735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
04/07/2023, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SilentCryptoMinerBuildere.exe
Size

56.8MB
MD5

dcb5e65801d361ef8fb5efb9b79f0534
SHA1

0195c586e891616affde2e51d994fcee8df9bbba
SHA256

735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a
SHA512

9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31
SSDEEP

393216:z8u1qXD+Ao41+ARiG+V9s/qCbliCtKQyyh9fB5jGbA1MZlNHgX43PEtSRjf/MfRS:z2+ktih9syYlVtKFK+51E43Mkjf/IR

Score

10^/10

evasion persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs

description	pid	Process	procid_target
PID 3064 created 1228	3064	SilentCryptoMinerBuildere.exe	5
PID 3064 created 1228	3064	SilentCryptoMinerBuildere.exe	5
PID 3064 created 1228	3064	SilentCryptoMinerBuildere.exe	5
PID 3064 created 1228	3064	SilentCryptoMinerBuildere.exe	5
PID 3064 created 1228	3064	SilentCryptoMinerBuildere.exe	5
PID 2964 created 1228	2964	updater.exe	5
PID 2964 created 1228	2964	updater.exe	5
PID 2964 created 1228	2964	updater.exe	5
PID 2964 created 1228	2964	updater.exe	5
PID 2964 created 1228	2964	updater.exe	5

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinRing0_1_2_0\ImagePath = "\\??\\C:\\Program Files\\Google\\Libs\\WR64.sys"	services.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
2964	updater.exe

Loads dropped DLL 1 IoCs

pid	Process
2408	taskeng.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx	svchost.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File created	C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC	svchost.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3064 set thread context of 1032	3064	SilentCryptoMinerBuildere.exe	38
PID 2964 set thread context of 2988	2964	updater.exe	55
PID 2964 set thread context of 2840	2964	updater.exe	59

