phorphiex | b23c1d8012cbca60bc3116fce597cb8cd5d582e3a76913f23861bb22f3ce9788

General

Target

020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe
Size

272KB
MD5

020ff160669157c4cb8013f1987beb70
SHA1

ad7701d1d749652e899d8a953b96b3990dd0c434
SHA256

b23c1d8012cbca60bc3116fce597cb8cd5d582e3a76913f23861bb22f3ce9788
SHA512

a7f6017c3767ad3dd998f86118298692fdad9b8afc6ca4e019421d539885a346e51e30f5842eac3207f5ef97ae62f8437ddb7d018a32d306d05863edb909b0d0
SSDEEP

3072:+33mUyfOhAt33UwIFUCuwE5jJ6xwfB/G1Vi6eXXEm5aaNwKbuAs0FNmhMn+IhNsM:+byWhAZ3xIFUCKj7J/GhTvYl7

Score

10^/10

phorphiex xmrig evasion loader miner persistence trojan worm

Malware Config

Extracted

Family

phorphiex

C2

http://185.215.113.66/

http://5.42.96.117/

http://91.202.233.141/

Wallets

0xCa90599132C4D88907Bd8E046540284aa468a035

TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6

qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

XryzFMFVpDUvU7famUGf214EXD3xNUSmQf

LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv

rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb

48jYpFT6bT8MTeph7VsyzCQeDsGHqdQNc2kUkRFJPzfRHHjarBvBtudPUtParMkDzZbYBrd3yntWBQcsnVBNeeMbN9EXifg

15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC

17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY

ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp

3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc

3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3

DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA

t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh

stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj

bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw

bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3

bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r

GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3

Attributes

mutex
plo7udsa2s
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Signatures

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

syslmgrsvc.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" syslmgrsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	syslmgrsvc.exe

Phorphiex payload 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\142577658.exe	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

1396432280.exewupgrdsv.exe

description	pid	process	target process
PID 2228 created 1192	2228	1396432280.exe	Explorer.EXE
PID 2228 created 1192	2228	1396432280.exe	Explorer.EXE
PID 2344 created 1192	2344	wupgrdsv.exe	Explorer.EXE
PID 2344 created 1192	2344	wupgrdsv.exe	Explorer.EXE

Windows security bypass 2 TTPs 6 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

syslmgrsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syslmgrsvc.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 4 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/872-98-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/872-99-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/872-100-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/872-101-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig

Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

197A.exe142577658.exesyslmgrsvc.exe230216461.exe26418044.exe199346420.exe1396432280.exewupgrdsv.exe

pid process

2408 197A.exe
2708 142577658.exe
2660 syslmgrsvc.exe
1596 230216461.exe
3012 26418044.exe
1792 199346420.exe
2228 1396432280.exe
2344 wupgrdsv.exe
Loads dropped DLL 8 IoCs

Processes:

197A.exesyslmgrsvc.exe199346420.exetaskeng.exe

pid process

2408 197A.exe
2408 197A.exe
2660 syslmgrsvc.exe
2660 syslmgrsvc.exe
2660 syslmgrsvc.exe
2660 syslmgrsvc.exe
1792 199346420.exe
1932 taskeng.exe

pid	process
2408	197A.exe
2708	142577658.exe
2660	syslmgrsvc.exe
1596	230216461.exe
3012	26418044.exe
1792	199346420.exe
2228	1396432280.exe
2344	wupgrdsv.exe

pid	process
2408	197A.exe
2408	197A.exe
2660	syslmgrsvc.exe
2660	syslmgrsvc.exe
2660	syslmgrsvc.exe
2660	syslmgrsvc.exe
1792	199346420.exe
1932	taskeng.exe

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

syslmgrsvc.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	syslmgrsvc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	syslmgrsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

142577658.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\syslmgrsvc.exe"	142577658.exe

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

wupgrdsv.exe

description pid process target process

PID 2344 set thread context of 872 2344 wupgrdsv.exe notepad.exe
Drops file in Windows directory 2 IoCs

Processes:

142577658.exe

description ioc process

File created C:\Windows\syslmgrsvc.exe 142577658.exe
File opened for modification C:\Windows\syslmgrsvc.exe 142577658.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1348 schtasks.exe
2920 schtasks.exe

description	pid	process	target process
PID 2344 set thread context of 872	2344	wupgrdsv.exe	notepad.exe

description	ioc	process
File created	C:\Windows\syslmgrsvc.exe	142577658.exe
File opened for modification	C:\Windows\syslmgrsvc.exe	142577658.exe

pid	process
1348	schtasks.exe
2920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

1396432280.exepowershell.exewupgrdsv.exepowershell.exe

pid	process
2228	1396432280.exe
2228	1396432280.exe
2132	powershell.exe
2228	1396432280.exe
2228	1396432280.exe
2344	wupgrdsv.exe
2344	wupgrdsv.exe
1148	powershell.exe
2344	wupgrdsv.exe
2344	wupgrdsv.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.exepowershell.exenotepad.exe

description	pid	process
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeLockMemoryPrivilege	872	notepad.exe
Token: SeLockMemoryPrivilege	872	notepad.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

notepad.exe

pid	process
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

notepad.exe

pid	process
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe
872	notepad.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe197A.exe142577658.exesyslmgrsvc.exe199346420.exepowershell.exetaskeng.exepowershell.exewupgrdsv.exe

description	pid	process	target process
PID 1704 wrote to memory of 2408	1704	020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe	197A.exe
PID 1704 wrote to memory of 2408	1704	020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe	197A.exe
PID 1704 wrote to memory of 2408	1704	020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe	197A.exe
PID 1704 wrote to memory of 2408	1704	020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe	197A.exe
PID 2408 wrote to memory of 2708	2408	197A.exe	142577658.exe
PID 2408 wrote to memory of 2708	2408	197A.exe	142577658.exe
PID 2408 wrote to memory of 2708	2408	197A.exe	142577658.exe
PID 2408 wrote to memory of 2708	2408	197A.exe	142577658.exe
PID 2708 wrote to memory of 2660	2708	142577658.exe	syslmgrsvc.exe
PID 2708 wrote to memory of 2660	2708	142577658.exe	syslmgrsvc.exe
PID 2708 wrote to memory of 2660	2708	142577658.exe	syslmgrsvc.exe
PID 2708 wrote to memory of 2660	2708	142577658.exe	syslmgrsvc.exe
PID 2660 wrote to memory of 1596	2660	syslmgrsvc.exe	230216461.exe
PID 2660 wrote to memory of 1596	2660	syslmgrsvc.exe	230216461.exe
PID 2660 wrote to memory of 1596	2660	syslmgrsvc.exe	230216461.exe
PID 2660 wrote to memory of 1596	2660	syslmgrsvc.exe	230216461.exe
PID 2660 wrote to memory of 3012	2660	syslmgrsvc.exe	26418044.exe
PID 2660 wrote to memory of 3012	2660	syslmgrsvc.exe	26418044.exe
PID 2660 wrote to memory of 3012	2660	syslmgrsvc.exe	26418044.exe
PID 2660 wrote to memory of 3012	2660	syslmgrsvc.exe	26418044.exe
PID 2660 wrote to memory of 1792	2660	syslmgrsvc.exe	199346420.exe
PID 2660 wrote to memory of 1792	2660	syslmgrsvc.exe	199346420.exe
PID 2660 wrote to memory of 1792	2660	syslmgrsvc.exe	199346420.exe
PID 2660 wrote to memory of 1792	2660	syslmgrsvc.exe	199346420.exe
PID 1792 wrote to memory of 2228	1792	199346420.exe	1396432280.exe
PID 1792 wrote to memory of 2228	1792	199346420.exe	1396432280.exe
PID 1792 wrote to memory of 2228	1792	199346420.exe	1396432280.exe
PID 1792 wrote to memory of 2228	1792	199346420.exe	1396432280.exe
PID 2132 wrote to memory of 1348	2132	powershell.exe	schtasks.exe
PID 2132 wrote to memory of 1348	2132	powershell.exe	schtasks.exe
PID 2132 wrote to memory of 1348	2132	powershell.exe	schtasks.exe
PID 1932 wrote to memory of 2344	1932	taskeng.exe	wupgrdsv.exe
PID 1932 wrote to memory of 2344	1932	taskeng.exe	wupgrdsv.exe
PID 1932 wrote to memory of 2344	1932	taskeng.exe	wupgrdsv.exe
PID 1148 wrote to memory of 2920	1148	powershell.exe	schtasks.exe
PID 1148 wrote to memory of 2920	1148	powershell.exe	schtasks.exe
PID 1148 wrote to memory of 2920	1148	powershell.exe	schtasks.exe
PID 2344 wrote to memory of 872	2344	wupgrdsv.exe	notepad.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1192

C:\Users\Admin\AppData\Local\Temp\020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\020ff160669157c4cb8013f1987beb70_NeikiAnalytics.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1704

C:\Users\Admin\AppData\Local\Temp\197A.exe
"C:\Users\Admin\AppData\Local\Temp\197A.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408

C:\Users\Admin\AppData\Local\Temp\142577658.exe
C:\Users\Admin\AppData\Local\Temp\142577658.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\syslmgrsvc.exe
C:\Windows\syslmgrsvc.exe
5⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2660

C:\Users\Admin\AppData\Local\Temp\230216461.exe
C:\Users\Admin\AppData\Local\Temp\230216461.exe
6⤵
- Executes dropped EXE
PID:1596

C:\Users\Admin\AppData\Local\Temp\26418044.exe
C:\Users\Admin\AppData\Local\Temp\26418044.exe
6⤵
- Executes dropped EXE
PID:3012

C:\Users\Admin\AppData\Local\Temp\199346420.exe
C:\Users\Admin\AppData\Local\Temp\199346420.exe
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\1396432280.exe
C:\Users\Admin\AppData\Local\Temp\1396432280.exe
7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2228

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"
3⤵
- Creates scheduled task(s)
PID:1348

C:\Windows\System32\schtasks.exe
C:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"
2⤵
PID:1040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1148

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"
3⤵
- Creates scheduled task(s)
PID:2920

C:\Windows\System32\notepad.exe
C:\Windows\System32\notepad.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:872

C:\Windows\system32\taskeng.exe
taskeng.exe {2A5C37AA-C870-4D5C-AE5C-AE3DF81B0D7A} S-1-5-21-481678230-3773327859-3495911762-1000:UIBNQNMA\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1396432280.exe
Filesize
2.8MB

MD5
fdf9148c92430af11e5d815dc0869464

SHA1
eec5a4e8b1f78f2a4d1e730d9ec34c8ab524483f

SHA256
e771385bd4194ddfffc69a415b3f0e8dbf68e997c875f83131fe3a5899f7f693

SHA512
292a067321f685e823712b2ecbf4509cb1ce260d040c34a9dbd04d0f79528928ca448e12853c589f4a6641dc9e406503da42886555bf7d87060e72b26503f1c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\142577658.exe
Filesize
93KB

MD5
a318cc45e79498b93e40d5e5b9b76be4

SHA1
4ebc9969cc3c330741c377e22a5fb0cdb8ce5fd5

SHA256
4b4e596641d0dd9eece8a24556fd1246056cbc315a79675a7400927858bbd7c2

SHA512
3131d627837a3cafdf532173ccadd4beff933ee3d5e050366153434b1394c4d57056b4d273ddb826a1a0478caa83e1f6e095e83366102ae1d3705ab2d3ec0e2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1914821138.exe
Filesize
80KB

MD5
2ff2bb06682812eeb76628bfbe817fbb

SHA1
18e86614d0f4904e1fe97198ccda34b25aab7dae

SHA256
985da56fb594bf65d8bb993e8e37cd6e78535da6c834945068040faf67e91e7d

SHA512
5cd3b5a1e16202893b08c0ae70d3bcd9e7a49197ebf1ded08e01395202022b3b6c2d8837196ef0415fea6497d928b44e03544b934f8e062ddbb6c6f79fb6f440

Download Submit
C:\Users\Admin\AppData\Local\Temp\197A.exe
Filesize
9KB

MD5
8d8e6c7952a9dc7c0c73911c4dbc5518

SHA1
9098da03b33b2c822065b49d5220359c275d5e94

SHA256
feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278

SHA512
91a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645

Download Submit
C:\Users\Admin\AppData\Local\Temp\199346420.exe
Filesize
10KB

MD5
c8cf446ead193a3807472fbd294c5f23

SHA1
2162f28c919222f75ce5f52e4bb1155255ae5368

SHA256
e5d12658a690c62af7d4fc7b26735affc7210e3bfb6b2241de1bf90aebdc0717

SHA512
fc94014fabf204ecd57990db4b05b81cbda0a314b621cbfa755296ddf5493ec55fb129d12eff5f92863d9f1d7fea679dc2aeb62baf898791448cb4fe34b595c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\26418044.exe
Filesize
7KB

MD5
77eed2bbe1769686fbfaba7c0fca9f79

SHA1
d70bbf046b40f09420aa8938dcb49890db48f976

SHA256
94084872fe25303309a1a35fadae3b75ae99c9ffb94926e1c7640f8d3469d0e2

SHA512
e3e0d1d4f25553c13343bd80e59fcdfc690c20605f8ade8e86ba0eef9a6d20249f9f8f46b5fde494e781b2dcc28cc00c7143f8e425d8edcf2dfa6a2a03b89ec8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
7ac2c69e97d93464c87ced67e4126b33

SHA1
daa448ebc59ba27d13b836c727606d75936059e5

SHA256
7d6418f505da643c3b599fefbd010429a277687eb1f428b6042f45317b5ed02a

SHA512
42d403fcb3833c4f1e60cff8a53f070cf972c126415bc6bbec9882bec0e5b0e0f305f0cc02357e3662c9833d24494d5b8baa5676332395eaf8618eb66ae0fb5d

Download Submit
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe
Filesize
2.1MB

MD5
873a19658ca5370b911e8c1560e6e90e

SHA1
ffd8af17fbc69bd1eea74ad1f910c54479a52702

SHA256
3c604c5a0ecc7ba722dcc29de92bb516821eb58b54f32380125b100da2ce9dff

SHA512
e7a3032e48d8f0f5af7d3f454a535e0df14809ed210ccfbe3f7d1ef45df1dd7575d7de7241aefa31b4fa259c891ce6caff9f2572070d214abd4ebc7a647e4512

Download Submit
memory/872-96-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/872-94-0x0000000000230000-0x0000000000250000-memory.dmp

Filesize
128KB

Download
memory/872-95-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/872-98-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/872-99-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/872-100-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/872-101-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/1148-90-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/1148-89-0x000000001B500000-0x000000001B7E2000-memory.dmp

Filesize
2.9MB

Download
memory/2132-77-0x0000000002210000-0x0000000002218000-memory.dmp

Filesize
32KB

Download
memory/2132-76-0x000000001B580000-0x000000001B862000-memory.dmp

Filesize
2.9MB

Download
memory/2228-80-0x000000013FAC0000-0x0000000140036000-memory.dmp

Filesize
5.5MB

Download
memory/2344-93-0x000000013F8C0000-0x000000013FE36000-memory.dmp

Filesize
5.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads