e01bf187051ab20ecf85a9cea1c4c9072fd05658e7a9109e9c080161d9ad2e57

General

Target

containerServerNet.exe
Size

1.8MB
MD5

890b5cd71949526257d1497549da82ef
SHA1

1054441b6b2ec4b87a9e749ba7f2df20d58baa54
SHA256

e01bf187051ab20ecf85a9cea1c4c9072fd05658e7a9109e9c080161d9ad2e57
SHA512

5f65d1802332ead2af69dab9dcffbb8d2b70638c7f78babc72e35007fce09e6472dacb38c7b309490ccbd8cf848d0e365a211571d57b4912e52a5802e2bb0143
SSDEEP

24576:/99RO+iS+lV3yh3+hCXPa+uI04j7xXKIOUm4JWCQlWlEKgplLTRkIREfdJ76h/jR:1MR8UC/XuIJIrt4JW7WlULlkI6L7C9

Score

10^/10

persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

containerServerNet.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\", \"C:\\Windows\\Web\\Wallpaper\\containerServerNet.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\", \"C:\\Windows\\Web\\Wallpaper\\containerServerNet.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\", \"C:\\Windows\\Web\\Wallpaper\\containerServerNet.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\", \"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\", \"C:\\Windows\\Web\\Wallpaper\\containerServerNet.exe\", \"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\lsass.exe\", \"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\", \"C:\\Users\\Admin\\AppData\\Local\\Temp\\containerServerNet.exe\""	containerServerNet.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2684	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2152	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2444	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2508	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2032	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1268	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2188	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1076	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1728	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1200	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2156	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1668	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	628	2580	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1444	2580	schtasks.exe

Executes dropped EXE 1 IoCs

Processes:

containerServerNet.exe

pid process

2264 containerServerNet.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2264	containerServerNet.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

containerServerNet.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\containerServerNet = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\containerServerNet.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\containerServerNet = "\"C:\\Windows\\Web\\Wallpaper\\containerServerNet.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\containerServerNet = "\"C:\\Windows\\Web\\Wallpaper\\containerServerNet.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\MSOCache\\All Users\\{90140000-0011-0000-0000-0000000FF1CE}-C\\lsass.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\containerServerNet = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\containerServerNet.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Recovery\\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\\explorer.exe\""	containerServerNet.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Users\\Public\\Music\\Sample Music\\lsass.exe\""	containerServerNet.exe

Drops file in System32 directory 2 IoCs

Processes:

csc.exe

description	ioc	process
File created	\??\c:\Windows\System32\CSC9390781266E6479684DE396B19B9C161.TMP	csc.exe
File created	\??\c:\Windows\System32\slsogk.exe	csc.exe

Drops file in Program Files directory 2 IoCs

Processes:

containerServerNet.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe	containerServerNet.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\6203df4a6bafc7	containerServerNet.exe

Drops file in Windows directory 2 IoCs

Processes:

containerServerNet.exe

description	ioc	process
File created	C:\Windows\Web\Wallpaper\containerServerNet.exe	containerServerNet.exe
File created	C:\Windows\Web\Wallpaper\ec2123b2142962	containerServerNet.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2684	schtasks.exe
2676	schtasks.exe
2152	schtasks.exe
2444	schtasks.exe
2848	schtasks.exe
1444	schtasks.exe
2156	schtasks.exe
1668	schtasks.exe
2508	schtasks.exe
1268	schtasks.exe
1076	schtasks.exe
1200	schtasks.exe
628	schtasks.exe
2032	schtasks.exe
752	schtasks.exe
2188	schtasks.exe
1728	schtasks.exe
1564	schtasks.exe

Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

containerServerNet.execontainerServerNet.exe

pid	process
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
3024	containerServerNet.exe
2264	containerServerNet.exe
2264	containerServerNet.exe
2264	containerServerNet.exe
2264	containerServerNet.exe
2264	containerServerNet.exe
2264	containerServerNet.exe
2264	containerServerNet.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

rundll32.exe

pid process

2080 rundll32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

containerServerNet.execontainerServerNet.exe

description pid process

Token: SeDebugPrivilege 3024 containerServerNet.exe
Token: SeDebugPrivilege 2264 containerServerNet.exe

pid	process
2080	rundll32.exe

description	pid	process
Token: SeDebugPrivilege	3024	containerServerNet.exe
Token: SeDebugPrivilege	2264	containerServerNet.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

containerServerNet.execsc.execmd.exerundll32.exe

description	pid	process	target process
PID 3024 wrote to memory of 2468	3024	containerServerNet.exe	csc.exe
PID 3024 wrote to memory of 2468	3024	containerServerNet.exe	csc.exe
PID 3024 wrote to memory of 2468	3024	containerServerNet.exe	csc.exe
PID 2468 wrote to memory of 2316	2468	csc.exe	cvtres.exe
PID 2468 wrote to memory of 2316	2468	csc.exe	cvtres.exe
PID 2468 wrote to memory of 2316	2468	csc.exe	cvtres.exe
PID 3024 wrote to memory of 2760	3024	containerServerNet.exe	cmd.exe
PID 3024 wrote to memory of 2760	3024	containerServerNet.exe	cmd.exe
PID 3024 wrote to memory of 2760	3024	containerServerNet.exe	cmd.exe
PID 2760 wrote to memory of 2472	2760	cmd.exe	chcp.com
PID 2760 wrote to memory of 2472	2760	cmd.exe	chcp.com
PID 2760 wrote to memory of 2472	2760	cmd.exe	chcp.com
PID 2760 wrote to memory of 2060	2760	cmd.exe	w32tm.exe
PID 2760 wrote to memory of 2060	2760	cmd.exe	w32tm.exe
PID 2760 wrote to memory of 2060	2760	cmd.exe	w32tm.exe
PID 2760 wrote to memory of 2264	2760	cmd.exe	containerServerNet.exe
PID 2760 wrote to memory of 2264	2760	cmd.exe	containerServerNet.exe
PID 2760 wrote to memory of 2264	2760	cmd.exe	containerServerNet.exe
PID 2080 wrote to memory of 2956	2080	rundll32.exe	NOTEPAD.EXE
PID 2080 wrote to memory of 2956	2080	rundll32.exe	NOTEPAD.EXE
PID 2080 wrote to memory of 2956	2080	rundll32.exe	NOTEPAD.EXE

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\containerServerNet.exe
"C:\Users\Admin\AppData\Local\Temp\containerServerNet.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3024

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p4gvlaqo\p4gvlaqo.cmdline"
2⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2250.tmp" "c:\Windows\System32\CSC9390781266E6479684DE396B19B9C161.TMP"
3⤵
PID:2316

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\khJ1ONqZMg.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\system32\chcp.com
chcp 65001
3⤵
PID:2472

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
3⤵
PID:2060

C:\Windows\Web\Wallpaper\containerServerNet.exe
"C:\Windows\Web\Wallpaper\containerServerNet.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 9 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "explorere" /sc MINUTE /mo 5 /tr "'C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 10 /tr "'C:\Users\Public\Music\Sample Music\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Users\Public\Music\Sample Music\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Music\Sample Music\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containerServerNetc" /sc MINUTE /mo 14 /tr "'C:\Windows\Web\Wallpaper\containerServerNet.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2032

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containerServerNet" /sc ONLOGON /tr "'C:\Windows\Web\Wallpaper\containerServerNet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containerServerNetc" /sc MINUTE /mo 8 /tr "'C:\Windows\Web\Wallpaper\containerServerNet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2188

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1076

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Microsoft.NET\RedistList\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1728

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1564

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containerServerNetc" /sc MINUTE /mo 6 /tr "'C:\Users\Admin\AppData\Local\Temp\containerServerNet.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1668

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containerServerNet" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\containerServerNet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:628

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "containerServerNetc" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\AppData\Local\Temp\containerServerNet.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1444

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
PID:1988

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Zt0l7qyIjn
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Zt0l7qyIjn
2⤵
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

Scheduled Task/Job

Defense Evasion

Modify Registry

2

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\d6b272a2-8f1b-11ee-9e28-7ed9061e9c39\explorer.exe
Filesize
1.8MB

MD5
890b5cd71949526257d1497549da82ef

SHA1
1054441b6b2ec4b87a9e749ba7f2df20d58baa54

SHA256
e01bf187051ab20ecf85a9cea1c4c9072fd05658e7a9109e9c080161d9ad2e57

SHA512
5f65d1802332ead2af69dab9dcffbb8d2b70638c7f78babc72e35007fce09e6472dacb38c7b309490ccbd8cf848d0e365a211571d57b4912e52a5802e2bb0143