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	SilentCryptoMinerBuildere.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2980	sc.exe
3036	sc.exe
540	sc.exe
1372	sc.exe
1620	sc.exe
980	sc.exe
2432	sc.exe
1288	sc.exe
2372	sc.exe
2224	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2668	schtasks.exe
2440	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 508f74c97baed901	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
2388	powershell.exe
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
2260	powershell.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
3064	SilentCryptoMinerBuildere.exe
3064	SilentCryptoMinerBuildere.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe
1032	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1228	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	services.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	1032	dialer.exe
Token: SeDebugPrivilege	2260	powershell.exe
Token: SeAuditPrivilege	856	svchost.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	2988	dialer.exe
Token: SeAuditPrivilege	856	svchost.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeLockMemoryPrivilege	2840	dialer.exe
Token: SeLoadDriverPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeAssignPrimaryTokenPrivilege	856	svchost.exe
Token: SeIncreaseQuotaPrivilege	856	svchost.exe
Token: SeSecurityPrivilege	856	svchost.exe
Token: SeTakeOwnershipPrivilege	856	svchost.exe
Token: SeLoadDriverPrivilege	856	svchost.exe
Token: SeSystemtimePrivilege	856	svchost.exe
Token: SeBackupPrivilege	856	svchost.exe
Token: SeRestorePrivilege	856	svchost.exe
Token: SeShutdownPrivilege	856	svchost.exe
Token: SeSystemEnvironmentPrivilege	856	svchost.exe
Token: SeUndockPrivilege	856	svchost.exe
Token: SeManageVolumePrivilege	856	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	856	svchost.exe
Token: SeIncreaseQuotaPrivilege	856	svchost.exe
Token: SeSecurityPrivilege	856	svchost.exe
Token: SeTakeOwnershipPrivilege	856	svchost.exe
Token: SeLoadDriverPrivilege	856	svchost.exe
Token: SeSystemtimePrivilege	856	svchost.exe
Token: SeBackupPrivilege	856	svchost.exe
Token: SeRestorePrivilege	856	svchost.exe
Token: SeShutdownPrivilege	856	svchost.exe
Token: SeSystemEnvironmentPrivilege	856	svchost.exe
Token: SeUndockPrivilege	856	svchost.exe
Token: SeManageVolumePrivilege	856	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	856	svchost.exe
Token: SeIncreaseQuotaPrivilege	856	svchost.exe
Token: SeSecurityPrivilege	856	svchost.exe
Token: SeTakeOwnershipPrivilege	856	svchost.exe
Token: SeLoadDriverPrivilege	856	svchost.exe
Token: SeSystemtimePrivilege	856	svchost.exe
Token: SeBackupPrivilege	856	svchost.exe
Token: SeRestorePrivilege	856	svchost.exe
Token: SeShutdownPrivilege	856	svchost.exe
Token: SeSystemEnvironmentPrivilege	856	svchost.exe
Token: SeUndockPrivilege	856	svchost.exe
Token: SeManageVolumePrivilege	856	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	856	svchost.exe
Token: SeIncreaseQuotaPrivilege	856	svchost.exe
Token: SeSecurityPrivilege	856	svchost.exe
Token: SeTakeOwnershipPrivilege	856	svchost.exe
Token: SeLoadDriverPrivilege	856	svchost.exe
Token: SeSystemtimePrivilege	856	svchost.exe
Token: SeBackupPrivilege	856	svchost.exe
Token: SeRestorePrivilege	856	svchost.exe
Token: SeShutdownPrivilege	856	svchost.exe
Token: SeSystemEnvironmentPrivilege	856	svchost.exe
Token: SeUndockPrivilege	856	svchost.exe
Token: SeManageVolumePrivilege	856	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	856	svchost.exe
Token: SeIncreaseQuotaPrivilege	856	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2980	1612	cmd.exe	33
PID 1612 wrote to memory of 2980	1612	cmd.exe	33
PID 1612 wrote to memory of 2980	1612	cmd.exe	33
PID 1612 wrote to memory of 3036	1612	cmd.exe	34
PID 1612 wrote to memory of 3036	1612	cmd.exe	34
PID 1612 wrote to memory of 3036	1612	cmd.exe	34
PID 1612 wrote to memory of 980	1612	cmd.exe	35
PID 1612 wrote to memory of 980	1612	cmd.exe	35
PID 1612 wrote to memory of 980	1612	cmd.exe	35
PID 1612 wrote to memory of 540	1612	cmd.exe	36
PID 1612 wrote to memory of 540	1612	cmd.exe	36
PID 1612 wrote to memory of 540	1612	cmd.exe	36
PID 1612 wrote to memory of 2432	1612	cmd.exe	37
PID 1612 wrote to memory of 2432	1612	cmd.exe	37
PID 1612 wrote to memory of 2432	1612	cmd.exe	37
PID 3064 wrote to memory of 1032	3064	SilentCryptoMinerBuildere.exe	38
PID 1032 wrote to memory of 420	1032	dialer.exe	3
PID 1032 wrote to memory of 464	1032	dialer.exe	2
PID 1032 wrote to memory of 480	1032	dialer.exe	1
PID 1032 wrote to memory of 488	1032	dialer.exe	23
PID 1032 wrote to memory of 604	1032	dialer.exe	22
PID 1032 wrote to memory of 684	1032	dialer.exe	4
PID 1032 wrote to memory of 772	1032	dialer.exe	21
PID 1032 wrote to memory of 812	1032	dialer.exe	20
PID 2260 wrote to memory of 2668	2260	powershell.exe	41
PID 2260 wrote to memory of 2668	2260	powershell.exe	41
PID 2260 wrote to memory of 2668	2260	powershell.exe	41
PID 1032 wrote to memory of 856	1032	dialer.exe	19
PID 1032 wrote to memory of 968	1032	dialer.exe	18
PID 1032 wrote to memory of 296	1032	dialer.exe	17
PID 1032 wrote to memory of 272	1032	dialer.exe	16
PID 1032 wrote to memory of 1096	1032	dialer.exe	15
PID 1032 wrote to memory of 1104	1032	dialer.exe	14
PID 1032 wrote to memory of 1180	1032	dialer.exe	13
PID 1032 wrote to memory of 1228	1032	dialer.exe	5
PID 1032 wrote to memory of 1848	1032	dialer.exe	11
PID 1032 wrote to memory of 1944	1032	dialer.exe	10
PID 1032 wrote to memory of 1060	1032	dialer.exe	9
PID 1032 wrote to memory of 568	1032	dialer.exe	7
PID 1032 wrote to memory of 3064	1032	dialer.exe	28
PID 1032 wrote to memory of 2828	1032	dialer.exe	42
PID 856 wrote to memory of 2408	856	svchost.exe	44
PID 856 wrote to memory of 2408	856	svchost.exe	44
PID 856 wrote to memory of 2408	856	svchost.exe	44
PID 1032 wrote to memory of 2408	1032	dialer.exe	44
PID 1032 wrote to memory of 2408	1032	dialer.exe	44
PID 2408 wrote to memory of 2964	2408	taskeng.exe	45
PID 2408 wrote to memory of 2964	2408	taskeng.exe	45
PID 2408 wrote to memory of 2964	2408	taskeng.exe	45
PID 1032 wrote to memory of 2964	1032	dialer.exe	45
PID 1032 wrote to memory of 2964	1032	dialer.exe	45
PID 1032 wrote to memory of 1536	1032	dialer.exe	46
PID 1032 wrote to memory of 2404	1032	dialer.exe	47
PID 2088 wrote to memory of 1288	2088	cmd.exe	50
PID 2088 wrote to memory of 1288	2088	cmd.exe	50
PID 2088 wrote to memory of 1288	2088	cmd.exe	50
PID 2088 wrote to memory of 1372	2088	cmd.exe	51
PID 2088 wrote to memory of 1372	2088	cmd.exe	51
PID 2088 wrote to memory of 1372	2088	cmd.exe	51
PID 2088 wrote to memory of 1620	2088	cmd.exe	52
PID 2088 wrote to memory of 1620	2088	cmd.exe	52
PID 2088 wrote to memory of 1620	2088	cmd.exe	52
PID 2088 wrote to memory of 2372	2088	cmd.exe	53
PID 2088 wrote to memory of 2372	2088	cmd.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:684
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1944
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1848
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1104
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1096
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:272
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:296
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:968
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:856
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {B9987AB1-4E36-4895-AF9B-5C6A70931B6D} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Program Files\Google\Chrome\updater.exe
      "C:\Program Files\Google\Chrome\updater.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      PID:2964
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:812
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  - Drops file in System32 directory
  PID:772
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:604
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    3⤵
    - Checks processor information in registry
    PID:2468

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1228
- C:\Users\Admin\AppData\Local\Temp\SilentCryptoMinerBuildere.exe
  "C:\Users\Admin\AppData\Local\Temp\SilentCryptoMinerBuildere.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2388
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2980
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3036
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:980
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:540
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2432
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ldnxz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2668
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1288
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1372
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1620
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2372
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2224
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ldnxz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2440
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:568

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1060

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1180

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "965643557-365124481032673789-1204734518-115432061813621025492116458310-1508248074"
1⤵
PID:2404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ebd54916348d6b2231dc62282fa5cf9f

SHA1
5b5fa542ae33a5b6eec2e9a8c78f617f1231edf4

SHA256
336fb6d45a1b75d87e5396ef5d544ded56c5db401633aa8f1983afa9d9d77233

SHA512
592140b717a33c63635388bd1ad8825393ad61056ba7d570550bec3d0c9ab0ced496992158d2f53fff5ab9eaf68c80aed65bef2d1b0e32c2163cdb0fc579636d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
ebd54916348d6b2231dc62282fa5cf9f

SHA1
5b5fa542ae33a5b6eec2e9a8c78f617f1231edf4

SHA256
336fb6d45a1b75d87e5396ef5d544ded56c5db401633aa8f1983afa9d9d77233

SHA512
592140b717a33c63635388bd1ad8825393ad61056ba7d570550bec3d0c9ab0ced496992158d2f53fff5ab9eaf68c80aed65bef2d1b0e32c2163cdb0fc579636d

Download Submit
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC

Filesize
3KB

MD5
3b62a3e9053bd12fc73eaebf98a684d5

SHA1
630442a180a214deb88fba6a4c4fc868f20c8644

SHA256
8f2a8fdc00470a099d00962163139594969b48fa2e51edec4c416aa119e51ed5

SHA512
a2cc78f9cf96a50373840ca5862ea050b6509965472c33bd71d4c89fd48bd6895e47f8734f8d0721e5ea83a9f5e7b479d15be51aae7e7b76d698a5712157586c

