xmrig | cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68

Analysis

max time kernel
300s
max time network
297s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
Size

8.9MB
MD5

e2df1fca37cff12eb333d1d11d11d5af
SHA1

21a2733360dbd70672448da47843cf6675087d59
SHA256

cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68
SHA512

9746086f68101b73c92805b18483d3e69d45052abddcf12a9da515d91f023febd3a9385b18ded0ff71e80da1f685b854bceb4f47da8baef23d22a0de0dd33e31
SSDEEP

196608:6WOiyabx20kSkWfWTsO8OFyaKnMFkd3EvOdytLmS+SLgKckF3HNo3mNssMryk:PxsHsGgaKbdCOQRmTZpkQv

Score

10^/10

xmrig evasion miner themida

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 1920 created 1296	1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe	6
PID 1920 created 1296	1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe	6
PID 1920 created 1296	1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe	6
PID 1920 created 1296	1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe	6
PID 1920 created 1296	1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe	6
PID 3020 created 1296	3020	updater.exe	6
PID 3020 created 1296	3020	updater.exe	6
PID 3020 created 1296	3020	updater.exe	6
PID 3020 created 1296	3020	updater.exe	6
PID 3020 created 1296	3020	updater.exe	6
PID 3020 created 1296	3020	updater.exe	6

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 23 IoCs

miner

resource	yara_rule
behavioral1/memory/3020-138-0x000000013FD60000-0x0000000140DD8000-memory.dmp	xmrig
behavioral1/memory/2676-144-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-147-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-149-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-151-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-153-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-155-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-157-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-159-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-161-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-163-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-165-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-167-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-169-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-171-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-173-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-175-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-177-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-179-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-181-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-183-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-185-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig
behavioral1/memory/2676-187-0x0000000140000000-0x00000001407EF000-memory.dmp	xmrig

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe
File created	C:\Windows\System32\drivers\etc\hosts	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
3020	updater.exe

Loads dropped DLL 1 IoCs

pid	Process
2056	taskeng.exe

Themida packer 24 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/1920-53-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-54-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-59-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-60-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-61-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-62-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-63-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-64-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-70-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/memory/1920-96-0x000000013F270000-0x00000001402E8000-memory.dmp	themida
behavioral1/files/0x002a000000015c70-99.dat	themida
behavioral1/files/0x002a000000015c70-102.dat	themida
behavioral1/memory/3020-103-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-104-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-108-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-109-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-107-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-106-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-105-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-110-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-121-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/memory/3020-124-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida
behavioral1/files/0x002a000000015c70-136.dat	themida
behavioral1/memory/3020-138-0x000000013FD60000-0x0000000140DD8000-memory.dmp	themida

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
3020	updater.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3020 set thread context of 2088	3020	updater.exe	70
PID 3020 set thread context of 2676	3020	updater.exe	71

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2724	sc.exe
2780	sc.exe
2388	sc.exe
1820	sc.exe
332	sc.exe
2744	sc.exe
2836	sc.exe
2032	sc.exe
340	sc.exe
484	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1912	schtasks.exe
2540	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 808899d3adc9d901	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
2516	powershell.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
2440	powershell.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
1920	cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
3020	updater.exe
3020	updater.exe
1220	powershell.exe
3020	updater.exe
3020	updater.exe
3020	updater.exe
3020	updater.exe
3020	updater.exe
3020	updater.exe
2396	powershell.exe
3020	updater.exe
3020	updater.exe
3020	updater.exe
3020	updater.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe
2676	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeShutdownPrivilege	472	powercfg.exe
Token: SeShutdownPrivilege	984	powercfg.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	2180	powercfg.exe
Token: SeDebugPrivilege	1220	powershell.exe
Token: SeShutdownPrivilege	1972	powercfg.exe
Token: SeShutdownPrivilege	2308	powercfg.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeShutdownPrivilege	2280	powercfg.exe
Token: SeShutdownPrivilege	2556	powercfg.exe
Token: SeDebugPrivilege	3020	updater.exe
Token: SeLockMemoryPrivilege	2676	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 2724	2768	cmd.exe	34
PID 2768 wrote to memory of 2724	2768	cmd.exe	34
PID 2768 wrote to memory of 2724	2768	cmd.exe	34
PID 2768 wrote to memory of 2744	2768	cmd.exe	35
PID 2768 wrote to memory of 2744	2768	cmd.exe	35
PID 2768 wrote to memory of 2744	2768	cmd.exe	35
PID 2768 wrote to memory of 2780	2768	cmd.exe	36
PID 2768 wrote to memory of 2780	2768	cmd.exe	36
PID 2768 wrote to memory of 2780	2768	cmd.exe	36
PID 2768 wrote to memory of 2836	2768	cmd.exe	37
PID 2768 wrote to memory of 2836	2768	cmd.exe	37
PID 2768 wrote to memory of 2836	2768	cmd.exe	37
PID 2768 wrote to memory of 2388	2768	cmd.exe	38
PID 2768 wrote to memory of 2388	2768	cmd.exe	38
PID 2768 wrote to memory of 2388	2768	cmd.exe	38
PID 2772 wrote to memory of 472	2772	cmd.exe	43
PID 2772 wrote to memory of 472	2772	cmd.exe	43
PID 2772 wrote to memory of 472	2772	cmd.exe	43
PID 2772 wrote to memory of 984	2772	cmd.exe	44
PID 2772 wrote to memory of 984	2772	cmd.exe	44
PID 2772 wrote to memory of 984	2772	cmd.exe	44
PID 2772 wrote to memory of 1472	2772	cmd.exe	45
PID 2772 wrote to memory of 1472	2772	cmd.exe	45
PID 2772 wrote to memory of 1472	2772	cmd.exe	45
PID 2772 wrote to memory of 2180	2772	cmd.exe	46
PID 2772 wrote to memory of 2180	2772	cmd.exe	46
PID 2772 wrote to memory of 2180	2772	cmd.exe	46
PID 2440 wrote to memory of 1912	2440	powershell.exe	47
PID 2440 wrote to memory of 1912	2440	powershell.exe	47
PID 2440 wrote to memory of 1912	2440	powershell.exe	47
PID 2056 wrote to memory of 3020	2056	taskeng.exe	51
PID 2056 wrote to memory of 3020	2056	taskeng.exe	51
PID 2056 wrote to memory of 3020	2056	taskeng.exe	51
PID 3028 wrote to memory of 1820	3028	cmd.exe	56
PID 3028 wrote to memory of 1820	3028	cmd.exe	56
PID 3028 wrote to memory of 1820	3028	cmd.exe	56
PID 3028 wrote to memory of 2032	3028	cmd.exe	57
PID 3028 wrote to memory of 2032	3028	cmd.exe	57
PID 3028 wrote to memory of 2032	3028	cmd.exe	57
PID 3028 wrote to memory of 340	3028	cmd.exe	58
PID 3028 wrote to memory of 340	3028	cmd.exe	58
PID 3028 wrote to memory of 340	3028	cmd.exe	58
PID 3028 wrote to memory of 484	3028	cmd.exe	59
PID 3028 wrote to memory of 484	3028	cmd.exe	59
PID 3028 wrote to memory of 484	3028	cmd.exe	59
PID 3028 wrote to memory of 332	3028	cmd.exe	60
PID 3028 wrote to memory of 332	3028	cmd.exe	60
PID 3028 wrote to memory of 332	3028	cmd.exe	60
PID 1764 wrote to memory of 1972	1764	cmd.exe	65
PID 1764 wrote to memory of 1972	1764	cmd.exe	65
PID 1764 wrote to memory of 1972	1764	cmd.exe	65
PID 1764 wrote to memory of 2308	1764	cmd.exe	66
PID 1764 wrote to memory of 2308	1764	cmd.exe	66
PID 1764 wrote to memory of 2308	1764	cmd.exe	66
PID 1764 wrote to memory of 2280	1764	cmd.exe	67
PID 1764 wrote to memory of 2280	1764	cmd.exe	67
PID 1764 wrote to memory of 2280	1764	cmd.exe	67
PID 1764 wrote to memory of 2556	1764	cmd.exe	68
PID 1764 wrote to memory of 2556	1764	cmd.exe	68
PID 1764 wrote to memory of 2556	1764	cmd.exe	68
PID 2396 wrote to memory of 2540	2396	powershell.exe	69
PID 2396 wrote to memory of 2540	2396	powershell.exe	69
PID 2396 wrote to memory of 2540	2396	powershell.exe	69
PID 3020 wrote to memory of 2088	3020	updater.exe	70

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1296
- C:\Users\Admin\AppData\Local\Temp\cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe
  "C:\Users\Admin\AppData\Local\Temp\cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Drivers directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2724
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2744
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2780
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2836
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2388
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:984
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1472
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:1912
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1220
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1820
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2032
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:340
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:484
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:332
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2280
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
    3⤵
    - Creates scheduled task(s)
    PID:2540
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2088
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676

C:\Windows\system32\taskeng.exe
taskeng.exe {FB1B9227-7B97-44A3-B54D-496936E403DA} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
8.9MB

