zgrat | 93fff33d2e1adb0f8fe56338727c0074cab763fc9018ae18884e2ff1c95a6df0

Analysis

max time kernel
259s
max time network
263s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
14-05-2024 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

348KB
MD5

11f654abf3ca9b28cb249e98b804a980
SHA1

bd08373ada451d494b94067f3d68c830f9563e02
SHA256

93fff33d2e1adb0f8fe56338727c0074cab763fc9018ae18884e2ff1c95a6df0
SHA512

f6b97936361a3e9e763d875a6516ce4992d313866b0ce8ba23356c55aca9fda4184fbb37f4723990ac419f1f13b5c4a361a6905e522408008f6b4d0162883de2
SSDEEP

6144:o6IgLSq6ucXCJq7KPx/AuBshtZFDG5YorToy4d96r:QgLNF6fZFDGSovSzC

Score

10^/10

zgrat evasion execution persistence rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 3 IoCs

Processes:

resource	yara_rule
behavioral4/files/0x000600000002a8ab-7.dat	family_zgrat_v1
behavioral4/files/0x000200000002a9a8-23.dat	family_zgrat_v1
behavioral4/memory/1776-25-0x00000000006F0000-0x0000000000A92000-memory.dmp	family_zgrat_v1

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Sessionperf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\SearchHost.exe\", \"C:\\Program Files\\7-Zip\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\SearchHost.exe\", \"C:\\Program Files\\7-Zip\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\lsass.exe\", \"C:\\Recovery\\WindowsRE\\smss.exe\", \"C:\\Program Files (x86)\\Windows NT\\TableTextService\\lsass.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\SearchHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\SearchHost.exe\", \"C:\\Program Files\\7-Zip\\System.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\blockcontainerWincrtdll\\SearchHost.exe\", \"C:\\Program Files\\7-Zip\\System.exe\", \"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\lsass.exe\""	Sessionperf.exe

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3452	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3604	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2276	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3572	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3300	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1616	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3760	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3132	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3328	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2568	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4416	schtasks.exe	84
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	4416	schtasks.exe	84

ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	Process
1884	powershell.exe
920	powershell.exe
3800	powershell.exe
328	powershell.exe
2292	powershell.exe

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

Processes:

Checker.exeSessionperf.exeSystem.exe

pid	Process
2432	Checker.exe
1776	Sessionperf.exe
2284	System.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Sessionperf.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\7-Zip\\System.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\blockcontainerWincrtdll\\SearchHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\7-Zip\\System.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\lsass.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Recovery\\WindowsRE\\smss.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\lsass.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Windows NT\\TableTextService\\lsass.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SearchHost = "\"C:\\blockcontainerWincrtdll\\SearchHost.exe\""	Sessionperf.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\lsass.exe\""	Sessionperf.exe

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	Process
File created	\??\c:\Windows\System32\CSC796031FDE042478189B53B491F7DEC7.TMP	csc.exe
File created	\??\c:\Windows\System32\ocudno.exe	csc.exe

Drops file in Program Files directory 6 IoCs

Processes:

Sessionperf.exe

description	ioc	Process
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\6203df4a6bafc7	Sessionperf.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\lsass.exe	Sessionperf.exe
File created	C:\Program Files (x86)\Windows NT\TableTextService\6203df4a6bafc7	Sessionperf.exe
File created	C:\Program Files\7-Zip\System.exe	Sessionperf.exe
File created	C:\Program Files\7-Zip\27d1bcfc3c54e0	Sessionperf.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe	Sessionperf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	Process
3452	schtasks.exe
2276	schtasks.exe
5040	schtasks.exe
3760	schtasks.exe
3132	schtasks.exe
1064	schtasks.exe
1616	schtasks.exe
2620	schtasks.exe
4652	schtasks.exe
4072	schtasks.exe
2568	schtasks.exe
3604	schtasks.exe
3572	schtasks.exe
3300	schtasks.exe
3328	schtasks.exe

Modifies registry class 2 IoCs

Processes:

Checker.exeSessionperf.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	Checker.exe
Key created	\REGISTRY\USER\S-1-5-21-2457560273-69882387-977367775-1000_Classes\Local Settings	Sessionperf.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

reg.exe

pid	Process
4784	reg.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

Processes:

PING.EXE

pid	Process
3792	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Sessionperf.exe

pid	Process
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe
1776	Sessionperf.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

System.exe

pid	Process
2284	System.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

Loader.exeSessionperf.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeSystem.exe

description	pid	Process
Token: SeDebugPrivilege	2732	Loader.exe
Token: SeDebugPrivilege	1776	Sessionperf.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	920	powershell.exe
Token: SeDebugPrivilege	328	powershell.exe
Token: SeDebugPrivilege	2284	System.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

System.exe

pid	Process
2284	System.exe

Suspicious use of WriteProcessMemory 36 IoCs

Processes:

Loader.exeChecker.exeWScript.execmd.exeSessionperf.execsc.execmd.exe

description	pid	Process	procid_target
PID 2732 wrote to memory of 2432	2732	Loader.exe	78
PID 2732 wrote to memory of 2432	2732	Loader.exe	78
PID 2732 wrote to memory of 2432	2732	Loader.exe	78
PID 2432 wrote to memory of 2192	2432	Checker.exe	79
PID 2432 wrote to memory of 2192	2432	Checker.exe	79
PID 2432 wrote to memory of 2192	2432	Checker.exe	79
PID 2192 wrote to memory of 3200	2192	WScript.exe	80
PID 2192 wrote to memory of 3200	2192	WScript.exe	80
PID 2192 wrote to memory of 3200	2192	WScript.exe	80
PID 3200 wrote to memory of 4784	3200	cmd.exe	82
PID 3200 wrote to memory of 4784	3200	cmd.exe	82
PID 3200 wrote to memory of 4784	3200	cmd.exe	82
PID 3200 wrote to memory of 1776	3200	cmd.exe	83
PID 3200 wrote to memory of 1776	3200	cmd.exe	83
PID 1776 wrote to memory of 1920	1776	Sessionperf.exe	88
PID 1776 wrote to memory of 1920	1776	Sessionperf.exe	88
PID 1920 wrote to memory of 3932	1920	csc.exe	90
PID 1920 wrote to memory of 3932	1920	csc.exe	90
PID 1776 wrote to memory of 2292	1776	Sessionperf.exe	103
PID 1776 wrote to memory of 2292	1776	Sessionperf.exe	103
PID 1776 wrote to memory of 328	1776	Sessionperf.exe	104
PID 1776 wrote to memory of 328	1776	Sessionperf.exe	104
PID 1776 wrote to memory of 3800	1776	Sessionperf.exe	105
PID 1776 wrote to memory of 3800	1776	Sessionperf.exe	105
PID 1776 wrote to memory of 920	1776	Sessionperf.exe	106
PID 1776 wrote to memory of 920	1776	Sessionperf.exe	106
PID 1776 wrote to memory of 1884	1776	Sessionperf.exe	107
PID 1776 wrote to memory of 1884	1776	Sessionperf.exe	107
PID 1776 wrote to memory of 1672	1776	Sessionperf.exe	113
PID 1776 wrote to memory of 1672	1776	Sessionperf.exe	113
PID 1672 wrote to memory of 3152	1672	cmd.exe	115
PID 1672 wrote to memory of 3152	1672	cmd.exe	115
PID 1672 wrote to memory of 3792	1672	cmd.exe	116
PID 1672 wrote to memory of 3792	1672	cmd.exe	116
PID 1672 wrote to memory of 2284	1672	cmd.exe	117
PID 1672 wrote to memory of 2284	1672	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Roaming\Checker.exe
  "C:\Users\Admin\AppData\Roaming\Checker.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat" "
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:4784
    - - C:\blockcontainerWincrtdll\Sessionperf.exe
        
        "C:\blockcontainerWincrtdll/Sessionperf.exe"
        5⤵
        Modifies WinLogon for persistence
        Executes dropped EXE
        Adds Run key to start application
        Drops file in Program Files directory
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1776
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mxobdnfk\mxobdnfk.cmdline"
        6⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8388.tmp" "c:\Windows\System32\CSC796031FDE042478189B53B491F7DEC7.TMP"
        7⤵
        
        PID:3932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\blockcontainerWincrtdll\SearchHost.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\7-Zip\System.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3800
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows NT\TableTextService\lsass.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1884
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\GNi15UcR9I.bat"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3152
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        7⤵
        Runs ping.exe
        
        PID:3792
        
        C:\Program Files\7-Zip\System.exe
        
        "C:\Program Files\7-Zip\System.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 13 /tr "'C:\blockcontainerWincrtdll\SearchHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHost" /sc ONLOGON /tr "'C:\blockcontainerWincrtdll\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3452

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchHostS" /sc MINUTE /mo 7 /tr "'C:\blockcontainerWincrtdll\SearchHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3604

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 13 /tr "'C:\Program Files\7-Zip\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\7-Zip\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Program Files\7-Zip\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3572

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Reference Assemblies\Microsoft\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows NT\TableTextService\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows NT\TableTextService\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
05b3cd21c1ec02f04caba773186ee8d0

SHA1
39e790bfe10abf55b74dfb3603df8fcf6b5e6edb

SHA256
911efc5cf9cbeb697543eb3242f5297e1be46dd6603a390140a9ff031ed9e1e8

SHA512
e751008b032394817beb46937fd93a73be97254c2be94dd42f22fb1306d2715c653ece16fa96eab1a3e73811936768cea6b37888437086fc6f3e3e793a2515eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\GNi15UcR9I.bat

Filesize
161B

MD5
1e72f99d92846ad07f2fdc629d121a02

SHA1
5bc84fa02a3eefd862b973f3a9a123fcd6b61cdc

SHA256
5395a317a87c803171e6de79592f00dc638e1411c57b79ca5ffae47325acd1ca

SHA512
5ba13a5959536e4afac52bba4cff1ad70dfd0c9586e7ea7cd98a69aae3ea40a35f78bd1173fb1cb4ddb354d7eb569088a7e41c7676307ed9c144b68ffbce23da

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8388.tmp

Filesize
1KB

MD5
487f86e42432bb1e00aed9ea30f33805

SHA1
1357d6b51c652e1056740a7ac248294ce945f7f9

SHA256
8863c06c66be862873dcb95a44228dad00047634e1f4bf8fe1d1ddda2eff1ffe

SHA512
721c458b60e8e9b648ed9dcc7a2e04f4ae8050e01d52022b82a36e825795c5324e7938c187348f9647aace56820d96796878e3360f44f4aae68fef149ffe8ba6

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qoak5qiq.ehq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Checker.exe

Filesize
3.9MB

MD5
1003b37d9d942d41a38a83670eaa285c

SHA1
a4ee7ef69fc681caf1116d59578667abb9080ad6

SHA256
d822b616ee7e10b00fead9be9eb0cf9780fdb0b3fec3001ff31c9ce0cb7255ae

SHA512
0c6f4e063cc22ee3c076c95bf5ea1cb593e5b6f40e4f2b8d3723a5c18c14eeecf568dad2a16599967c56588f4918cecd996e475fd20615b07c99de4800309f9a

Download Submit
C:\blockcontainerWincrtdll\SFUqxLlNpV20NJ9uCnUYCbrkrl1WOe98n.vbe

Filesize
228B

MD5
4f702b152f4098393712e3fe99b04fbd

SHA1
fec2f913e1fac5053127e175f1ba048c9d8dd25c

SHA256
f0e2bfb22d22aed8ac10eff5a010fad081a5798706b3a6fd7764798cab716eb2

SHA512
7c0844d6591b694d77ecf3d070eb3f70fd99427e41d62167aa58c98c1966a8065d90beb82ab0aa0a42bb80edb3c205dd07bb1d4fc03d989a0cb4df8993635fbf

Download Submit
C:\blockcontainerWincrtdll\Sessionperf.exe

Filesize
3.6MB

MD5
bf0f63bb48eb95aaec6fc6a001c974ce

SHA1
19baab2b0c129ecbd6a1aa21bada3e2e5cdd1136

SHA256
bbb080aed81b8f4d0f5d590c7cb0e56e68da5a27d32d964c32e50e1cb2015edc

SHA512
130f08a7c4901ef47e7d21effe83c19fa442f2ade97967c11e646f949a9e8c2c46e8272a31a5b75f6c279009530cd101a562f1ab31a28fe410273cd69bf6c28c

Download Submit
C:\blockcontainerWincrtdll\TudTneFnbF0PE5UTQ8BUoLqStO6.bat

Filesize
201B

MD5
159297f9e35114bf97d74622097780d8

SHA1
2aaaf993b9ecb9bae43ccd41585734512ff08355

SHA256
650c37c1afde471e40f77d7aec8603382214e9ec318b7f08ab7653f9c4e87f81

SHA512
a82faa2f64caf669d44eac03705e34bea213c9a74ed73950bd8d2158d1c256ca290b7ffece866c3a03c36a091be70d92157353782061e184e5d44ac937949f69

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mxobdnfk\mxobdnfk.0.cs

Filesize
373B

MD5
125d4f7581aabb9558243ab388965f51

SHA1
786e1c61c56e81b4d50f90dee024e934ba08394e

SHA256
f48a4ed7bb169a64e7fec35b18110496397d383dd25f7cdab77ed8c04e8fe228

SHA512
32f9aedd7b36161597e06c538d80e0bb3df3cdb36e72321f20629e310929c8f58299ca0376476f768737b8238de2593e3b7a260bfb95edfc260a0695f90f0bc9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\mxobdnfk\mxobdnfk.cmdline

Filesize
235B

MD5
d5195c3db62818dba00aba63d46aab62

SHA1
1cd7ffb1d860e2e3d4313dd7205de304da6f56e6

SHA256
63642455c6988a8facc6e45049d05d3f9b8eb3323a944e03976888dfa7238d01

SHA512
316d010225586f37f64b4bae20e131f10b417216bff0868c8fd431acbdd676c20b9be5574e7d59c4892d9595b5fd93e9927ba7ac6d2b34b85dd1c0355aac1a9e

