a69f30c1b304b7f6c85facbbd598f1ebdfdc967488f1bf0617b3bddc3a3a4e86

Analysis

max time kernel
58s
max time network
60s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 17:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NeverLose.exe
Size

2.4MB
MD5

4a20d992a3e773d0fc70d29d27217fe5
SHA1

237ea4f9f0d167d3161ac8cba193b2e79b7cdd84
SHA256

a69f30c1b304b7f6c85facbbd598f1ebdfdc967488f1bf0617b3bddc3a3a4e86
SHA512

7bd12dbb3b051ee6b47ab734047ee06929ec5cbdda6c5be47513644257e75b10a6414e11503a7323ad3851a71c86932803e3d691e7d8f0cedb9625830ea0d270
SSDEEP

49152:tBELVoj3mruOsvEsgZpfyECvOhsX7/iEuHTClwGe:nQI0zLhpfTCWhsL/iEMUu

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\agentMonitornetcommon\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\ja-JP\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\System.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\wininit.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\agentMonitornetcommon\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\ja-JP\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\System.exe\", \"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\wininit.exe\", \"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\agentMonitornetcommon\\cmd.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\agentMonitornetcommon\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\ja-JP\\conhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Users\\Default User\\dllhost.exe\", \"C:\\agentMonitornetcommon\\cmd.exe\", \"C:\\Program Files (x86)\\Windows Sidebar\\ja-JP\\conhost.exe\", \"C:\\Program Files\\Google\\Chrome\\Application\\System.exe\""	Msfontruntime.exe

Process spawned unexpected child process 18 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2560	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2760	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2780	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1620	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1592	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2068	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2428	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2744	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1216	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2912	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2384	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1744	2736	schtasks.exe	35
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	804	2736	schtasks.exe	35

Executes dropped EXE 5 IoCs

pid	Process
1304	Msfontruntime.exe
2424	dllhost.exe
1544	dllhost.exe
1144	dllhost.exe
1604	dllhost.exe

Loads dropped DLL 2 IoCs

pid	Process
2388	cmd.exe
2388	cmd.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Msfontruntime = "\"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Default User\\dllhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\agentMonitornetcommon\\cmd.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Windows Sidebar\\ja-JP\\conhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files (x86)\\Windows Sidebar\\ja-JP\\conhost.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Google\\Chrome\\Application\\System.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System = "\"C:\\Program Files\\Google\\Chrome\\Application\\System.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Msfontruntime = "\"C:\\agentMonitornetcommon\\Msfontruntime.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\agentMonitornetcommon\\cmd.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\wininit.exe\""	Msfontruntime.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\Program Files (x86)\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\wininit.exe\""	Msfontruntime.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\CSC69D58C46C692493CB0AD28F9B1B9E57C.TMP	csc.exe
File created	\??\c:\Windows\System32\8wawgv.exe	csc.exe

Drops file in Program Files directory 7 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\56085415360792	Msfontruntime.exe
File created	C:\Program Files\Google\Chrome\Application\System.exe	Msfontruntime.exe
File created	C:\Program Files\Google\Chrome\Application\27d1bcfc3c54e0	Msfontruntime.exe
File created	C:\Program Files (x86)\Windows Sidebar\ja-JP\conhost.exe	Msfontruntime.exe
File created	C:\Program Files (x86)\Windows Sidebar\ja-JP\088424020bedd6	Msfontruntime.exe
File created	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wininit.exe	Msfontruntime.exe
File opened for modification	C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wininit.exe	Msfontruntime.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NeverLose.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2512	PING.EXE
3036	PING.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2512	PING.EXE
3036	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 18 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2428	schtasks.exe
1216	schtasks.exe
1820	schtasks.exe
2912	schtasks.exe
3056	schtasks.exe
1744	schtasks.exe
2760	schtasks.exe
1620	schtasks.exe
1592	schtasks.exe
1768	schtasks.exe
836	schtasks.exe
2780	schtasks.exe
2384	schtasks.exe
804	schtasks.exe
2068	schtasks.exe
2744	schtasks.exe
2700	schtasks.exe
2560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe
1304	Msfontruntime.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	Msfontruntime.exe
Token: SeDebugPrivilege	2424	dllhost.exe
Token: SeDebugPrivilege	1544	dllhost.exe
Token: SeDebugPrivilege	1144	dllhost.exe
Token: SeDebugPrivilege	1604	dllhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 1920	1292	NeverLose.exe	31
PID 1292 wrote to memory of 1920	1292	NeverLose.exe	31
PID 1292 wrote to memory of 1920	1292	NeverLose.exe	31
PID 1292 wrote to memory of 1920	1292	NeverLose.exe	31
PID 1920 wrote to memory of 2388	1920	WScript.exe	32
PID 1920 wrote to memory of 2388	1920	WScript.exe	32
PID 1920 wrote to memory of 2388	1920	WScript.exe	32
PID 1920 wrote to memory of 2388	1920	WScript.exe	32
PID 2388 wrote to memory of 1304	2388	cmd.exe	34
PID 2388 wrote to memory of 1304	2388	cmd.exe	34
PID 2388 wrote to memory of 1304	2388	cmd.exe	34
PID 2388 wrote to memory of 1304	2388	cmd.exe	34
PID 1304 wrote to memory of 2652	1304	Msfontruntime.exe	39
PID 1304 wrote to memory of 2652	1304	Msfontruntime.exe	39
PID 1304 wrote to memory of 2652	1304	Msfontruntime.exe	39
PID 2652 wrote to memory of 2104	2652	csc.exe	41
PID 2652 wrote to memory of 2104	2652	csc.exe	41
PID 2652 wrote to memory of 2104	2652	csc.exe	41
PID 1304 wrote to memory of 844	1304	Msfontruntime.exe	57
PID 1304 wrote to memory of 844	1304	Msfontruntime.exe	57
PID 1304 wrote to memory of 844	1304	Msfontruntime.exe	57
PID 844 wrote to memory of 2160	844	cmd.exe	59
PID 844 wrote to memory of 2160	844	cmd.exe	59
PID 844 wrote to memory of 2160	844	cmd.exe	59
PID 844 wrote to memory of 2512	844	cmd.exe	60
PID 844 wrote to memory of 2512	844	cmd.exe	60
PID 844 wrote to memory of 2512	844	cmd.exe	60
PID 844 wrote to memory of 2424	844	cmd.exe	61
PID 844 wrote to memory of 2424	844	cmd.exe	61
PID 844 wrote to memory of 2424	844	cmd.exe	61
PID 2424 wrote to memory of 568	2424	dllhost.exe	62
PID 2424 wrote to memory of 568	2424	dllhost.exe	62
PID 2424 wrote to memory of 568	2424	dllhost.exe	62
PID 568 wrote to memory of 1892	568	cmd.exe	64
PID 568 wrote to memory of 1892	568	cmd.exe	64
PID 568 wrote to memory of 1892	568	cmd.exe	64
PID 568 wrote to memory of 624	568	cmd.exe	65
PID 568 wrote to memory of 624	568	cmd.exe	65
PID 568 wrote to memory of 624	568	cmd.exe	65
PID 568 wrote to memory of 1544	568	cmd.exe	66
PID 568 wrote to memory of 1544	568	cmd.exe	66
PID 568 wrote to memory of 1544	568	cmd.exe	66
PID 1544 wrote to memory of 2432	1544	dllhost.exe	67
PID 1544 wrote to memory of 2432	1544	dllhost.exe	67
PID 1544 wrote to memory of 2432	1544	dllhost.exe	67
PID 2432 wrote to memory of 1740	2432	cmd.exe	69
PID 2432 wrote to memory of 1740	2432	cmd.exe	69
PID 2432 wrote to memory of 1740	2432	cmd.exe	69
PID 2432 wrote to memory of 3036	2432	cmd.exe	70
PID 2432 wrote to memory of 3036	2432	cmd.exe	70
PID 2432 wrote to memory of 3036	2432	cmd.exe	70
PID 2432 wrote to memory of 1144	2432	cmd.exe	71
PID 2432 wrote to memory of 1144	2432	cmd.exe	71
PID 2432 wrote to memory of 1144	2432	cmd.exe	71
PID 1144 wrote to memory of 2456	1144	dllhost.exe	72
PID 1144 wrote to memory of 2456	1144	dllhost.exe	72
PID 1144 wrote to memory of 2456	1144	dllhost.exe	72
PID 2456 wrote to memory of 1600	2456	cmd.exe	74
PID 2456 wrote to memory of 1600	2456	cmd.exe	74
PID 2456 wrote to memory of 1600	2456	cmd.exe	74
PID 2456 wrote to memory of 1612	2456	cmd.exe	75
PID 2456 wrote to memory of 1612	2456	cmd.exe	75
PID 2456 wrote to memory of 1612	2456	cmd.exe	75
PID 2456 wrote to memory of 1604	2456	cmd.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\NeverLose.exe
"C:\Users\Admin\AppData\Local\Temp\NeverLose.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\agentMonitornetcommon\GBi0Q8YazuDC5WsFvOE.vbe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\agentMonitornetcommon\g9S8CVbETtCg5QN5yxxbdptY4CtSRTw.bat" "
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\agentMonitornetcommon\Msfontruntime.exe
      "C:\agentMonitornetcommon/Msfontruntime.exe"
      4⤵
      Modifies WinLogon for persistence
      Executes dropped EXE
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1304
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qlqmchcg\qlqmchcg.cmdline"
        5⤵
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2652
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCAE.tmp" "c:\Windows\System32\CSC69D58C46C692493CB0AD28F9B1B9E57C.TMP"
        6⤵
        
        PID:2104
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\hKniAGqDE1.bat"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:844
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:2160
      - C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2512
      - C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7ar6wdwHCe.bat"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:568
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        8⤵
        
        PID:1892
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        8⤵
        
        PID:624
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\5nOOmGNqzh.bat"
        9⤵
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        10⤵
        
        PID:1740
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3036
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        10⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KU0xjXjpGp.bat"
        11⤵
        Suspicious use of WriteProcessMemory
        
        PID:2456
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        12⤵
        
        PID:1600
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        12⤵
        
        PID:1612
        
        C:\Users\Default User\dllhost.exe
        
        "C:\Users\Default User\dllhost.exe"
        12⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\KvMN3vAFGm.bat"
        13⤵
        
        PID:3048
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        14⤵
        
        PID:2296
        
        C:\Windows\system32\w32tm.exe
        
        w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
        14⤵
        
        PID:2108

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default User\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 8 /tr "'C:\Users\Default User\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 11 /tr "'C:\agentMonitornetcommon\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\agentMonitornetcommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\agentMonitornetcommon\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Sidebar\ja-JP\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2428

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 14 /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "System" /sc ONLOGON /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 11 /tr "'C:\Program Files\Google\Chrome\Application\System.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1768

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2384

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsfontruntimeM" /sc MINUTE /mo 12 /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Msfontruntime" /sc ONLOGON /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MsfontruntimeM" /sc MINUTE /mo 6 /tr "'C:\agentMonitornetcommon\Msfontruntime.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5nOOmGNqzh.bat

Filesize
161B

MD5
825a7126fdcecdc9ea0ec936f40631f5

SHA1
d73ff94f7f222c73afecc826ca46bf95ca8e38c5

SHA256
7bbcfbf58b1af85f67fa89b13ca2c17750275efe93353589df20ef536140ded4

SHA512
fa1b5227ec2335dfd15af5c551564441b1654963dfac5397653db0bb276f0898c383d17a0d541f1054642b0e6ce15c795166f805ee8bdd398f1c42052a91856c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ar6wdwHCe.bat

Filesize
209B

MD5
8f00b20e608a813916aa420d5dc098a8

SHA1
c2a89f20f580d8ced1c7dcc550699fddf3b08da3

SHA256
b0405631e09b8e1ac83c58b3ede77a23ea16802ecd8b93adbc3fb2edd64f5ea1

SHA512
7f8a8365c1f2404e6f6ea401989decf86172c4a24d714e790dbcdede8231eb71d51d933d0fb8251f33b9195a925660036be910f4dd46dcb59abdd98c06d0e1e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\KU0xjXjpGp.bat

Filesize
209B

MD5
d7938ce67dd94f376976cab40771047e

SHA1
5491b776076378f46dbe9a2dc6b6f4666ee5adfa

SHA256
5ebe1032cd0c1523b25b900fb5f5c50385fa01e049b64dff049932d352646173

SHA512
90fcd6185641a36f910ee587d8dc3f70dd0557a00558237097aaba636d6d85960720b83d85f1f45bd87f15c6a29e4b2cbaab5240157af83363625750dfcb4d82

Download Submit
C:\Users\Admin\AppData\Local\Temp\KvMN3vAFGm.bat

Filesize
209B

MD5
ca23b76240ac3b07c88f43e73af36d11

SHA1
da0cc8c7aa1ee374d493da043a572584caf837c9

SHA256
5d83c7b9e6b03758fbf7d3297cf28e0bd3d6e4e8ef6342949599500fa7949d99

SHA512
ac58b7ccc231c919a655a5633054c0e1c25a289b6437a2dde2c79bc2d83d974333bdff8d77f814d8194b8f16afe4fbe18a89a8e1fba2dba08e67cfd0f3cd9063

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESCAE.tmp

Filesize
1KB

MD5
5d21cb2637fcc06ef56ebb530c530d2f

SHA1
93f0a3418493ee18685f0385e9136d613421fd4c

SHA256
9a1c1fe2aee927a3a56d9149bd82216d5b90af23e6ffe0ed0c31244ed6880349

SHA512
e109e62e0069597fda085d5fff0884b90fbefc7ec5eb5d4143ddc74e0ccb37d03466b9b062a12e3764285eafe23c25ebf3fc4e031f96de9fb59ca2fdd4a03d36

Download Submit
C:\Users\Admin\AppData\Local\Temp\hKniAGqDE1.bat

Filesize
161B

MD5
a8479887cb03f7fdc097c4fcfd27dec6

SHA1
f9500cf6e72f605ad80f52f0c10ffa139bff0226

SHA256
0ce72d4c85018e8453825bc1913d362069089799cda74e04389127370f7f6171

SHA512
145729de416ad741d03de09a1bc11abf5e0e4d381a86851866262d0d1d27cf91505c0ad3a32a46f0afe02ad7abe31eab75e45b4d0ee8626ba50aa2dfe86bf872

Download Submit
C:\agentMonitornetcommon\GBi0Q8YazuDC5WsFvOE.vbe

Filesize
231B

MD5
e9836fb94a627362459e478f344fe010

SHA1
ce16cdd9513923ac775a7498e4548d4a66bcef2c

SHA256
fe4eda0eca7f098fe7ad5ce5a5e8f68d8735e24e93654fb61e3187d6e6207235

SHA512
f589c484cea94694a9405a3cd49111671ba479f526a9068d46c30f59dd1f813b85eb08c1fb76d39ff4d268ee94da307b4fa70afe3454faa062ddaa71ad7e7f1b

Download Submit
C:\agentMonitornetcommon\g9S8CVbETtCg5QN5yxxbdptY4CtSRTw.bat

Filesize
82B

MD5
8beb041aab9fe0aa4f76082b7329a1a5

SHA1
6c1dd365d03640042ff51a2a3ada9a764706efba

SHA256
4504697922de405075ca52ec9d6c636ad153e3cd06b1ad1ae33a9f5e6edb2646

SHA512
286a95f6182408207e0db553ee3b5ab67ff60d5238984db49abe0a4497ee0fdf9c4210d2adfb5a1257dcdedabff0b067a8bee27f1e581a02364f9e8fd6bda7e6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qlqmchcg\qlqmchcg.0.cs

Filesize
365B

MD5
83f99d454f3ee4351efc0eaf1196605a

SHA1
e24b86abc213944412d604dfb18aa50688bf1b6a

SHA256
454a519b15e5005517d0d14b034abc8efce70355a8e4a2b788c6744eb9510b2c

SHA512
c5de1b38068ee7c2482f411327c63a8b4683e967f266337857308b7027d1999c4ec7cb7249c4e06ad7e3401654b6d0b8bedb7daa9caeec75b9e0ca47d4f6840d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qlqmchcg\qlqmchcg.cmdline

Filesize
235B

MD5
8fc283a225b2da402a59ef116353c839

SHA1
535f267461249bb3aa940f817ada4d243b842652

SHA256
b153f88eeecc4f80b9264a3fea5858e47091252c29d12cc8622951edfb26a272

SHA512
a50cc87321f88abec2626c6b6cca0b121a5bc61349f74066eceb2fff31c8fb06955c20dbe3c971536beefab14b983894c9ed5a51e1238567a188ace669523ee2

Download Submit
\??\c:\Windows\System32\CSC69D58C46C692493CB0AD28F9B1B9E57C.TMP

Filesize
1KB

MD5
028d4cd290ab6fe13d6fecce144a32cc

SHA1
e1d9531cb2e6bc9cab285b1f19e5d627257a3394

SHA256
3f42f68eb3df49cf836fbb0019b8206af735e22f3d528e7b122fa9b2541fdde3

SHA512
2f99d37a56444831298f8efaef425e5dadec938ac459bfc0cdaf3708ef8662f12bd8d687a58fc1dd6bbdac6c806214b65a21489a24d3160c1e8575968e3caa6e

Download Submit
\agentMonitornetcommon\Msfontruntime.exe

Filesize
1.8MB

MD5
769730d9ed728056adc3c69648deae26

SHA1
6c0a76de7715745eb3ca344d6ad5665c66f10ace

SHA256
c4f58fcf47c8897c4e3fe97b40c8ae6e3093242d37eecc325f5e89e1f7f1ca89

SHA512
9124c43ff1df0b56bfe9c1211abe997ce83bc4941546fd48c26414e43ec9117a2f009c7290019579fc09726cb93c78de90aa4d3589222a105985f287c28116ab

Download Submit
memory/1144-73-0x0000000001100000-0x00000000012DA000-memory.dmp

Filesize
1.9MB

Download
memory/1304-21-0x0000000000800000-0x000000000080C000-memory.dmp

Filesize
48KB

Download
memory/1304-19-0x0000000002180000-0x0000000002198000-memory.dmp

Filesize
96KB

Download
memory/1304-17-0x0000000002160000-0x000000000217C000-memory.dmp

Filesize
112KB

Download
memory/1304-15-0x00000000007F0000-0x00000000007FE000-memory.dmp

Filesize
56KB

Download
memory/1304-13-0x00000000003D0000-0x00000000005AA000-memory.dmp

Filesize
1.9MB

Download
memory/1604-84-0x00000000002C0000-0x000000000049A000-memory.dmp

Filesize
1.9MB

Download
memory/2424-52-0x0000000000DF0000-0x0000000000FCA000-memory.dmp

Filesize
1.9MB

Download