbaaf02a7149aa7524253926ccc5990a237814930cc22abb49

Download Submit
\??\c:\Windows\System32\CSC4AF017437F2A4355B99429D230817EF.TMP

Filesize
1KB

MD5
dbd9f08fe1204b55edd7689f0ff86d2f

SHA1
93a0995d1e07ebd10d10d7dd36e7fa021b2b3637

SHA256
300e4915ed524682a79eda6cdd246098e05bb3b84380c692fe50ed7f41177e56

SHA512
aaa1769baabc4858021e071d89a6012a3e5c3f36fab0a93c4160e6265f8e7ad9203c1940fa8f1def91239c68b5e274cccfa14aba75c517bbe341c4c70588f0d8

Download Submit
memory/3644-113-0x0000026B6F4D0000-0x0000026B6F4F2000-memory.dmp

Filesize
136KB

Download
memory/4212-0-0x0000000000980000-0x00000000009DE000-memory.dmp

Filesize
376KB

Download
memory/4212-12-0x00007FF8EA1D0000-0x00007FF8EAC91000-memory.dmp

Filesize
10.8MB

Download
memory/4212-2-0x00007FF8EA1D0000-0x00007FF8EAC91000-memory.dmp

Filesize
10.8MB

Download
memory/4212-1-0x00007FF8EA1D3000-0x00007FF8EA1D5000-memory.dmp

Filesize
8KB

Download
memory/4780-189-0x000000001E960000-0x000000001E9AE000-memory.dmp

Filesize
312KB

Download
memory/4936-32-0x000000001C930000-0x000000001C980000-memory.dmp

Filesize
320KB

Download
memory/4936-73-0x000000001CA40000-0x000000001CA4C000-memory.dmp

Filesize
48KB

Download
memory/4936-52-0x000000001C9C0000-0x000000001C9D6000-memory.dmp

Filesize
88KB

Download
memory/4936-54-0x000000001C9E0000-0x000000001C9F2000-memory.dmp

Filesize
72KB

Download
memory/4936-55-0x000000001CF30000-0x000000001D458000-memory.dmp

Filesize
5.2MB

Download
memory/4936-57-0x000000001C980000-0x000000001C98E000-memory.dmp

Filesize
56KB

Download
memory/4936-59-0x000000001C990000-0x000000001C9A0000-memory.dmp

Filesize
64KB

Download
memory/4936-61-0x000000001CA00000-0x000000001CA10000-memory.dmp

Filesize
64KB

Download
memory/4936-63-0x000000001CA70000-0x000000001CACA000-memory.dmp

Filesize
360KB

Download
memory/4936-67-0x000000001CA20000-0x000000001CA30000-memory.dmp

Filesize
64KB

Download
memory/4936-65-0x000000001CA10000-0x000000001CA1E000-memory.dmp

Filesize
56KB

Download
memory/4936-69-0x000000001CA30000-0x000000001CA3E000-memory.dmp

Filesize
56KB

Download
memory/4936-71-0x000000001CAD0000-0x000000001CAE8000-memory.dmp

Filesize
96KB

Download
memory/4936-50-0x000000001C920000-0x000000001C930000-memory.dmp

Filesize
64KB

Download
memory/4936-75-0x000000001CB40000-0x000000001CB8E000-memory.dmp

Filesize
312KB

Download
memory/4936-48-0x000000001C8F0000-0x000000001C8FC000-memory.dmp

Filesize
48KB

Download
memory/4936-46-0x000000001C9A0000-0x000000001C9B2000-memory.dmp

Filesize
72KB

Download
memory/4936-44-0x000000001C8E0000-0x000000001C8EE000-memory.dmp

Filesize
56KB

Download
memory/4936-42-0x000000001C8A0000-0x000000001C8AE000-memory.dmp

Filesize
56KB

Download
memory/4936-40-0x00000000031C0000-0x00000000031D0000-memory.dmp

Filesize
64KB

Download
memory/4936-38-0x00000000018C0000-0x00000000018D0000-memory.dmp

Filesize
64KB

Download
memory/4936-112-0x000000001CE90000-0x000000001CEDE000-memory.dmp

Filesize
312KB

Download
memory/4936-36-0x000000001C900000-0x000000001C918000-memory.dmp

Filesize
96KB

Download
memory/4936-34-0x00000000018B0000-0x00000000018C0000-memory.dmp

Filesize
64KB

Download
memory/4936-31-0x000000001C880000-0x000000001C89C000-memory.dmp

Filesize
112KB

Download
memory/4936-29-0x0000000001890000-0x000000000189E000-memory.dmp

Filesize
56KB

Download
memory/4936-27-0x000000001C8B0000-0x000000001C8D6000-memory.dmp

Filesize
152KB

Download
memory/4936-25-0x0000000000C10000-0x0000000000FB2000-memory.dmp

Filesize
3.6MB

Download