zgrat | d72e20d6e093dcbca62d7a6481f598fe753c664655e3ffd5e3dadce4ef807644

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

437a180db44c659505d08da56b1c5344.exe
Size

1.8MB
MD5

437a180db44c659505d08da56b1c5344
SHA1

63dcc88fc8ca4dc2c25028695b72fc48f9978df2
SHA256

d72e20d6e093dcbca62d7a6481f598fe753c664655e3ffd5e3dadce4ef807644
SHA512

fc28c35c86aecf808101692b459d51eba922743677c48127d91fbc7ddb46202621a87f31e460fdd6915b26564a8ac5fe4ff190ae0dcfdb64f709bc193878582a
SSDEEP

24576:cr3h9VUoVO3iealWdJarwRH7Vq5nTwJfrOTSxiRuxC7HtTlu6uFGBrkSVYNntYrl:cZbnV4koqTCxytBurGBwSVYNWZc7G8p

Score

10^/10

zgrat persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 2 IoCs

resource	yara_rule
behavioral2/memory/2688-1-0x00000000007F0000-0x00000000009CA000-memory.dmp	family_zgrat_v1
behavioral2/files/0x000700000002341d-26.dat	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\explorer.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\twain_32\\explorer.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\twain_32\\explorer.exe\", \"C:\\Users\\Public\\Libraries\\dllhost.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\explorer.exe\", \"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Windows\\twain_32\\explorer.exe\", \"C:\\Users\\Public\\Libraries\\dllhost.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\437a180db44c659505d08da56b1c5344.exe\""	437a180db44c659505d08da56b1c5344.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1312	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3848	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3192	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4532	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3912	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3520	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3636	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5320	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2544	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3388	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5656	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5616	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1388	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4520	4344	schtasks.exe	85
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5792	4344	schtasks.exe	85

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	437a180db44c659505d08da56b1c5344.exe

Executes dropped EXE 1 IoCs

pid	Process
2104	dllhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\437a180db44c659505d08da56b1c5344 = "\"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Libraries\\dllhost.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Public\\Libraries\\dllhost.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\437a180db44c659505d08da56b1c5344 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\437a180db44c659505d08da56b1c5344.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\WindowsRE\\explorer.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\437a180db44c659505d08da56b1c5344 = "\"C:\\Program Files\\Windows Portable Devices\\437a180db44c659505d08da56b1c5344.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\twain_32\\explorer.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Windows\\twain_32\\explorer.exe\""	437a180db44c659505d08da56b1c5344.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\437a180db44c659505d08da56b1c5344 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\437a180db44c659505d08da56b1c5344.exe\""	437a180db44c659505d08da56b1c5344.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC622F2953DFF473F8EEF86FE3AA5C.TMP	csc.exe
File created	\??\c:\Windows\System32\taz5vb.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Portable Devices\5d5d2713534b5f	437a180db44c659505d08da56b1c5344.exe
File created	C:\Program Files\Windows Portable Devices\437a180db44c659505d08da56b1c5344.exe	437a180db44c659505d08da56b1c5344.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\twain_32\explorer.exe	437a180db44c659505d08da56b1c5344.exe
File created	C:\Windows\twain_32\7a0fd90576e088	437a180db44c659505d08da56b1c5344.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3388	schtasks.exe
5656	schtasks.exe
1388	schtasks.exe
5792	schtasks.exe
3848	schtasks.exe
3912	schtasks.exe
3520	schtasks.exe
3636	schtasks.exe
2236	schtasks.exe
2152	schtasks.exe
5616	schtasks.exe
5320	schtasks.exe
2544	schtasks.exe
4520	schtasks.exe
1312	schtasks.exe
3192	schtasks.exe
4532	schtasks.exe
3900	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	437a180db44c659505d08da56b1c5344.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe
2688	437a180db44c659505d08da56b1c5344.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2104	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2688	437a180db44c659505d08da56b1c5344.exe
Token: SeDebugPrivilege	2104	dllhost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 3632	2688	437a180db44c659505d08da56b1c5344.exe	89
PID 2688 wrote to memory of 3632	2688	437a180db44c659505d08da56b1c5344.exe	89
PID 3632 wrote to memory of 5700	3632	csc.exe	91
PID 3632 wrote to memory of 5700	3632	csc.exe	91
PID 2688 wrote to memory of 4240	2688	437a180db44c659505d08da56b1c5344.exe	107
PID 2688 wrote to memory of 4240	2688	437a180db44c659505d08da56b1c5344.exe	107
PID 4240 wrote to memory of 5028	4240	cmd.exe	109
PID 4240 wrote to memory of 5028	4240	cmd.exe	109
PID 4240 wrote to memory of 5552	4240	cmd.exe	110
PID 4240 wrote to memory of 5552	4240	cmd.exe	110
PID 4240 wrote to memory of 2104	4240	cmd.exe	117
PID 4240 wrote to memory of 2104	4240	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\437a180db44c659505d08da56b1c5344.exe
"C:\Users\Admin\AppData\Local\Temp\437a180db44c659505d08da56b1c5344.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jggmdjap\jggmdjap.cmdline"
  2⤵
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3632
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3A4A.tmp" "c:\Windows\System32\CSC622F2953DFF473F8EEF86FE3AA5C.TMP"
    3⤵
    PID:5700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GKFet18XkD.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5028
- - C:\Windows\system32\w32tm.exe
    w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
    3⤵
    PID:5552
- - C:\Recovery\WindowsRE\dllhost.exe
    "C:\Recovery\WindowsRE\dllhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2104