Download Submit
\??\c:\Windows\System32\CSC796031FDE042478189B53B491F7DEC7.TMP

Filesize
1KB

MD5
54cefb6c0b45d232dbd1a7f5f0302149

SHA1
b0848dc50e9529a886c9b9775006439ed6a19907

SHA256
d13416f322d513d42157f0aa991a603ff4d260e963584a4bbe3778e0ff833393

SHA512
89b9da8c2b3b5c91cf64d7660b5038cf7951fe42635f1d1e9efcde11df43cb7c991b2701d64b13008187fbfcf9a99ea0f74cd6acca4c3d77c1f1f0eba429f699

Download Submit
memory/1776-52-0x000000001C350000-0x000000001C366000-memory.dmp

Filesize
88KB

Download
memory/1776-29-0x0000000002B10000-0x0000000002B1E000-memory.dmp

Filesize
56KB

Download
memory/1776-38-0x0000000002B30000-0x0000000002B40000-memory.dmp

Filesize
64KB

Download
memory/1776-40-0x0000000002BA0000-0x0000000002BB0000-memory.dmp

Filesize
64KB

Download
memory/1776-42-0x0000000002CC0000-0x0000000002CCE000-memory.dmp

Filesize
56KB

Download
memory/1776-44-0x0000000002CD0000-0x0000000002CDE000-memory.dmp

Filesize
56KB

Download
memory/1776-46-0x0000000002D80000-0x0000000002D92000-memory.dmp

Filesize
72KB

Download
memory/1776-48-0x0000000002D00000-0x0000000002D0C000-memory.dmp

Filesize
48KB

Download
memory/1776-50-0x0000000002D60000-0x0000000002D70000-memory.dmp

Filesize
64KB

Download
memory/1776-25-0x00000000006F0000-0x0000000000A92000-memory.dmp

Filesize
3.6MB

Download
memory/1776-54-0x000000001C370000-0x000000001C382000-memory.dmp

Filesize
72KB

Download
memory/1776-55-0x000000001C8C0000-0x000000001CDE8000-memory.dmp

Filesize
5.2MB

Download
memory/1776-57-0x0000000002D70000-0x0000000002D7E000-memory.dmp

Filesize
56KB

Download
memory/1776-59-0x000000001C330000-0x000000001C340000-memory.dmp

Filesize
64KB

Download
memory/1776-61-0x000000001C340000-0x000000001C350000-memory.dmp

Filesize
64KB

Download
memory/1776-63-0x000000001C3F0000-0x000000001C44A000-memory.dmp

Filesize
360KB

Download
memory/1776-65-0x000000001C390000-0x000000001C39E000-memory.dmp

Filesize
56KB

Download
memory/1776-67-0x000000001C3A0000-0x000000001C3B0000-memory.dmp

Filesize
64KB

Download
memory/1776-69-0x000000001C3B0000-0x000000001C3BE000-memory.dmp

Filesize
56KB

Download
memory/1776-71-0x000000001C650000-0x000000001C668000-memory.dmp

Filesize
96KB

Download
memory/1776-73-0x000000001C3C0000-0x000000001C3CC000-memory.dmp

Filesize
48KB

Download
memory/1776-75-0x000000001C6C0000-0x000000001C70E000-memory.dmp

Filesize
312KB

Download
memory/1776-34-0x0000000002B20000-0x0000000002B30000-memory.dmp

Filesize
64KB

Download
memory/1776-32-0x0000000002D10000-0x0000000002D60000-memory.dmp

Filesize
320KB

Download
memory/1776-31-0x0000000002B80000-0x0000000002B9C000-memory.dmp

Filesize
112KB

Download
memory/1776-36-0x0000000002CE0000-0x0000000002CF8000-memory.dmp

Filesize
96KB

Download
memory/1776-27-0x0000000002B50000-0x0000000002B76000-memory.dmp

Filesize
152KB

Download
memory/2284-183-0x000000001C480000-0x000000001C489000-memory.dmp

Filesize
36KB

Download
memory/2292-101-0x00000212E3A30000-0x00000212E3A52000-memory.dmp

Filesize
136KB

Download
memory/2732-0-0x0000000000610000-0x000000000066E000-memory.dmp

Filesize
376KB

Download
memory/2732-11-0x00007FFC626A0000-0x00007FFC63162000-memory.dmp

Filesize
10.8MB

Download
memory/2732-2-0x00007FFC626A0000-0x00007FFC63162000-memory.dmp

Filesize
10.8MB

Download
memory/2732-1-0x00007FFC626A3000-0x00007FFC626A5000-memory.dmp

Filesize
8KB

Download