Analysis
-
max time kernel
86s -
max time network
88s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241023-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
14-11-2024 22:11
Static task
static1
Behavioral task
behavioral1
Sample
Downloader.exe
Resource
win10ltsc2021-20241023-en
General
-
Target
Downloader.exe
-
Size
202KB
-
MD5
fca21eb23c210b8ed73302745ea78f70
-
SHA1
143486e415dedb630de5c776beb3c8b150dd9bf1
-
SHA256
33a9357923338bee03659341ec7705dc76a2e03245f084311fa758e94c74c3f0
-
SHA512
41e8c5a6a5b77b6da39a4801494dc83a26dd5010482d907a35a15e51472fcf8c4c4367532c578660760144a39326b6a4f38973a3bd9c43d8f75e0141f9c92e40
-
SSDEEP
3072:NWF1Sss2XaOvu+v7QC2mCAbtoJOBW0rArwrkut57cIrDjy6Hy7GKbY64IrHi:NWF0+XaOvuyycWNrwrk6y70JIr
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.215.113.66
http://185.215.113.84
-
mutex
Klipux
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x002800000004508c-11.dat family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 900 created 3548 900 1004721785.exe 57 PID 900 created 3548 900 1004721785.exe 57 PID 1980 created 3548 1980 winupsecvmgr.exe 57 PID 1980 created 3548 1980 winupsecvmgr.exe 57 PID 1980 created 3548 1980 winupsecvmgr.exe 57 -
Xmrig family
-
XMRig Miner payload 4 IoCs
resource yara_rule behavioral1/memory/1980-90-0x00007FF7FBCC0000-0x00007FF7FC257000-memory.dmp xmrig behavioral1/memory/4876-94-0x00007FF641BD0000-0x00007FF6423BF000-memory.dmp xmrig behavioral1/memory/4876-102-0x00007FF641BD0000-0x00007FF6423BF000-memory.dmp xmrig behavioral1/memory/4876-115-0x00007FF641BD0000-0x00007FF6423BF000-memory.dmp xmrig -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000\Control Panel\International\Geo\Nation 2224221839.exe -
Executes dropped EXE 10 IoCs
pid Process 4440 9D1B.exe 2168 176766182.exe 560 sysnldcvmr.exe 4924 2224221839.exe 1540 1185310144.exe 3748 2615931573.exe 900 1004721785.exe 1980 winupsecvmgr.exe 1224 BB8B.exe 3684 495814481.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe" 176766182.exe -
pid Process 2112 powershell.exe 4284 powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1980 set thread context of 5080 1980 winupsecvmgr.exe 120 PID 1980 set thread context of 4876 1980 winupsecvmgr.exe 121 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysnldcvmr.exe 176766182.exe File opened for modification C:\Windows\sysnldcvmr.exe 176766182.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9D1B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1185310144.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BB8B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Downloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2615931573.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Downloader.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 495814481.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 176766182.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1361837696-2276465416-1936241636-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4924 2224221839.exe 4924 2224221839.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 900 1004721785.exe 900 1004721785.exe 3320 taskmgr.exe 2112 powershell.exe 2112 powershell.exe 2112 powershell.exe 3320 taskmgr.exe 900 1004721785.exe 900 1004721785.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 1980 winupsecvmgr.exe 1980 winupsecvmgr.exe 4284 powershell.exe 4284 powershell.exe 4284 powershell.exe 3320 taskmgr.exe 1980 winupsecvmgr.exe 1980 winupsecvmgr.exe 1980 winupsecvmgr.exe 1980 winupsecvmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4924 2224221839.exe Token: SeDebugPrivilege 3320 taskmgr.exe Token: SeSystemProfilePrivilege 3320 taskmgr.exe Token: SeCreateGlobalPrivilege 3320 taskmgr.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 powershell.exe Token: SeSecurityPrivilege 2112 powershell.exe Token: SeTakeOwnershipPrivilege 2112 powershell.exe Token: SeLoadDriverPrivilege 2112 powershell.exe Token: SeSystemProfilePrivilege 2112 powershell.exe Token: SeSystemtimePrivilege 2112 powershell.exe Token: SeProfSingleProcessPrivilege 2112 powershell.exe Token: SeIncBasePriorityPrivilege 2112 powershell.exe Token: SeCreatePagefilePrivilege 2112 powershell.exe Token: SeBackupPrivilege 2112 powershell.exe Token: SeRestorePrivilege 2112 powershell.exe Token: SeShutdownPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeSystemEnvironmentPrivilege 2112 powershell.exe Token: SeRemoteShutdownPrivilege 2112 powershell.exe Token: SeUndockPrivilege 2112 powershell.exe Token: SeManageVolumePrivilege 2112 powershell.exe Token: 33 2112 powershell.exe Token: 34 2112 powershell.exe Token: 35 2112 powershell.exe Token: 36 2112 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 powershell.exe Token: SeSecurityPrivilege 2112 powershell.exe Token: SeTakeOwnershipPrivilege 2112 powershell.exe Token: SeLoadDriverPrivilege 2112 powershell.exe Token: SeSystemProfilePrivilege 2112 powershell.exe Token: SeSystemtimePrivilege 2112 powershell.exe Token: SeProfSingleProcessPrivilege 2112 powershell.exe Token: SeIncBasePriorityPrivilege 2112 powershell.exe Token: SeCreatePagefilePrivilege 2112 powershell.exe Token: SeBackupPrivilege 2112 powershell.exe Token: SeRestorePrivilege 2112 powershell.exe Token: SeShutdownPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeSystemEnvironmentPrivilege 2112 powershell.exe Token: SeRemoteShutdownPrivilege 2112 powershell.exe Token: SeUndockPrivilege 2112 powershell.exe Token: SeManageVolumePrivilege 2112 powershell.exe Token: 33 2112 powershell.exe Token: 34 2112 powershell.exe Token: 35 2112 powershell.exe Token: 36 2112 powershell.exe Token: SeIncreaseQuotaPrivilege 2112 powershell.exe Token: SeSecurityPrivilege 2112 powershell.exe Token: SeTakeOwnershipPrivilege 2112 powershell.exe Token: SeLoadDriverPrivilege 2112 powershell.exe Token: SeSystemProfilePrivilege 2112 powershell.exe Token: SeSystemtimePrivilege 2112 powershell.exe Token: SeProfSingleProcessPrivilege 2112 powershell.exe Token: SeIncBasePriorityPrivilege 2112 powershell.exe Token: SeCreatePagefilePrivilege 2112 powershell.exe Token: SeBackupPrivilege 2112 powershell.exe Token: SeRestorePrivilege 2112 powershell.exe Token: SeShutdownPrivilege 2112 powershell.exe Token: SeDebugPrivilege 2112 powershell.exe Token: SeSystemEnvironmentPrivilege 2112 powershell.exe Token: SeRemoteShutdownPrivilege 2112 powershell.exe Token: SeUndockPrivilege 2112 powershell.exe Token: SeManageVolumePrivilege 2112 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe 4876 dwm.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe 4876 dwm.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe 3320 taskmgr.exe 3320 taskmgr.exe 4876 dwm.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1176 wrote to memory of 4440 1176 Downloader.exe 82 PID 1176 wrote to memory of 4440 1176 Downloader.exe 82 PID 1176 wrote to memory of 4440 1176 Downloader.exe 82 PID 4440 wrote to memory of 2168 4440 9D1B.exe 88 PID 4440 wrote to memory of 2168 4440 9D1B.exe 88 PID 4440 wrote to memory of 2168 4440 9D1B.exe 88 PID 2168 wrote to memory of 560 2168 176766182.exe 90 PID 2168 wrote to memory of 560 2168 176766182.exe 90 PID 2168 wrote to memory of 560 2168 176766182.exe 90 PID 560 wrote to memory of 4924 560 sysnldcvmr.exe 97 PID 560 wrote to memory of 4924 560 sysnldcvmr.exe 97 PID 4924 wrote to memory of 1268 4924 2224221839.exe 98 PID 4924 wrote to memory of 1268 4924 2224221839.exe 98 PID 4924 wrote to memory of 1084 4924 2224221839.exe 100 PID 4924 wrote to memory of 1084 4924 2224221839.exe 100 PID 1268 wrote to memory of 2532 1268 cmd.exe 102 PID 1268 wrote to memory of 2532 1268 cmd.exe 102 PID 1084 wrote to memory of 2012 1084 cmd.exe 103 PID 1084 wrote to memory of 2012 1084 cmd.exe 103 PID 560 wrote to memory of 1540 560 sysnldcvmr.exe 107 PID 560 wrote to memory of 1540 560 sysnldcvmr.exe 107 PID 560 wrote to memory of 1540 560 sysnldcvmr.exe 107 PID 560 wrote to memory of 3748 560 sysnldcvmr.exe 109 PID 560 wrote to memory of 3748 560 sysnldcvmr.exe 109 PID 560 wrote to memory of 3748 560 sysnldcvmr.exe 109 PID 3748 wrote to memory of 900 3748 2615931573.exe 111 PID 3748 wrote to memory of 900 3748 2615931573.exe 111 PID 1980 wrote to memory of 5080 1980 winupsecvmgr.exe 120 PID 1980 wrote to memory of 4876 1980 winupsecvmgr.exe 121 PID 4476 wrote to memory of 1224 4476 Downloader.exe 124 PID 4476 wrote to memory of 1224 4476 Downloader.exe 124 PID 4476 wrote to memory of 1224 4476 Downloader.exe 124 PID 1224 wrote to memory of 3684 1224 BB8B.exe 125 PID 1224 wrote to memory of 3684 1224 BB8B.exe 125 PID 1224 wrote to memory of 3684 1224 BB8B.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\Downloader.exe"C:\Users\Admin\AppData\Local\Temp\Downloader.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\9D1B.exe"C:\Users\Admin\AppData\Local\Temp\9D1B.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\176766182.exeC:\Users\Admin\AppData\Local\Temp\176766182.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2224221839.exeC:\Users\Admin\AppData\Local\Temp\2224221839.exe6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵PID:2532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵PID:2012
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1185310144.exeC:\Users\Admin\AppData\Local\Temp\1185310144.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1540
-
-
C:\Users\Admin\AppData\Local\Temp\2615931573.exeC:\Users\Admin\AppData\Local\Temp\2615931573.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Users\Admin\AppData\Local\Temp\1004721785.exeC:\Users\Admin\AppData\Local\Temp\1004721785.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:900
-
-
-
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3320
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:3996
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4284
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:5080
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4876
-
-
C:\Users\Admin\Desktop\Downloader.exe"C:\Users\Admin\Desktop\Downloader.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\BB8B.exe"C:\Users\Admin\AppData\Local\Temp\BB8B.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\495814481.exeC:\Users\Admin\AppData\Local\Temp\495814481.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3684
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1928
-
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5beddacb1b8cdf9b2701ec9ba52fc7a57
SHA142fc5858911200e8615ce0c223d19a3521468773
SHA256839ab90ed4c452c99e6610f0bdc0be6290475e34407e5d3fa9c5fb38b6eeaf0e
SHA512b738727610cccc12e4271974d7cf95cfaf143bc4010e3e3a90fe31ae922630821d46dad255a3ba7044c45cefaca3cb40696a46d55be0e5b3cc0b58cb5abfc04a
-
Filesize
108KB
MD51fcb78fb6cf9720e9d9494c42142d885
SHA1fef9c2e728ab9d56ce9ed28934b3182b6f1d5379
SHA25684652bb8c63ca4fd7eb7a2d6ef44029801f3057aa2961867245a3a765928dd02
SHA512cdf58e463af1784aea86995b3e5d6b07701c5c4095e30ec80cc901ffd448c6f4f714c521bf8796ffa8c47538bf8bf5351e157596efaa7ab88155d63dc33f7dc3
-
Filesize
1KB
MD50572dcb97ad2dcefce1c4843a3d1678a
SHA1ead93679bb3c1e2b40f8e0eacadd100e19edd412
SHA256053d89dbed84cc70a6103bc4ab4a575d41f32bb5fc4e243bbf5f052ff688ca85
SHA512d8f4dc26a4866f4c6327108701e91c7460eba2a7e834aac1a0a1e808fae5fa11addce62f85799b3c1a62e055593f606c5163b05dfa82222c00dfee55da7e998d
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
49KB
MD56946486673f91392724e944be9ca9249
SHA1e74009983ced1fa683cda30b52ae889bc2ca6395
SHA256885fbe678b117e5e0eace7c64980f6072c31290eb36d0e14953d6a2d12eff9cd
SHA512e3241f85def0efefd36b3ffb6722ab025e8523082e4cf3e7f35ff86a9a452b5a50454c3b9530dfdad3929f74a6e42bf2a2cf35e404af588f778e0579345b38c9
-
Filesize
79KB
MD50c883b1d66afce606d9830f48d69d74b
SHA1fe431fe73a4749722496f19b3b3ca0b629b50131
SHA256d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
SHA512c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
-
Filesize
8KB
MD5cb8420e681f68db1bad5ed24e7b22114
SHA1416fc65d538d3622f5ca71c667a11df88a927c31
SHA2565850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea
SHA512baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf
-
Filesize
10KB
MD596509ab828867d81c1693b614b22f41d
SHA1c5f82005dbda43cedd86708cc5fc3635a781a67e
SHA256a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
SHA512ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
-
Filesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82