zgrat | 93fff33d2e1adb0f8fe56338727c0074cab763fc9018ae18884e2ff1c95a6df0

Analysis

max time kernel
259s
max time network
255s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14-05-2024 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

348KB
MD5

11f654abf3ca9b28cb249e98b804a980
SHA1

bd08373ada451d494b94067f3d68c830f9563e02
SHA256

93fff33d2e1adb0f8fe56338727c0074cab763fc9018ae18884e2ff1c95a6df0
SHA512

f6b97936361a3e9e763d875a6516ce4992d313866b0ce8ba23356c55aca9fda4184fbb37f4723990ac419f1f13b5c4a361a6905e522408008f6b4d0162883de2
SSDEEP

6144:o6IgLSq6ucXCJq7KPx/AuBshtZFDG5YorToy4d96r:QgLNF6fZFDGSovSzC

Score

10^/10

zgrat evasion execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 5 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001226d-8.dat	family_zgrat_v1
behavioral2/files/0x0038000000015cbf-20.dat	family_zgrat_v1
behavioral2/memory/2724-24-0x0000000001260000-0x0000000001602000-memory.dmp	family_zgrat_v1
behavioral2/memory/1760-128-0x0000000000B80000-0x0000000000F22000-memory.dmp	family_zgrat_v1
behavioral2/memory/1604-173-0x00000000013C0000-0x0000000001762000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\L2Schemas\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\L2Schemas\\Idle.exe\", \"C:\\blockcontainerWincrtdll\\taskhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\L2Schemas\\Idle.exe\", \"C:\\blockcontainerWincrtdll\\taskhost.exe\", \"C:\\Windows\\Branding\\wininit.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\L2Schemas\\Idle.exe\", \"C:\\blockcontainerWincrtdll\\taskhost.exe\", \"C:\\Windows\\Branding\\wininit.exe\", \"C:\\blockcontainerWincrtdll\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\L2Schemas\\Idle.exe\", \"C:\\blockcontainerWincrtdll\\taskhost.exe\", \"C:\\Windows\\Branding\\wininit.exe\", \"C:\\blockcontainerWincrtdll\\Idle.exe\", \"C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\conhost.exe\""	Sessionperf.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	480	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	996	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	272	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	780	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	308	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1792	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1492	1244	schtasks.exe	34
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2924	1244	schtasks.exe	34

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
676	powershell.exe
2368	powershell.exe
1260	powershell.exe
2352	powershell.exe
1624	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2612	Checker.exe
2724	Sessionperf.exe
1760	Idle.exe
1604	conhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2788	cmd.exe
2788	cmd.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\L2Schemas\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\blockcontainerWincrtdll\\taskhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\blockcontainerWincrtdll\\taskhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Branding\\wininit.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\conhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\conhost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Windows\\L2Schemas\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Branding\\wininit.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\blockcontainerWincrtdll\\Idle.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\blockcontainerWincrtdll\\Idle.exe\""	Sessionperf.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC80CE99B1922F4E16B21752D98B44FB54.TMP	csc.exe
File created	\??\c:\Windows\System32\hccjfr.exe	csc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe	Sessionperf.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\088424020bedd6	Sessionperf.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\L2Schemas\Idle.exe	Sessionperf.exe
File opened for modification	C:\Windows\L2Schemas\Idle.exe	Sessionperf.exe
File created	C:\Windows\L2Schemas\6ccacd8608530f	Sessionperf.exe
File created	C:\Windows\Branding\wininit.exe	Sessionperf.exe
File created	C:\Windows\Branding\56085415360792	Sessionperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2604	schtasks.exe
2924	schtasks.exe
1196	schtasks.exe
1956	schtasks.exe
1152	schtasks.exe
308	schtasks.exe
480	schtasks.exe
1792	schtasks.exe
780	schtasks.exe
1668	schtasks.exe
1492	schtasks.exe
2440	schtasks.exe
996	schtasks.exe
272	schtasks.exe
2884	schtasks.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2644	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2212	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe
2724	Sessionperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1760	Idle.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	Loader.exe
Token: SeDebugPrivilege	2724	Sessionperf.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1260	powershell.exe
Token: SeDebugPrivilege	2352	powershell.exe
Token: SeDebugPrivilege	676	powershell.exe
Token: SeDebugPrivilege	2368	powershell.exe
Token: SeDebugPrivilege	1760	Idle.exe
Token: SeDebugPrivilege	1604	conhost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1760	Idle.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2612	1684	Loader.exe	28
PID 1684 wrote to memory of 2612	1684	Loader.exe	28
PID 1684 wrote to memory of 2612	1684	Loader.exe	28
PID 1684 wrote to memory of 2612	1684	Loader.exe	28
PID 2612 wrote to memory of 2648	2612	Checker.exe	29
PID 2612 wrote to memory of 2648	2612	Checker.exe	29
PID 2612 wrote to memory of 2648	2612	Checker.exe	29
PID 2612 wrote to memory of 2648	2612	Checker.exe	29
PID 2648 wrote to memory of 2788	2648	WScript.exe	30
PID 2648 wrote to memory of 2788	2648	WScript.exe	30
PID 2648 wrote to memory of 2788	2648	WScript.exe	30
PID 2648 wrote to memory of 2788	2648	WScript.exe	30
PID 2788 wrote to memory of 2644	2788	cmd.exe	32
PID 2788 wrote to memory of 2644	2788	cmd.exe	32
PID 2788 wrote to memory of 2644	2788	cmd.exe	32
PID 2788 wrote to memory of 2644	2788	cmd.exe	32
PID 2788 wrote to memory of 2724	2788	cmd.exe	33
PID 2788 wrote to memory of 2724	2788	cmd.exe	33
PID 2788 wrote to memory of 2724	2788	cmd.exe	33
PID 2788 wrote to memory of 2724	2788	cmd.exe	33
PID 2724 wrote to memory of 2400	2724	Sessionperf.exe	38
PID 2724 wrote to memory of 2400	2724	Sessionperf.exe	38
PID 2724 wrote to memory of 2400	2724	Sessionperf.exe	38
PID 2400 wrote to memory of 1992	2400	csc.exe	40
PID 2400 wrote to memory of 1992	2400	csc.exe	40
PID 2400 wrote to memory of 1992	2400	csc.exe	40
PID 2724 wrote to memory of 1624	2724	Sessionperf.exe	53
PID 2724 wrote to memory of 1624	2724	Sessionperf.exe	53
PID 2724 wrote to memory of 1624	2724	Sessionperf.exe	53
PID 2724 wrote to memory of 676	2724	Sessionperf.exe	54
PID 2724 wrote to memory of 676	2724	Sessionperf.exe	54
PID 2724 wrote to memory of 676	2724	Sessionperf.exe	54
PID 2724 wrote to memory of 2368	2724	Sessionperf.exe	55
PID 2724 wrote to memory of 2368	2724	Sessionperf.exe	55
PID 2724 wrote to memory of 2368	2724	Sessionperf.exe	55
PID 2724 wrote to memory of 2352	2724	Sessionperf.exe	56
PID 2724 wrote to memory of 2352	2724	Sessionperf.exe	56
PID 2724 wrote to memory of 2352	2724	Sessionperf.exe	56
PID 2724 wrote to memory of 1260	2724	Sessionperf.exe	57
PID 2724 wrote to memory of 1260	2724	Sessionperf.exe	57
PID 2724 wrote to memory of 1260	2724	Sessionperf.exe	57
PID 2724 wrote to memory of 1136	2724	Sessionperf.exe	63
PID 2724 wrote to memory of 1136	2724	Sessionperf.exe	63
PID 2724 wrote to memory of 1136	2724	Sessionperf.exe	63
PID 1136 wrote to memory of 1520	1136	cmd.exe	65
PID 1136 wrote to memory of 1520	1136	cmd.exe	65
PID 1136 wrote to memory of 1520	1136	cmd.exe	65
PID 1136 wrote to memory of 2212	1136	cmd.exe	66
PID 1136 wrote to memory of 2212	1136	cmd.exe	66
PID 1136 wrote to memory of 2212	1136	cmd.exe	66
PID 1136 wrote to memory of 1760	1136	cmd.exe	67
PID 1136 wrote to memory of 1760	1136	cmd.exe	67
PID 1136 wrote to memory of 1760	1136	cmd.exe	67
PID 1744 wrote to memory of 1604	1744	taskeng.exe	71
PID 1744 wrote to memory of 1604	1744	taskeng.exe	71
PID 1744 wrote to memory of 1604	1744	taskeng.exe	71

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Roaming\Checker.exe
  "C:\Users\Admin\AppData\Roaming\Checker.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat" "
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:2644
    - - C:\blockcontainerWincrtdll\Sessionperf.exe
        
        "C:\blockcontainerWincrtdll/Sessionperf.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2724
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kob43vet\kob43vet.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES472E.tmp" "c:\Windows\System32\CSC80CE99B1922F4E16B21752D98B44FB54.TMP"
        7⤵
        
        PID:1992
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\L2Schemas\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockcontainerWincrtdll\taskhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Branding\wininit.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockcontainerWincrtdll\Idle.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1260
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\AK04JJGLgh.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:1520
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:2212
        
        C:\blockcontainerWincrtdll\Idle.exe
        
        "C:\blockcontainerWincrtdll\Idle.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\L2Schemas\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\L2Schemas\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 5 /tr "'C:\Windows\L2Schemas\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2440

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 6 /tr "'C:\blockcontainerWincrtdll\taskhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:480

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\blockcontainerWincrtdll\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 9 /tr "'C:\blockcontainerWincrtdll\taskhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Branding\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Branding\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 10 /tr "'C:\Windows\Branding\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\blockcontainerWincrtdll\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:308

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\blockcontainerWincrtdll\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\blockcontainerWincrtdll\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2924

C:\Windows\system32\taskeng.exe
taskeng.exe {FFFCDD30-AC25-4931-932E-C8CF620A4AE5} S-1-5-21-3691908287-3775019229-3534252667-1000:UOTHCPHQ\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\conhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\AK04JJGLgh.bat

Filesize
163B

MD5
63c6c2c647f40a7d542e600cfe5d3d20

SHA1
7ccca841a05a312ba63447eceb50e010044136c7

SHA256
9d46ba05181f968fe9a9ab95a643bea7a343cfe69c7c24c573de2b548e92bf46

SHA512
03a9172986c0ce5f319362e9a9d0a98fd20fa222f9fcd7a1b07603651dd12c9cfda71e766a90b25dfc1f555866d102ce0ea90285296e23fa7fc9352038092f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES472E.tmp

Filesize
1KB

MD5
d756d8586c1f04d20710228004408081

SHA1
3b943042fa56cc14facfb3afc79ffb1bb64f5c3a

SHA256
0ea2cc6de8e930781458bbf7a421e581994d0a60c6502287250bc34af1328c9e

SHA512
3596480f2c087e0797ff24fbc873e5bb2d4ad4cffe4138c0fb210d0199be8aa78e7f0b165665c0965c55fd5dc32268a61826e0ed04d586c95e52a64acfa04816

Download Submit
C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
3.9MB

MD5
1003b37d9d942d41a38a83670eaa285c

SHA1
a4ee7ef69fc681caf1116d59578667abb9080ad6

SHA256
d822b616ee7e10b00fead9be9eb0cf9780fdb0b3fec3001ff31c9ce0cb7255ae

SHA512
0c6f4e063cc22ee3c076c95bf5ea1cb593e5b6f40e4f2b8d3723a5c18c14eeecf568dad2a16599967c56588f4918cecd996e475fd20615b07c99de4800309f9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
486ed656b41acf1770f9e6ec5959d50c

SHA1
5493225e375536f84b35368c50bba9cad5a3067c

SHA256
476173b428a910e0ced5ff5545af2fb476b29007694633e054e174b525c67c63

SHA512
b14b6f5811646467baee2cd759d4be49d57927efab2dc5b4dbbf55e4931edebf4a1c59be9169c7327f04cd06d00c7bbdd26dc8c97341fe9680757a33c29df07e

Download Submit
C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe

Filesize
228B

MD5
4f702b152f4098393712e3fe99b04fbd

SHA1
fec2f913e1fac5053127e175f1ba048c9d8dd25c

SHA256
f0e2bfb22d22aed8ac10eff5a010fad081a5798706b3a6fd7764798cab716eb2

SHA512
7c0844d6591b694d77ecf3d070eb3f70fd99427e41d62167aa58c98c1966a8065d90beb82ab0aa0a42bb80edb3c205dd07bb1d4fc03d989a0cb4df8993635fbf

Download Submit
C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat

Filesize
201B

MD5
159297f9e35114bf97d74622097780d8

SHA1
2aaaf993b9ecb9bae43ccd41585734512ff08355

SHA256
650c37c1afde471e40f77d7aec8603382214e9ec318b7f08ab7653f9c4e87f81

SHA512
a82faa2f64caf669d44eac03705e34bea213c9a74ed73950bd8d2158d1c256ca290b7ffece866c3a03c36a091be70d92157353782061e184e5d44ac937949f69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kob43vet\kob43vet.0.cs

Filesize
361B

MD5
338484b71ab362e55a216c6d15955772

SHA1
8bb00f7e60795773aadf30a9d68e280ccf48396d

SHA256
065e7ff6692b96a4e88d6d686a022d5d9a25e88a3b945f3507cef163b7f34fdd

SHA512
637ba3aa23cbde8e677238a44e4f84bf11ca5420781611274a87448484f67d4e24906ed63cf5178c66d728d5b424bf748b5d44e79f799533e266286297951ef9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kob43vet\kob43vet.cmdline

Filesize
235B

MD5
a583fd83c2665bf2fe4624b4374598c6

SHA1
d8e84abd1557f8a48800bda5d0899790405b6154

SHA256
29f0ebbbf6a05b537571573f1f52923f20a2d63ac803cf19883fc6f87b7da4a6

SHA512
322680389ea2f817604475c92e674a57f135e54c185677a8a94f77c4b3981700b516149feab9688849f33d50ed36298179266f9a3c1ded8c4139ccb35ae9186c

Download Submit
\??\c:\Windows\System32\CSC80CE99B1922F4E16B21752D98B44FB54.TMP

Filesize
1KB

MD5
707f3ae17d1443518c14e3d57f6b0fa5

SHA1
78ac15700b932222fa2ce60142966a1716c90838

SHA256
1fafc870513c7e90d1f2569dd473478821fb4798e8eb51e1f8a1620b3bf29aea

SHA512
ac3805f209da253c7eb6758d472a7c6a084392594a4dd7389dc926181933f9333fa0a74d7f749bc7ecb0b901afa5cad91d64d62989122acd3f4b583c3a4e2c9f

Download Submit
\blockcontainerWincrtdll\Sessionperf.exe

Filesize
3.6MB

MD5
bf0f63bb48eb95aaec6fc6a001c974ce

SHA1
19baab2b0c129ecbd6a1aa21bada3e2e5cdd1136

SHA256
bbb080aed81b8f4d0f5d590c7cb0e56e68da5a27d32d964c32e50e1cb2015edc

SHA512
130f08a7c4901ef47e7d21effe83c19fa442f2ade97967c11e646f949a9e8c2c46e8272a31a5b75f6c279009530cd101a562f1ab31a28fe410273cd69bf6c28c

Download Submit
memory/676-109-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/1604-173-0x00000000013C0000-0x0000000001762000-memory.dmp

Filesize
3.6MB

Download
memory/1624-114-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/1684-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

Filesize
4KB

Download
memory/1684-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1684-1-0x0000000000220000-0x000000000027E000-memory.dmp

Filesize
376KB

Download
memory/1684-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1684-9-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

Filesize
9.9MB

Download
memory/1760-128-0x0000000000B80000-0x0000000000F22000-memory.dmp

Filesize
3.6MB

Download
memory/2724-50-0x0000000000D90000-0x0000000000DA6000-memory.dmp

Filesize
88KB

Download
memory/2724-72-0x000000001B850000-0x000000001B89E000-memory.dmp

Filesize
312KB

Download
memory/2724-46-0x0000000000B10000-0x0000000000B1C000-memory.dmp

Filesize
48KB

Download
memory/2724-52-0x0000000000DB0000-0x0000000000DC2000-memory.dmp

Filesize
72KB

Download
memory/2724-54-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Filesize
56KB

Download
memory/2724-56-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Filesize
64KB

Download
memory/2724-58-0x0000000000BF0000-0x0000000000C00000-memory.dmp

Filesize
64KB

Download
memory/2724-60-0x0000000000F60000-0x0000000000FBA000-memory.dmp

Filesize
360KB

Download
memory/2724-62-0x0000000000DD0000-0x0000000000DDE000-memory.dmp

Filesize
56KB

Download
memory/2724-64-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

Filesize
64KB

Download
memory/2724-66-0x0000000000DF0000-0x0000000000DFE000-memory.dmp

Filesize
56KB

Download
memory/2724-68-0x0000000000E20000-0x0000000000E38000-memory.dmp

Filesize
96KB

Download
memory/2724-70-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/2724-48-0x0000000000BA0000-0x0000000000BB0000-memory.dmp

Filesize
64KB

Download
memory/2724-44-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Filesize
72KB

Download
memory/2724-42-0x0000000000860000-0x000000000086E000-memory.dmp

Filesize
56KB

Download
memory/2724-40-0x0000000000620000-0x000000000062E000-memory.dmp

Filesize
56KB

Download
memory/2724-38-0x00000000005F0000-0x0000000000600000-memory.dmp

Filesize
64KB

Download
memory/2724-36-0x00000000005E0000-0x00000000005F0000-memory.dmp

Filesize
64KB

Download
memory/2724-34-0x0000000000840000-0x0000000000858000-memory.dmp

Filesize
96KB

Download
memory/2724-32-0x0000000000310000-0x0000000000320000-memory.dmp

Filesize
64KB

Download
memory/2724-30-0x0000000000600000-0x000000000061C000-memory.dmp

Filesize
112KB

Download
memory/2724-28-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/2724-26-0x00000000003A0000-0x00000000003C6000-memory.dmp

Filesize
152KB

Download
memory/2724-24-0x0000000001260000-0x0000000001602000-memory.dmp

Filesize
3.6MB

Download