9c722efda237af4e856b06657c20ad677d6c75ea33a033e28fa3f522039b5eae

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22-07-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SheetRat/Server-cleaned.exe
Size

1.3MB
MD5

c1862c57cf6b6c302f71ef986950328f
SHA1

2b5df84beb75f758e2b50f9d8c1d73cc59bf9936
SHA256

f90bcd094d81b324edfa8413b4ae9a6a51a38058520b2572151a91205e9b788f
SHA512

de5cd2be9933e317d48b2b8556a260a5427ca88e8653975951d9d6364cebea91e3cc500a724a7d38c314d449c84ba9cb12988f3d2425905e149f1a095f90ef2d
SSDEEP

24576:YLysNT+f7momlEkmmsEnE7E7E7EUmemmmmmmIzme4jwnaKEmbToQ2:Y2sNTI7momSkmmtEQQQUmemmmmmmIzm/

Score

10^/10

persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Public\\Documents\\xdwdAvast Antivirus Upgrade.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 4 IoCs

pid	Process
4412	Client.exe
4248	Client.exe
5072	Client.exe
1880	Client.exe

Loads dropped DLL 47 IoCs

pid	Process
1748	Server-cleaned.exe
1748	Server-cleaned.exe
1748	Server-cleaned.exe
2012	Process not Found
3244	Process not Found
4300	taskmgr.exe
956	Process not Found
2996	taskmgr.exe
3616	Process not Found
4280	Process not Found
3676	taskmgr.exe
1980	Process not Found
5016	Process not Found
4924	Process not Found
316	Process not Found
1624	Process not Found
2528	Process not Found
4248	Client.exe
5072	Client.exe
1880	Client.exe
1316	Process not Found
624	Process not Found
4400	Process not Found
3160	Process not Found
1208	Process not Found
4224	Process not Found
2500	Process not Found
4232	Process not Found
2496	Process not Found
4856	Process not Found
2044	Process not Found
1764	Process not Found
4016	Process not Found
2536	Process not Found
624	Process not Found
1904	Process not Found
4924	Process not Found
3896	Process not Found
4316	Process not Found
2732	Process not Found
1988	Process not Found
1912	Process not Found
4232	Process not Found
3172	Process not Found
1904	Process not Found
4544	Process not Found
2012	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows update = "C:\\Users\\Admin\\Documents\\xdwdPuTTY Update.exe"	Client.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Modifies registry class 55 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	Server-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000444ab7bb08d2da01b62427c40cd2da01c98629c40cd2da0114000000	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Server-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Server-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	Server-cleaned.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Server-cleaned.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	Server-cleaned.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Server-cleaned.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Server-cleaned.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Server-cleaned.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 37 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2944	schtasks.exe
4704	schtasks.exe
3624	schtasks.exe
3052	schtasks.exe
2044	schtasks.exe
1320	schtasks.exe
4368	schtasks.exe
4552	schtasks.exe
4348	schtasks.exe
4764	schtasks.exe
812	schtasks.exe
3000	schtasks.exe
4228	schtasks.exe
4708	schtasks.exe
3032	schtasks.exe
4652	schtasks.exe
4104	schtasks.exe
892	schtasks.exe
812	schtasks.exe
4564	schtasks.exe
3052	schtasks.exe
348	schtasks.exe
3892	schtasks.exe
2824	schtasks.exe
4312	schtasks.exe
4360	schtasks.exe
4260	schtasks.exe
3252	schtasks.exe
4656	schtasks.exe
4224	schtasks.exe
2908	schtasks.exe
3476	schtasks.exe
1040	schtasks.exe
4492	schtasks.exe
1208	schtasks.exe
3840	schtasks.exe
4552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe
4412	Client.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	Server-cleaned.exe
Token: SeDebugPrivilege	4412	Client.exe
Token: SeDebugPrivilege	4356	taskmgr.exe
Token: SeSystemProfilePrivilege	4356	taskmgr.exe
Token: SeCreateGlobalPrivilege	4356	taskmgr.exe
Token: SeDebugPrivilege	4300	taskmgr.exe
Token: SeSystemProfilePrivilege	4300	taskmgr.exe
Token: SeCreateGlobalPrivilege	4300	taskmgr.exe
Token: SeDebugPrivilege	2996	taskmgr.exe
Token: SeSystemProfilePrivilege	2996	taskmgr.exe
Token: SeCreateGlobalPrivilege	2996	taskmgr.exe
Token: SeDebugPrivilege	3676	taskmgr.exe
Token: SeSystemProfilePrivilege	3676	taskmgr.exe
Token: SeCreateGlobalPrivilege	3676	taskmgr.exe
Token: SeDebugPrivilege	4248	Client.exe
Token: SeDebugPrivilege	5072	Client.exe
Token: SeDebugPrivilege	1880	Client.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4356	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
4300	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
2996	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe
3676	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1748	Server-cleaned.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4088	4412	Client.exe	104
PID 4412 wrote to memory of 4088	4412	Client.exe	104
PID 4088 wrote to memory of 2944	4088	CMD.exe	106
PID 4088 wrote to memory of 2944	4088	CMD.exe	106
PID 4412 wrote to memory of 3672	4412	Client.exe	107
PID 4412 wrote to memory of 3672	4412	Client.exe	107
PID 3672 wrote to memory of 1040	3672	CMD.exe	109
PID 3672 wrote to memory of 1040	3672	CMD.exe	109
PID 4412 wrote to memory of 2404	4412	Client.exe	110
PID 4412 wrote to memory of 2404	4412	Client.exe	110
PID 2404 wrote to memory of 4492	2404	CMD.exe	112
PID 2404 wrote to memory of 4492	2404	CMD.exe	112
PID 4412 wrote to memory of 2520	4412	Client.exe	113
PID 4412 wrote to memory of 2520	4412	Client.exe	113
PID 2520 wrote to memory of 1320	2520	CMD.exe	115
PID 2520 wrote to memory of 1320	2520	CMD.exe	115
PID 4412 wrote to memory of 3600	4412	Client.exe	117
PID 4412 wrote to memory of 3600	4412	Client.exe	117
PID 3600 wrote to memory of 2824	3600	CMD.exe	119
PID 3600 wrote to memory of 2824	3600	CMD.exe	119
PID 4412 wrote to memory of 3340	4412	Client.exe	122
PID 4412 wrote to memory of 3340	4412	Client.exe	122
PID 3340 wrote to memory of 1208	3340	CMD.exe	124
PID 3340 wrote to memory of 1208	3340	CMD.exe	124
PID 4412 wrote to memory of 392	4412	Client.exe	125
PID 4412 wrote to memory of 392	4412	Client.exe	125
PID 392 wrote to memory of 4312	392	CMD.exe	127
PID 392 wrote to memory of 4312	392	CMD.exe	127
PID 4412 wrote to memory of 1912	4412	Client.exe	129
PID 4412 wrote to memory of 1912	4412	Client.exe	129
PID 1912 wrote to memory of 3032	1912	CMD.exe	131
PID 1912 wrote to memory of 3032	1912	CMD.exe	131
PID 4412 wrote to memory of 4092	4412	Client.exe	137
PID 4412 wrote to memory of 4092	4412	Client.exe	137
PID 4092 wrote to memory of 4656	4092	CMD.exe	139
PID 4092 wrote to memory of 4656	4092	CMD.exe	139
PID 4412 wrote to memory of 4808	4412	Client.exe	140
PID 4412 wrote to memory of 4808	4412	Client.exe	140
PID 4808 wrote to memory of 4652	4808	CMD.exe	142
PID 4808 wrote to memory of 4652	4808	CMD.exe	142
PID 4412 wrote to memory of 3000	4412	Client.exe	143
PID 4412 wrote to memory of 3000	4412	Client.exe	143
PID 3000 wrote to memory of 4224	3000	CMD.exe	145
PID 3000 wrote to memory of 4224	3000	CMD.exe	145
PID 4412 wrote to memory of 3884	4412	Client.exe	149
PID 4412 wrote to memory of 3884	4412	Client.exe	149
PID 3884 wrote to memory of 3840	3884	CMD.exe	151
PID 3884 wrote to memory of 3840	3884	CMD.exe	151
PID 4412 wrote to memory of 1900	4412	Client.exe	154
PID 4412 wrote to memory of 1900	4412	Client.exe	154
PID 1900 wrote to memory of 4104	1900	CMD.exe	156
PID 1900 wrote to memory of 4104	1900	CMD.exe	156
PID 4412 wrote to memory of 2244	4412	Client.exe	157
PID 4412 wrote to memory of 2244	4412	Client.exe	157
PID 2244 wrote to memory of 3052	2244	CMD.exe	159
PID 2244 wrote to memory of 3052	2244	CMD.exe	159
PID 4412 wrote to memory of 3616	4412	Client.exe	160
PID 4412 wrote to memory of 3616	4412	Client.exe	160
PID 3616 wrote to memory of 812	3616	CMD.exe	162
PID 3616 wrote to memory of 812	3616	CMD.exe	162
PID 5072 wrote to memory of 3648	5072	Client.exe	166
PID 5072 wrote to memory of 3648	5072	Client.exe	166
PID 3648 wrote to memory of 3000	3648	CMD.exe	168
PID 3648 wrote to memory of 3000	3648	CMD.exe	168

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SheetRat\Server-cleaned.exe
"C:\Users\Admin\AppData\Local\Temp\SheetRat\Server-cleaned.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1748

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Visual Studio Code Host" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Visual Studio Code Host" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2944
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Node.js" /tr "C:\Users\Admin\Documents\xdwdPuTTY Update.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Node.js" /tr "C:\Users\Admin\Documents\xdwdPuTTY Update.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4492
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1320
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2824
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4312
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4224
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3068
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4368
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4360
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4260
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4704
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:348
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4448
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2064
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3476
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:5088
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4564
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3052
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:3244
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3892
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1812
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4552

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4356

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4300

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2996

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3676

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4248
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4728
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4704

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:2180
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:892

C:\Users\Admin\Desktop\Client.exe
"C:\Users\Admin\Desktop\Client.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1880
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:1208
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4360
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST & exit
  2⤵
  PID:4464
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "Google Drive" /tr "C:\Users\Public\Documents\xdwdAvast Antivirus Upgrade.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\StartRename.bat" "
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x86\System.Data.SQLite.DLL

Filesize
1.3MB

MD5
14393eb908e072fa3164597414bb0a75

SHA1
5e04e084ec44a0b29196d0c21213201240f11ba0

SHA256
59b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80

SHA512
f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Client.exe.log

Filesize
871B

MD5
386677f585908a33791517dfc2317f88

SHA1
2e6853b4560a9ac8a74cdd5c3124a777bc0d874e

SHA256
7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0

SHA512
876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9

Download Submit
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\hjm4e4t5.newcfg

Filesize
1KB

MD5
3e83308de9805817d7c747a0773199ab

SHA1
13bd5f4085f08bdadb67ad22bba2b4d62895d533

SHA256
dae07fa593aaa1d8638c277d2e4c936986480528e5fb24bdfbf31971df19b81e

SHA512
73643a5f42f2208bc2663b20b5b49aa74c328736c0ac395774d7aa72bad6d760e997c17f5c7d479e611c5ec0c23cb7b74415f9c95fca0973ef3c84c176bdb0f4

Download Submit
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\user.config

Filesize
797B

MD5
1dc25fcc9d2526c8def3bf40c1bfaf69

SHA1
8ea5d1e6b4f6aba87727fa313d40740071d46bce

SHA256
62f5c0be8ea24233cf5660b2d1a0d1f0e7319415f5caf14e7ae84e3c9e2632c4

SHA512
845b5f4eeb05d5bb57fd94fdac623d2a3b3ef9365ad4c712667f09912c21ed4d4ef242021124cef40a29fd4ecfb851e8668be854b78dae284a32ecb7e255c970

Download Submit
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\user.config

Filesize
1KB

MD5
7cf968e0ae06a462ba72a5d7d1fdc88a

SHA1
95dc2fe0f93f3952e808ca85a2e76b35e06b3878

SHA256
87ca18aad1637b36c6e5aaa982110681d1c81e897667b9a38003f3c1052d289f

SHA512
49e362871abd1ea9f0ffaaa764b479ed7efaf5e179d87e8f070d0cdebc7bce26f558b1bbe649d837f39d343cb0c4fc6a67cb313f19e4e06c03f4f7f43ad12fd9

Download Submit
C:\Users\Admin\AppData\Local\Server\Server-cleaned.exe_Url_v01rgh5g1psgca1y4pynyjgu3xx5dv4c\1.0.0.0\user.config

Filesize
920B

MD5
db822f44e045c6bce441574f8e8614e6

SHA1
e74eb4fc67ddacbf01d66c82a776a04bffc13004

SHA256
4984544e2fa632fc296eac6050f8ba3e2f60e585d6be6ef08b49d2bce47a51a5

SHA512
80790a1c19b764d07243db826cbf38b224e40cf6be66984141f8d436c5f8be6af2a4be2db81eb2834cc9beb15313474c0f64d694603e1fc6287767b997adc922

Download Submit
C:\Users\Admin\Desktop\Client.exe

Filesize
469KB

MD5
353dc319756b4b9055570540565fee3a

SHA1
a33bc6683e7c7f7c872fe2cf7954770ec53d6358

SHA256
27c58d8ba3f12e38f036440381568c73339e0a01037e1cff5271373e5a8224d9

SHA512
8ccb58583bf102aa59f86eb2649874897f0228599c966b21fb086218bdb213cd641d57c7663dcaf833a70cc75d4154565b6f825d09d5010279d65617adae293d

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1748-80-0x000000000EC80000-0x000000000ED32000-memory.dmp

Filesize
712KB

Download
memory/1748-86-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-11-0x0000000009960000-0x0000000009C42000-memory.dmp

Filesize
2.9MB

Download
memory/1748-10-0x0000000009640000-0x000000000966C000-memory.dmp

Filesize
176KB

Download
memory/1748-12-0x0000000009F30000-0x000000000A284000-memory.dmp

Filesize
3.3MB

Download
memory/1748-13-0x00000000096D0000-0x00000000096F2000-memory.dmp

Filesize
136KB

Download
memory/1748-8-0x0000000008750000-0x00000000087FA000-memory.dmp

Filesize
680KB

Download
memory/1748-18-0x0000000009710000-0x000000000985B000-memory.dmp

Filesize
1.3MB

Download
memory/1748-30-0x0000000009870000-0x00000000098BC000-memory.dmp

Filesize
304KB

Download
memory/1748-31-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-7-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-6-0x0000000005A50000-0x0000000005A5A000-memory.dmp

Filesize
40KB

Download
memory/1748-5-0x0000000006460000-0x00000000066B2000-memory.dmp

Filesize
2.3MB

Download
memory/1748-4-0x0000000005A80000-0x0000000005B12000-memory.dmp

Filesize
584KB

Download
memory/1748-69-0x0000000006F40000-0x0000000006F7C000-memory.dmp

Filesize
240KB

Download
memory/1748-70-0x0000000006F00000-0x0000000006F21000-memory.dmp

Filesize
132KB

Download
memory/1748-0-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/1748-81-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-82-0x00000000747CE000-0x00000000747CF000-memory.dmp

Filesize
4KB

Download
memory/1748-83-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-84-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-9-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-87-0x000000000FE20000-0x000000000FF42000-memory.dmp

Filesize
1.1MB

Download
memory/1748-114-0x0000000012380000-0x000000001239A000-memory.dmp

Filesize
104KB

Download
memory/1748-122-0x00000000747C0000-0x0000000074F70000-memory.dmp

Filesize
7.7MB

Download
memory/1748-3-0x00000000055F0000-0x000000000564C000-memory.dmp

Filesize
368KB

Download
memory/1748-1-0x0000000000B00000-0x0000000000C48000-memory.dmp

Filesize
1.3MB

Download
memory/1748-2-0x0000000005C50000-0x00000000061F4000-memory.dmp

Filesize
5.6MB

Download
memory/4356-137-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-128-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-129-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-133-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-139-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-138-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-127-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-136-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-135-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4356-134-0x0000014C29EC0000-0x0000014C29EC1000-memory.dmp

Filesize
4KB

Download
memory/4412-126-0x00007FF8EB993000-0x00007FF8EB995000-memory.dmp

Filesize
8KB

Download
memory/4412-200-0x00007FF8EB993000-0x00007FF8EB995000-memory.dmp

Filesize
8KB

Download
memory/4412-125-0x0000000000D70000-0x0000000000DEC000-memory.dmp

Filesize
496KB

Download