ca45577006013e8af6a3c06a645824ce98b3222bfdcd847373bc9a12ab97b67c

Resubmissions

28/09/2024, 07:40

240928-jhpvdatgkp 8

04/07/2024, 03:55

240704-egtpqatanp 8

Analysis

max time kernel
131s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Lite.cmd
Size

842B
MD5

5ae0aac595dab0ffe87b36e4cbb822a6
SHA1

29a36471f7280ca5bb5970e8e1e22a734615483e
SHA256

23bccb5d8c1036fac73b954710da88380cdf2125654fbef534a7ccd56d918bd0
SHA512

60dff8a051aca03c172299caf614999f3b317854d0e1311e97b72d55f2e3d9304b4bf93d7873da59be565001773da6b59dc390a8cbd3192a554b7bf2d9a4fbfb

Score

8^/10

persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 9 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\VerifierDebug = "0"	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\GlobalFlag = "256"	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\KMS_HWID = "4187226795851251830"	Activator.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\VerifierDlls = "SppExtComObjHook.dll"	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\VerifierFlags = "2147483648"	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\KMS_Emulation = "1"	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\KMS_ActivationInterval = "120"	Activator.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\KMS_RenewalInterval = "10080"	Activator.exe

Executes dropped EXE 3 IoCs

pid	Process
2596	gatherosstatemodified.exe
764	clipup.exe
4392	clipup.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\SppExtComObjHook.dll	Activator.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2776	sc.exe
2248	sc.exe
636	sc.exe
2700	sc.exe
532	sc.exe
3176	sc.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Clipup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	gatherosstatemodified.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	gatherosstatemodified.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	gatherosstatemodified.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	gatherosstatemodified.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	gatherosstatemodified.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	Clipup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	Clipup.exe

Modifies data under HKEY_USERS 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\0018C00E86FE275E = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000025211fa19d5026448d80ded9f423a63d0000000002000000000010660000000100002000000093847cfde2aee572429c89588402f9555593df3204873cc1075720e22bdf1ac4000000000e8000000002000020000000d417784e7488f26b0b4892808b1ae77dee56bef4031e508d97829c1caa948b1b800000003ea42ccbc925ef9f4924c14a8ec8dc1654ac724ffe70310ff6854d074a50928066cac3f423f1604f8ad4fca30dc9c86624c40deea3f4b9b23cb762ac21e3369904a8f9068099dd1dffbdcaa69f67bcdd9bb47d8ec7591ac93c839a2dae1d962097ace74329dd6736f8f02ea0a5505e136665bf13e050be93a2ee054d32a5d031400000002a167b7fb0af050c0bdc652ab1f8e1bc8eac25669626653e734c8ba248961e3580cd8c8d7fecd33c64514cfe68d156ca3d08fcd03c9c5250a984e8b134c2c76e	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\ExtendedProperties	Activator.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property	Activator.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive	Activator.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000025211fa19d5026448d80ded9f423a63d00000000020000000000106600000001000020000000d70947690c4147bdc9a83d49bbae1e498ed5a5287c1f4664078ce358a9774924000000000e8000000002000020000000e306a60d750c922386bd26d8bf9b795615f54a5749cc8a1ae54f3122108a62e2100d00007ef9bcd05184f938c3ca7b77d039f3c77c08f0b0dfc994923e53a53c76ff581392eedd54cf2a567ce8f338dcda3c79d05b1c1e436c11e8332a5a4e81b5c5a43e0a46f13909a2ae0d500c31554077986c52e7689b5542d3f5705aa10e668ad46b2b3837bd716f90205ac622b64328d213b4f12aa306262246eb67711412f07db58403c8d7d3ec751277d5bf31549ca4d385c2f7d2d58c92a8a09f0930c315963c42c7fd9d313b0f56ba9bf51b126ab257f410c83fac8abc4bea8b6a35e13a8f28349d42561038c764b5fabe0d22609158673f6041cf7341c3de75f3f67aef9e45f781f4692d443bb53f3bef9bb70f61ef9adeba6c4de9081a1ec190faa20104f7ac06d723e3b2071cc1c11489e94b3a913a3e99485f7d2bb75bc321bc8b7002da7af0fefec927a213ac6feb3a5f6b2bf58817a2e9739dc4672f7ee083587840508a716b29d70e2241302cdada8b8a95fdb733429ae236dbf2337e7e101a24eb8f9480516541817d67466a7824178d68d2d778f8a373c2a046a7f1075caa0fef8ebc72fdc59c5da6084eead42f2048cd8d33de7b0a9f07eb72bf85a3c0c5238337925b49099531a6daffb24fae3eb17c3723b36802b9c68c3f4acaf7c337018a0e510af3d66f6a3d2ec1c5d3fdf079e51d42df13d39dfa69b8fed61d3068be0899385eabde40c9ded4b959ec39ff7a6959a989efffbe7cdae40728e5ad4f30670e902ef8d821e8d13eeb5d0fbff1abc2d418254f4192bbfd512e112d19e7b384bc144fa3e4eff7036d0a3bcc5e96fb3f5e640008ccfa45402a1f715c6f18293c9d98998fe80ca3fcab79bfaf27268d8b26eb56bf6bc676143a4127de3778f0fc6ce8c9f5be18f5c7f8d5c8ac9a0ed31e16b81a0f7861a740aae130f18e1aa403c933d727262d3f1791aa470ecad95df7ae17f40b99f4fddc88135e4ae179d9535a58eba4e17cf8d8573410d025bc7b3412cba3c8c98c040c6d89e84b4e5dca1bb5bcaaf732a7fc3e3dff4b85f4a405651aaac89271767674071074dbdfcc7223d6ce660af44513dc36b1d95206caab40fe7a1e2f55fe1423bffc1450b4656a9ca2b6dc975cd4515150c8c075afa7db6f4f5ebf0781861dfda0cac08b3d8869761a8cb754636b1d1156813568690b132021755c6fe22fecc62dd5a7433ccc54f198c5d7b32cb81855e52340134cb352d19b74ec79f3e19f819c9a07e5efc0c755abf9a82527114fb96ad08b75bee9f61bd0a98ac1571e81024b11900e359a1a06b8375beaa5d662913ee6f2a74c35372c1555d1230d75200253de3ce0a990a9e3559c0f71586094a56e747639585831792a47bdcf66cf0e95914f8823c35f8f43d890c2205584ed654a30dfe4efe1861d38f55f87638fe2ff90e3f32c20497fa1178262b06ea8e5ead7448367b3ea037880b46fda2013f0b5df98555b8112e10de5b3ee6fb4b8f1082095313478ce3bdc4c4885462c89d6404a4d1c1a3aea9481207580f8a2286a3edc730effad97af6d718aac4e6b229ec910b17a5450f0e0e1e9b875ff7e6afad4e04444eee3de3d34554289415cabe913c45ffa1655504949b310f8c3bb2be7e2e8d29311ceadc87d5e55fe8378d3a98dca8a06c3c355bb6ed9fe855ee67eeee6712fa09a3c92440a3d89776192ca5ac65e8de871925f12aa4cecde9ca06554a52de15cfacb70808b2ef04e2c341509c0f39e96bfdc4c7bd91d35e8db18c2020a6f21d6fb3931bbd2bea773e0e05f6f1d21276644bd90082207063d57a4bd3bf086e3907523613b4d562dd54317ce9236e66307f0a2a31faab954b2f2372c53c74bd86d83589d5ae8ebff44d979440c893ea11b6762278995e876c44818e84ed772ff0214974bce68e12079a97db988124c9a7cbff4c2121392cd295e55be80e90c1a3da617c49965b52883a346573f90cb195b3c56e4eccbeb533d2c7b09e73bfcbd56099c2c473fe8dcca4184d0ccffdf26c9d3d81a24715357bb86a5ac9e0affc3ab3869e67c0698e4726b8a5faff7fe88d58e24b8af899e4fa658c08e9160b53ee6d0ea54f42d07947067a4c4b911fd4936da64491d4d95fe707039be8cfc392607f5f0094d5f321f79962b7ae9d4b836b27079efda05b0c9e72129fbc4fb1b6655ad42421a47d0974c88eed319caf7cd837e6c5f25cc32158709e5a5bd5267cb91a5a0959f984bb45a2d4492909955fc17f2acedf024222a80b5efa4693f70b0bacbf0ea6707dca5cf1c5c28329a8b4151df5617d1eadcb3ab911b7476b037fe20d1393669711125b6a4d71b1f7fd0c1e23cc859d55d6785493da5e37a4b14e8cd3d9526ed50da298646c1deb00311a7b4e9a392d3185b857e316c60ae362db7345a56008f7fe20c4bea80a42d3bdd6ac8b31af9c8b38218e31c73cfb926818aec6c53b09671ff66e330de948a4a95c1a886ab4cfcbeecfb08f651596a3893c07d64e4f20aa21730e59d957e2cb4f81483a12fd0c0254e804a281605c41c21571db64b4251eddecede9e4b635c43a7ac6b65f6a4dbd427dfd0a3bdc3da2763ce8dc66c81d367dcc7272d1b7d17c2b70af580a6be0b02fc66f6a048dd61bbe947f085d4c249a22fe9856bdbc26ba6105ae5262577356adc005c85cf506dad53b517904372da36ab8e13e7d76ff3de32b83d8ecfc9d453797f6c1a854167868d9ab319de338fbfde2120cfe75df98926275f528fb857e2789ff1f5e3d39bea10e97b0d08597f0d20d08bbf699c04eca97724516d1c3c7c8f160be652597a7d4a8e352e2855365bc5f0e45aaad3fd18320e2dab8da660586fe8beaf7d44d1e7af137dcf8acc487378bf5a40d2bf8632c6dc2ca0ae325a0b3807196d4a5728701474197622cb9233df57990a3f4a254d7f0ab1d8c256650154f2f8613a99a4b26adba3cc51d686d3d090515a6e3dd32c332c5a0637b769c1b966ea0f524d01d90350e85d9054efa4d6c62e707c2aea2787be5ee3715c8a2e1b26258de0e854f87aad6f490ff4220832fc0f02b76ee4858ee71f663a89eb1042fe45c8e88364c19c4241abb55354a70cedf2651caab08a014d912789aad41c5d32ba429e401e83e47362e1262a28ba0f6aa0071f5e5bc6c045f519e523baa4dc947210acc2096f33559aea972bb5851913a1d2e99295e5c81ec0582199d2d953b36ec47a4af8b4578175891022515e431019c92a31022e53c9e2e86b796995762089d6b56bce445c511c9bbc0f3615a9e5f2ea397c8efd296491557029d7da1cf2c89997bafff6ad5d60b441ec9c4a29496af904a41bdffc764359ff67b5e80a7cc703b98e9a9f808803956587da2d0e20f1b249e9e3da0db99ecbb1acf6cd2a5fd9870566d90aa7a553055c3310e6dfd57ab80de3b20972fb2c8eaa7b542f07aafa264bd49e4a8d3219fb6989ac62da20cd77f3261784985a6f328191d219fab77e4f36bbccb3ce4195f409f4694caf09c3a51473944b4fa50cecca02a7f372072ebbf9789b0c2fa27cbb50870632a1def977c6264465980e53fa061f396ae2bc729c36362c2140d2ef67e33e1e5583d054f220a0d1f6cd9096b27a3d14a9b0a5f77ac7b1d9c89d150f355d09016865a2d6e7bbe3c164a95f8c2ed87267219d449cb56a4d10055573b92d838f73d3a379480bdd9b3d116480b5cd0addb6f08a70655f9d3e0a1d0dc7023841fc8803493dc03a39bbf1e645d0012529cd061e1802082ec9607616e4a3f30a37135a8a2eb898688d7262cfc37f664c5c11b4c1e117fe5670b835284fa336df3f5e2e022cb206c8c410c1be7b447537535499962458768d64ddc3df7659b49180be0aee69f37f9519d711fbc68c247328f403fa2a7e927137e80fa79664a3eb97c2c2cb20b2c462829ef37a57b3f1138eb8f20448f25e79f12bb3da6a1b8314981b7bd9259605fc6b394d785f881d18e93171c40026a27b9155da3a0f96c6ca0e05147d9e0f27028fca2001579a31754ccccf35563d45dd0b1d8c64882fe42d1f8c9159ae6f9096eca194f3894e4003d730c3e49a134fccede081dd8b127d011fd1738ad82bae2c2e487e6009c35e11d013af99682ae60f437fd4559e74e3fe4384397b0c0e97f64940b9bb97ed8a016c690abae51cd5c75186d5ba65a55b804313d08aabd84467d94f3a065f9c1da85b0485474cafc083c78e3c97c53e420ce40592f8de02ea019bc051637aa9a90e6feb776b84f2f54b04f589a4e48a185cb98f95ac5d7c734c99cbf9feb108be4a254deb053c1c8988e213699978ef0d51052afd2c8f3f4b12f9eb2de1fdc3ca593bf3fc752f6134514942d392bdcbf8847238f88009c0349d8d75e8425519b1272c42f14eea7767a0a1f0f4485e15b7d6f5f3fdc8c835a3978eb7f36043f8e30c38d95d1dec39658289cd2ac1b415f648853885c2fef55fd11319b97043aa9019b33401cd646aa34389fdb7ae3cd4f007b5977da99e2ee2ee67119e6742e467f36ff799db4532dad929ddf23a816f8ab708e1f3a9bd62f7ac4c8d3f4c0e8fa5ee45399d80c87cc2078bc62e70813961b8474eaab15f1ffb23881d30043ce1c7b6fc8dfafa8ba4d85527bfb1de301942b950792fd46e6c1c6761b51feddac0b7c72efb018c8013789d0a350e179acc467849a271f1452eeffa9becd65fd52a81c06d4ac4fdb08ca6c166007778f50a16353793b28b8aebb286140699b4990fd049f3e66af8633ceb9e74cae44a6978fbb2d2f8df072140000000043bfeb57298deff4f863f6f3f8f6db2ffbd7a3fe202f565d39598eb6c200cd73c4435097324842abe98d4fff4ef9c9031733aa10b076134a4a0ce3cd39b3bb2	svchost.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token	Activator.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production	Activator.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL	Activator.exe
Key deleted	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}	Activator.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "0018C00E86FE275E"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe
4432	Activator.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4432	Activator.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2716	3212	cmd.exe	81
PID 3212 wrote to memory of 2716	3212	cmd.exe	81
PID 3212 wrote to memory of 4432	3212	cmd.exe	82
PID 3212 wrote to memory of 4432	3212	cmd.exe	82
PID 4432 wrote to memory of 2896	4432	Activator.exe	95
PID 4432 wrote to memory of 2896	4432	Activator.exe	95
PID 2896 wrote to memory of 2776	2896	cmd.exe	97
PID 2896 wrote to memory of 2776	2896	cmd.exe	97
PID 4432 wrote to memory of 2984	4432	Activator.exe	98
PID 4432 wrote to memory of 2984	4432	Activator.exe	98
PID 2984 wrote to memory of 2248	2984	cmd.exe	100
PID 2984 wrote to memory of 2248	2984	cmd.exe	100
PID 4432 wrote to memory of 4536	4432	Activator.exe	101
PID 4432 wrote to memory of 4536	4432	Activator.exe	101
PID 4536 wrote to memory of 636	4536	cmd.exe	103
PID 4536 wrote to memory of 636	4536	cmd.exe	103
PID 4432 wrote to memory of 3876	4432	Activator.exe	104
PID 4432 wrote to memory of 3876	4432	Activator.exe	104
PID 4432 wrote to memory of 3196	4432	Activator.exe	107
PID 4432 wrote to memory of 3196	4432	Activator.exe	107
PID 3196 wrote to memory of 532	3196	cmd.exe	109
PID 3196 wrote to memory of 532	3196	cmd.exe	109
PID 4432 wrote to memory of 3976	4432	Activator.exe	110
PID 4432 wrote to memory of 3976	4432	Activator.exe	110
PID 3976 wrote to memory of 3176	3976	cmd.exe	112
PID 3976 wrote to memory of 3176	3976	cmd.exe	112
PID 4432 wrote to memory of 2596	4432	Activator.exe	116
PID 4432 wrote to memory of 2596	4432	Activator.exe	116
PID 4432 wrote to memory of 2596	4432	Activator.exe	116
PID 4432 wrote to memory of 764	4432	Activator.exe	119
PID 4432 wrote to memory of 764	4432	Activator.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Lite.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\Activator.exe
  "C:\Users\Admin\AppData\Local\Temp\Activator.exe" /Lite
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config ClipSVC start= demand
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\system32\sc.exe
      sc config ClipSVC start= demand
      4⤵
      Launches sc.exe
      PID:2776
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config wlidsvc start= demand
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\system32\sc.exe
      sc config wlidsvc start= demand
      4⤵
      Launches sc.exe
      PID:2248
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config sppsvc start= delayed-auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\system32\sc.exe
      sc config sppsvc start= delayed-auto
      4⤵
      Launches sc.exe
      PID:636
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config LicenseManager start= demand
    3⤵
    PID:3876
  - - C:\Windows\system32\sc.exe
      sc config LicenseManager start= demand
      4⤵
      Launches sc.exe
      PID:2700
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config Winmgmt start= auto
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\Windows\system32\sc.exe
      sc config Winmgmt start= auto
      4⤵
      Launches sc.exe
      PID:532
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c sc config wuauserv start= demand
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\system32\sc.exe
      sc config wuauserv start= demand
      4⤵
      Launches sc.exe
      PID:3176
- - C:\Users\Admin\AppData\Local\Temp\_Temp\gatherosstatemodified.exe
    "C:\Users\Admin\AppData\Local\Temp\_Temp\gatherosstatemodified.exe" Pfn=Microsoft.Windows.48.res-v3557_8wekyb3d8bbwe;DownlevelGenuineState=1
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    PID:2596
- - C:\Users\Admin\AppData\Local\Temp\_Temp\clipup.exe
    "C:\Users\Admin\AppData\Local\Temp\_Temp\clipup.exe" -v -o -altto C:\Users\Admin\AppData\Local\Temp\_Temp\GenuineTicket.xml
    3⤵
    - Executes dropped EXE
    PID:764
  - - C:\Users\Admin\AppData\Local\Temp\_Temp\clipup.exe
      "C:\Users\Admin\AppData\Local\Temp\_Temp\clipup.exe" -v -o -altto C:\Users\Admin\AppData\Local\Temp\_Temp\GenuineTicket.xml -ppl C:\Users\Admin\AppData\Local\Temp\temB205.tmp
      4⤵
      Executes dropped EXE
      PID:4392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Modifies data under HKEY_USERS
PID:1792

C:\Windows\system32\Clipup.exe
"C:\Windows\system32\Clipup.exe" -o
1⤵
PID:4428
- C:\Windows\system32\Clipup.exe
  "C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\TEMP\temB30F.tmp
  2⤵
  - Checks SCSI registry key(s)
  PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_Temp\GenuineTicket.xml

Filesize
1KB

MD5
f87bd1da475f771cec29e823d03f718e

SHA1
1b24cc598aa23bcaaf004dc305a44e6110b4a25e

SHA256
2525f8426c8b2f62a6787dde6d3b2f9c45fd55149420553b8db9ce1239a5986a

SHA512
41bbb158e356dede8633a0f11169d676144c10650c722aabc15fd05c1065fe73d8641a65a58a65d8008cce8d2798155ced1e4d56688490ded0523b530a357875

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Temp\clipup.exe

Filesize
1.3MB

MD5
bd1908ab0887873fce6b059822599e4e

SHA1
48d928b1bec25a56fe896c430c2c034b7866aa7a

SHA256
0d6e9f6bbd0321eda149658d96040cb4f79e0bd93ba60061f25b28fecbf4d4ef

SHA512
e602efef6d697cdb0c958df3210331170c354edf1c372975d5edd71c884f2de26c6bad07e4caea4f7832ad42a9fe9c8c1b72ca24734a6d464f108864d0a8cf4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Temp\gatherosstatemodified.exe

Filesize
330KB

MD5
892fae48577e46eabd9fbbc4107d924c

SHA1
3fccb9c359edb9527c9f5688683f8b3c5910e75d

SHA256
5b8d76ee9a57fa2592f480f1c5035d45946304cae7899279857126cd48f601d7

SHA512
49f9237657b77b789edc54563b6500787905429673ffa3797a4a2d50ae25eaab3c684890847a0a790361ef3c525c432712cc4e00e98de3912ff13a0c3d5c252d

Download Submit
C:\Users\Admin\AppData\Local\Temp\temB205.tmp

Filesize
230B

MD5
62bb58da510ecb05194b2199ef7889ef

SHA1
8f0e4f6d9776cbde466a6f4b51f6b43a22b5af1f

SHA256
33d3fe617709057bdf5feec1df85a1f6ea33f2e2443c0f10a7819a78bb3abf31

SHA512
9a07668211c476e10636ee7f6f2cab9435e73a3c07b2e5ba54ab9fec28ae71c47c16a798a9e0733c6eb08d7e620806b2ef624fa984675a9aaa4bfbe574cae65d

Download Submit
C:\Windows\TEMP\temB30F.tmp

Filesize
206B

MD5
b13af738aa8be55154b2752979d76827

SHA1
64a5f927720af02a367c105c65c1f5da639b7a93

SHA256
663ef05eb1c17b68e752a2d1e2dcd0eaa024e4c2ec88a7bc99a59e0aeabdf79b

SHA512
cb774f2729ce6b5cda325417fbad93e952b447fa2e9285375c26eb0fbdb7f4f8b644b1007038caafd6d8ba4efb3cc8c5da307c14e12be3454103d52848a029a4

Download Submit
memory/764-18-0x000001B92B500000-0x000001B92B510000-memory.dmp

Filesize
64KB

Download
memory/764-19-0x000001B92B500000-0x000001B92B510000-memory.dmp

Filesize
64KB

Download
memory/764-20-0x000001B92B500000-0x000001B92B510000-memory.dmp

Filesize
64KB

Download
memory/764-30-0x000001B92B500000-0x000001B92B510000-memory.dmp

Filesize
64KB

Download
memory/764-31-0x000001B92B500000-0x000001B92B510000-memory.dmp

Filesize
64KB

Download
memory/4032-35-0x00000211E7F60000-0x00000211E7F70000-memory.dmp

Filesize
64KB

Download
memory/4032-34-0x00000211E7F60000-0x00000211E7F70000-memory.dmp

Filesize
64KB

Download
memory/4032-39-0x00000211E7F60000-0x00000211E7F70000-memory.dmp

Filesize
64KB

Download
memory/4392-28-0x0000013B36CA0000-0x0000013B36CB0000-memory.dmp

Filesize
64KB

Download
memory/4392-27-0x0000013B36CA0000-0x0000013B36CB0000-memory.dmp

Filesize
64KB

Download
memory/4392-25-0x0000013B36CA0000-0x0000013B36CB0000-memory.dmp

Filesize
64KB

Download
memory/4392-24-0x0000013B36CA0000-0x0000013B36CB0000-memory.dmp

Filesize
64KB

Download
memory/4392-23-0x0000013B36CA0000-0x0000013B36CB0000-memory.dmp

Filesize
64KB

Download
memory/4428-32-0x00000239CBE20000-0x00000239CBE30000-memory.dmp

Filesize
64KB

Download
memory/4428-33-0x00000239CBE20000-0x00000239CBE30000-memory.dmp

Filesize
64KB

Download
memory/4428-41-0x00000239CBE20000-0x00000239CBE30000-memory.dmp

Filesize
64KB

Download
memory/4432-4-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-5-0x00007FFA736D3000-0x00007FFA736D5000-memory.dmp

Filesize
8KB

Download
memory/4432-6-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-0-0x00007FFA736D3000-0x00007FFA736D5000-memory.dmp

Filesize
8KB

Download
memory/4432-8-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-3-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-2-0x000000001B5B0000-0x000000001BB12000-memory.dmp

Filesize
5.4MB

Download
memory/4432-1-0x00000000008A0000-0x00000000008B0000-memory.dmp

Filesize
64KB

Download
memory/4432-7-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-43-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-44-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download
memory/4432-45-0x00007FFA736D0000-0x00007FFA74191000-memory.dmp

Filesize
10.8MB

Download