Download Submit
C:\Windows\System32\Tasks\GoogleUpdateTaskMachineQC

Filesize
3KB

MD5
3b62a3e9053bd12fc73eaebf98a684d5

SHA1
630442a180a214deb88fba6a4c4fc868f20c8644

SHA256
8f2a8fdc00470a099d00962163139594969b48fa2e51edec4c416aa119e51ed5

SHA512
a2cc78f9cf96a50373840ca5862ea050b6509965472c33bd71d4c89fd48bd6895e47f8734f8d0721e5ea83a9f5e7b479d15be51aae7e7b76d698a5712157586c

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
56.8MB

MD5
dcb5e65801d361ef8fb5efb9b79f0534

SHA1
0195c586e891616affde2e51d994fcee8df9bbba

SHA256
735b54259f82fed90763efd31cfb59d25da39ccf0e34c31c6025575109605b9a

SHA512
9233b64ee9a6df806b2f6ad48505eb387ec7c765695bb91adadfc2b3b6173601db80dfeafe7b841e35d67c27bf2588e915d788f25a4e07d8f98c494fede7bb31

Download Submit
memory/272-206-0x0000000001D00000-0x0000000001D27000-memory.dmp

Filesize
156KB

Download
memory/272-207-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/296-199-0x0000000000C10000-0x0000000000C37000-memory.dmp

Filesize
156KB

Download
memory/296-205-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/296-139-0x0000000000C10000-0x0000000000C37000-memory.dmp

Filesize
156KB

Download
memory/420-70-0x0000000000A10000-0x0000000000A37000-memory.dmp

Filesize
156KB

Download
memory/420-68-0x00000000009E0000-0x0000000000A01000-memory.dmp

Filesize
132KB

Download
memory/420-84-0x0000000000A10000-0x0000000000A37000-memory.dmp

Filesize
156KB

Download
memory/420-71-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/420-386-0x0000000000AF0000-0x0000000000B17000-memory.dmp

Filesize
156KB

Download
memory/420-69-0x00000000009E0000-0x0000000000A01000-memory.dmp

Filesize
132KB

Download
memory/420-72-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/464-96-0x0000000000150000-0x0000000000177000-memory.dmp

Filesize
156KB

Download
memory/464-87-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/464-388-0x0000000000610000-0x0000000000637000-memory.dmp

Filesize
156KB

Download
memory/464-86-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/464-77-0x0000000000150000-0x0000000000177000-memory.dmp

Filesize
156KB

Download
memory/480-103-0x0000000000150000-0x0000000000177000-memory.dmp

Filesize
156KB

Download
memory/480-91-0x0000000000150000-0x0000000000177000-memory.dmp

Filesize
156KB

Download
memory/488-108-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/488-101-0x00000000003E0000-0x0000000000407000-memory.dmp

Filesize
156KB

Download
memory/488-282-0x00000000003E0000-0x0000000000407000-memory.dmp

Filesize
156KB

Download
memory/488-104-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/488-106-0x00000000003E0000-0x0000000000407000-memory.dmp

Filesize
156KB

Download
memory/568-254-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/568-233-0x0000000002300000-0x0000000002327000-memory.dmp

Filesize
156KB

Download
memory/568-387-0x0000000001EA0000-0x0000000001EC7000-memory.dmp

Filesize
156KB

Download
memory/604-114-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/604-110-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/604-107-0x0000000000600000-0x0000000000627000-memory.dmp

Filesize
156KB

Download
memory/604-284-0x0000000000600000-0x0000000000627000-memory.dmp

Filesize
156KB

Download
memory/684-119-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/684-113-0x00000000002F0000-0x0000000000317000-memory.dmp

Filesize
156KB

Download
memory/684-116-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/684-174-0x00000000002F0000-0x0000000000317000-memory.dmp

Filesize
156KB

Download
memory/772-184-0x0000000000840000-0x0000000000867000-memory.dmp

Filesize
156KB

Download
memory/772-123-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/772-125-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/772-120-0x0000000000840000-0x0000000000867000-memory.dmp

Filesize
156KB

Download
memory/812-186-0x0000000000470000-0x0000000000497000-memory.dmp

Filesize
156KB

Download
memory/812-129-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/812-132-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/812-127-0x0000000000470000-0x0000000000497000-memory.dmp

Filesize
156KB

Download
memory/856-193-0x00000000008E0000-0x0000000000907000-memory.dmp

Filesize
156KB

Download
memory/856-201-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/856-134-0x00000000008E0000-0x0000000000907000-memory.dmp

