Resubmissions
10-07-2023 09:55
230710-lxskxsaf4t 1031-05-2023 16:56
230531-vfmssagf4z 1031-05-2023 16:50
230531-vcdeyagb66 1031-05-2023 16:49
230531-vbs41age81 1031-05-2023 16:49
230531-vbraeage8z 1005-05-2023 05:31
230505-f72npage67 1005-05-2023 05:31
230505-f7zjbsad9z 1005-05-2023 05:31
230505-f7wgnsge66 1005-05-2023 05:30
230505-f7keeage64 1004-05-2023 10:10
230504-l7mgnabe89 10Analysis
-
max time kernel
75s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-05-2023 16:50
Static task
static1
Behavioral task
behavioral1
Sample
qM5GMXBk6hJE6Y5e.exe
Resource
win7-20230220-en
General
-
Target
qM5GMXBk6hJE6Y5e.exe
-
Size
2.0MB
-
MD5
a16a669a09bf158058b83e04e69fe38e
-
SHA1
f6c94763850d9e590d86057139e8895a7aacdeea
-
SHA256
cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
-
SHA512
658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
SSDEEP
49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
Processes:
qM5GMXBk6hJE6Y5e.exeupdater.execonhost.exedescription pid process target process PID 4108 created 3112 4108 qM5GMXBk6hJE6Y5e.exe Explorer.EXE PID 4108 created 3112 4108 qM5GMXBk6hJE6Y5e.exe Explorer.EXE PID 1596 created 3112 1596 updater.exe Explorer.EXE PID 1596 created 3112 1596 updater.exe Explorer.EXE PID 1596 created 3112 1596 updater.exe Explorer.EXE PID 3248 created 3112 3248 conhost.exe Explorer.EXE PID 1596 created 3112 1596 updater.exe Explorer.EXE -
XMRig Miner payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1452-246-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp xmrig behavioral2/memory/1452-251-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp xmrig behavioral2/memory/1452-252-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp xmrig behavioral2/memory/1452-256-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp xmrig behavioral2/memory/1452-260-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1596 updater.exe -
Processes:
resource yara_rule behavioral2/memory/1452-246-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp upx behavioral2/memory/1452-251-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp upx behavioral2/memory/1452-252-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp upx behavioral2/memory/1452-256-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp upx behavioral2/memory/1452-260-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 1596 set thread context of 3248 1596 updater.exe conhost.exe PID 1596 set thread context of 1452 1596 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
qM5GMXBk6hJE6Y5e.exeupdater.execmd.execmd.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe qM5GMXBk6hJE6Y5e.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
qM5GMXBk6hJE6Y5e.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.exepid process 4108 qM5GMXBk6hJE6Y5e.exe 4108 qM5GMXBk6hJE6Y5e.exe 2164 powershell.exe 2164 powershell.exe 4108 qM5GMXBk6hJE6Y5e.exe 4108 qM5GMXBk6hJE6Y5e.exe 2748 powershell.exe 2748 powershell.exe 4108 qM5GMXBk6hJE6Y5e.exe 4108 qM5GMXBk6hJE6Y5e.exe 4108 qM5GMXBk6hJE6Y5e.exe 4108 qM5GMXBk6hJE6Y5e.exe 2324 powershell.exe 2324 powershell.exe 1596 updater.exe 1596 updater.exe 2256 powershell.exe 2256 powershell.exe 1596 updater.exe 1596 updater.exe 1784 powershell.exe 1784 powershell.exe 1596 updater.exe 1596 updater.exe 1596 updater.exe 1596 updater.exe 3248 conhost.exe 3248 conhost.exe 1596 updater.exe 1596 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 664 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2164 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeIncreaseQuotaPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 2748 powershell.exe Token: SeTakeOwnershipPrivilege 2748 powershell.exe Token: SeLoadDriverPrivilege 2748 powershell.exe Token: SeSystemProfilePrivilege 2748 powershell.exe Token: SeSystemtimePrivilege 2748 powershell.exe Token: SeProfSingleProcessPrivilege 2748 powershell.exe Token: SeIncBasePriorityPrivilege 2748 powershell.exe Token: SeCreatePagefilePrivilege 2748 powershell.exe Token: SeBackupPrivilege 2748 powershell.exe Token: SeRestorePrivilege 2748 powershell.exe Token: SeShutdownPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSystemEnvironmentPrivilege 2748 powershell.exe Token: SeRemoteShutdownPrivilege 2748 powershell.exe Token: SeUndockPrivilege 2748 powershell.exe Token: SeManageVolumePrivilege 2748 powershell.exe Token: 33 2748 powershell.exe Token: 34 2748 powershell.exe Token: 35 2748 powershell.exe Token: 36 2748 powershell.exe Token: SeIncreaseQuotaPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 2748 powershell.exe Token: SeTakeOwnershipPrivilege 2748 powershell.exe Token: SeLoadDriverPrivilege 2748 powershell.exe Token: SeSystemProfilePrivilege 2748 powershell.exe Token: SeSystemtimePrivilege 2748 powershell.exe Token: SeProfSingleProcessPrivilege 2748 powershell.exe Token: SeIncBasePriorityPrivilege 2748 powershell.exe Token: SeCreatePagefilePrivilege 2748 powershell.exe Token: SeBackupPrivilege 2748 powershell.exe Token: SeRestorePrivilege 2748 powershell.exe Token: SeShutdownPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSystemEnvironmentPrivilege 2748 powershell.exe Token: SeRemoteShutdownPrivilege 2748 powershell.exe Token: SeUndockPrivilege 2748 powershell.exe Token: SeManageVolumePrivilege 2748 powershell.exe Token: 33 2748 powershell.exe Token: 34 2748 powershell.exe Token: 35 2748 powershell.exe Token: 36 2748 powershell.exe Token: SeIncreaseQuotaPrivilege 2748 powershell.exe Token: SeSecurityPrivilege 2748 powershell.exe Token: SeTakeOwnershipPrivilege 2748 powershell.exe Token: SeLoadDriverPrivilege 2748 powershell.exe Token: SeSystemProfilePrivilege 2748 powershell.exe Token: SeSystemtimePrivilege 2748 powershell.exe Token: SeProfSingleProcessPrivilege 2748 powershell.exe Token: SeIncBasePriorityPrivilege 2748 powershell.exe Token: SeCreatePagefilePrivilege 2748 powershell.exe Token: SeBackupPrivilege 2748 powershell.exe Token: SeRestorePrivilege 2748 powershell.exe Token: SeShutdownPrivilege 2748 powershell.exe Token: SeDebugPrivilege 2748 powershell.exe Token: SeSystemEnvironmentPrivilege 2748 powershell.exe Token: SeRemoteShutdownPrivilege 2748 powershell.exe Token: SeUndockPrivilege 2748 powershell.exe Token: SeManageVolumePrivilege 2748 powershell.exe Token: 33 2748 powershell.exe Token: 34 2748 powershell.exe Token: 35 2748 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cmd.exepowershell.exeupdater.execmd.exedescription pid process target process PID 3820 wrote to memory of 1820 3820 cmd.exe choice.exe PID 3820 wrote to memory of 1820 3820 cmd.exe choice.exe PID 2324 wrote to memory of 2284 2324 powershell.exe schtasks.exe PID 2324 wrote to memory of 2284 2324 powershell.exe schtasks.exe PID 1596 wrote to memory of 3248 1596 updater.exe conhost.exe PID 3712 wrote to memory of 1508 3712 cmd.exe WMIC.exe PID 3712 wrote to memory of 1508 3712 cmd.exe WMIC.exe PID 1596 wrote to memory of 1452 1596 updater.exe conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e.exe"C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe qtdiqnkejoz2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz2⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.0MB
MD5a16a669a09bf158058b83e04e69fe38e
SHA1f6c94763850d9e590d86057139e8895a7aacdeea
SHA256cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
SHA512658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.0MB
MD5a16a669a09bf158058b83e04e69fe38e
SHA1f6c94763850d9e590d86057139e8895a7aacdeea
SHA256cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
SHA512658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5d28a889fd956d5cb3accfbaf1143eb6f
SHA1157ba54b365341f8ff06707d996b3635da8446f7
SHA25621e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA5120b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD55b9df3d6dc4d4aa11c7bc0096d2d0c05
SHA1f958f6d755b031d35d8016ee8a14bd9e27c5fb1b
SHA2561bfbb738c61d84240148ae6c033a59337263bdf6ff4bbdcd8f3d8dffd249d142
SHA5125795039542bf784eaa2d6937df510c8cff35122187a65cd82db90c816098632310139e37afce465fa67c9aee2195e76c889e704fc14a601bf2b3f544535e8d73
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_telzopkt.qtu.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/1452-244-0x000001A6B6370000-0x000001A6B6390000-memory.dmpFilesize
128KB
-
memory/1452-260-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmpFilesize
8.0MB
-
memory/1452-256-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmpFilesize
8.0MB
-
memory/1452-258-0x000001A6B6AD0000-0x000001A6B6AF0000-memory.dmpFilesize
128KB
-
memory/1452-254-0x000001A6B6AD0000-0x000001A6B6AF0000-memory.dmpFilesize
128KB
-
memory/1452-253-0x000001A6B6AB0000-0x000001A6B6AD0000-memory.dmpFilesize
128KB
-
memory/1452-252-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmpFilesize
8.0MB
-
memory/1452-246-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmpFilesize
8.0MB
-
memory/1452-257-0x000001A6B6AB0000-0x000001A6B6AD0000-memory.dmpFilesize
128KB
-
memory/1452-251-0x00007FF6EBCC0000-0x00007FF6EC4B4000-memory.dmpFilesize
8.0MB
-
memory/1452-249-0x000001A6B64B0000-0x000001A6B64F0000-memory.dmpFilesize
256KB
-
memory/1596-181-0x00007FF7166F0000-0x00007FF716901000-memory.dmpFilesize
2.1MB
-
memory/1596-243-0x00007FF7166F0000-0x00007FF716901000-memory.dmpFilesize
2.1MB
-
memory/1596-220-0x00007FF7166F0000-0x00007FF716901000-memory.dmpFilesize
2.1MB
-
memory/1784-238-0x00000254FAE10000-0x00000254FAE20000-memory.dmpFilesize
64KB
-
memory/1784-237-0x00007FF4A8AC0000-0x00007FF4A8AD0000-memory.dmpFilesize
64KB
-
memory/1784-225-0x00000254FAE10000-0x00000254FAE20000-memory.dmpFilesize
64KB
-
memory/1784-226-0x00000254FAE10000-0x00000254FAE20000-memory.dmpFilesize
64KB
-
memory/2164-134-0x000001FB34990000-0x000001FB349B2000-memory.dmpFilesize
136KB
-
memory/2164-144-0x000001FB32910000-0x000001FB32920000-memory.dmpFilesize
64KB
-
memory/2164-145-0x000001FB32910000-0x000001FB32920000-memory.dmpFilesize
64KB
-
memory/2164-146-0x000001FB32910000-0x000001FB32920000-memory.dmpFilesize
64KB
-
memory/2256-208-0x000001961C220000-0x000001961C23A000-memory.dmpFilesize
104KB
-
memory/2256-192-0x0000019601450000-0x0000019601460000-memory.dmpFilesize
64KB
-
memory/2256-210-0x000001961C200000-0x000001961C206000-memory.dmpFilesize
24KB
-
memory/2256-209-0x000001961C1D0000-0x000001961C1D8000-memory.dmpFilesize
32KB
-
memory/2256-191-0x0000019601450000-0x0000019601460000-memory.dmpFilesize
64KB
-
memory/2256-207-0x000001961C1C0000-0x000001961C1CA000-memory.dmpFilesize
40KB
-
memory/2256-206-0x00007FF4826E0000-0x00007FF4826F0000-memory.dmpFilesize
64KB
-
memory/2256-205-0x000001961C1E0000-0x000001961C1FC000-memory.dmpFilesize
112KB
-
memory/2256-204-0x000001961C070000-0x000001961C07A000-memory.dmpFilesize
40KB
-
memory/2256-203-0x000001961BF90000-0x000001961BFAC000-memory.dmpFilesize
112KB
-
memory/2256-193-0x0000019601450000-0x0000019601460000-memory.dmpFilesize
64KB
-
memory/2256-211-0x000001961C210000-0x000001961C21A000-memory.dmpFilesize
40KB
-
memory/2324-178-0x000002A2B1DD0000-0x000002A2B1DE0000-memory.dmpFilesize
64KB
-
memory/2324-177-0x000002A2B1DD0000-0x000002A2B1DE0000-memory.dmpFilesize
64KB
-
memory/2324-176-0x000002A2B1DD0000-0x000002A2B1DE0000-memory.dmpFilesize
64KB
-
memory/2748-160-0x000001604E910000-0x000001604E920000-memory.dmpFilesize
64KB
-
memory/2748-162-0x000001604E910000-0x000001604E920000-memory.dmpFilesize
64KB
-
memory/2748-161-0x000001604E910000-0x000001604E920000-memory.dmpFilesize
64KB
-
memory/3248-250-0x00007FF6E5320000-0x00007FF6E5336000-memory.dmpFilesize
88KB
-
memory/3248-259-0x00007FF6E5320000-0x00007FF6E5336000-memory.dmpFilesize
88KB
-
memory/4108-133-0x00007FF7EA810000-0x00007FF7EAA21000-memory.dmpFilesize
2.1MB
-
memory/4108-165-0x00007FF7EA810000-0x00007FF7EAA21000-memory.dmpFilesize
2.1MB