Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-07-2023 22:39

General

  • Target

    release-v2.exe

  • Size

    6.1MB

  • MD5

    f7acd0852bb12402618146b0d16f354e

  • SHA1

    211e1174154435cf731ffd70c69cc9050f924174

  • SHA256

    02131c1bff27d6b1d89013f963095a425a32f8506e69799e7087554461bbbd9d

  • SHA512

    6dee8dcc59d0ac59728c7750cba5c570797e91cd39755c4b910c95ee0dfb3b0e1c69d954970a3638ded9ec411927226c2468adc39471671ea7f96ebe402298cc

  • SSDEEP

    196608:pNsMnreFZyDr0jUSCYKdY0ZVeQ+KMm6XOeRJpyrMS0kRkZ0YezmEse7IBWc7pH9K:pyc7/Zd31VC7WcVHdPa4c15D

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
    1⤵
    • Drops file in System32 directory
    PID:1080
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3180
      • C:\Users\Admin\AppData\Local\Temp\release-v2.exe
        "C:\Users\Admin\AppData\Local\Temp\release-v2.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in Drivers directory
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3132
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3940
      • C:\Windows\System32\cmd.exe
        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3692
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-ac 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2136
        • C:\Windows\System32\powercfg.exe
          powercfg /x -hibernate-timeout-dc 0
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4300
        • C:\Windows\System32\powercfg.exe
          powercfg /x -standby-timeout-ac 0
          3⤵
            PID:4616
          • C:\Windows\System32\powercfg.exe
            powercfg /x -standby-timeout-dc 0
            3⤵
              PID:1800
          • C:\Windows\System32\dialer.exe
            C:\Windows\System32\dialer.exe
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4480
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#eszkltr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:616
        • C:\Windows\sysmon.exe
          C:\Windows\sysmon.exe
          1⤵
            PID:2508
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
            1⤵
              PID:1528
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
              1⤵
                PID:1400
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                1⤵
                  PID:1388
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                  1⤵
                    PID:1352
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                    1⤵
                      PID:1332
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1292
                      • C:\Windows\system32\sihost.exe
                        sihost.exe
                        2⤵
                          PID:1444
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          2⤵
                            PID:408
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                          1⤵
                            PID:1216
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                            1⤵
                              PID:1192
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                              1⤵
                                PID:1040
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                1⤵
                                  PID:440
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                  1⤵
                                    PID:628
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                    1⤵
                                      PID:528
                                    • C:\Windows\system32\dwm.exe
                                      "dwm.exe"
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1016
                                      • C:\Windows\system32\WerFault.exe
                                        C:\Windows\system32\WerFault.exe -u -p 1016 -s 3832
                                        2⤵
                                        • Program crash
                                        PID:508
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                      1⤵
                                        PID:944
                                      • C:\Windows\system32\lsass.exe
                                        C:\Windows\system32\lsass.exe
                                        1⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:668
                                      • C:\Windows\system32\winlogon.exe
                                        winlogon.exe
                                        1⤵
                                          PID:584
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -u -p 584 -s 764
                                            2⤵
                                            • Program crash
                                            PID:2948
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -pss -s 464 -p 1016 -ip 1016
                                          1⤵
                                            PID:2780
                                          • C:\Windows\system32\WerFault.exe
                                            C:\Windows\system32\WerFault.exe -pss -s 476 -p 584 -ip 584
                                            1⤵
                                              PID:804
                                            • C:\Windows\System32\smss.exe
                                              \SystemRoot\System32\smss.exe 000000c0 00000084
                                              1⤵
                                              • Suspicious behavior: LoadsDriver
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4616
                                            • C:\Windows\System32\smss.exe
                                              \SystemRoot\System32\smss.exe 000000e0 00000084
                                              1⤵
                                              • Suspicious behavior: LoadsDriver
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1800

                                            Network

                                            MITRE ATT&CK Matrix

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                                              Filesize

                                              2KB

                                              MD5

                                              d85ba6ff808d9e5444a4b369f5bc2730

                                              SHA1

                                              31aa9d96590fff6981b315e0b391b575e4c0804a

                                              SHA256

                                              84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                              SHA512

                                              8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                              Filesize

                                              944B

                                              MD5

                                              77d622bb1a5b250869a3238b9bc1402b

                                              SHA1

                                              d47f4003c2554b9dfc4c16f22460b331886b191b

                                              SHA256

                                              f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

                                              SHA512

                                              d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qrzytt2q.pxb.ps1
                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                              Filesize

                                              2KB

                                              MD5

                                              8abf2d6067c6f3191a015f84aa9b6efe

                                              SHA1

                                              98f2b0a5cdb13cd3d82dc17bd43741bf0b3496f7

                                              SHA256

                                              ee18bd3259f220c41062abcbe71a421da3e910df11b9f86308a16cdc3a66fbea

                                              SHA512

                                              c2d686a6373efcff583c1ef50c144c59addb8b9c4857ccd8565cd8be3c94b0ac0273945167eb04ebd40dfb0351e4b66cffe4c4e478fb7733714630a11f765b63

                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
                                              Filesize

                                              2KB

                                              MD5

                                              f313c5b4f95605026428425586317353

                                              SHA1

                                              06be66fa06e1cffc54459c38d3d258f46669d01a

                                              SHA256

                                              129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b

                                              SHA512

                                              b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890

                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                              Filesize

                                              2KB

                                              MD5

                                              ceb7caa4e9c4b8d760dbf7e9e5ca44c5

                                              SHA1

                                              a3879621f9493414d497ea6d70fbf17e283d5c08

                                              SHA256

                                              98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9

                                              SHA512

                                              1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff

                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
                                              Filesize

