Analysis
-
max time kernel
78s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 01:35
Static task
static1
Behavioral task
behavioral1
Sample
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe
Resource
win7-20240220-en
General
-
Target
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe
-
Size
1.0MB
-
MD5
77fe62e62469db6e17cf41f91c47b5b5
-
SHA1
93d2fddd66d7fac316d26e21f4406e46f46442b7
-
SHA256
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c
-
SHA512
4150a94c5348b81aa59fa99685a7ec13528ad7baee6a377bf394cf4cad535355466d502c9c039ed8a2af479447c278923e977a1817afcc9ed9dc173032ac32b7
-
SSDEEP
24576:6AHnh+eWsN3skA4RV1Hom2KXMmHayOmwQZZE9f/5:Nh+ZkldoPK8YayOr6A
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://77.91.77.92/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
55a4er5wo
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
sysmablsvr.exewinblrsnrcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" winblrsnrcs.exe -
Phorphiex payload 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\2740827080.exe family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
1540521067.exewupgrdsv.exedescription pid process target process PID 2036 created 1196 2036 1540521067.exe Explorer.EXE PID 2036 created 1196 2036 1540521067.exe Explorer.EXE PID 1004 created 1196 1004 wupgrdsv.exe Explorer.EXE PID 1004 created 1196 1004 wupgrdsv.exe Explorer.EXE -
Processes:
winblrsnrcs.exesysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe -
XMRig Miner payload 11 IoCs
Processes:
resource yara_rule behavioral1/memory/1004-103-0x000000013FB90000-0x0000000140106000-memory.dmp xmrig behavioral1/memory/3036-114-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-124-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-130-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-132-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-133-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-134-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-135-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-136-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-137-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/3036-138-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
8F6.exe2740827080.exesysmablsvr.exe74443878.exe3235327769.exe799618997.exe1540521067.exewupgrdsv.exe565710221.exewinblrsnrcs.exe3553328432.exe2780020372.exe2006712311.exepid process 2564 8F6.exe 2508 2740827080.exe 2476 sysmablsvr.exe 2760 74443878.exe 1268 3235327769.exe 1612 799618997.exe 2036 1540521067.exe 1004 wupgrdsv.exe 1080 565710221.exe 1448 winblrsnrcs.exe 2984 3553328432.exe 3024 2780020372.exe 2572 2006712311.exe -
Loads dropped DLL 12 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe8F6.exesysmablsvr.exe3235327769.exetaskeng.exewinblrsnrcs.exepid process 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 2564 8F6.exe 2564 8F6.exe 2476 sysmablsvr.exe 2476 sysmablsvr.exe 2476 sysmablsvr.exe 1268 3235327769.exe 692 taskeng.exe 2476 sysmablsvr.exe 1448 winblrsnrcs.exe 1448 winblrsnrcs.exe 1448 winblrsnrcs.exe -
Processes:
winblrsnrcs.exesysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
565710221.exe2740827080.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winblrsnrcs.exe" 565710221.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe" 2740827080.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wupgrdsv.exedescription pid process target process PID 1004 set thread context of 3036 1004 wupgrdsv.exe notepad.exe -
Drops file in Windows directory 4 IoCs
Processes:
565710221.exe2740827080.exedescription ioc process File created C:\Windows\winblrsnrcs.exe 565710221.exe File opened for modification C:\Windows\winblrsnrcs.exe 565710221.exe File created C:\Windows\sysmablsvr.exe 2740827080.exe File opened for modification C:\Windows\sysmablsvr.exe 2740827080.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1876 schtasks.exe 1112 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
1540521067.exepowershell.exewupgrdsv.exepowershell.exepid process 2036 1540521067.exe 2036 1540521067.exe 2236 powershell.exe 2036 1540521067.exe 2036 1540521067.exe 1004 wupgrdsv.exe 1004 wupgrdsv.exe 1132 powershell.exe 1004 wupgrdsv.exe 1004 wupgrdsv.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exenotepad.exedescription pid process Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 1132 powershell.exe Token: SeLockMemoryPrivilege 3036 notepad.exe Token: SeLockMemoryPrivilege 3036 notepad.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exenotepad.exepid process 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe -
Suspicious use of SendNotifyMessage 33 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exenotepad.exepid process 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe 3036 notepad.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe8F6.exe2740827080.exesysmablsvr.exe3235327769.exepowershell.exetaskeng.exe565710221.exepowershell.exewupgrdsv.exewinblrsnrcs.exedescription pid process target process PID 2932 wrote to memory of 2564 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 8F6.exe PID 2932 wrote to memory of 2564 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 8F6.exe PID 2932 wrote to memory of 2564 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 8F6.exe PID 2932 wrote to memory of 2564 2932 58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe 8F6.exe PID 2564 wrote to memory of 2508 2564 8F6.exe 2740827080.exe PID 2564 wrote to memory of 2508 2564 8F6.exe 2740827080.exe PID 2564 wrote to memory of 2508 2564 8F6.exe 2740827080.exe PID 2564 wrote to memory of 2508 2564 8F6.exe 2740827080.exe PID 2508 wrote to memory of 2476 2508 2740827080.exe sysmablsvr.exe PID 2508 wrote to memory of 2476 2508 2740827080.exe sysmablsvr.exe PID 2508 wrote to memory of 2476 2508 2740827080.exe sysmablsvr.exe PID 2508 wrote to memory of 2476 2508 2740827080.exe sysmablsvr.exe PID 2476 wrote to memory of 2760 2476 sysmablsvr.exe 74443878.exe PID 2476 wrote to memory of 2760 2476 sysmablsvr.exe 74443878.exe PID 2476 wrote to memory of 2760 2476 sysmablsvr.exe 74443878.exe PID 2476 wrote to memory of 2760 2476 sysmablsvr.exe 74443878.exe PID 2476 wrote to memory of 1268 2476 sysmablsvr.exe 3235327769.exe PID 2476 wrote to memory of 1268 2476 sysmablsvr.exe 3235327769.exe PID 2476 wrote to memory of 1268 2476 sysmablsvr.exe 3235327769.exe PID 2476 wrote to memory of 1268 2476 sysmablsvr.exe 3235327769.exe PID 2476 wrote to memory of 1612 2476 sysmablsvr.exe 799618997.exe PID 2476 wrote to memory of 1612 2476 sysmablsvr.exe 799618997.exe PID 2476 wrote to memory of 1612 2476 sysmablsvr.exe 799618997.exe PID 2476 wrote to memory of 1612 2476 sysmablsvr.exe 799618997.exe PID 1268 wrote to memory of 2036 1268 3235327769.exe 1540521067.exe PID 1268 wrote to memory of 2036 1268 3235327769.exe 1540521067.exe PID 1268 wrote to memory of 2036 1268 3235327769.exe 1540521067.exe PID 1268 wrote to memory of 2036 1268 3235327769.exe 1540521067.exe PID 2236 wrote to memory of 1876 2236 powershell.exe schtasks.exe PID 2236 wrote to memory of 1876 2236 powershell.exe schtasks.exe PID 2236 wrote to memory of 1876 2236 powershell.exe schtasks.exe PID 692 wrote to memory of 1004 692 taskeng.exe wupgrdsv.exe PID 692 wrote to memory of 1004 692 taskeng.exe wupgrdsv.exe PID 692 wrote to memory of 1004 692 taskeng.exe wupgrdsv.exe PID 2476 wrote to memory of 1080 2476 sysmablsvr.exe 565710221.exe PID 2476 wrote to memory of 1080 2476 sysmablsvr.exe 565710221.exe PID 2476 wrote to memory of 1080 2476 sysmablsvr.exe 565710221.exe PID 2476 wrote to memory of 1080 2476 sysmablsvr.exe 565710221.exe PID 1080 wrote to memory of 1448 1080 565710221.exe winblrsnrcs.exe PID 1080 wrote to memory of 1448 1080 565710221.exe winblrsnrcs.exe PID 1080 wrote to memory of 1448 1080 565710221.exe winblrsnrcs.exe PID 1080 wrote to memory of 1448 1080 565710221.exe winblrsnrcs.exe PID 1132 wrote to memory of 1112 1132 powershell.exe schtasks.exe PID 1132 wrote to memory of 1112 1132 powershell.exe schtasks.exe PID 1132 wrote to memory of 1112 1132 powershell.exe schtasks.exe PID 1004 wrote to memory of 3036 1004 wupgrdsv.exe notepad.exe PID 1448 wrote to memory of 2984 1448 winblrsnrcs.exe 3553328432.exe PID 1448 wrote to memory of 2984 1448 winblrsnrcs.exe 3553328432.exe PID 1448 wrote to memory of 2984 1448 winblrsnrcs.exe 3553328432.exe PID 1448 wrote to memory of 2984 1448 winblrsnrcs.exe 3553328432.exe PID 1448 wrote to memory of 3024 1448 winblrsnrcs.exe 2780020372.exe PID 1448 wrote to memory of 3024 1448 winblrsnrcs.exe 2780020372.exe PID 1448 wrote to memory of 3024 1448 winblrsnrcs.exe 2780020372.exe PID 1448 wrote to memory of 3024 1448 winblrsnrcs.exe 2780020372.exe PID 1448 wrote to memory of 2572 1448 winblrsnrcs.exe 2006712311.exe PID 1448 wrote to memory of 2572 1448 winblrsnrcs.exe 2006712311.exe PID 1448 wrote to memory of 2572 1448 winblrsnrcs.exe 2006712311.exe PID 1448 wrote to memory of 2572 1448 winblrsnrcs.exe 2006712311.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe"C:\Users\Admin\AppData\Local\Temp\58e4d692a54725d6a5a8b189a3fc3bc7d0907daacae44d0cb333c56f9e5a417c.exe"2⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8F6.exe"C:\Users\Admin\AppData\Local\Temp\8F6.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2740827080.exeC:\Users\Admin\AppData\Local\Temp\2740827080.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\sysmablsvr.exeC:\Windows\sysmablsvr.exe5⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\74443878.exeC:\Users\Admin\AppData\Local\Temp\74443878.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3235327769.exeC:\Users\Admin\AppData\Local\Temp\3235327769.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1540521067.exeC:\Users\Admin\AppData\Local\Temp\1540521067.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\799618997.exeC:\Users\Admin\AppData\Local\Temp\799618997.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\565710221.exeC:\Users\Admin\AppData\Local\Temp\565710221.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\winblrsnrcs.exeC:\Windows\winblrsnrcs.exe7⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3553328432.exeC:\Users\Admin\AppData\Local\Temp\3553328432.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2780020372.exeC:\Users\Admin\AppData\Local\Temp\2780020372.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2006712311.exeC:\Users\Admin\AppData\Local\Temp\2006712311.exe8⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskeng.exetaskeng.exe {A1A31560-5452-4EA9-86CB-2C5B4FD7ED39} S-1-5-21-2721934792-624042501-2768869379-1000:BISMIZHX\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\565710221.exeFilesize
18KB
MD530dca8b68825d5b3db7a685aa3da0a13
SHA107320822d14d6caf8825dd6d806c0cde398584f3
SHA256f2dc635cb5fe8b8815ea98d909b67016975ca8e5a43cb39e47595ecd01038a96
SHA512b5f3be086d3f7c751028d8d8a025069743b2472cec10252627f5583492383a5a865e88ad5839d83bf3a3c31b5b630753e77a2c02433d7fbe90aa11acd0f35f0c
-
C:\Users\Admin\AppData\Local\Temp\74443878.exeFilesize
7KB
MD577eed2bbe1769686fbfaba7c0fca9f79
SHA1d70bbf046b40f09420aa8938dcb49890db48f976
SHA25694084872fe25303309a1a35fadae3b75ae99c9ffb94926e1c7640f8d3469d0e2
SHA512e3e0d1d4f25553c13343bd80e59fcdfc690c20605f8ade8e86ba0eef9a6d20249f9f8f46b5fde494e781b2dcc28cc00c7143f8e425d8edcf2dfa6a2a03b89ec8
-
C:\Users\Admin\AppData\Local\Temp\799618997.exeFilesize
11KB
MD5cafd277c4132f5d0f202e7ea07a27d5c
SHA172c8c16a94cce56a3e01d91bc1276dafc65b351d
SHA256e5162fa594811f0f01fc76f4acbd9fe99b2265df9cfcbc346023f28775c19f1e
SHA5127c87d1dec61b78e0f223e8f9fec019d96509813fa6d96129289aab00b2d6f05bf91fe1fafd680b7d9e746f4c2c8cbe48a3028bcaad479048d00d79a19f71b196
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5ff3580a78531a416d8392e4ccb14c4d3
SHA173f34e4031ffa92d8c52e7f62be8f5cf4314491e
SHA2562d401a644ca118c980153bd4e68922cd0e8d97d3a97408afedab933bce7b9ed3
SHA512cbade63ce89931783a438b0267a625e9a962b4ac5171ce9d837bce89e38148766ec935f546cf147ec6baa41d68c34d5b8d8c360d2163c85a7b9f8ea630350bdc
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OSPVKKF1ATAVQW9UTPIZ.tempFilesize
7KB
MD5ddc8a810d13d6e019f0a1f6e2d351f73
SHA1b1442430c3dfcfad7067a1689245a054b23274dd
SHA25678478039f851357beff9109a1b76c2b22197a54db1bc8906b201ad5d70240dc7
SHA5126789bfa91424cfeb8ba5fe4029df31d721deb8626c029d1808703b93889741ac597f1f948b1f57d57fb589ab00cf22198920b82af0489acab02940f37dc5e927
-
\Users\Admin\AppData\Local\Temp\1540521067.exeFilesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
\Users\Admin\AppData\Local\Temp\2006712311.exeFilesize
8KB
MD59b8a3fb66b93c24c52e9c68633b00f37
SHA12a9290e32d1582217eac32b977961ada243ada9a
SHA2568a169cf165f635ecb6c55cacecb2c202c5fc6ef5fa82ec9cdb7d4b0300f35293
SHA512117da1ec9850212e4cafce6669c2cfffc8078627f5c3ccdfd6a1bf3bee2d351290071087a4c206578d23852fa5e69c2ebefd71905c85b1eaed4220932bb71a39
-
\Users\Admin\AppData\Local\Temp\2740827080.exeFilesize
88KB
MD54505daf4c08fc8e8e1380911e98588aa
SHA1d990eb1b2ccbb71c878944be37923b1ebd17bc72
SHA256a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40
SHA512bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec
-
\Users\Admin\AppData\Local\Temp\3235327769.exeFilesize
10KB
MD56567b839ec69322ba1aa41b15fbd1e64
SHA10a2a0770afe094765a5eb88f6201847bf642bea9
SHA2568a4b87ed94fc50767d0bc91291a8b8a436b941b273b29ab0d442ba1cc10b76fb
SHA5122e4798244bf3891beea64ee0b0d106c6f47b7c7d6daf222af6192874dc0ef67491c82e93821c1ff9fbd25cf9ec50178e959adb466b210ff9754dd4e8387a30cf
-
\Users\Admin\AppData\Local\Temp\3553328432.exeFilesize
8KB
MD587b22e975994246dc5b7c2a3adbf85a5
SHA11e6528987190f0f5188240cdac553388c39e8590
SHA25617399263a05a9144c1571e8ef88175fd08c61a38e3fcb3a955279d4a2bb9a919
SHA51258c33379879fc75679902d1fe3db0bf1c854151cb6e4bf10496a1d657a8778699be70976bd8bba1ddd3949b24b6ae44cbc0421dd0a8cea13ef5e00179d6599db
-
\Users\Admin\AppData\Local\Temp\8F6.exeFilesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
memory/1004-103-0x000000013FB90000-0x0000000140106000-memory.dmpFilesize
5.5MB
-
memory/1132-98-0x0000000001EB0000-0x0000000001EB8000-memory.dmpFilesize
32KB
-
memory/1132-97-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/2036-78-0x000000013FC40000-0x00000001401B6000-memory.dmpFilesize
5.5MB
-
memory/2236-74-0x000000001B5E0000-0x000000001B8C2000-memory.dmpFilesize
2.9MB
-
memory/2236-75-0x0000000001EB0000-0x0000000001EB8000-memory.dmpFilesize
32KB
-
memory/2932-18-0x00000000042F0000-0x00000000042F4000-memory.dmpFilesize
16KB
-
memory/3036-132-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-124-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-114-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-130-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-104-0x0000000000360000-0x0000000000380000-memory.dmpFilesize
128KB
-
memory/3036-133-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-134-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-135-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-136-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-137-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/3036-138-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB