colibri | 148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1

Resubmissions

29-11-2022 17:05

221129-vlxj6sbg5v 10

20-10-2022 23:30

221020-3g7hksbbgl 10

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
Size

2.0MB
MD5

443880cbb37d23e8c3846e0b3c7f7358
SHA1

0824425675beced43463ee3943f745f4dd4f9110
SHA256

148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1
SHA512

5ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766
SSDEEP

24576:CNhI4oUnscbH/4IhUaTkO4yMFBSPQh6PTntnjjgRGVDkkahscbqk9zDRXq6LYsU/:MXHw+UBT6Ld/9Ss8DxxL7dEMZ

Score

10^/10

colibri build1 loader spyware stealer

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Signatures

Colibri Loader
A loader sold as MaaS first seen in August 2021.
loader colibri

Process spawned unexpected child process 9 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3508	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4048	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2600	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2840	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2848	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5036	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2368	4412	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1292	4412	schtasks.exe

Executes dropped EXE 5 IoCs

Processes:

tmpC1DE.tmp.exetmpC1DE.tmp.exeupfc.exetmpDECC.tmp.exetmpDECC.tmp.exe

pid process

516 tmpC1DE.tmp.exe
3380 tmpC1DE.tmp.exe
4704 upfc.exe
1016 tmpDECC.tmp.exe
2600 tmpDECC.tmp.exe

pid	process
516	tmpC1DE.tmp.exe
3380	tmpC1DE.tmp.exe
4704	upfc.exe
1016	tmpDECC.tmp.exe
2600	tmpDECC.tmp.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

upfc.exe148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	upfc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

19 ipinfo.io
20 ipinfo.io

flow	ioc
19	ipinfo.io
20	ipinfo.io

Suspicious use of SetThreadContext 2 IoCs

Processes:

tmpC1DE.tmp.exetmpDECC.tmp.exe

description	pid	process	target process
PID 516 set thread context of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 1016 set thread context of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe

Drops file in Windows directory 2 IoCs

Processes:

148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe

description	ioc	process
File created	C:\Windows\Performance\WinSAT\DataStore\upfc.exe	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
File created	C:\Windows\Performance\WinSAT\DataStore\ea1d8f6d871115	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
2600	schtasks.exe
864	schtasks.exe
5036	schtasks.exe
2368	schtasks.exe
3508	schtasks.exe
4048	schtasks.exe
2840	schtasks.exe
2848	schtasks.exe
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid	process
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
2224	powershell.exe
2224	powershell.exe
4656	powershell.exe
4656	powershell.exe
1144	powershell.exe
1144	powershell.exe
1344	powershell.exe
1344	powershell.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
1844	powershell.exe
1844	powershell.exe
3312	powershell.exe
3312	powershell.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
2224	powershell.exe
2224	powershell.exe
4772	powershell.exe
4772	powershell.exe
2180	powershell.exe
2180	powershell.exe
404	powershell.exe
404	powershell.exe
4164	powershell.exe
4164	powershell.exe
1144	powershell.exe
1144	powershell.exe
4656	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

upfc.exe

pid process

4704 upfc.exe

pid	process
4704	upfc.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

Processes:

description	pid	process
Token: SeDebugPrivilege	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
Token: SeDebugPrivilege	2224	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	1144	powershell.exe
Token: SeDebugPrivilege	1344	powershell.exe
Token: SeDebugPrivilege	1844	powershell.exe
Token: SeDebugPrivilege	4772	powershell.exe
Token: SeDebugPrivilege	2180	powershell.exe
Token: SeDebugPrivilege	3312	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	4164	powershell.exe
Token: SeDebugPrivilege	2520	powershell.exe
Token: SeDebugPrivilege	4232	powershell.exe
Token: SeDebugPrivilege	4704	upfc.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exetmpC1DE.tmp.exeupfc.exetmpDECC.tmp.exe

description	pid	process	target process
PID 4316 wrote to memory of 516	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	tmpC1DE.tmp.exe
PID 4316 wrote to memory of 516	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	tmpC1DE.tmp.exe
PID 4316 wrote to memory of 516	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 516 wrote to memory of 3380	516	tmpC1DE.tmp.exe	tmpC1DE.tmp.exe
PID 4316 wrote to memory of 4656	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4656	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 2224	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 2224	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 1144	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 1144	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 1344	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 1344	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 1844	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 1844	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 3312	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 3312	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4772	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4772	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 2180	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 2180	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 404	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 404	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 2520	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 2520	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4232	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4232	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4164	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4164	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	powershell.exe
PID 4316 wrote to memory of 4704	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	upfc.exe
PID 4316 wrote to memory of 4704	4316	148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe	upfc.exe
PID 4704 wrote to memory of 1016	4704	upfc.exe	tmpDECC.tmp.exe
PID 4704 wrote to memory of 1016	4704	upfc.exe	tmpDECC.tmp.exe
PID 4704 wrote to memory of 1016	4704	upfc.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe
PID 1016 wrote to memory of 2600	1016	tmpDECC.tmp.exe	tmpDECC.tmp.exe

C:\Users\Admin\AppData\Local\Temp\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe
"C:\Users\Admin\AppData\Local\Temp\148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316

C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:516

C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe"
3⤵
- Executes dropped EXE
PID:3380

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4772

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4232

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4164

C:\Windows\Performance\WinSAT\DataStore\upfc.exe
"C:\Windows\Performance\WinSAT\DataStore\upfc.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704

C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016

C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe"
4⤵
- Executes dropped EXE
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4048

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2600

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:864

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\odt\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2848

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 8 /tr "'C:\Windows\Performance\WinSAT\DataStore\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Windows\Performance\WinSAT\DataStore\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Windows\Performance\WinSAT\DataStore\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1292

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
e243a38635ff9a06c87c2a61a2200656

SHA1
ecd95ed5bf1a9fbe96a8448fc2814a0210fa2afc

SHA256
af5782703f3f2d5a29fb313dae6680a64134db26064d4a321a3f23b75f6ca00f

SHA512
4418957a1b10eee44cf270c81816ae707352411c4f5ac14b6b61ab537c91480e24e0a0a2c276a6291081b4984c123cf673a45dcedb0ceeef682054ba0fc19cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
3a6bad9528f8e23fb5c77fbd81fa28e8

SHA1
f127317c3bc6407f536c0f0600dcbcf1aabfba36

SHA256
986366767de5873f1b170a63f2a33ce05132d1afd90c8f5017afbca8ef1beb05

SHA512
846002154a0ece6f3e9feda6f115d3161dc21b3789525dd62ae1d9188495171293efdbe7be4710666dd8a15e66b557315b5a02918a741ed1d5f3ff0c515b98e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
aaaac7c68d2b7997ed502c26fd9f65c2

SHA1
7c5a3731300d672bf53c43e2f9e951c745f7fbdf

SHA256
8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb

SHA512
c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
17fbfbe3f04595e251287a6bfcdc35de

SHA1
b576aabfd5e6d5799d487011506ed1ae70688987

SHA256
2e61ae727ca01496c9418a65777d6d7e05a85cbdb6b3a19516857442e5bd2da0

SHA512
449c68512d90a17f598e9dacfd6230e6e97bc6bfaaf2b06f3b91b370ece92e2322b81ee3721e288880fa1f05470156e519256e3f03d786c3b28a39788f5e0ad6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
5f0ddc7f3691c81ee14d17b419ba220d

SHA1
f0ef5fde8bab9d17c0b47137e014c91be888ee53

SHA256
a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5

SHA512
2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe
Filesize
52KB

MD5
d8e1495b46cded57eb1423b8bb789834

SHA1
db64bc20550e51c602dbb92d07c8f02842efebcc

SHA256
aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

SHA512
8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe
Filesize
52KB

MD5
d8e1495b46cded57eb1423b8bb789834

SHA1
db64bc20550e51c602dbb92d07c8f02842efebcc

SHA256
aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

SHA512
8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpC1DE.tmp.exe
Filesize
52KB

MD5
d8e1495b46cded57eb1423b8bb789834

SHA1
db64bc20550e51c602dbb92d07c8f02842efebcc

SHA256
aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

SHA512
8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe
Filesize
52KB

MD5
d8e1495b46cded57eb1423b8bb789834

SHA1
db64bc20550e51c602dbb92d07c8f02842efebcc

SHA256
aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

SHA512
8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe
Filesize
52KB

MD5
d8e1495b46cded57eb1423b8bb789834

SHA1
db64bc20550e51c602dbb92d07c8f02842efebcc

SHA256
aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

SHA512
8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpDECC.tmp.exe
Filesize
52KB

MD5
d8e1495b46cded57eb1423b8bb789834

SHA1
db64bc20550e51c602dbb92d07c8f02842efebcc

SHA256
aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

SHA512
8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

Download Submit
C:\Windows\Performance\WinSAT\DataStore\upfc.exe
Filesize
2.0MB

MD5
443880cbb37d23e8c3846e0b3c7f7358

SHA1
0824425675beced43463ee3943f745f4dd4f9110

SHA256
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1

SHA512
5ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766

Download Submit
C:\Windows\Performance\WinSAT\DataStore\upfc.exe
Filesize
2.0MB

MD5
443880cbb37d23e8c3846e0b3c7f7358

SHA1
0824425675beced43463ee3943f745f4dd4f9110

SHA256
148d9ed52b15aa29e6a5d501cd575bd119039ffc2051b7ef47b33bce13dc8ec1

SHA512
5ca14e9a0ab251e30deb47383f20f8d288e34086bbf2e75438e6907e31e9128a49373dba29cedaef95e5cb228efdd69b39a4e14ef761b7d95dabd3b33ad0c766

Download Submit
memory/404-152-0x0000000000000000-mapping.dmp

Download
memory/404-198-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/404-169-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/516-134-0x0000000000000000-mapping.dmp

Download
memory/516-139-0x0000000000B50000-0x0000000000C50000-memory.dmp

Filesize
1024KB

Download
memory/1016-172-0x0000000000000000-mapping.dmp

Download
memory/1144-146-0x0000000000000000-mapping.dmp

Download
memory/1144-185-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/1144-159-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/1344-147-0x0000000000000000-mapping.dmp

Download
memory/1344-189-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/1344-160-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/1844-148-0x0000000000000000-mapping.dmp

Download
memory/1844-161-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/1844-196-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2180-200-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2180-167-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2180-151-0x0000000000000000-mapping.dmp

Download
memory/2224-158-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2224-145-0x0000000000000000-mapping.dmp

Download
memory/2224-184-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2224-156-0x000001C950B70000-0x000001C950B92000-memory.dmp

Filesize
136KB

Download
memory/2520-153-0x0000000000000000-mapping.dmp

Download
memory/2520-178-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2520-202-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/2600-176-0x0000000000000000-mapping.dmp

Download
memory/3312-164-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/3312-193-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/3312-149-0x0000000000000000-mapping.dmp

Download
memory/3380-143-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3380-140-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3380-138-0x0000000000000000-mapping.dmp

Download
memory/4164-155-0x0000000000000000-mapping.dmp

Download
memory/4164-171-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4164-180-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4232-154-0x0000000000000000-mapping.dmp

Download
memory/4232-175-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4232-203-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4316-168-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4316-142-0x000000001C410000-0x000000001C460000-memory.dmp

Filesize
320KB

Download
memory/4316-132-0x0000000000510000-0x0000000000714000-memory.dmp

Filesize
2.0MB

Download
memory/4316-133-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4656-187-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4656-144-0x0000000000000000-mapping.dmp

Download
memory/4656-157-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4704-204-0x000000001E400000-0x000000001E5C2000-memory.dmp

Filesize
1.8MB

Download
memory/4704-206-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4704-170-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4704-205-0x000000001F6A0000-0x000000001FBC8000-memory.dmp

Filesize
5.2MB

Download
memory/4704-163-0x0000000000000000-mapping.dmp

Download
memory/4772-162-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4772-191-0x00007FF8F8BA0000-0x00007FF8F9661000-memory.dmp

Filesize
10.8MB

Download
memory/4772-150-0x0000000000000000-mapping.dmp

Download