zgrat | c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70

max time kernel
145s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
13-05-2024 22:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

347KB
MD5

1cb742cb95699d994e1cc6810c6f7642
SHA1

103ea603322859742a3e51c5e517a927b9dcd40c
SHA256

c9c660914e4d58a6e0dd460afae6e4af288c9f191ad8592dc95db5a69868fc70
SHA512

79f9a70232b3470ef9386d9b3d987b5370d0562959315d8239509000a1aa9274b13cecc4c6c871cd4d258a0cd19d30574e3280edd54fb108b6ffca7d8c7e4795
SSDEEP

6144:RrwFDD0tZzmf7GxMLEYaEzE2d9JK5/J1pZKM35QM6KkfiruhbOuzB:Rg07e7seE2dK71rKu5Q6kfirIbOuF

Score

10^/10

zgrat evasion execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral4/files/0x000a000000028cee-8.dat	family_zgrat_v1
behavioral4/files/0x000200000002aa0f-24.dat	family_zgrat_v1
behavioral4/memory/708-26-0x0000000000D60000-0x0000000001102000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Sessionperf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\csrss.exe\", \"C:\\Windows\\Sun\\Java\\Deployment\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Documents\\OfficeClickToRun.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\csrss.exe\", \"C:\\Windows\\Sun\\Java\\Deployment\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Documents\\OfficeClickToRun.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\legal\\winlogon.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\csrss.exe\", \"C:\\Windows\\Sun\\Java\\Deployment\\StartMenuExperienceHost.exe\", \"C:\\Users\\Default\\Documents\\OfficeClickToRun.exe\", \"C:\\Program Files\\Java\\jdk-1.8\\legal\\winlogon.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\en-US\\sysmon.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\csrss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\csrss.exe\", \"C:\\Windows\\Sun\\Java\\Deployment\\StartMenuExperienceHost.exe\""	Sessionperf.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1748	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	776	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4156	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4552	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4332	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	796	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3728	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4780	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4856	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1148	968	schtasks.exe	89
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2800	968	schtasks.exe	89

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
2880	powershell.exe
2836	powershell.exe
2640	powershell.exe
2008	powershell.exe
2940	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

Processes:

Checker.exeSessionperf.execsrss.exe

pid	Process
4216	Checker.exe
708	Sessionperf.exe
1512	csrss.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Sessionperf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\blockcontainerWincrtdll\\csrss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default\\Documents\\OfficeClickToRun.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Java\\jdk-1.8\\legal\\winlogon.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Internet Explorer\\en-US\\sysmon.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\blockcontainerWincrtdll\\csrss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Sun\\Java\\Deployment\\StartMenuExperienceHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "\"C:\\Users\\Default\\Documents\\OfficeClickToRun.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\Program Files\\Java\\jdk-1.8\\legal\\winlogon.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysmon = "\"C:\\Program Files (x86)\\Internet Explorer\\en-US\\sysmon.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\StartMenuExperienceHost = "\"C:\\Windows\\Sun\\Java\\Deployment\\StartMenuExperienceHost.exe\""	Sessionperf.exe

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	Process
File created	\??\c:\Windows\System32\CSC50C50C304CE24AFDBE6F258F9A6F2348.TMP	csc.exe
File created	\??\c:\Windows\System32\tdzjfo.exe	csc.exe

Drops file in Program Files directory 4 IoCs

Processes:

Sessionperf.exe

description	ioc	Process
File created	C:\Program Files\Java\jdk-1.8\legal\cc11b995f2a76d	Sessionperf.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\sysmon.exe	Sessionperf.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\121e5b5079f7c0	Sessionperf.exe
File created	C:\Program Files\Java\jdk-1.8\legal\winlogon.exe	Sessionperf.exe

Drops file in Windows directory 2 IoCs

Processes:

Sessionperf.exe

description	ioc	Process
File created	C:\Windows\Sun\Java\Deployment\StartMenuExperienceHost.exe	Sessionperf.exe
File created	C:\Windows\Sun\Java\Deployment\55b276f4edf653	Sessionperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
1748	schtasks.exe
1764	schtasks.exe
4780	schtasks.exe
4856	schtasks.exe
776	schtasks.exe
1148	schtasks.exe
2800	schtasks.exe
4156	schtasks.exe
4492	schtasks.exe
1720	schtasks.exe
4332	schtasks.exe
1200	schtasks.exe
3728	schtasks.exe
4552	schtasks.exe
796	schtasks.exe

Modifies registry class 2 IoCs

Processes:

Checker.exeSessionperf.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	Sessionperf.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
476	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sessionperf.exe

pid	Process
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe
708	Sessionperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

csrss.exe

pid	Process
1512	csrss.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Loader.exeSessionperf.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exe

description	pid	Process
Token: SeDebugPrivilege	3016	Loader.exe
Token: SeDebugPrivilege	708	Sessionperf.exe
Token: SeDebugPrivilege	2836	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	2940	powershell.exe
Token: SeDebugPrivilege	2008	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	1512	csrss.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

csrss.exe

pid	Process
1512	csrss.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

Loader.exeChecker.exeWScript.execmd.exeSessionperf.execsc.execmd.exe

description	pid	Process	procid_target
PID 3016 wrote to memory of 4216	3016	Loader.exe	80
PID 3016 wrote to memory of 4216	3016	Loader.exe	80
PID 3016 wrote to memory of 4216	3016	Loader.exe	80
PID 4216 wrote to memory of 4924	4216	Checker.exe	81
PID 4216 wrote to memory of 4924	4216	Checker.exe	81
PID 4216 wrote to memory of 4924	4216	Checker.exe	81
PID 4924 wrote to memory of 2720	4924	WScript.exe	84
PID 4924 wrote to memory of 2720	4924	WScript.exe	84
PID 4924 wrote to memory of 2720	4924	WScript.exe	84
PID 2720 wrote to memory of 476	2720	cmd.exe	86
PID 2720 wrote to memory of 476	2720	cmd.exe	86
PID 2720 wrote to memory of 476	2720	cmd.exe	86
PID 2720 wrote to memory of 708	2720	cmd.exe	87
PID 2720 wrote to memory of 708	2720	cmd.exe	87
PID 708 wrote to memory of 2420	708	Sessionperf.exe	93
PID 708 wrote to memory of 2420	708	Sessionperf.exe	93
PID 2420 wrote to memory of 1684	2420	csc.exe	95
PID 2420 wrote to memory of 1684	2420	csc.exe	95
PID 708 wrote to memory of 2836	708	Sessionperf.exe	108
PID 708 wrote to memory of 2836	708	Sessionperf.exe	108
PID 708 wrote to memory of 2880	708	Sessionperf.exe	109
PID 708 wrote to memory of 2880	708	Sessionperf.exe	109
PID 708 wrote to memory of 2940	708	Sessionperf.exe	110
PID 708 wrote to memory of 2940	708	Sessionperf.exe	110
PID 708 wrote to memory of 2008	708	Sessionperf.exe	111
PID 708 wrote to memory of 2008	708	Sessionperf.exe	111
PID 708 wrote to memory of 2640	708	Sessionperf.exe	112
PID 708 wrote to memory of 2640	708	Sessionperf.exe	112
PID 708 wrote to memory of 3336	708	Sessionperf.exe	118
PID 708 wrote to memory of 3336	708	Sessionperf.exe	118
PID 3336 wrote to memory of 4612	3336	cmd.exe	120
PID 3336 wrote to memory of 4612	3336	cmd.exe	120
PID 3336 wrote to memory of 4636	3336	cmd.exe	121
PID 3336 wrote to memory of 4636	3336	cmd.exe	121
PID 3336 wrote to memory of 1512	3336	cmd.exe	122
PID 3336 wrote to memory of 1512	3336	cmd.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Roaming\Checker.exe
  "C:\Users\Admin\AppData\Roaming\Checker.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2720
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:476
    - - C:\blockcontainerWincrtdll\Sessionperf.exe
        
        "C:\blockcontainerWincrtdll/Sessionperf.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:708
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mqbym0tz\mqbym0tz.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB565.tmp" "c:\Windows\System32\CSC50C50C304CE24AFDBE6F258F9A6F2348.TMP"
        7⤵
        
        PID:1684
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockcontainerWincrtdll\csrss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Sun\Java\Deployment\StartMenuExperienceHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2880
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Documents\OfficeClickToRun.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2940
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Java\jdk-1.8\legal\winlogon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\en-US\sysmon.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2640
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\9RFiL1KRB6.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4612
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        7⤵
        
        PID:4636
        
        C:\blockcontainerWincrtdll\csrss.exe
        
        "C:\blockcontainerWincrtdll\csrss.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\blockcontainerWincrtdll\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\blockcontainerWincrtdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\blockcontainerWincrtdll\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 14 /tr "'C:\Windows\Sun\Java\Deployment\StartMenuExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHost" /sc ONLOGON /tr "'C:\Windows\Sun\Java\Deployment\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1720

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "StartMenuExperienceHostS" /sc MINUTE /mo 10 /tr "'C:\Windows\Sun\Java\Deployment\StartMenuExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4552

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 10 /tr "'C:\Users\Default\Documents\OfficeClickToRun.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Users\Default\Documents\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Documents\OfficeClickToRun.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Program Files\Java\jdk-1.8\legal\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\Java\jdk-1.8\legal\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\Java\jdk-1.8\legal\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\sysmon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4856

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmon" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1148

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sysmons" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\en-US\sysmon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
437395ef86850fbff98c12dff89eb621

SHA1
9cec41e230fa9839de1e5c42b7dbc8b31df0d69c

SHA256
9c39f3e1ee674a289926fddddfc5549740c488686ec6513f53848a225c192ba6

SHA512
bc669893f5c97e80a62fc3d15383ed7c62ffc86bc986401735903019bb96a5f13e4d0f6356baa2021267503a4eb62681e58e28fcff435350e83aa425fa76cd64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1a9fa92a4f2e2ec9e244d43a6a4f8fb9

SHA1
9910190edfaccece1dfcc1d92e357772f5dae8f7

SHA256
0ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888

SHA512
5d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
05b3cd21c1ec02f04caba773186ee8d0

SHA1
39e790bfe10abf55b74dfb3603df8fcf6b5e6edb

SHA256
911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8

SHA512
e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\9RFiL1KRB6.bat

Filesize
212B

MD5
30569074b8cdebc701bed7eb6649f648

SHA1
ccd099dfcb690e83697df63dd2fdae0026d13941

SHA256
7bd7d5da656800ceb966157ae1e35d09c875f1a9f0340d69de98523d6261288e

SHA512
15ad50d78705a74144c165ca5c2989e1b74d096f747eb38de1c34cfae7163c30629a45c16a548c4051961d245087262d465f18e4ebb41cacb791282cfce267cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESB565.tmp

Filesize
1KB

MD5
d557e0b84b9236fccb952a94a515cac6

SHA1
712f98d3ee76eef4b6074bbb2bbf42168628ab48

SHA256
d5fe2f46bf1e771a79dc0b8060fe96ccb7f3ef0ea654800c988659f777b5c60f

SHA512
cd7d5fa83a9874a62c99f7e10ca9f65668df8339f474b62d72ef5fd0cb74e3146c1d5b99ea9691d1386e8d2098fc27b82eda482921ae770f8036916869b8049d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rx024api.lu3.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
3.9MB

MD5
1003b37d9d942d41a38a83670eaa285c

SHA1
a4ee7ef69fc681caf1116d59578667abb9080ad6

SHA256
d822b616ee7e10b00fead9be9eb0cf9780fdb0b3fec3001ff31c9ce0cb7255ae

SHA512
0c6f4e063cc22ee3c076c95bf5ea1cb593e5b6f40e4f2b8d3723a5c18c14eeecf568dad2a16599967c56588f4918cecd996e475fd20615b07c99de4800309f9a

Download Submit
C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe

Filesize
228B

MD5
4f702b152f4098393712e3fe99b04fbd

SHA1
fec2f913e1fac5053127e175f1ba048c9d8dd25c

SHA256
f0e2bfb22d22aed8ac10eff5a010fad081a5798706b3a6fd7764798cab716eb2

SHA512
7c0844d6591b694d77ecf3d070eb3f70fd99427e41d62167aa58c98c1966a8065d90beb82ab0aa0a42bb80edb3c205dd07bb1d4fc03d989a0cb4df8993635fbf

Download Submit
C:\blockcontainerWincrtdll\Sessionperf.exe

Filesize
3.6MB

MD5
bf0f63bb48eb95aaec6fc6a001c974ce

SHA1
19baab2b0c129ecbd6a1aa21bada3e2e5cdd1136

SHA256
bbb080aed81b8f4d0f5d590c7cb0e56e68da5a27d32d964c32e50e1cb2015edc

SHA512
130f08a7c4901ef47e7d21effe83c19fa442f2ade97967c11e646f949a9e8c2c46e8272a31a5b75f6c279009530cd101a562f1ab31a28fe410273cd69bf6c28c

Download Submit
C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat

Filesize
201B

MD5
159297f9e35114bf97d74622097780d8

SHA1
2aaaf993b9ecb9bae43ccd41585734512ff08355

SHA256
650c37c1afde471e40f77d7aec8603382214e9ec318b7f08ab7653f9c4e87f81

SHA512
a82faa2f64caf669d44eac03705e34bea213c9a74ed73950bd8d2158d1c256ca290b7ffece866c3a03c36a091be70d92157353782061e184e5d44ac937949f69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mqbym0tz\mqbym0tz.0.cs

Filesize
368B

MD5
597078e7f2f6b312e26e1b388e9144f8

SHA1
1822584631d623218a95255385e09bcc2d9379bd

SHA256
e8b291f42fe1090c67bc97fd7053f48a2eee6f49efb7dbfa32908c3eb5b1cd8f

SHA512
02dd997ac5e455588ecb6f961f28ea322c98aa3a31806afc992366442304f5000633e0fe518c8a2d13ed1ac9aac449f223100c7a05c0a5ccfd788ddddd84bdbc

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mqbym0tz\mqbym0tz.cmdline

Filesize
235B

MD5
757033546c5b7a1f03ba59e8c577ac37

SHA1
7f358a9c316f41c26cae2576f42f8eee17c05c36

SHA256
d4a6b2044c3d6e9b825b38d5393e5fd17d8e6448b92f5ff7f9628900426520f2

SHA512
428a934dfa0b4796374f28667929d7128aee9b319a46ca24404fc17060ad2ea1fb2eaa5a5130b9c09bcad465d1d0b3223553158db1e04765442a21b1c09bd88c

Download Submit
\??\c:\Windows\System32\CSC50C50C304CE24AFDBE6F258F9A6F2348.TMP

Filesize
1KB

MD5
1a502a1fc30970b31463301991b83663

SHA1
e0bcd847edd6234a49ececfb30e2b72ba342937a

SHA256
bb5f44725fee83456522fbbc02e8728cd273403428753bce8aedcc411f08fcc3

SHA512
a583e7c099d0c1ccf0c7f005da315001dd35ae5a16ecc11a296da1bf9da25e0b595202b571a001b39bb7545cdf7e93d4d6d6883572ddb54b07ce1ea1572f5819

Download Submit
memory/708-33-0x000000001C080000-0x000000001C0D0000-memory.dmp

Filesize
320KB

Download
memory/708-74-0x000000001C190000-0x000000001C19C000-memory.dmp

Filesize
48KB

Download
memory/708-37-0x000000001C030000-0x000000001C048000-memory.dmp

Filesize
96KB

Download
memory/708-39-0x0000000003350000-0x0000000003360000-memory.dmp

Filesize
64KB

Download
memory/708-41-0x0000000003360000-0x0000000003370000-memory.dmp

Filesize
64KB

Download
memory/708-43-0x000000001BCA0000-0x000000001BCAE000-memory.dmp

Filesize
56KB

Download
memory/708-45-0x000000001C050000-0x000000001C05E000-memory.dmp

Filesize
56KB

Download
memory/708-47-0x000000001C0D0000-0x000000001C0E2000-memory.dmp

Filesize
72KB

Download
memory/708-49-0x000000001C060000-0x000000001C06C000-memory.dmp

Filesize
48KB

Download
memory/708-51-0x000000001C070000-0x000000001C080000-memory.dmp

Filesize
64KB

Download
memory/708-53-0x000000001C110000-0x000000001C126000-memory.dmp

Filesize
88KB

Download
memory/708-55-0x000000001C130000-0x000000001C142000-memory.dmp

Filesize
72KB

Download
memory/708-56-0x000000001C680000-0x000000001CBA8000-memory.dmp

Filesize
5.2MB

Download
memory/708-58-0x000000001C0F0000-0x000000001C0FE000-memory.dmp

Filesize
56KB

Download
memory/708-60-0x000000001C100000-0x000000001C110000-memory.dmp

Filesize
64KB

Download
memory/708-62-0x000000001C150000-0x000000001C160000-memory.dmp

Filesize
64KB

Download
memory/708-64-0x000000001C1C0000-0x000000001C21A000-memory.dmp

Filesize
360KB

Download
memory/708-66-0x000000001C160000-0x000000001C16E000-memory.dmp

Filesize
56KB

Download
memory/708-68-0x000000001C170000-0x000000001C180000-memory.dmp

Filesize
64KB

Download
memory/708-70-0x000000001C180000-0x000000001C18E000-memory.dmp

Filesize
56KB

Download
memory/708-72-0x000000001C220000-0x000000001C238000-memory.dmp

Filesize
96KB

Download
memory/708-35-0x0000000001A70000-0x0000000001A80000-memory.dmp

Filesize
64KB

Download
memory/708-76-0x000000001C490000-0x000000001C4DE000-memory.dmp

Filesize
312KB

Download
memory/708-129-0x000000001CDB0000-0x000000001CE86000-memory.dmp

Filesize
856KB

Download
memory/708-32-0x000000001BC80000-0x000000001BC9C000-memory.dmp

Filesize
112KB

Download
memory/708-30-0x0000000001A60000-0x0000000001A6E000-memory.dmp

Filesize
56KB

Download
memory/708-28-0x000000001C000000-0x000000001C026000-memory.dmp

Filesize
152KB

Download
memory/708-26-0x0000000000D60000-0x0000000001102000-memory.dmp

Filesize
3.6MB

Download
memory/1512-190-0x000000001DDE0000-0x000000001DEB6000-memory.dmp

Filesize
856KB

Download
memory/1512-191-0x000000001D250000-0x000000001D259000-memory.dmp

Filesize
36KB

Download
memory/2008-158-0x0000024930AD0000-0x0000024930C1F000-memory.dmp

Filesize
1.3MB

Download
memory/2640-162-0x0000016DF0E10000-0x0000016DF0F5F000-memory.dmp

Filesize
1.3MB

Download
memory/2836-111-0x0000028179F50000-0x0000028179F72000-memory.dmp

Filesize
136KB

Download
memory/2836-149-0x000002817A210000-0x000002817A35F000-memory.dmp

Filesize
1.3MB

Download
memory/2880-153-0x000001B27ED70000-0x000001B27EEBF000-memory.dmp

Filesize
1.3MB

Download
memory/2940-159-0x0000026D1D7C0000-0x0000026D1D90F000-memory.dmp

Filesize
1.3MB

Download
memory/3016-2-0x00007FF829670000-0x00007FF82A132000-memory.dmp

Filesize
10.8MB

Download
memory/3016-0-0x0000000000C30000-0x0000000000C8E000-memory.dmp

Filesize
376KB

Download
memory/3016-3-0x00007FF829670000-0x00007FF82A132000-memory.dmp

Filesize
10.8MB

Download
memory/3016-19-0x00007FF829670000-0x00007FF82A132000-memory.dmp

Filesize
10.8MB

Download
memory/3016-1-0x00007FF829673000-0x00007FF829675000-memory.dmp

Filesize
8KB

Download