Malware Analysis Report

2024-10-10 13:04

Sample ID 240618-1qq6vaxdmg
Target 5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e
SHA256 5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e
Tags
rat dcrat xworm execution infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e

Threat Level: Known bad

The file 5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e was found to be: Known bad.

Malicious Activity Summary

rat dcrat xworm execution infostealer persistence trojan

Modifies WinLogon for persistence

Dcrat family

Xworm

DcRat

Xworm family

Detects Windows executables referencing non-Windows User-Agents

DCRat payload

Detect Xworm Payload

Process spawned unexpected child process

DCRat payload

Detects Windows executables referencing non-Windows User-Agents

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

Modifies registry class

Uses Task Scheduler COM API

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Checks SCSI registry key(s)

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of SetWindowsHookEx

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-18 21:51

Signatures

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A

Dcrat family

dcrat

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A

Xworm family

xworm

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 21:51

Reported

2024-06-18 21:54

Platform

win7-20240221-en

Max time kernel

150s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe"

Signatures

DcRat

rat infostealer dcrat
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
File created C:\Windows\en-US\2efc4cfb112324 C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
Key opened \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Office\14.0\Common C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\", \"C:\\Program Files (x86)\\Google\\lsass.exe\", \"C:\\Windows\\TAPI\\spoolsv.exe\", \"C:\\BlockhostNet\\taskhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\", \"C:\\Program Files (x86)\\Google\\lsass.exe\", \"C:\\Windows\\TAPI\\spoolsv.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\", \"C:\\Program Files (x86)\\Google\\lsass.exe\", \"C:\\Windows\\TAPI\\spoolsv.exe\", \"C:\\BlockhostNet\\taskhost.exe\", \"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Reviewperf.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Users\\All Users\\System.exe\", \"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\", \"C:\\Program Files (x86)\\Google\\lsass.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\", \"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\", \"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\", \"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\", \"C:\\Windows\\Downloaded Program Files\\cmd.exe\", \"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\", \"C:\\Users\\All Users\\System.exe\"" C:\BlockhostNet\Reviewperf.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Everything-1.4.1.1024.x86-Setup = "\"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Everything-1.4.1.1024.x86-Setup = "\"C:\\Windows\\en-US\\Everything-1.4.1.1024.x86-Setup.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Reviewperf = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Reviewperf.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Downloaded Program Files\\cmd.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Google\\lsass.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Google\\lsass.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\BlockhostNet\\taskhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsass = "\"C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\lsass.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Downloaded Program Files\\cmd.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\BlockhostNet\\taskhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Windows\\Installer\\{90140000-002A-0000-1000-0000000FF1CE}\\wininit.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhost = "\"C:\\Program Files (x86)\\Mozilla Maintenance Service\\logs\\taskhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\TAPI\\spoolsv.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsm = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\lsm.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\1033\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Users\\All Users\\System.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Windows\\TAPI\\spoolsv.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Reviewperf = "\"C:\\MSOCache\\All Users\\{90140000-00A1-0409-0000-0000000FF1CE}-C\\Reviewperf.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Users\\Public\\SecurityHealthSystray.exe" C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Recovery\\ed850442-d104-11ee-9c57-c695cbc44580\\sppsvc.exe\"" C:\BlockhostNet\Reviewperf.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 2.tcp.eu.ngrok.io N/A N/A
N/A 6.tcp.eu.ngrok.io N/A N/A
N/A 6.tcp.eu.ngrok.io N/A N/A
N/A 5.tcp.eu.ngrok.io N/A N/A
N/A 5.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A
N/A 7.tcp.eu.ngrok.io N/A N/A