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2250.tmp
Filesize
1KB

MD5
8f7eaf931afa433238a224760df3d5ca

SHA1
d74b73c06352caaccd3963b302ae0e42bd16035d

SHA256
6b2acbe8db1bced43c16456a3c2bb550dae79af3a116e3d45720b279e6cad116

SHA512
a5e4c30977ad1d12ef98c5aa86183ac0ff2169a93fc0b87d0a57b40e64f9a2f94809ee03a84d4c28cccb85ea50b19b074f2cadf90bd5d963abad24f1128fd86b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zt0l7qyIjn
Filesize
92KB

MD5
69b4e9248982ac94fa6ee1ea6528305f

SHA1
6fb0e765699dd0597b7a7c35af4b85eead942e5b

SHA256
53c5e056da67d60a3b2872f8d4bda857f687be398ed05ed17c102f4c4b942883

SHA512
5cb260ab12c8cf0f134c34ae9533ac06227a0c3bdb9ad30d925d3d7b96e6fae0825c63e7db3c78852dc2a053767bbcfdd16898531509ffadade2dd7149f6241d

Download Submit
C:\Users\Admin\AppData\Local\Temp\khJ1ONqZMg.bat
Filesize
223B

MD5
40d969c4159ab73f2b23abd1028d6847

SHA1
1bb3367a9cd7f01e064871a0e27201d67d14d232

SHA256
de3af92b358a3293064862633664eb0ec0628945d4f20480f54a3bd45d75e2b4

SHA512
bf5f2b053dc2525c2c12e42e09d59e67c51a38ae1c96de4424c3d6edbfd25648dfdf4371d4ef76377f4d48429db383b4ad840dc3f8f0eadbf564b01826720413

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\p4gvlaqo\p4gvlaqo.0.cs
Filesize
393B

MD5
6d32e26f379ac2a7d7a59b0ac16d3730

SHA1
26d7cdae629ef4c0ec1c58af5e68b8ab6a6f4dbb

SHA256
ee88f1f55f454b3ea551d4cd4d80d81e2bb62865a7651f8db9b4102c3e69a704

SHA512
5044dec02c9b0c90c3d757ad1d6abfca741c1928c3a841dff362e5050f6d64b97d9ddbc1ecb813d8cbb480b54725f38fe573251049e3e6ece6737d7d45e57829

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\p4gvlaqo\p4gvlaqo.cmdline
Filesize
235B

MD5
ec1ec9716d79dc463dc770b3de586bf8

SHA1
8fc662089890ea3d117ddf43ca00769b55cb2a56

SHA256
bc1eb541ee66fb4f3f46ddaf39995b9b16af6324ef2bda1ea1c6b28e8c119af6

SHA512
2a0411050afe55f2e33955881865b412073da2a0d096e53e946ed627f1ef6d95787b949f6e0f36547a3b54836211f7052f1c78062bb5c5e39516d959362a8ed7

Download Submit
\??\c:\Windows\System32\CSC9390781266E6479684DE396B19B9C161.TMP
Filesize
1KB

MD5
3fcb2bd8a227751c0367dff5940613bb

SHA1
bcca174ab4499de5713d836fbc368966aa1f5b2c

SHA256
aca1f364ec354097cdecc50336698c1180b10ae84fc6051eab154482e0965e8c

SHA512
c7357bb6ee27df96ba39066e893ce8521cb1d5c550be24ced7f860e11cc36ecc04fbec14f61da920bca04e0ae150df8dbc53de0c4a6880afa6067bccfe767672

Download Submit
memory/2264-46-0x0000000000F90000-0x0000000001162000-memory.dmp

Filesize
1.8MB

Download
memory/3024-6-0x0000000001FA0000-0x0000000001FAE000-memory.dmp

Filesize
56KB

Download
memory/3024-15-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-12-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-11-0x0000000002210000-0x0000000002228000-memory.dmp

Filesize
96KB

Download
memory/3024-14-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-8-0x00000000021F0000-0x000000000220C000-memory.dmp

Filesize
112KB

Download
memory/3024-9-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-0-0x000007FEF5E93000-0x000007FEF5E94000-memory.dmp

Filesize
4KB

Download
memory/3024-4-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-3-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-43-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-2-0x000007FEF5E90000-0x000007FEF687C000-memory.dmp

Filesize
9.9MB

Download
memory/3024-1-0x00000000008C0000-0x0000000000A92000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads