Resubmissions
27/08/2024, 01:28
240827-bvntvaxfpp1027/08/2024, 01:00
240827-bc5pmswgpr1026/08/2024, 05:53
240826-glgxtszdpp1022/08/2024, 07:34
240822-jedb6svfpe10Analysis
- max time kernel
139s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
26/08/2024, 05:53
Behavioral task
behavioral1
Sample
26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe
Resource
win7-20240708-en
windows7-x64
13 signatures
150 seconds
General
- Target 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe
- Size 3.3MB
- Sample240826-glgxtszdpp
- SHA256 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
- MD5 e52f30961dfc54e980d1aa1ae0d16145
- SHA1 6e22251748e5cd0a9ea745a8dce14352b619ec99
- SHA512 b6bbd178a529d355fc00c7ab769d3b573f778d00b05952a1700cbfd161d4c809886a9073b7de37d3210fe6f5e0823be731bb53021a8fce199d26d1f3a5e8595b
- SSDEEP 49152:vX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q9:vlRsZ47/QXoHUOfAoj1x69
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detects MeshAgent payload 1 IoCs
resource yara_rule behavioral2/files/0x000900000002340e-2.dat family_meshagent - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Mesh Agent\ImagePath = "\"C:\\Program Files\\Mesh Agent\\MeshAgent.exe\" " 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe - Executes dropped EXE 1 IoCs
pid Process 3712 MeshAgent.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Keys MeshAgent.exe File opened for modification C:\Windows\System32\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\advapi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\shcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\crypt32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\win32u.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32full.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\iphlpapi.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\809390C49542D3CDD06A8B53A317648CD3EF8A3F MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\System32\dll\ucrtbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\ncrypt.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\System32\ole32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\bcryptprimitives.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ntdll.pdb MeshAgent.exe File opened for modification C:\Windows\System32\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\Kernel.Appcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcp_win.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\combase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\shcore.pdb MeshAgent.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\8AAE6FFE8D79637570DD769B181937FFF81F88A0 MeshAgent.exe File opened for modification C:\Windows\System32\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\kernel32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\sechost.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ncrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\apphelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\gdi32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\dbghelp.pdb MeshAgent.exe File opened for modification C:\Windows\System32\DLL\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\ntasn1.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\rpcrt4.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\msvcrt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\gdiplus.pdb MeshAgent.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\8AAE6FFE8D79637570DD769B181937FFF81F88A0 MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\dll\user32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dbgcore.pdb MeshAgent.exe File opened for modification C:\Windows\System32\symbols\exe\MeshService64.pdb MeshAgent.exe File opened for modification C:\Windows\System32\comctl32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\bcrypt.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\kernelbase.pdb MeshAgent.exe File opened for modification C:\Windows\System32\ws2_32.pdb MeshAgent.exe File opened for modification C:\Windows\System32\dll\advapi32.pdb MeshAgent.exe - Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Mesh Agent\MeshAgent.msh MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.exe 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db MeshAgent.exe File opened for modification C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe File created C:\Program Files\Mesh Agent\MeshAgent.db.tmp MeshAgent.exe -
pid Process 1648 powershell.exe 2244 powershell.exe 2140 powershell.exe 2668 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" MeshAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" MeshAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2140 powershell.exe 2140 powershell.exe 2668 powershell.exe 2668 powershell.exe 1648 powershell.exe 1648 powershell.exe 2244 powershell.exe 2244 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1804 wmic.exe Token: SeSecurityPrivilege 1804 wmic.exe Token: SeTakeOwnershipPrivilege 1804 wmic.exe Token: SeLoadDriverPrivilege 1804 wmic.exe Token: SeSystemProfilePrivilege 1804 wmic.exe Token: SeSystemtimePrivilege 1804 wmic.exe Token: SeProfSingleProcessPrivilege 1804 wmic.exe Token: SeIncBasePriorityPrivilege 1804 wmic.exe Token: SeCreatePagefilePrivilege 1804 wmic.exe Token: SeBackupPrivilege 1804 wmic.exe Token: SeRestorePrivilege 1804 wmic.exe Token: SeShutdownPrivilege 1804 wmic.exe Token: SeDebugPrivilege 1804 wmic.exe Token: SeSystemEnvironmentPrivilege 1804 wmic.exe Token: SeRemoteShutdownPrivilege 1804 wmic.exe Token: SeUndockPrivilege 1804 wmic.exe Token: SeManageVolumePrivilege 1804 wmic.exe Token: 33 1804 wmic.exe Token: 34 1804 wmic.exe Token: 35 1804 wmic.exe Token: 36 1804 wmic.exe Token: SeIncreaseQuotaPrivilege 1804 wmic.exe Token: SeSecurityPrivilege 1804 wmic.exe Token: SeTakeOwnershipPrivilege 1804 wmic.exe Token: SeLoadDriverPrivilege 1804 wmic.exe Token: SeSystemProfilePrivilege 1804 wmic.exe Token: SeSystemtimePrivilege 1804 wmic.exe Token: SeProfSingleProcessPrivilege 1804 wmic.exe Token: SeIncBasePriorityPrivilege 1804 wmic.exe Token: SeCreatePagefilePrivilege 1804 wmic.exe Token: SeBackupPrivilege 1804 wmic.exe Token: SeRestorePrivilege 1804 wmic.exe Token: SeShutdownPrivilege 1804 wmic.exe Token: SeDebugPrivilege 1804 wmic.exe Token: SeSystemEnvironmentPrivilege 1804 wmic.exe Token: SeRemoteShutdownPrivilege 1804 wmic.exe Token: SeUndockPrivilege 1804 wmic.exe Token: SeManageVolumePrivilege 1804 wmic.exe Token: 33 1804 wmic.exe Token: 34 1804 wmic.exe Token: 35 1804 wmic.exe Token: 36 1804 wmic.exe Token: SeAssignPrimaryTokenPrivilege 4516 wmic.exe Token: SeIncreaseQuotaPrivilege 4516 wmic.exe Token: SeSecurityPrivilege 4516 wmic.exe Token: SeTakeOwnershipPrivilege 4516 wmic.exe Token: SeLoadDriverPrivilege 4516 wmic.exe Token: SeSystemtimePrivilege 4516 wmic.exe Token: SeBackupPrivilege 4516 wmic.exe Token: SeRestorePrivilege 4516 wmic.exe Token: SeShutdownPrivilege 4516 wmic.exe Token: SeSystemEnvironmentPrivilege 4516 wmic.exe Token: SeUndockPrivilege 4516 wmic.exe Token: SeManageVolumePrivilege 4516 wmic.exe Token: SeAssignPrimaryTokenPrivilege 4516 wmic.exe Token: SeIncreaseQuotaPrivilege 4516 wmic.exe Token: SeSecurityPrivilege 4516 wmic.exe Token: SeTakeOwnershipPrivilege 4516 wmic.exe Token: SeLoadDriverPrivilege 4516 wmic.exe Token: SeSystemtimePrivilege 4516 wmic.exe Token: SeBackupPrivilege 4516 wmic.exe Token: SeRestorePrivilege 4516 wmic.exe Token: SeShutdownPrivilege 4516 wmic.exe Token: SeSystemEnvironmentPrivilege 4516 wmic.exe - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 4824 wrote to memory of 1804 4824 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe 85 PID 4824 wrote to memory of 1804 4824 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe 85 PID 4824 wrote to memory of 1480 4824 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe 103 PID 4824 wrote to memory of 1480 4824 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe 103 PID 3712 wrote to memory of 4516 3712 MeshAgent.exe 107 PID 3712 wrote to memory of 4516 3712 MeshAgent.exe 107 PID 3712 wrote to memory of 444 3712 MeshAgent.exe 109 PID 3712 wrote to memory of 444 3712 MeshAgent.exe 109 PID 3712 wrote to memory of 2356 3712 MeshAgent.exe 111 PID 3712 wrote to memory of 2356 3712 MeshAgent.exe 111 PID 3712 wrote to memory of 1980 3712 MeshAgent.exe 113 PID 3712 wrote to memory of 1980 3712 MeshAgent.exe 113 PID 3712 wrote to memory of 3296 3712 MeshAgent.exe 115 PID 3712 wrote to memory of 3296 3712 MeshAgent.exe 115 PID 3712 wrote to memory of 1996 3712 MeshAgent.exe 117 PID 3712 wrote to memory of 1996 3712 MeshAgent.exe 117 PID 3712 wrote to memory of 2140 3712 MeshAgent.exe 119 PID 3712 wrote to memory of 2140 3712 MeshAgent.exe 119 PID 3712 wrote to memory of 2668 3712 MeshAgent.exe 121 PID 3712 wrote to memory of 2668 3712 MeshAgent.exe 121 PID 3712 wrote to memory of 1648 3712 MeshAgent.exe 123 PID 3712 wrote to memory of 1648 3712 MeshAgent.exe 123 PID 3712 wrote to memory of 2244 3712 MeshAgent.exe 126 PID 3712 wrote to memory of 2244 3712 MeshAgent.exe 126 PID 3712 wrote to memory of 4956 3712 MeshAgent.exe 128 PID 3712 wrote to memory of 4956 3712 MeshAgent.exe 128 PID 4956 wrote to memory of 3716 4956 cmd.exe 130 PID 4956 wrote to memory of 3716 4956 cmd.exe 130 PID 3712 wrote to memory of 2840 3712 MeshAgent.exe 131 PID 3712 wrote to memory of 2840 3712 MeshAgent.exe 131 PID 2840 wrote to memory of 1280 2840 cmd.exe 133 PID 2840 wrote to memory of 1280 2840 cmd.exe 133
Processes
-
C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe"C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe"C:\Users\Admin\AppData\Local\Temp\26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6.exe" -fullinstall2⤵
- Sets service image path in registry
- Drops file in Program Files directory
PID:1480
-
-
C:\Program Files\Mesh Agent\MeshAgent.exe"C:\Program Files\Mesh Agent\MeshAgent.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\System32\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4516
-
-
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵PID:444
-
-
C:\Windows\System32\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵PID:2356
-
-
C:\Windows\system32\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵PID:1980
-
-
C:\Windows\System32\wbem\wmic.exewmic SystemEnclosure get ChassisTypes2⤵PID:3296
-
-
C:\Windows\System32\wbem\wmic.exewmic ComputerSystem get PCSystemType /FORMAT:"C:\Windows\system32\wbem\en-US\csv"2⤵PID:1996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2140
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Drops file in System32 directory
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1648
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -noprofile -nologo -command -2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2244
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get C: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get C: -Type recoverypassword3⤵PID:3716
-
-
-
C:\Windows\system32\cmd.exe/c manage-bde -protectors -get F: -Type recoverypassword2⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\system32\manage-bde.exemanage-bde -protectors -get F: -Type recoverypassword3⤵PID:1280
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Mesh Agent\MeshAgent.db.tmp
- Size 151KB
- SHA256 27ce29c1445850260d49ba5b9b81d7bcadc1c4215ce7036c229087cf13fb1029
- MD5 9979dc0fa2d876e43c117d1bd2471c44
- SHA1 7d1c5232884543ebe3c9e31b9569ece57232d3f3
- SHA512 2a4792fb845d316fb4b39b13227d18ae21731f1a3afbac4a676b43dd11355619a360803d97097309c2fc420e56f2408d2f3d860e69379270d7a8927b6822f4be
- SSDEEP 3072:5czj9+IIQh4LER+bxOFR+DLkcwcpG55UJBM9W1hQs1mVI:529+dQh4gek86/UJ28+skVI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Mesh Agent\MeshAgent.exe
- Size 3.3MB
- SHA256 26280868cbe3e29c7ac5ab123df6dcd0b625d13d09699c2ec4b8902a891a42b6
- MD5 e52f30961dfc54e980d1aa1ae0d16145
- SHA1 6e22251748e5cd0a9ea745a8dce14352b619ec99
- SHA512 b6bbd178a529d355fc00c7ab769d3b573f778d00b05952a1700cbfd161d4c809886a9073b7de37d3210fe6f5e0823be731bb53021a8fce199d26d1f3a5e8595b
- SSDEEP 49152:vX3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q9:vlRsZ47/QXoHUOfAoj1x69
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Temp\__PSScriptPolicyTest_nwezjccd.i0l.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 54e15de2bef9f651d7717e2a336ac6b2ea2b723e6f29d2b153d8fbbc89aef723
- MD5 06d16fea6ab505097d16fcaa32949d47
- SHA1 0c1c719831fa41cd102d0d72d61c0f46ec5b8de8
- SHA512 03c00f1eebb51cec11703141ae9d9c3ac589f5495bc04d8a4b043714089a9d50bd3a520e4d72b4a4c99f5b9bf5f689bf2585fa5c7d4ddbe6f71cbba0172f593a
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 dbf3b24fa6d0a7c6fbb01099f7ccde280eb43ae2a7f41701a0bb96e7cc31ae9d
- MD5 5fe620fa7ab9c4f31da0bdad5eb21037
- SHA1 30a6867776cc7c41bac6364abb22e5fb91a52076
- SHA512 92f1ea32da8b9a392f5d5de8cab981b36591c8cf1159d2b9def3e43a5557befcddfcedbc660cf410e9a76285e213a9b0b60c073d5034b91dd5755301f3b44598
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 86cd6b95819282eee4bd6c900b27ebeddf453a90a9f6147978e9137479f36bd6
- MD5 2c0bdf06d302688498d4e7f9cd669ab5
- SHA1 18186323d93499e03f737f137b4ad795eb7f470b
- SHA512 f8f02ab1cb6906975695369183d00d7f25ec4c54c40aba5ac0a1f42312c5eff5a6774a8e84c3357415555405f7e9754deebe8335dd1fdcf693137ab044cc18fe
- MD5 SHA1 SHA512
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive
- Size 2KB
- SHA256 6410b59ee5c7a032ff27d682cadc67fdd402db42f561b1600acbb39f20f5d082
- MD5 a05f27c7c042d87d0fbc150b55c0a942
- SHA1 df39609c96eb38202beb1d4d2295ce22a05d9dbb
- SHA512 b0a39d74d79a37dbf08a051437f58dc41027695d6b771d0989cfe1a59c0d4148e51a46f404ce7c28f06a33f3afa62bf5b0fa39f2c29f8273343919f8fb114262
- MD5 SHA1 SHA512