cae246e1b4386518005749ac3958c4506d448f1f7efdd49d839dd10a5e01be2b

Analysis

max time kernel
133s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XMRfinal.exe
Size

45KB
MD5

34c74daeeaf8a3aab61553a507b329c7
SHA1

8a28ede427de7fc4088a8ababe018c2284b93c2b
SHA256

8ad91fe964e0a868a0260a6142a94a2b7fa930be6d79fff4dbe199f38f7be17b
SHA512

114571ba25987bdbdb623d233bd9f52b9ff049ce52723cc0e68d715eed633c62b604e95ec8191e2bda10fe6aaa55d63ccbc1f9af36f2a6d11d2ac744ee2adf73
SSDEEP

768:rkbsy4kAcpYHEX1DwaLwRpeP5YlsDpqcO6TlJmOh4bIDX3aan2yyhYnLNqgXi2f:4bsVcbNGcpjO4jmI4sKjyBNfXzf

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
556	powershell.exe
1968	powershell.exe
2084	powershell.exe
1564	powershell.exe
2212	powershell.exe
2976	powershell.exe
2676	powershell.exe
2132	powershell.exe
2524	powershell.exe
2948	powershell.exe
2016	powershell.exe
2288	powershell.exe

Executes dropped EXE 6 IoCs

Processes:

svchost64.exeservices64.exesvchost64.exesihost64.exeservices64.exesvchost64.exe

pid process

1688 svchost64.exe
864 services64.exe
1600 svchost64.exe
1500 sihost64.exe
2876 services64.exe
1896 svchost64.exe
Loads dropped DLL 6 IoCs

Processes:

cmd.exesvchost64.execmd.exesvchost64.exesihost64.execmd.exe

pid process

2624 cmd.exe
1688 svchost64.exe
972 cmd.exe
1600 svchost64.exe
1500 sihost64.exe
1244 cmd.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

9 raw.githubusercontent.com
10 raw.githubusercontent.com
14 raw.githubusercontent.com

pid	process
1688	svchost64.exe
864	services64.exe
1600	svchost64.exe
1500	sihost64.exe
2876	services64.exe
1896	svchost64.exe

pid	process
2624	cmd.exe
1688	svchost64.exe
972	cmd.exe
1600	svchost64.exe
1500	sihost64.exe
1244	cmd.exe

flow	ioc
9	raw.githubusercontent.com
10	raw.githubusercontent.com
14	raw.githubusercontent.com

Drops file in System32 directory 14 IoCs

Processes:

powershell.exepowershell.exepowershell.exesvchost64.exesihost64.exepowershell.exepowershell.exesvchost64.exepowershell.exepowershell.exepowershell.exesvchost64.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	svchost64.exe
File opened for modification	C:\Windows\system32\services64.exe	sihost64.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\system32\services64.exe	svchost64.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\services64.exe	svchost64.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	svchost64.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\Microsoft\Libs\WR64.sys	svchost64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

svchost64.exesvchost64.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	svchost64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	svchost64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	svchost64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	svchost64.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	svchost64.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2088 schtasks.exe
2368 schtasks.exe
2940 schtasks.exe

pid	process
2088	schtasks.exe
2368	schtasks.exe
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exesvchost64.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost64.exepowershell.exepowershell.exepowershell.exepowershell.exesvchost64.exe

pid	process
2288	powershell.exe
2212	powershell.exe
2976	powershell.exe
2676	powershell.exe
1688	svchost64.exe
1564	powershell.exe
556	powershell.exe
2132	powershell.exe
2524	powershell.exe
1600	svchost64.exe
1968	powershell.exe
2948	powershell.exe
2016	powershell.exe
2084	powershell.exe
1896	svchost64.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	2288	powershell.exe
Token: SeDebugPrivilege	2212	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	1688	svchost64.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	556	powershell.exe
Token: SeDebugPrivilege	2132	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	1600	svchost64.exe
Token: SeDebugPrivilege	1968	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeDebugPrivilege	2016	powershell.exe
Token: SeDebugPrivilege	2084	powershell.exe
Token: SeDebugPrivilege	1896	svchost64.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

XMRfinal.execmd.execmd.exesvchost64.execmd.exeservices64.execmd.execmd.execmd.exesvchost64.execmd.exe

description	pid	process	target process
PID 1624 wrote to memory of 1800	1624	XMRfinal.exe	cmd.exe
PID 1624 wrote to memory of 1800	1624	XMRfinal.exe	cmd.exe
PID 1624 wrote to memory of 1800	1624	XMRfinal.exe	cmd.exe
PID 1800 wrote to memory of 2288	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2288	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2288	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2212	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2212	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2212	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2976	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2976	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2976	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2676	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2676	1800	cmd.exe	powershell.exe
PID 1800 wrote to memory of 2676	1800	cmd.exe	powershell.exe
PID 1624 wrote to memory of 2624	1624	XMRfinal.exe	cmd.exe
PID 1624 wrote to memory of 2624	1624	XMRfinal.exe	cmd.exe
PID 1624 wrote to memory of 2624	1624	XMRfinal.exe	cmd.exe
PID 2624 wrote to memory of 1688	2624	cmd.exe	svchost64.exe
PID 2624 wrote to memory of 1688	2624	cmd.exe	svchost64.exe
PID 2624 wrote to memory of 1688	2624	cmd.exe	svchost64.exe
PID 1688 wrote to memory of 1984	1688	svchost64.exe	cmd.exe
PID 1688 wrote to memory of 1984	1688	svchost64.exe	cmd.exe
PID 1688 wrote to memory of 1984	1688	svchost64.exe	cmd.exe
PID 1984 wrote to memory of 2940	1984	cmd.exe	schtasks.exe
PID 1984 wrote to memory of 2940	1984	cmd.exe	schtasks.exe
PID 1984 wrote to memory of 2940	1984	cmd.exe	schtasks.exe
PID 1688 wrote to memory of 864	1688	svchost64.exe	services64.exe
PID 1688 wrote to memory of 864	1688	svchost64.exe	services64.exe
PID 1688 wrote to memory of 864	1688	svchost64.exe	services64.exe
PID 1688 wrote to memory of 2628	1688	svchost64.exe	cmd.exe
PID 1688 wrote to memory of 2628	1688	svchost64.exe	cmd.exe
PID 1688 wrote to memory of 2628	1688	svchost64.exe	cmd.exe
PID 864 wrote to memory of 2384	864	services64.exe	cmd.exe
PID 864 wrote to memory of 2384	864	services64.exe	cmd.exe
PID 864 wrote to memory of 2384	864	services64.exe	cmd.exe
PID 2384 wrote to memory of 1564	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 1564	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 1564	2384	cmd.exe	powershell.exe
PID 2628 wrote to memory of 572	2628	cmd.exe	choice.exe
PID 2628 wrote to memory of 572	2628	cmd.exe	choice.exe
PID 2628 wrote to memory of 572	2628	cmd.exe	choice.exe
PID 2384 wrote to memory of 556	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 556	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 556	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 2132	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 2132	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 2132	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 2524	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 2524	2384	cmd.exe	powershell.exe
PID 2384 wrote to memory of 2524	2384	cmd.exe	powershell.exe
PID 864 wrote to memory of 972	864	services64.exe	cmd.exe
PID 864 wrote to memory of 972	864	services64.exe	cmd.exe
PID 864 wrote to memory of 972	864	services64.exe	cmd.exe
PID 972 wrote to memory of 1600	972	cmd.exe	svchost64.exe
PID 972 wrote to memory of 1600	972	cmd.exe	svchost64.exe
PID 972 wrote to memory of 1600	972	cmd.exe	svchost64.exe
PID 1600 wrote to memory of 1964	1600	svchost64.exe	cmd.exe
PID 1600 wrote to memory of 1964	1600	svchost64.exe	cmd.exe
PID 1600 wrote to memory of 1964	1600	svchost64.exe	cmd.exe
PID 1600 wrote to memory of 1500	1600	svchost64.exe	sihost64.exe
PID 1600 wrote to memory of 1500	1600	svchost64.exe	sihost64.exe
PID 1600 wrote to memory of 1500	1600	svchost64.exe	sihost64.exe
PID 1964 wrote to memory of 2088	1964	cmd.exe	schtasks.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\XMRfinal.exe
"C:\Users\Admin\AppData\Local\Temp\XMRfinal.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1624

C:\Windows\system32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1800

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\XMRfinal.exe"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\svchost64.exe
C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Users\Admin\AppData\Local\Temp\XMRfinal.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1984

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
5⤵
- Scheduled Task/Job: Scheduled Task
PID:2940

C:\Windows\system32\services64.exe
"C:\Windows\system32\services64.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864

C:\Windows\system32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:972

C:\Users\Admin\AppData\Local\Temp\svchost64.exe
C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
7⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
8⤵
- Scheduled Task/Job: Scheduled Task
PID:2088

C:\Windows\system32\Microsoft\Libs\sihost64.exe
"C:\Windows\system32\Microsoft\Libs\sihost64.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
PID:1500

C:\Windows\system32\services64.exe
"C:\Windows\system32\services64.exe"
8⤵
- Executes dropped EXE
PID:2876

C:\Windows\system32\cmd.exe
"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
9⤵
PID:1628

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin'
10⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1968

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
10⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
10⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
10⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
9⤵
- Loads dropped DLL
PID:1244

C:\Users\Admin\AppData\Local\Temp\svchost64.exe
C:\Users\Admin\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
11⤵
PID:1516

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
12⤵
- Scheduled Task/Job: Scheduled Task
PID:2368

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
11⤵
PID:2780

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
12⤵
PID:2692

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
7⤵
PID:2284

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
8⤵
PID:2652

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\svchost64.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
5⤵
PID:572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
924bd0dba478c4beabbd07b844d26704

SHA1
f9f8ecfdccd181a8d6ea4bde1f20ddcfd0d50b93

SHA256
540745cb9098db67a534c25f05ae51a399613a7864119efc9bac2cacb30c3bc8

SHA512
327214a091258a74779a39d05542f27a105aeae7bd38bbd619ccd81a075706544987f303c2dd328e93f8634726b47265fdebfa13384213f599a5abd6a3a86521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ecba00ed846c4607d88c63782ab24f6

SHA1
7b4e35ac1fa77e6a3c602fbca2ce1b9c966f7b9f

SHA256
a342e4c9017c1a0bfa8c6dd4d33ff8bd230627490fa68d800b1318b85c637917

SHA512
4ae0dc1706b33e3219112d99e3b7677e8571c33da9eaba6d5135d868c1c771cb9de00b593ef10adb5eee2280c92e3a3e6fa49c1c8ca214ad104d890fe5a45d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A02.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7A15.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
50b5f4007e9b41f9463485a9ca90e0bf

SHA1
1262c96587cd649d2f9d8e5f6a43265ba2b1bc38

SHA256
b7aef884efc6e5fcb669b92dc2708d4e7ca9141e215710fb695a6fdd980c9ce8

SHA512
8ea1bd9fc51de732c05da339374b7b15758980c3e4463c1e513aaadb1ac0f0d8db54587b7ab8befb79a423ae80263300f28ad9e7a708c66e1fdfaa0ba5bb938e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5dde1c91e6a33ec56552777163cb541d

SHA1
a4faa21d522526b5ff0d3280ec7353b4c56d7d3d

SHA256
473b2ec0a14680674b077527f4c9eded1a5d3ca32f4cc03e5f9dc683cef0b19f

SHA512
4da7c8dd0352b2857abc928a7ceaedde7591960c0f3bd2471b75505c43fe22811da98b8ba5932ed92d3d4e8b4dd5484356ad5a029e4f688a0c810725fb7c08d3

Download Submit
C:\Windows\system32\Microsoft\Libs\WR64.sys

Filesize
14KB

MD5
0c0195c48b6b8582fa6f6373032118da

SHA1
d25340ae8e92a6d29f599fef426a2bc1b5217299

SHA256
11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5

SHA512
ab28e99659f219fec553155a0810de90f0c5b07dc9b66bda86d7686499fb0ec5fddeb7cd7a3c5b77dccb5e865f2715c2d81f4d40df4431c92ac7860c7e01720d

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\svchost64.exe

Filesize
37KB

MD5
2398af19987fa42ea0b0af39f971dac0

SHA1
e2d74b1bb2d7dd705c95be5e9c28dd7a2ba5e646

SHA256
716849b27ea4000c6711238980d7de59adda3cf0dcd5055b06d84b361f6402f2

SHA512
0eb926162a4fdbb9a0ea31ba49ad9e8deb5bf6faece4bf0785c46a83d405464294ec38aa4d08104de892219d1a3d8c9c87885c7d9629e792d8aec1168338296f

Download Submit
\Windows\System32\Microsoft\Libs\sihost64.exe

Filesize
7KB

MD5
56da2835319cea01989c1c9974e3d92d

SHA1
6af5d3e866a1d84149aaed7866cbcd81bbbf1997

SHA256
d4671ce89aad24e2d2dd69afdc41d9b917e5aadeca4a1d0d3f41f0a2ed20748b

SHA512
275fdf1a5ee1b5010896c342acac1b3062908c574be5cb865afe9608017cef09f47147d375089bfa325c038647b68a3a48f48e9c535191d6160beac8591eaba2

Download Submit
\Windows\System32\services64.exe

Filesize
45KB

MD5
34c74daeeaf8a3aab61553a507b329c7

SHA1
8a28ede427de7fc4088a8ababe018c2284b93c2b

SHA256
8ad91fe964e0a868a0260a6142a94a2b7fa930be6d79fff4dbe199f38f7be17b

SHA512
114571ba25987bdbdb623d233bd9f52b9ff049ce52723cc0e68d715eed633c62b604e95ec8191e2bda10fe6aaa55d63ccbc1f9af36f2a6d11d2ac744ee2adf73

Download Submit
memory/864-47-0x0000000001330000-0x0000000001340000-memory.dmp

Filesize
64KB

Download
memory/1500-80-0x000000013F7C0000-0x000000013F7C6000-memory.dmp

Filesize
24KB

Download
memory/1600-73-0x000000013FB80000-0x000000013FB8E000-memory.dmp

Filesize
56KB

Download
memory/1624-35-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-8-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-0-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/1624-32-0x000007FEF53E3000-0x000007FEF53E4000-memory.dmp

Filesize
4KB

Download
memory/1624-33-0x000007FEF53E0000-0x000007FEF5DCC000-memory.dmp

Filesize
9.9MB

Download
memory/1624-1-0x0000000000120000-0x0000000000130000-memory.dmp

Filesize
64KB

Download
memory/1688-40-0x000000013F880000-0x000000013F88E000-memory.dmp

Filesize
56KB

Download
memory/1896-212-0x000000013F220000-0x000000013F22E000-memory.dmp

Filesize
56KB

Download
memory/2212-21-0x0000000001FF0000-0x0000000001FF8000-memory.dmp

Filesize
32KB

Download
memory/2212-20-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

Filesize
2.9MB

Download
memory/2288-14-0x0000000002DBB000-0x0000000002E22000-memory.dmp

Filesize
412KB

Download
memory/2288-11-0x000007FEF2870000-0x000007FEF320D000-memory.dmp

Filesize
9.6MB

Download
memory/2288-9-0x0000000002DB0000-0x0000000002E30000-memory.dmp

Filesize
512KB

Download
memory/2288-10-0x000007FEF2B2E000-0x000007FEF2B2F000-memory.dmp

Filesize
4KB

Download
memory/2288-13-0x000007FEF2870000-0x000007FEF320D000-memory.dmp

Filesize
9.6MB

Download
memory/2288-7-0x0000000002890000-0x0000000002898000-memory.dmp

Filesize
32KB

Download
memory/2288-12-0x000007FEF2870000-0x000007FEF320D000-memory.dmp

Filesize
9.6MB

Download
memory/2288-6-0x000000001B730000-0x000000001BA12000-memory.dmp

Filesize
2.9MB

Download
memory/2876-184-0x0000000000920000-0x0000000000930000-memory.dmp

Filesize
64KB

Download