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1312

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3192

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "437a180db44c659505d08da56b1c53444" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Portable Devices\437a180db44c659505d08da56b1c5344.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2236

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "437a180db44c659505d08da56b1c5344" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\437a180db44c659505d08da56b1c5344.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "437a180db44c659505d08da56b1c53444" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\437a180db44c659505d08da56b1c5344.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 13 /tr "'C:\Windows\twain_32\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Windows\twain_32\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3520

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 10 /tr "'C:\Windows\twain_32\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2544

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Users\Public\Libraries\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "437a180db44c659505d08da56b1c53444" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\437a180db44c659505d08da56b1c5344.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1388

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "437a180db44c659505d08da56b1c5344" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\437a180db44c659505d08da56b1c5344.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "437a180db44c659505d08da56b1c53444" /sc MINUTE /mo 11 /tr "'C:\Users\Admin\AppData\Local\Temp\437a180db44c659505d08da56b1c5344.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\explorer.exe

Filesize
1.8MB

MD5
437a180db44c659505d08da56b1c5344

SHA1
63dcc88fc8ca4dc2c25028695b72fc48f9978df2

SHA256
d72e20d6e093dcbca62d7a6481f598fe753c664655e3ffd5e3dadce4ef807644

SHA512
fc28c35c86aecf808101692b459d51eba922743677c48127d91fbc7ddb46202621a87f31e460fdd6915b26564a8ac5fe4ff190ae0dcfdb64f709bc193878582a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GKFet18XkD.bat

Filesize
209B

MD5
cd6dcf0c54c6f30059c07656b58b2337

SHA1
e22f3d6e80122ffea99f83b54024c91bf15e9697

SHA256
3ad50abdd3d0e47ead514606487c105738e536a5d64844028453ce8328c58df8

SHA512
a3dd5dd8cdca887bdbe09c9db505a0a30f11ac74dc0d5357def14ba658d560028534056f1661016b5110daee318b6ecdd88001b22b8a06edb5afabe34e0c1a14

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3A4A.tmp

Filesize
1KB

MD5
c68447f884c945a76d104d4b528bf0eb

SHA1
d0f0f1b3b44428d57fe89ac177553a14de1890f4

SHA256
e193ad24899c5f56454dce0f10bb545f54ab91ffc356f2262c21d7083d9d2bb0

SHA512
0a1f3c7e008526a8dd05fe4e20865e4fa250bcbbfce04ebd192832082eca5c00b580f8c57f083304fd0ef9db70140599a95ee393f91f61ee4c04a847524f5f9e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jggmdjap\jggmdjap.0.cs

Filesize
366B

MD5
4e1a10f31157621a4f851807428086e1

SHA1
49485736703c4c04026ac6bd6ff700c5f32952be

SHA256
8d6f2bfa3d55d36d3de91d3ed1a50f5a785566defdecb43399550129d1d05310

SHA512
d5e60d8247b60d91336a39af0b25c5d3f687f68928d72ca24423c8e42b5736fd4ceb3684e5d41bd1364f6171326425a24155b1e74157e9198a4e2dff511ce269

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jggmdjap\jggmdjap.cmdline

Filesize
235B

MD5
0710caaa1daf11ec017043998013eaaf

SHA1
cd022bb47482f34e7193f15340f771f061c055d8

SHA256
c006a3e7c6a94bbc4b521a6baafdaceffd646048a9f258d6b8c6004b67c736b7

SHA512
d160efbcedb099b2910f4416326c5e039352fc9c67f06778cdfd2839c4b246ba3d9746cb8a1f9accbd484dd1a777f63b369811a699415261c2d3cd74e36bcd3b

Download Submit
\??\c:\Windows\System32\CSC622F2953DFF473F8EEF86FE3AA5C.TMP

Filesize
1KB

MD5
dbd9f08fe1204b55edd7689f0ff86d2f

SHA1
93a0995d1e07ebd10d10d7dd36e7fa021b2b3637

SHA256
300e4915ed524682a79eda6cdd246098e05bb3b84380c692fe50ed7f41177e56

SHA512
aaa1769baabc4858021e071d89a6012a3e5c3f36fab0a93c4160e6265f8e7ad9203c1940fa8f1def91239c68b5e274cccfa14aba75c517bbe341c4c70588f0d8

Download Submit
memory/2104-59-0x000000001C4B0000-0x000000001C5B2000-memory.dmp

Filesize
1.0MB

Download
memory/2688-19-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-30-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-9-0x000000001B990000-0x000000001B9E0000-memory.dmp

Filesize
320KB

Download
memory/2688-14-0x0000000002B80000-0x0000000002B8C000-memory.dmp

Filesize
48KB

Download
memory/2688-15-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-1-0x00000000007F0000-0x00000000009CA000-memory.dmp

Filesize
1.9MB

Download
memory/2688-10-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-28-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-29-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-12-0x000000001B940000-0x000000001B958000-memory.dmp

Filesize
96KB

Download
memory/2688-31-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-35-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-8-0x000000001B920000-0x000000001B93C000-memory.dmp

Filesize
112KB

Download
memory/2688-6-0x0000000002B70000-0x0000000002B7E000-memory.dmp

Filesize
56KB

Download
memory/2688-4-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-3-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-51-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-2-0x00007FF990900000-0x00007FF9913C1000-memory.dmp

Filesize
10.8MB

Download
memory/2688-0-0x00007FF990903000-0x00007FF990905000-memory.dmp

Filesize
8KB

Download