Malware Analysis Report

2024-12-07 10:06

Sample ID 241112-xr2r7axqdz
Target 00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c
SHA256 00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c
Tags
quasar defense_evasion discovery evasion execution impact persistence ransomware spyware trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c

Threat Level: Known bad

The file 00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c was found to be: Known bad.

Malicious Activity Summary

quasar defense_evasion discovery evasion execution impact persistence ransomware spyware trojan

Modifies Windows Defender Real-time Protection settings

Quasar RAT

Modifies security service

Quasar family

UAC bypass

Windows security bypass

Contains code to disable Windows Defender

Quasar payload

Deletes shadow copies

Windows security modification

Loads dropped DLL

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Adds Run key to start application

Looks up external IP address via web service

Modifies Security services

Checks whether UAC is enabled

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Unsigned PE

System policy modification

Scheduled Task/Job: Scheduled Task

Suspicious use of SetWindowsHookEx

Interacts with shadow copies

Suspicious behavior: EnumeratesProcesses

Uses Volume Shadow Copy service COM API

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 19:06

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 19:06

Reported

2024-11-12 19:08

Platform

win7-20240903-en

Max time kernel

138s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

Signatures

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WinDefend\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WinDefend\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Quasar RAT

trojan spyware quasar

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Deletes shadow copies

ransomware defense_evasion impact execution

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe\"" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe\"" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\"" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\"" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Modifies Security services

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdBoot\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdFilter\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdFilter\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdBoot\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdFilter\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WdBoot\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\vssadmin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\vssadmin.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Interacts with shadow copies

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A
N/A N/A C:\Windows\SysWOW64\vssadmin.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\vssvc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2692 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2692 wrote to memory of 2816 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 2816 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 3032 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 2500 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 2816 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2816 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2816 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2816 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\vssadmin.exe
PID 2816 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 2816 wrote to memory of 1972 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1972 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1044 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 672 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1044 wrote to memory of 560 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1044 wrote to memory of 560 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1044 wrote to memory of 560 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1044 wrote to memory of 560 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\vssadmin.exe
PID 1044 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1044 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1044 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1044 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe" /f

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /delete /tn "iceTelemetryLogtte" /f

C:\Windows\SysWOW64\vssadmin.exe

"vssadmin" delete shadows /all /quiet

C:\Windows\system32\vssvc.exe

C:\Windows\system32\vssvc.exe

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe

"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe

"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe

"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe" /f

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /delete /tn "iceTelemetryLogtte" /f

C:\Windows\SysWOW64\vssadmin.exe

"vssadmin" delete shadows /all /quiet

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

Network

Country Destination Domain Proto
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 172.67.19.24:443 pastebin.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 edificiobaldeares.linkpc.net udp
US 128.90.108.251:9057 edificiobaldeares.linkpc.net tcp
US 128.90.108.251:9057 edificiobaldeares.linkpc.net tcp

Files

memory/2692-0-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2692-1-0x0000000001270000-0x000000000135E000-memory.dmp

memory/2692-2-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2692-3-0x0000000000500000-0x0000000000512000-memory.dmp

memory/2692-4-0x000000007408E000-0x000000007408F000-memory.dmp

memory/2692-5-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2692-6-0x0000000005360000-0x0000000005400000-memory.dmp

memory/2816-8-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-15-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-19-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-20-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2816-17-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2816-11-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-9-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2816-7-0x0000000000400000-0x000000000045C000-memory.dmp

memory/2692-21-0x0000000074080000-0x000000007476E000-memory.dmp

memory/2816-22-0x0000000074080000-0x000000007476E000-memory.dmp

\Users\Admin\AppData\Roaming\GPret\Vespre.exe

MD5 fee0d9b8fd3d7765f902463817e0db71
SHA1 a2e83ee17368cfbcaa52fa36eeb5b192e3d21c42
SHA256 00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c
SHA512 dfdf07b1c8211bb0bf3db619cbc07f7746f793bbb284247e6865d08e15dd83bccf668ea752f1431df51b508e69acb6eed291692119a4c72b3564bcc0124166fa

memory/2816-41-0x0000000074080000-0x000000007476E000-memory.dmp

memory/1972-42-0x0000000000E90000-0x0000000000F7E000-memory.dmp

memory/1972-43-0x0000000000440000-0x0000000000452000-memory.dmp

memory/1044-53-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

C:\Users\Admin\AppData\Roaming\GPret\settings.xml

MD5 5e2fed2afe7d007c0ab27b308afed971
SHA1 61a28c39e779581188313be2259998eb897cf4aa
SHA256 5b3b07df23c2b320bfb878662e8f812c96e3b8dbda668adb173a3aa236c98f52
SHA512 f6e593810403313382c69cf41b97536c63b348e8e9648d3e65675297a47c2ef5d9be302acee4999b3225f01f3fafd6a7735932e7b6f1e81f7b85d5523b730382

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 bb6f7d496c55a7ca16270be9d3924249
SHA1 fc1f40cd3e147a3df38f24ec6a3b07f639c5f436
SHA256 f58254c98322bef0fb3fcaa847d894f7ce19991373ef69c4edce8c27db0588e7
SHA512 afa8229e19adca4624ca75ec14779e18f966b622ddbcaf4e731a3a1a2f11514aee87c2209b952ff9107a28441026bcadb546c503b9fdc0a7a637b755858feb74

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-12 19:06

Reported

2024-11-12 19:08

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

Signatures

Contains code to disable Windows Defender

Description Indicator Process Target
N/A N/A N/A N/A

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Modifies security service

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WinDefend\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Quasar RAT

trojan spyware quasar

Quasar family

quasar

Quasar payload

Description Indicator Process Target
N/A N/A N/A N/A

UAC bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\DisableAntiSpyware = "1" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "1" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe\"" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe\"" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\"" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iceTelemetryLogtte = "\"C:\\Users\\Admin\\AppData\\Roaming\\GPret\\Vespre.exe\"" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Modifies Security services

defense_evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdBoot\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisSvc\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdFilter\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdFilter\Start = "4" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdBoot\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\WdNisDrv\Start = "4" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 3672 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe
PID 4456 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 4456 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 4456 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 4456 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 4456 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 4456 wrote to memory of 1556 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\schtasks.exe
PID 4456 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4456 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4456 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 4456 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4456 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4456 wrote to memory of 4720 N/A C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 4720 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe
PID 1428 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 4340 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\schtasks.exe
PID 1428 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1428 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1428 wrote to memory of 1152 N/A C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe

"C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Local\Temp\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe" /f

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /delete /tn "iceTelemetryLogtte" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe

"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe

"C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe"

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /create /tn "\Microsoft\Windows\System\Dev34\Files\iceTelemetryLogtte" /SC MINUTE /MO 3 /RL HIGHEST /tr "C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe" /f

C:\Windows\SysWOW64\schtasks.exe

"schtasks" /delete /tn "iceTelemetryLogtte" /f

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell" Get-MpPreference -verbose

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 172.67.19.24:443 pastebin.com tcp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 edificiobaldeares.linkpc.net udp
US 128.90.108.251:9057 edificiobaldeares.linkpc.net tcp
US 8.8.8.8:53 251.108.90.128.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 128.90.108.251:9057 edificiobaldeares.linkpc.net tcp

Files

memory/3672-0-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

memory/3672-1-0x0000000000140000-0x000000000022E000-memory.dmp

memory/3672-2-0x00000000050D0000-0x0000000005674000-memory.dmp

memory/3672-3-0x0000000004C00000-0x0000000004C92000-memory.dmp

memory/3672-4-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

memory/3672-5-0x0000000074CB0000-0x0000000075460000-memory.dmp

memory/3672-6-0x0000000004E90000-0x0000000004F2C000-memory.dmp

memory/3672-7-0x0000000005E80000-0x0000000005E92000-memory.dmp

memory/3672-8-0x0000000074CBE000-0x0000000074CBF000-memory.dmp

memory/3672-9-0x0000000074CB0000-0x0000000075460000-memory.dmp

memory/3672-10-0x00000000062F0000-0x0000000006390000-memory.dmp

memory/4456-11-0x0000000000400000-0x000000000045C000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c.exe.log

MD5 8ec831f3e3a3f77e4a7b9cd32b48384c
SHA1 d83f09fd87c5bd86e045873c231c14836e76a05c
SHA256 7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982
SHA512 26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

memory/4456-14-0x0000000074CB0000-0x0000000075460000-memory.dmp

memory/3672-15-0x0000000074CB0000-0x0000000075460000-memory.dmp

memory/4456-16-0x0000000074CB0000-0x0000000075460000-memory.dmp

memory/4456-22-0x0000000006430000-0x0000000006496000-memory.dmp

memory/4456-23-0x0000000006740000-0x0000000006752000-memory.dmp

memory/4456-24-0x00000000067A0000-0x00000000067DC000-memory.dmp

memory/2564-26-0x0000000002420000-0x0000000002456000-memory.dmp

memory/2564-27-0x0000000004EC0000-0x00000000054E8000-memory.dmp

memory/2564-28-0x0000000004E80000-0x0000000004EA2000-memory.dmp

memory/2564-29-0x0000000005560000-0x00000000055C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wx5f5t22.cg0.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2564-39-0x0000000005770000-0x0000000005AC4000-memory.dmp

memory/2564-40-0x0000000005DD0000-0x0000000005DEE000-memory.dmp

memory/2564-41-0x0000000005E00000-0x0000000005E4C000-memory.dmp

memory/2564-42-0x0000000006390000-0x00000000063C2000-memory.dmp

memory/2564-43-0x00000000700A0000-0x00000000700EC000-memory.dmp

memory/2564-53-0x0000000006F80000-0x0000000006F9E000-memory.dmp

memory/2564-54-0x0000000006FB0000-0x0000000007053000-memory.dmp

memory/2564-55-0x0000000007730000-0x0000000007DAA000-memory.dmp

memory/2564-56-0x00000000070F0000-0x000000000710A000-memory.dmp

memory/2564-57-0x0000000007160000-0x000000000716A000-memory.dmp

memory/2564-58-0x0000000007370000-0x0000000007406000-memory.dmp

memory/2564-59-0x00000000072F0000-0x0000000007301000-memory.dmp

memory/2564-60-0x0000000007320000-0x000000000732E000-memory.dmp

memory/2564-61-0x0000000007330000-0x0000000007344000-memory.dmp

memory/2564-62-0x0000000007430000-0x000000000744A000-memory.dmp

memory/2564-63-0x0000000007410000-0x0000000007418000-memory.dmp

C:\Users\Admin\AppData\Roaming\GPret\Vespre.exe

MD5 fee0d9b8fd3d7765f902463817e0db71
SHA1 a2e83ee17368cfbcaa52fa36eeb5b192e3d21c42
SHA256 00752a2889e0712000b18846f8a060434d23d6fcae5e98e3cb8d39f70376366c
SHA512 dfdf07b1c8211bb0bf3db619cbc07f7746f793bbb284247e6865d08e15dd83bccf668ea752f1431df51b508e69acb6eed291692119a4c72b3564bcc0124166fa

memory/4456-71-0x0000000074CB0000-0x0000000075460000-memory.dmp

memory/4720-72-0x0000000005000000-0x0000000005012000-memory.dmp

C:\Users\Admin\AppData\Roaming\GPret\settings.xml

MD5 0670ea91a3ff99e765de101bacc1ce56
SHA1 3b83e99ae94105ffe78aab1b4e2dab1187b4b0f7
SHA256 7dc01c0f1c1d2aa56555d951562ebc455718d3ca7c8e25bd59d42ad5b46b2f2b
SHA512 4063b047638fd8cf8927bd360e2426416a6f154a986ad9f6b2c2d6278f7aab41f96c0c9e32c042d3d32fc6779d204012890f76e389681f6f63985b4f93a6d84d

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 3d086a433708053f9bf9523e1d87a4e8
SHA1 b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA256 6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512 931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

memory/1152-88-0x0000000005710000-0x0000000005A64000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 7a89b32f7f93abbf3fe1b176bae3f5a5
SHA1 763000f8ce3b8a0ac1b43ded3fb0708efc8db2d4
SHA256 37b19e7fcf85760be52acbfb204ed1f8abefb2c06d2fd24799f666707edfebe0
SHA512 133674b4f233aeffdfc593f6ee13081e9057c7ca7a5830b877e3033fa81ecb256c2fc9c4d5609f1f487b6de98b24efb92ddf31be76eaa0b15ad87df41f78d7fd

memory/1152-94-0x0000000005EC0000-0x0000000005F0C000-memory.dmp

memory/1152-95-0x00000000700D0000-0x000000007011C000-memory.dmp

memory/1152-105-0x0000000006E40000-0x0000000006EE3000-memory.dmp

memory/1152-106-0x00000000073A0000-0x00000000073B1000-memory.dmp

memory/1152-107-0x00000000073F0000-0x0000000007404000-memory.dmp