                                              2KB

                                              MD5

                                              7d612892b20e70250dbd00d0cdd4f09b

                                              SHA1

                                              63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5

                                              SHA256

                                              727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02

                                              SHA512

                                              f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1

                                            • C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
                                              Filesize

                                              2KB

                                              MD5

                                              0b990e24f1e839462c0ac35fef1d119e

                                              SHA1

                                              9e17905f8f68f9ce0a2024d57b537aa8b39c6708

                                              SHA256

                                              a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a

                                              SHA512

                                              c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4

                                            • memory/440-206-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/440-204-0x0000029479390000-0x00000294793B7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/440-306-0x0000029479390000-0x00000294793B7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/528-193-0x000001CF4BD60000-0x000001CF4BD87000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/528-176-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/528-174-0x000001CF4BD60000-0x000001CF4BD87000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/584-161-0x00007FF8319ED000-0x00007FF8319EE000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/584-234-0x0000025E83AB0000-0x0000025E83AD7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/584-158-0x0000025E83AB0000-0x0000025E83AD7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/584-233-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/584-155-0x0000025E83A80000-0x0000025E83AA1000-memory.dmp
                                              Filesize

                                              132KB

                                            • memory/616-262-0x00007FF8130A0000-0x00007FF813B61000-memory.dmp
                                              Filesize

                                              10.8MB

                                            • memory/616-198-0x0000017FD7D40000-0x0000017FD7D50000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/616-180-0x0000017FD7D40000-0x0000017FD7D50000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/616-178-0x00007FF8130A0000-0x00007FF813B61000-memory.dmp
                                              Filesize

                                              10.8MB

                                            • memory/616-179-0x0000017FD7D40000-0x0000017FD7D50000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/628-196-0x00000289E6530000-0x00000289E6557000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/628-197-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/628-269-0x00000289E6530000-0x00000289E6557000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/668-268-0x000001B412890000-0x000001B4128B7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/668-172-0x00007FF8319ED000-0x00007FF8319EE000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/668-175-0x00007FF8319EC000-0x00007FF8319ED000-memory.dmp
                                              Filesize

                                              4KB

                                            • memory/668-159-0x000001B412890000-0x000001B4128B7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/668-162-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/668-165-0x000001B412890000-0x000001B4128B7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/944-181-0x0000024D8BDD0000-0x0000024D8BDF7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/944-167-0x0000024D8BDD0000-0x0000024D8BDF7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/944-171-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1016-183-0x00000231B3020000-0x00000231B3047000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1016-168-0x00000231B3020000-0x00000231B3047000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1040-205-0x0000022FDED40000-0x0000022FDED67000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1040-207-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1040-307-0x0000022FDED40000-0x0000022FDED67000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1080-212-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1080-210-0x0000013954540000-0x0000013954567000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1080-308-0x0000013954540000-0x0000013954567000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1192-220-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1192-309-0x0000023EEF380000-0x0000023EEF3A7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1192-218-0x0000023EEF380000-0x0000023EEF3A7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1216-219-0x000002A4CDF90000-0x000002A4CDFB7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1216-226-0x000002A4CDF90000-0x000002A4CDFB7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1216-223-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1216-310-0x000002A4CDF90000-0x000002A4CDFB7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1292-229-0x0000021F2F930000-0x0000021F2F957000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1292-228-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1292-224-0x0000021F2F930000-0x0000021F2F957000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1292-311-0x0000021F2F930000-0x0000021F2F957000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1332-312-0x000001EFF25D0000-0x000001EFF25F7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1332-235-0x00007FF7F19D0000-0x00007FF7F19E0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/1332-232-0x000001EFF25D0000-0x000001EFF25F7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1352-313-0x000001F56ED80000-0x000001F56EDA7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1352-244-0x000001F56ED80000-0x000001F56EDA7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1388-267-0x0000025D323B0000-0x0000025D323D7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1400-265-0x0000014AC1160000-0x0000014AC1187000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1528-264-0x00000156359A0000-0x00000156359C7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/1528-314-0x00000156359A0000-0x00000156359C7000-memory.dmp
                                              Filesize

                                              156KB

                                            • memory/3132-133-0x00007FF6CC470000-0x00007FF6CCA87000-memory.dmp
                                              Filesize

                                              6.1MB

                                            • memory/3132-170-0x00007FF6CC470000-0x00007FF6CCA87000-memory.dmp
                                              Filesize

                                              6.1MB

                                            • memory/3940-134-0x0000017AB1F90000-0x0000017AB1FB2000-memory.dmp
                                              Filesize

                                              136KB

                                            • memory/3940-144-0x00007FF8130A0000-0x00007FF813B61000-memory.dmp
                                              Filesize

                                              10.8MB

                                            • memory/3940-145-0x0000017AB1FE0000-0x0000017AB1FF0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/3940-146-0x0000017AB1FE0000-0x0000017AB1FF0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/3940-147-0x0000017AB1FE0000-0x0000017AB1FF0000-memory.dmp
                                              Filesize

                                              64KB

                                            • memory/3940-150-0x00007FF8130A0000-0x00007FF813B61000-memory.dmp
                                              Filesize

                                              10.8MB

                                            • memory/4480-153-0x00007FF831950000-0x00007FF831B45000-memory.dmp
                                              Filesize

                                              2.0MB

                                            • memory/4480-154-0x00007FF8315C0000-0x00007FF83167E000-memory.dmp
                                              Filesize

                                              760KB

                                            • memory/4480-222-0x00007FF699130000-0x00007FF699159000-memory.dmp
                                              Filesize

                                              164KB