N/A 4.tcp.eu.ngrok.io N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\lsass.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\6203df4a6bafc7 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\b75386f1303e64 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Google\lsass.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Google\6203df4a6bafc7 C:\BlockhostNet\Reviewperf.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\en-US\Everything-1.4.1.1024.x86-Setup.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\wininit.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\56085415360792 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\Downloaded Program Files\cmd.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\Downloaded Program Files\ebf1f9fa8afd6d C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\TAPI\f3b6ecef712a24 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\en-US\Everything-1.4.1.1024.x86-Setup.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\en-US\2efc4cfb112324 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\TAPI\spoolsv.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\winsxs\x86_microsoft-windows-usbceip.resources_31bf3856ad364e35_6.1.7600.16385_it-it_28681e0845d44140\sppsvc.exe C:\BlockhostNet\Reviewperf.exe N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\System32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A
N/A N/A C:\Windows\system32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe N/A
N/A N/A C:\Windows\Downloaded Program Files\cmd.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Token: SeDebugPrivilege N/A C:\BlockhostNet\Reviewperf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Downloaded Program Files\cmd.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\SecurityHealthSystray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\SecurityHealthSystray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\SecurityHealthSystray.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2916 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2916 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2916 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2916 wrote to memory of 3020 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\shellbag.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\shellbag.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\shellbag.exe
PID 2916 wrote to memory of 2584 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\shellbag.exe
PID 2524 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2524 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2524 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2524 wrote to memory of 2748 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 2524 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskmgr.exe
PID 2524 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskmgr.exe
PID 2524 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskmgr.exe
PID 2524 wrote to memory of 2920 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\taskmgr.exe
PID 3020 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 3020 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 3020 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 3020 wrote to memory of 2088 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2916 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2088 wrote to memory of 1460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2088 wrote to memory of 1460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2088 wrote to memory of 1460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 2088 wrote to memory of 1460 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 1460 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockhostNet\Reviewperf.exe
PID 1460 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockhostNet\Reviewperf.exe
PID 1460 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockhostNet\Reviewperf.exe
PID 1460 wrote to memory of 340 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockhostNet\Reviewperf.exe
PID 340 wrote to memory of 2836 N/A C:\BlockhostNet\Reviewperf.exe C:\Windows\System32\cmd.exe
PID 340 wrote to memory of 2836 N/A C:\BlockhostNet\Reviewperf.exe C:\Windows\System32\cmd.exe
PID 340 wrote to memory of 2836 N/A C:\BlockhostNet\Reviewperf.exe C:\Windows\System32\cmd.exe
PID 2836 wrote to memory of 2556 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2836 wrote to memory of 2556 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2836 wrote to memory of 2556 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\w32tm.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2360 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2584 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\schtasks.exe
PID 2584 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\schtasks.exe
PID 2584 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\schtasks.exe
PID 2836 wrote to memory of 812 N/A C:\Windows\System32\cmd.exe C:\Windows\Downloaded Program Files\cmd.exe
PID 2836 wrote to memory of 812 N/A C:\Windows\System32\cmd.exe C:\Windows\Downloaded Program Files\cmd.exe
PID 2836 wrote to memory of 812 N/A C:\Windows\System32\cmd.exe C:\Windows\Downloaded Program Files\cmd.exe
PID 1676 wrote to memory of 980 N/A C:\Windows\system32\taskeng.exe C:\Users\Public\SecurityHealthSystray.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe

"C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe"

C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat

"C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\Íîâûé òåêñòîâûé äîêóìåíò.bat" "

C:\Users\Admin\AppData\Local\Temp\shellbag.exe

"C:\Users\Admin\AppData\Local\Temp\shellbag.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\taskmgr.exe

taskmgr.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\BlockhostNet\TFnnSou2o.vbe"

C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\BlockhostNet\go965fc8ARoK8wM.bat" "

C:\BlockhostNet\Reviewperf.exe

"C:\BlockhostNet\Reviewperf.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Everything-1.4.1.1024.x86-SetupE" /sc MINUTE /mo 9 /tr "'C:\Windows\en-US\Everything-1.4.1.1024.x86-Setup.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Everything-1.4.1.1024.x86-Setup" /sc ONLOGON /tr "'C:\Windows\en-US\Everything-1.4.1.1024.x86-Setup.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Everything-1.4.1.1024.x86-SetupE" /sc MINUTE /mo 7 /tr "'C:\Windows\en-US\Everything-1.4.1.1024.x86-Setup.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 7 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\Recovery\ed850442-d104-11ee-9c57-c695cbc44580\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\wininit.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Windows\Installer\{90140000-002A-0000-1000-0000000FF1CE}\wininit.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Windows\Downloaded Program Files\cmd.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Downloaded Program Files\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Windows\Downloaded Program Files\cmd.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsm" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsml" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\1033\lsm.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\System.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Users\All Users\System.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Google\lsass.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files (x86)\Google\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Google\lsass.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\TAPI\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 14 /tr "'C:\Windows\TAPI\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 10 /tr "'C:\BlockhostNet\taskhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhost" /sc ONLOGON /tr "'C:\BlockhostNet\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "taskhostt" /sc MINUTE /mo 13 /tr "'C:\BlockhostNet\taskhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ReviewperfR" /sc MINUTE /mo 6 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Reviewperf.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "Reviewperf" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Reviewperf.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "ReviewperfR" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0409-0000-0000000FF1CE}-C\Reviewperf.exe'" /rl HIGHEST /f

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\2OM6vZgrdE.bat"

C:\Windows\system32\w32tm.exe

w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\shellbag.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'shellbag.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\SecurityHealthSystray.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Public\SecurityHealthSystray.exe"

C:\Windows\Downloaded Program Files\cmd.exe

"C:\Windows\Downloaded Program Files\cmd.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {71ED5E96-084C-4096-ACBF-C0AEF3E7C4EF} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 5.tcp.eu.ngrok.io udp
DE 3.67.62.142:15221 5.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 a0996127.xsph.ru udp
RU 141.8.195.33:80 a0996127.xsph.ru tcp
RU 141.8.195.33:80 a0996127.xsph.ru tcp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.158.249.75:15221 0.tcp.eu.ngrok.io tcp
N/A 127.0.0.1:15221 tcp
US 8.8.8.8:53 7.tcp.eu.ngrok.io udp
DE 35.157.111.131:15221 7.tcp.eu.ngrok.io tcp
DE 3.67.62.142:15221 5.tcp.eu.ngrok.io tcp
DE 3.67.62.142:15221 5.tcp.eu.ngrok.io tcp
N/A 127.0.0.1:15221 tcp
DE 3.67.62.142:15221 5.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 4.tcp.eu.ngrok.io udp
DE 3.127.59.75:15221 4.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 2.tcp.eu.ngrok.io udp
DE 18.156.13.209:15221 2.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 6.tcp.eu.ngrok.io udp
DE 18.197.239.109:15221 6.tcp.eu.ngrok.io tcp
DE 18.156.13.209:15221 2.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 6.tcp.eu.ngrok.io udp
DE 52.28.247.255:15221 6.tcp.eu.ngrok.io tcp
DE 18.156.13.209:15221 2.tcp.eu.ngrok.io tcp
RU 141.8.195.33:80 a0996127.xsph.ru tcp
N/A 127.0.0.1:15221 tcp
US 8.8.8.8:53 5.tcp.eu.ngrok.io udp
DE 3.67.161.133:15221 5.tcp.eu.ngrok.io tcp
DE 3.67.161.133:15221 5.tcp.eu.ngrok.io tcp

Files

\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat

MD5 0e959d2fe0c85b63c51737d8689dc408
SHA1 664ee4e2b322f9909c23bd42eb8596acdd064bdc
SHA256 a0052c6b843d6346a71656e34c76afc712d6cd9063a0d229e7e1008d2711281d
SHA512 ec40afb2bc43c34e007d4d1822b70d54f1afd8b535c501308db9f1d70efc37d780e6c82f70cc3a299e10baed3b17e2dad79000a33e1a990e88a2016554868e5a

C:\Users\Admin\AppData\Local\Temp\Íîâûé òåêñòîâûé äîêóìåíò.bat

MD5 0b7c67b19efc2995b5c2a2103d7e30e5
SHA1 c3393cb94dfce2860edd71fe074cfa50463234ba
SHA256 40a320d35727df5e7b1fcd0722c45b5bce84b6814baef461bd11cdc097ae418b
SHA512 0eacfbcef78f9239e21b80bc1d1fa36f29a01def918f18f5824883400d8539503a9fb5bdc887d13c2f80223519c27dfa010ff57aa0622c4c08cc7790a8b1db99

\Users\Admin\AppData\Local\Temp\shellbag.exe

MD5 d366043ffd6eddefc153a535ee9feb84
SHA1 bde517095b81fec05cf0fcfd5bb70b3e75057f0d
SHA256 a61985b3d84fd4728439382a92fb117801eaf7faa2846b7cd9b26a3718076884
SHA512 cc1307eef18bc1236611e9ec580b4013d8539edc4c36982dc696cba868c58c531e77cecb829a935d374cbefc39d9589a93fe0c65eb694ea3e4bc12f65c3b438b

\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe

MD5 f55d52d5d690a8e1b2df9217bc3ddfdf
SHA1 0e45d3a28cc096dc7edc1208f7428d66335df11a
SHA256 59f57803fa5235075c3e470e1006905a61236e491bb75a599d862cafcfbb529f
SHA512 4101015760dd2b1d9cbf9586802e610bbe6f74b73bc5dbb4391417afe8fa20762a84b04cd15019b54107d8ad0e4fc523f25403482431dd53aec3d07a4b217941

memory/2916-34-0x0000000000400000-0x00000000006E5000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsd2483.tmp\InstallOptions.dll

MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

C:\BlockhostNet\TFnnSou2o.vbe

MD5 45347727c50684fa6a861f23f5980155
SHA1 5a29658e89ddedbeece3257b64abf00984f74293
SHA256 75e52d5fbb8bc0d9a887c46d4bb93989b0d3d38e6fd85ffd6a2d3a22bbc8c855
SHA512 3b1e6eeae858f14c4aa95e4833cc941f26532594e5e11264177a6f299e8d608d9783bf1f133ff1140575b7e067a31ed135ff58bb77e1c2068aad3de3f6e0e5d1

memory/2584-58-0x0000000000020000-0x0000000000030000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsd2483.tmp\LangDLL.dll

MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

C:\BlockhostNet\go965fc8ARoK8wM.bat

MD5 3d9b9303a3470cfeee145f324711c4ca
SHA1 423a8c5f6cfb0edbbe81965626c20ab6c157cbd8
SHA256 4e8c1aca1328fd4c2e32d620f6f65be2e11e267b031b50a30a1a860b164a0073
SHA512 bdbe24c0a06258182894f5959ebea27bd4f14942e2eee79f1b7419775b6c2c4b07874597ad262cad6e1802e38ccca57e61038820b042dfdd4233b8e8edcd3009

\BlockhostNet\Reviewperf.exe

MD5 460b1f316ba52be0bfa30542127029dc
SHA1 d96d9c357c23478c90beb5275457682919ed3883
SHA256 32e038fe6998090c2e9de22209a2e3860f07cac0f5063758adf092be51378f05
SHA512 cc07ae5360ffcb127ff27d8d5a0bd2f5240a2893a38c299de057403a2a43f54aed608beed565745142aad8748f5fd3a84e2b3834ce4e2f0774a385949d78502f

memory/340-70-0x00000000010C0000-0x0000000001196000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\2OM6vZgrdE.bat

MD5 6e515b942b341a2ab49212ba1d7ee774
SHA1 db83d5a434220f1fbed0033be41851f5641e82b9
SHA256 435606c8ebb9ee70474e39227fa5ad4a13da7b58f8eb33dd7f061e551a5fde2a
SHA512 7fe1e86a53e652cd5c212fd044efeac56957e2af4be73660deabc984e17d5088bfec3f01ea14234f86cc9f240dc39f0f0053df9826929aadace9b302a62a898e

\Users\Admin\AppData\Local\Temp\nsd2483.tmp\System.dll

MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

memory/2440-120-0x000000001B5A0000-0x000000001B882000-memory.dmp

memory/2440-121-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 01c25f70aa418168f1e1263b424132b7
SHA1 b3f6017e61e3fa28ec0f21d746061aaee22ccac6
SHA256 e0d6c2509d261e1add50744ad1b37779e7026578fca39dad32cea68e9e94e377
SHA512 8da608b70a94c0473ec8dbecad8fdddbcf3c22ae240f487f9bb088d28facfadd4b81795e170d0c1c67cea098ec150e4a48b452a75eaa7ab5d76253692458ff35

memory/2720-127-0x000000001B760000-0x000000001BA42000-memory.dmp

memory/2720-128-0x00000000021D0000-0x00000000021D8000-memory.dmp

memory/812-145-0x00000000003B0000-0x0000000000486000-memory.dmp

memory/980-151-0x0000000000A10000-0x0000000000A20000-memory.dmp

memory/1452-156-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-18 21:51

Reported

2024-06-18 21:54

Platform

win10v2004-20240611-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe"

Signatures

DcRat

rat infostealer dcrat

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies WinLogon for persistence

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\", \"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\", \"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office\\root\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\", \"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\", \"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office\\root\\SppExtComObj.exe\", \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\C4CB57A9-5153-4F68-A999-83DB798A5AEF\\RuntimeBroker.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\", \"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\", \"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\", \"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\", \"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\unsecapp.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\", \"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\", \"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Media Player\\unsecapp.exe\", \"C:\\Program Files\\Microsoft Office\\root\\SppExtComObj.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\spoolsv.exe\", \"C:\\Users\\Admin\\fontdrvhost.exe\", \"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\", \"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\"" C:\BlockhostNet\Reviewperf.exe N/A

Process spawned unexpected child process

Description Indicator Process Target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process N/A C:\Windows\system32\schtasks.exe

Xworm

trojan rat xworm

DCRat payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Detects Windows executables referencing non-Windows User-Agents

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat N/A
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation C:\BlockhostNet\Reviewperf.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHealthSystray.lnk C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Media Player\\unsecapp.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\unsecapp = "\"C:\\Program Files (x86)\\Windows Media Player\\unsecapp.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\C4CB57A9-5153-4F68-A999-83DB798A5AEF\\RuntimeBroker.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\ImmersiveControlPanel\\SystemSettings\\View\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Admin\\fontdrvhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Program Files\\Google\\Chrome\\sppsvc.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Microsoft Office\\root\\SppExtComObj.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Microsoft Office\\Updates\\Apply\\FilesInUse\\C4CB57A9-5153-4F68-A999-83DB798A5AEF\\RuntimeBroker.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spoolsv = "\"C:\\Recovery\\WindowsRE\\spoolsv.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Admin\\fontdrvhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Program Files\\Microsoft Office\\root\\SppExtComObj.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Users\\Public\\SecurityHealthSystray.exe" C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\Performance\\WinSAT\\DataStore\\fontdrvhost.exe\"" C:\BlockhostNet\Reviewperf.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A 6.tcp.eu.ngrok.io N/A N/A
N/A 5.tcp.eu.ngrok.io N/A N/A
N/A 4.tcp.eu.ngrok.io N/A N/A
N/A 5.tcp.eu.ngrok.io N/A N/A
N/A 2.tcp.eu.ngrok.io N/A N/A
N/A 4.tcp.eu.ngrok.io N/A N/A
N/A 0.tcp.eu.ngrok.io N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Google\Chrome\0a1fd5f707cd16 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Windows Media Player\unsecapp.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files (x86)\Windows Media Player\29c1c3cc0f7685 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files\Microsoft Office\root\SppExtComObj.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files\Microsoft Office\root\e1ef82546f0b02 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\C4CB57A9-5153-4F68-A999-83DB798A5AEF\RuntimeBroker.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\C4CB57A9-5153-4F68-A999-83DB798A5AEF\9e8d7a4ca61bd9 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Program Files\Google\Chrome\sppsvc.exe C:\BlockhostNet\Reviewperf.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Performance\WinSAT\DataStore\fontdrvhost.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\Performance\WinSAT\DataStore\5b884080fd4f94 C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\ImmersiveControlPanel\SystemSettings\View\csrss.exe C:\BlockhostNet\Reviewperf.exe N/A
File created C:\Windows\ImmersiveControlPanel\SystemSettings\View\886983d96e3d3e C:\BlockhostNet\Reviewperf.exe N/A

Enumerates physical storage devices

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 C:\Windows\SysWOW64\Taskmgr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A C:\Windows\SysWOW64\Taskmgr.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName C:\Windows\SysWOW64\Taskmgr.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C:\Windows\SysWOW64\explorer.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\BlockhostNet\Reviewperf.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Recovery\WindowsRE\spoolsv.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
Token: SeDebugPrivilege N/A C:\BlockhostNet\Reviewperf.exe N/A
Token: SeDebugPrivilege N/A C:\Recovery\WindowsRE\spoolsv.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\SecurityHealthSystray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\SecurityHealthSystray.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Public\SecurityHealthSystray.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A
N/A N/A C:\Windows\SysWOW64\Taskmgr.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2344 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2344 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2344 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat
PID 2344 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 1372 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Windows\SysWOW64\cmd.exe
PID 2344 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\shellbag.exe
PID 2344 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\shellbag.exe
PID 2344 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2344 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 2344 wrote to memory of 4848 N/A C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe
PID 1372 wrote to memory of 412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1372 wrote to memory of 412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1372 wrote to memory of 412 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\explorer.exe
PID 1372 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Taskmgr.exe
PID 1372 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Taskmgr.exe
PID 1372 wrote to memory of 3728 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\Taskmgr.exe
PID 4012 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 4012 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 4012 wrote to memory of 4956 N/A C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat C:\Windows\SysWOW64\WScript.exe
PID 4956 wrote to memory of 3316 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4956 wrote to memory of 3316 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 4956 wrote to memory of 3316 N/A C:\Windows\SysWOW64\WScript.exe C:\Windows\SysWOW64\cmd.exe
PID 3316 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockhostNet\Reviewperf.exe
PID 3316 wrote to memory of 3660 N/A C:\Windows\SysWOW64\cmd.exe C:\BlockhostNet\Reviewperf.exe
PID 3660 wrote to memory of 4552 N/A C:\BlockhostNet\Reviewperf.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 3660 wrote to memory of 4552 N/A C:\BlockhostNet\Reviewperf.exe C:\Recovery\WindowsRE\spoolsv.exe
PID 1152 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 2120 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 3920 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 3288 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 1932 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1152 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\schtasks.exe
PID 1152 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\shellbag.exe C:\Windows\System32\schtasks.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe

"C:\Users\Admin\AppData\Local\Temp\5a263375f836ca004e5a13e840b4227be54534ca0e25c6f6c36e2dfe5be0a43e.exe"

C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat

"C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Íîâûé òåêñòîâûé äîêóìåíò.bat" "

C:\Users\Admin\AppData\Local\Temp\shellbag.exe

"C:\Users\Admin\AppData\Local\Temp\shellbag.exe"

C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe

"C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe"

C:\Windows\SysWOW64\explorer.exe

explorer.exe

C:\Windows\SysWOW64\Taskmgr.exe

taskmgr.exe

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\BlockhostNet\TFnnSou2o.vbe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\BlockhostNet\go965fc8ARoK8wM.bat" "

C:\BlockhostNet\Reviewperf.exe

"C:\BlockhostNet\Reviewperf.exe"

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\spoolsv.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 7 /tr "'C:\Users\Admin\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 14 /tr "'C:\Users\Admin\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 12 /tr "'C:\Windows\Performance\WinSAT\DataStore\fontdrvhost.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 10 /tr "'C:\Windows\Performance\WinSAT\DataStore\fontdrvhost.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Program Files\Google\Chrome\sppsvc.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\View\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\View\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\Windows\ImmersiveControlPanel\SystemSettings\View\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Media Player\unsecapp.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Media Player\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Media Player\unsecapp.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\root\SppExtComObj.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\root\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Microsoft Office\root\SppExtComObj.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\C4CB57A9-5153-4F68-A999-83DB798A5AEF\RuntimeBroker.exe'" /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\C4CB57A9-5153-4F68-A999-83DB798A5AEF\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Windows\system32\schtasks.exe

schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 8 /tr "'C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\C4CB57A9-5153-4F68-A999-83DB798A5AEF\RuntimeBroker.exe'" /rl HIGHEST /f

C:\Recovery\WindowsRE\spoolsv.exe

"C:\Recovery\WindowsRE\spoolsv.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\shellbag.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'shellbag.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\SecurityHealthSystray.exe'

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'SecurityHealthSystray.exe'

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "SecurityHealthSystray" /tr "C:\Users\Public\SecurityHealthSystray.exe"

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

C:\Users\Public\SecurityHealthSystray.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 203.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
BE 88.221.83.224:443 www.bing.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 224.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 a0996127.xsph.ru udp
RU 141.8.195.33:80 a0996127.xsph.ru tcp
RU 141.8.195.33:80 a0996127.xsph.ru tcp
US 8.8.8.8:53 33.195.8.141.in-addr.arpa udp
US 8.8.8.8:53 4.tcp.eu.ngrok.io udp
DE 18.198.77.177:15221 4.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 177.77.198.18.in-addr.arpa udp
DE 18.198.77.177:15221 4.tcp.eu.ngrok.io tcp
DE 18.198.77.177:15221 4.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 0.tcp.eu.ngrok.io udp
DE 18.192.31.165:15221 0.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 165.31.192.18.in-addr.arpa udp
DE 18.198.77.177:15221 4.tcp.eu.ngrok.io tcp
DE 18.198.77.177:15221 4.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 6.tcp.eu.ngrok.io udp
DE 52.28.247.255:15221 6.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 5.tcp.eu.ngrok.io udp
DE 3.67.161.133:15221 5.tcp.eu.ngrok.io tcp
N/A 127.0.0.1:15221 tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
DE 52.28.247.255:15221 6.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 4.tcp.eu.ngrok.io udp
DE 3.127.59.75:15221 4.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 75.59.127.3.in-addr.arpa udp
DE 52.28.247.255:15221 6.tcp.eu.ngrok.io tcp
DE 3.127.59.75:15221 4.tcp.eu.ngrok.io tcp
RU 141.8.195.33:80 a0996127.xsph.ru tcp
N/A 127.0.0.1:15221 tcp
DE 3.67.161.133:15221 5.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 5.tcp.eu.ngrok.io udp
DE 3.67.62.142:15221 5.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 2.tcp.eu.ngrok.io udp
DE 3.127.138.57:15221 2.tcp.eu.ngrok.io tcp
US 8.8.8.8:53 57.138.127.3.in-addr.arpa udp
N/A 127.0.0.1:15221 tcp

Files

C:\Users\Admin\AppData\Local\Temp\CheatCheckLk9subat.bat

MD5 0e959d2fe0c85b63c51737d8689dc408
SHA1 664ee4e2b322f9909c23bd42eb8596acdd064bdc
SHA256 a0052c6b843d6346a71656e34c76afc712d6cd9063a0d229e7e1008d2711281d
SHA512 ec40afb2bc43c34e007d4d1822b70d54f1afd8b535c501308db9f1d70efc37d780e6c82f70cc3a299e10baed3b17e2dad79000a33e1a990e88a2016554868e5a

C:\Users\Admin\AppData\Local\Temp\shellbag.exe

MD5 d366043ffd6eddefc153a535ee9feb84
SHA1 bde517095b81fec05cf0fcfd5bb70b3e75057f0d
SHA256 a61985b3d84fd4728439382a92fb117801eaf7faa2846b7cd9b26a3718076884
SHA512 cc1307eef18bc1236611e9ec580b4013d8539edc4c36982dc696cba868c58c531e77cecb829a935d374cbefc39d9589a93fe0c65eb694ea3e4bc12f65c3b438b

C:\Users\Admin\AppData\Local\Temp\Everything-1.4.1.1024.x86-Setup.exe

MD5 f55d52d5d690a8e1b2df9217bc3ddfdf
SHA1 0e45d3a28cc096dc7edc1208f7428d66335df11a
SHA256 59f57803fa5235075c3e470e1006905a61236e491bb75a599d862cafcfbb529f
SHA512 4101015760dd2b1d9cbf9586802e610bbe6f74b73bc5dbb4391417afe8fa20762a84b04cd15019b54107d8ad0e4fc523f25403482431dd53aec3d07a4b217941

memory/1152-28-0x00007FFD79253000-0x00007FFD79255000-memory.dmp

memory/1152-30-0x0000000000460000-0x0000000000470000-memory.dmp

memory/2344-31-0x0000000000400000-0x00000000006E5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Íîâûé òåêñòîâûé äîêóìåíò.bat

MD5 0b7c67b19efc2995b5c2a2103d7e30e5
SHA1 c3393cb94dfce2860edd71fe074cfa50463234ba
SHA256 40a320d35727df5e7b1fcd0722c45b5bce84b6814baef461bd11cdc097ae418b
SHA512 0eacfbcef78f9239e21b80bc1d1fa36f29a01def918f18f5824883400d8539503a9fb5bdc887d13c2f80223519c27dfa010ff57aa0622c4c08cc7790a8b1db99

C:\Users\Admin\AppData\Local\Temp\nsg6FF2.tmp\InstallOptions.dll

MD5 ece25721125d55aa26cdfe019c871476
SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480

C:\Users\Admin\AppData\Local\Temp\nsg6FF2.tmp\LangDLL.dll

MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

C:\BlockhostNet\TFnnSou2o.vbe

MD5 45347727c50684fa6a861f23f5980155
SHA1 5a29658e89ddedbeece3257b64abf00984f74293
SHA256 75e52d5fbb8bc0d9a887c46d4bb93989b0d3d38e6fd85ffd6a2d3a22bbc8c855
SHA512 3b1e6eeae858f14c4aa95e4833cc941f26532594e5e11264177a6f299e8d608d9783bf1f133ff1140575b7e067a31ed135ff58bb77e1c2068aad3de3f6e0e5d1

memory/3728-61-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-60-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-59-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-67-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-71-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-70-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-69-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-68-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-66-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

memory/3728-65-0x0000000002AD0000-0x0000000002AD1000-memory.dmp

C:\BlockhostNet\go965fc8ARoK8wM.bat

MD5 3d9b9303a3470cfeee145f324711c4ca
SHA1 423a8c5f6cfb0edbbe81965626c20ab6c157cbd8
SHA256 4e8c1aca1328fd4c2e32d620f6f65be2e11e267b031b50a30a1a860b164a0073
SHA512 bdbe24c0a06258182894f5959ebea27bd4f14942e2eee79f1b7419775b6c2c4b07874597ad262cad6e1802e38ccca57e61038820b042dfdd4233b8e8edcd3009

C:\BlockhostNet\Reviewperf.exe

MD5 460b1f316ba52be0bfa30542127029dc
SHA1 d96d9c357c23478c90beb5275457682919ed3883
SHA256 32e038fe6998090c2e9de22209a2e3860f07cac0f5063758adf092be51378f05
SHA512 cc07ae5360ffcb127ff27d8d5a0bd2f5240a2893a38c299de057403a2a43f54aed608beed565745142aad8748f5fd3a84e2b3834ce4e2f0774a385949d78502f

memory/3660-76-0x0000000000A30000-0x0000000000B06000-memory.dmp

memory/2120-106-0x000001F0FE770000-0x000001F0FE792000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wmnbsyau.3qk.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 22310ad6749d8cc38284aa616efcd100
SHA1 440ef4a0a53bfa7c83fe84326a1dff4326dcb515
SHA256 55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf
SHA512 2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 ba169f4dcbbf147fe78ef0061a95e83b
SHA1 92a571a6eef49fff666e0f62a3545bcd1cdcda67
SHA256 5ef1421e19fde4bc03cd825dd7d6c0e7863f85fd8f0aa4a4d4f8d555dc7606d1
SHA512 8d2e5e552210dcda684682538bc964fdd8a8ff5b24cc2cc8af813729f0202191f98eb42d38d2355df17ae620fe401aad6ceaedaed3b112fdacd32485a3a0c07c

C:\Users\Admin\AppData\Local\Temp\nsg6FF2.tmp\System.dll

MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

memory/1152-168-0x00007FFD79253000-0x00007FFD79255000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecurityHealthSystray.exe.log

MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1