nanocore | 70b89cc9b030d9f21b278edda0277a9ed5d7956df026b4a407e94423198549f5

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
31-05-2024 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bypassdev.exe
Size

410KB
MD5

201787cd33e5530811265cd836d32d34
SHA1

5b3cac1e442996911acc2061b1c5ac54e5912aac
SHA256

bca6e27840de5c2375667cd775b9d02851229cdd60916770991acfd0ad37d62a
SHA512

2df1840ee6453dc458e20f4446a60cc3484d7c9ab6a9f8a227968f43f8b16d45215a87e66b1c93ce11995f267e70daadf720bc95b46c45e1de0d6426198bb8e4
SSDEEP

6144:avEN2U+T6i5LirrllHy4HUcMQY6rLV6Bta6dtJmakIM5/tfqlGgBFUZZPiAE:EENN+T5xYrllrU7QY6rLV6BtpmkaJmEE

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

gayagoris.ddns.net:7005

Mutex

444ca634-7148-4ffa-81b4-5959bb4b4e5e

Attributes

activate_away_mode
true
backup_connection_host
gayagoris.ddns.net
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2019-08-05T00:46:31.519038936Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
7005
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
444ca634-7148-4ffa-81b4-5959bb4b4e5e
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
gayagoris.ddns.net
primary_dns_server
8.8.8.8
request_elevation
false
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
false
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Modifies Installed Components in the registry 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	svchost.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F146C9B1-VMVQ-A9RC-NUFL-D0BA00B4E999}	svchost.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

Executes dropped EXE 6 IoCs

Processes:

bypassdev.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2192 bypassdev.exe
2592 icsys.icn.exe
2724 explorer.exe
2624 spoolsv.exe
2796 svchost.exe
2344 spoolsv.exe

pid	process
2192	bypassdev.exe
2592	icsys.icn.exe
2724	explorer.exe
2624	spoolsv.exe
2796	svchost.exe
2344	spoolsv.exe

Loads dropped DLL 12 IoCs

Processes:

bypassdev.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

pid	process
2232	bypassdev.exe
2232	bypassdev.exe
2232	bypassdev.exe
2232	bypassdev.exe
2592	icsys.icn.exe
2592	icsys.icn.exe
2724	explorer.exe
2724	explorer.exe
2624	spoolsv.exe
2624	spoolsv.exe
2796	svchost.exe
2796	svchost.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exebypassdev.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TCP Service = "C:\\Program Files (x86)\\TCP Service\\tcpsv.exe"	bypassdev.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

bypassdev.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bypassdev.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bypassdev.exe

Drops file in Program Files directory 2 IoCs

Processes:

bypassdev.exe

description	ioc	process
File created	C:\Program Files (x86)\TCP Service\tcpsv.exe	bypassdev.exe
File opened for modification	C:\Program Files (x86)\TCP Service\tcpsv.exe	bypassdev.exe

Drops file in Windows directory 6 IoCs

Processes:

icsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	svchost.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2316 schtasks.exe
2588 schtasks.exe

pid	process
2316	schtasks.exe
2588	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

icsys.icn.exeexplorer.exesvchost.exebypassdev.exe

pid	process
2592	icsys.icn.exe
2724	explorer.exe
2724	explorer.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2192	bypassdev.exe
2192	bypassdev.exe
2192	bypassdev.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe
2796	svchost.exe
2724	explorer.exe
2724	explorer.exe
2796	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

explorer.exebypassdev.exe svchost.exe

pid process

2724 explorer.exe
2192 bypassdev.exe
2796 svchost.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

bypassdev.exe

description pid process

Token: SeDebugPrivilege 2192 bypassdev.exe
Token: SeDebugPrivilege 2192 bypassdev.exe

pid	process
2724	explorer.exe
2192	bypassdev.exe
2796	svchost.exe

description	pid	process
Token: SeDebugPrivilege	2192	bypassdev.exe
Token: SeDebugPrivilege	2192	bypassdev.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

bypassdev.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2232	bypassdev.exe
2232	bypassdev.exe
2592	icsys.icn.exe
2592	icsys.icn.exe
2724	explorer.exe
2724	explorer.exe
2624	spoolsv.exe
2624	spoolsv.exe
2796	svchost.exe
2796	svchost.exe
2344	spoolsv.exe
2344	spoolsv.exe
2724	explorer.exe
2724	explorer.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

bypassdev.exebypassdev.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2232 wrote to memory of 2192	2232	bypassdev.exe	bypassdev.exe
PID 2232 wrote to memory of 2192	2232	bypassdev.exe	bypassdev.exe
PID 2232 wrote to memory of 2192	2232	bypassdev.exe	bypassdev.exe
PID 2232 wrote to memory of 2192	2232	bypassdev.exe	bypassdev.exe
PID 2192 wrote to memory of 2316	2192	bypassdev.exe	schtasks.exe
PID 2192 wrote to memory of 2316	2192	bypassdev.exe	schtasks.exe
PID 2192 wrote to memory of 2316	2192	bypassdev.exe	schtasks.exe
PID 2192 wrote to memory of 2316	2192	bypassdev.exe	schtasks.exe
PID 2232 wrote to memory of 2592	2232	bypassdev.exe	icsys.icn.exe
PID 2232 wrote to memory of 2592	2232	bypassdev.exe	icsys.icn.exe
PID 2232 wrote to memory of 2592	2232	bypassdev.exe	icsys.icn.exe
PID 2232 wrote to memory of 2592	2232	bypassdev.exe	icsys.icn.exe
PID 2592 wrote to memory of 2724	2592	icsys.icn.exe	explorer.exe
PID 2592 wrote to memory of 2724	2592	icsys.icn.exe	explorer.exe
PID 2592 wrote to memory of 2724	2592	icsys.icn.exe	explorer.exe
PID 2592 wrote to memory of 2724	2592	icsys.icn.exe	explorer.exe
PID 2192 wrote to memory of 2588	2192	bypassdev.exe	schtasks.exe
PID 2192 wrote to memory of 2588	2192	bypassdev.exe	schtasks.exe
PID 2192 wrote to memory of 2588	2192	bypassdev.exe	schtasks.exe
PID 2192 wrote to memory of 2588	2192	bypassdev.exe	schtasks.exe
PID 2724 wrote to memory of 2624	2724	explorer.exe	spoolsv.exe
PID 2724 wrote to memory of 2624	2724	explorer.exe	spoolsv.exe
PID 2724 wrote to memory of 2624	2724	explorer.exe	spoolsv.exe
PID 2724 wrote to memory of 2624	2724	explorer.exe	spoolsv.exe
PID 2624 wrote to memory of 2796	2624	spoolsv.exe	svchost.exe
PID 2624 wrote to memory of 2796	2624	spoolsv.exe	svchost.exe
PID 2624 wrote to memory of 2796	2624	spoolsv.exe	svchost.exe
PID 2624 wrote to memory of 2796	2624	spoolsv.exe	svchost.exe
PID 2796 wrote to memory of 2344	2796	svchost.exe	spoolsv.exe
PID 2796 wrote to memory of 2344	2796	svchost.exe	spoolsv.exe
PID 2796 wrote to memory of 2344	2796	svchost.exe	spoolsv.exe
PID 2796 wrote to memory of 2344	2796	svchost.exe	spoolsv.exe
PID 2796 wrote to memory of 1308	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1308	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1308	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1308	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1300	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1300	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1300	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1300	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1540	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1540	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1540	2796	svchost.exe	at.exe
PID 2796 wrote to memory of 1540	2796	svchost.exe	at.exe

C:\Users\Admin\AppData\Local\Temp\bypassdev.exe
"C:\Users\Admin\AppData\Local\Temp\bypassdev.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232

\??\c:\users\admin\appdata\local\temp\bypassdev.exe
c:\users\admin\appdata\local\temp\bypassdev.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1AE0.tmp"
3⤵
- Creates scheduled task(s)
PID:2316

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "TCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1BDB.tmp"
3⤵
- Creates scheduled task(s)
PID:2588

C:\Users\Admin\AppData\Local\icsys.icn.exe
C:\Users\Admin\AppData\Local\icsys.icn.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
5⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe PR
6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2344

C:\Windows\SysWOW64\at.exe
at 18:14 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
6⤵
PID:1308

C:\Windows\SysWOW64\at.exe
at 18:15 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
6⤵
PID:1300

C:\Windows\SysWOW64\at.exe
at 18:16 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
6⤵
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1AE0.tmp
Filesize
1KB

MD5
9418fc2c3eae3391cbd47e4a97427229

SHA1
b66bfc0acb17f40bfc31d73920b899cff196710c

SHA256
467fcbd388cb87138ce9383a710c5db70adb502de1c4b9279c282badf2cdf986

SHA512
cba6eb70ee1c3a4ef9df95af41f32631cfda57225af1217d3c918937888320d1666bc86be599b3f6309d013963bcb8f2e88a42b9b4d3f9e83214ea53a9d66f75

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1BDB.tmp
Filesize
1KB

MD5
93fc3117767507c9889abd12dc667d22

SHA1
1096e4cfa0c35756e3c3fb866c1e4c1e59115df9

SHA256
684997dd4ce15031cec8f2f93933b1d41d7bf5cbbff655dd64377b07055c449a

SHA512
e403348ee77bd3e7c45245dd5dae81c3ea130d5cf342f630982772ce5f75548b292013480e2831d68cf51349b64afde4589d4eec94b567d20f0a01e3b9549bdc

Download Submit
C:\Users\Admin\AppData\Roaming\mrsys.exe
Filesize
206KB

MD5
c71705bd57aff7f6c8349f9f93b4cadb

SHA1
7874baf35e85b2ef87fee3ee073391ae0e9c3d3b

SHA256
4cca6cee366798c707721b98335810ac1c7720992fe87ea56b4406180afd317a

SHA512
47630259cc84e3715db763967effebc07584d83c035df7bfdc5d6a7669d978f2f89eae5eb34a56f763c2f5da7019c7d815ced118ddd226fdd38e2550c768c8fc

Download Submit
C:\Windows\system\spoolsv.exe
Filesize
207KB

MD5
46f47efc6106d93f6680536a956f9c79

SHA1
8ad145e6c88aa2cf0a7ca7404cf0bed176bfe640

SHA256
a07dd5beeff9f70a1f850edd4f72d0c209f6913a54ee7940e28cbb6afbe1b330

SHA512
4d63c745ae96589aaec9cb51ca6a35c0245dc377c069e947ed48e7daf97a8c5a055ab118c2dfa2c80886a370e6ff76d7b67914c00224edadb5786cf15f5dc1d6

Download Submit
\??\PIPE\atsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\bypassdev.exe
Filesize
203KB

MD5
2dacc63c7b382248b2034585e527b19f

SHA1
8a5cf2aacfcb111a4703f4adc88a0f3e752a9f37

SHA256
2c92de520918b894d1934c99cfc74f46f979097c125b093077eee38218b01cee

SHA512
0a5a5be8583e41d947f635303121d2246de09b68a4aff08aa81f9e675385bcf6a10246c52aff3669066a1ac056aec90db72212d00a0e9a9ea80b6ecbc17e467b

Download Submit
\Users\Admin\AppData\Local\icsys.icn.exe
Filesize
206KB

MD5
ee5186c032fa5b49d8ef9121c69770ed

SHA1
3a73e644fee016d444d06ecb20818ab7c15bafbc

SHA256
eed51642726258b849f74c0a00f5989c6c2257c7f1a09fe3488b3e648c35bc27

SHA512
bea8e41f0bec4b98fa314082bbbfddf8688000aa4ab34cf495d0ceac2cef73bc9c3dc18a527a44f2f9508a4bc56b410bcc3091419927ecf02d559ccc6a452e42

Download Submit
\Windows\system\explorer.exe
Filesize
206KB

MD5
39def1bce19640d5c6653f5f54b77cb3

SHA1
12373a09b946ae9a73916a3a97efdfd7ba7fd418

SHA256
e3f8f846ca71a1d90c6f48a4c826a45e6c44863a6c7113f871b208a7968085ea

SHA512
109b96a30565e247983e044a32d31ba6380174cc55afa4aac7c8f0fdd739f72af013b2900e7444e76d7d0f0909c4f76791071677e025b9442e0f15d643cc6c94

Download Submit
\Windows\system\svchost.exe
Filesize
206KB

MD5
7b965b17d2bcde5f1cfd8307f9973c00

SHA1
2b211cfa986b4857f03a56e4b52efafcd14d7441

SHA256
394fd80a3f7495f06392d9bf7829f388f2e31caea4840f008d858f645153623d

SHA512
8a065fbb4c4eb606f69797b8298c323bac6c52cf400023f24f9fa3ec33db1ab4dcfe9898a98f26d4708af82a3aabed57b463924323d21ba9b234c6bddccbc151

Download Submit
memory/2192-96-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2192-16-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2192-15-0x0000000074180000-0x000000007472B000-memory.dmp

Filesize
5.7MB

Download
memory/2192-14-0x0000000074181000-0x0000000074182000-memory.dmp

Filesize
4KB

Download
memory/2232-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2232-26-0x0000000000540000-0x000000000056F000-memory.dmp

Filesize
188KB

Download
memory/2232-94-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2344-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2344-89-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2592-93-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2592-43-0x0000000001F80000-0x0000000001FAF000-memory.dmp

Filesize
188KB

Download
memory/2592-41-0x0000000001F80000-0x0000000001FAF000-memory.dmp

Filesize
188KB

Download
memory/2624-92-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2624-76-0x0000000002490000-0x00000000024BF000-memory.dmp

Filesize
188KB

Download
memory/2624-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2796-78-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2796-87-0x0000000001D80000-0x0000000001DAF000-memory.dmp

Filesize
188KB

Download
memory/2796-85-0x0000000001D80000-0x0000000001DAF000-memory.dmp

Filesize
188KB

Download