Filesize
156KB

Download
memory/856-140-0x000007FEBE230000-0x000007FEBE240000-memory.dmp

Filesize
64KB

Download
memory/968-203-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/968-138-0x00000000003C0000-0x00000000003E7000-memory.dmp

Filesize
156KB

Download
memory/968-197-0x00000000003C0000-0x00000000003E7000-memory.dmp

Filesize
156KB

Download
memory/1032-67-0x0000000077840000-0x000000007795F000-memory.dmp

Filesize
1.1MB

Download
memory/1032-66-0x0000000077A60000-0x0000000077C09000-memory.dmp

Filesize
1.7MB

Download
memory/1060-232-0x00000000007C0000-0x00000000007E7000-memory.dmp

Filesize
156KB

Download
memory/1096-209-0x00000000007C0000-0x00000000007E7000-memory.dmp

Filesize
156KB

Download
memory/1096-212-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1104-213-0x0000000002060000-0x0000000002087000-memory.dmp

Filesize
156KB

Download
memory/1104-215-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1180-255-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1180-216-0x0000000001A10000-0x0000000001A37000-memory.dmp

Filesize
156KB

Download
memory/1228-218-0x0000000002A60000-0x0000000002A87000-memory.dmp

Filesize
156KB

Download
memory/1228-256-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1536-294-0x0000000001100000-0x0000000001180000-memory.dmp

Filesize
512KB

Download
memory/1536-292-0x0000000001100000-0x0000000001180000-memory.dmp

Filesize
512KB

Download
memory/1536-297-0x0000000001100000-0x0000000001180000-memory.dmp

Filesize
512KB

Download
memory/1536-299-0x0000000019A30000-0x0000000019A57000-memory.dmp

Filesize
156KB

Download
memory/1536-305-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1536-306-0x000000000110B000-0x0000000001142000-memory.dmp

Filesize
220KB

Download
memory/1848-257-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1848-221-0x0000000000120000-0x0000000000147000-memory.dmp

Filesize
156KB

Download
memory/1944-258-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/1944-222-0x00000000001D0000-0x00000000001F7000-memory.dmp

Filesize
156KB

Download
memory/2260-170-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2260-83-0x000000001B130000-0x000000001B412000-memory.dmp

Filesize
2.9MB

Download
memory/2260-90-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

Filesize
32KB

Download
memory/2260-178-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2260-98-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2260-100-0x0000000002570000-0x00000000025F0000-memory.dmp

Filesize
512KB

Download
memory/2388-59-0x000000001B1A0000-0x000000001B482000-memory.dmp

Filesize
2.9MB

Download
memory/2388-64-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2388-60-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/2388-61-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2388-63-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2388-62-0x0000000002600000-0x0000000002680000-memory.dmp

Filesize
512KB

Download
memory/2404-308-0x0000000037AA0000-0x0000000037AB0000-memory.dmp

Filesize
64KB

Download
memory/2404-309-0x0000000000700000-0x0000000000727000-memory.dmp

Filesize
156KB

Download
memory/2404-301-0x0000000000700000-0x0000000000727000-memory.dmp

Filesize
156KB

Download
memory/2408-289-0x0000000000120000-0x0000000000147000-memory.dmp

Filesize
156KB

Download
memory/2408-274-0x0000000000B70000-0x0000000000B97000-memory.dmp

Filesize
156KB

Download
memory/2408-259-0x0000000000120000-0x0000000000147000-memory.dmp

Filesize
156KB

Download
memory/2964-279-0x0000000000470000-0x0000000000497000-memory.dmp

Filesize
156KB

Download
memory/2964-278-0x0000000000440000-0x0000000000467000-memory.dmp

Filesize
156KB

Download
memory/2980-375-0x0000000000A34000-0x0000000000A37000-memory.dmp

Filesize
12KB

Download
memory/2980-377-0x0000000000A3B000-0x0000000000A72000-memory.dmp

Filesize
220KB

Download
memory/3064-89-0x000000013F750000-0x000000014301C000-memory.dmp

Filesize
56.8MB

Download
memory/3064-54-0x000000013F750000-0x000000014301C000-memory.dmp

Filesize
56.8MB

Download
memory/3064-245-0x0000000000100000-0x0000000000127000-memory.dmp

Filesize
156KB

Download