MD5
e2df1fca37cff12eb333d1d11d11d5af

SHA1
21a2733360dbd70672448da47843cf6675087d59

SHA256
cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68

SHA512
9746086f68101b73c92805b18483d3e69d45052abddcf12a9da515d91f023febd3a9385b18ded0ff71e80da1f685b854bceb4f47da8baef23d22a0de0dd33e31

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
8.9MB

MD5
e2df1fca37cff12eb333d1d11d11d5af

SHA1
21a2733360dbd70672448da47843cf6675087d59

SHA256
cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68

SHA512
9746086f68101b73c92805b18483d3e69d45052abddcf12a9da515d91f023febd3a9385b18ded0ff71e80da1f685b854bceb4f47da8baef23d22a0de0dd33e31

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
341e471419eeff92ad40d4c0cd2f7201

SHA1
06d590501044bf2a8afef783424f297341b7f549

SHA256
f15a287130e65630ba953521da00dad0d2a4d6bd8632103b0628b3e446d1f322

SHA512
34b864bd6967dc789d449e350d8271c13db046281efe7bba3da92c776c5c7177ce80deb59e6910580c9139a452def4fb41831d9462d3dbc4e4001014d1bdc3c7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YUJI7VZDN59NAQMUO2G6.temp

Filesize
7KB

MD5
341e471419eeff92ad40d4c0cd2f7201

SHA1
06d590501044bf2a8afef783424f297341b7f549

SHA256
f15a287130e65630ba953521da00dad0d2a4d6bd8632103b0628b3e446d1f322

SHA512
34b864bd6967dc789d449e350d8271c13db046281efe7bba3da92c776c5c7177ce80deb59e6910580c9139a452def4fb41831d9462d3dbc4e4001014d1bdc3c7

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
3e9af076957c5b2f9c9ce5ec994bea05

SHA1
a8c7326f6bceffaeed1c2bb8d7165e56497965fe

SHA256
e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

SHA512
933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

Download Submit
\Program Files\Google\Chrome\updater.exe

Filesize
8.9MB

MD5
e2df1fca37cff12eb333d1d11d11d5af

SHA1
21a2733360dbd70672448da47843cf6675087d59

SHA256
cb95df0d30e07f020cf18517f7a698e6e0a7a3a60eb01e8e5aca16f1f5b8eb68

SHA512
9746086f68101b73c92805b18483d3e69d45052abddcf12a9da515d91f023febd3a9385b18ded0ff71e80da1f685b854bceb4f47da8baef23d22a0de0dd33e31

Download Submit
memory/1220-122-0x0000000001240000-0x00000000012C0000-memory.dmp

Filesize
512KB

Download
memory/1220-123-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1220-115-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1220-116-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/1220-120-0x0000000001240000-0x00000000012C0000-memory.dmp

Filesize
512KB

Download
memory/1220-119-0x0000000001240000-0x00000000012C0000-memory.dmp

Filesize
512KB

Download
memory/1220-118-0x0000000001240000-0x00000000012C0000-memory.dmp

Filesize
512KB

Download
memory/1920-63-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-58-0x000007FE80010000-0x000007FE80011000-memory.dmp

Filesize
4KB

Download
memory/1920-55-0x0000000000170000-0x0000000000171000-memory.dmp

Filesize
4KB

Download
memory/1920-65-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/1920-64-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-54-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-62-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-61-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-60-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-97-0x000007FEFD420000-0x000007FEFD48C000-memory.dmp

Filesize
432KB

Download
memory/1920-59-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-98-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/1920-96-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-53-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/1920-56-0x000007FEFD420000-0x000007FEFD48C000-memory.dmp

Filesize
432KB

Download
memory/1920-57-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/1920-70-0x000000013F270000-0x00000001402E8000-memory.dmp

Filesize
16.5MB

Download
memory/2056-100-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/2056-117-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/2088-143-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2088-150-0x0000000140000000-0x000000014002A000-memory.dmp

Filesize
168KB

Download
memory/2396-132-0x0000000001160000-0x00000000011E0000-memory.dmp

Filesize
512KB

Download
memory/2396-133-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2396-131-0x0000000001160000-0x00000000011E0000-memory.dmp

Filesize
512KB

Download
memory/2396-130-0x0000000001160000-0x00000000011E0000-memory.dmp

Filesize
512KB

Download
memory/2396-129-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2396-128-0x0000000001160000-0x00000000011E0000-memory.dmp

Filesize
512KB

Download
memory/2396-127-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2440-87-0x0000000002450000-0x0000000002458000-memory.dmp

Filesize
32KB

Download
memory/2440-94-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2440-91-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2440-93-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2440-92-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2440-90-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2440-89-0x0000000002660000-0x00000000026E0000-memory.dmp

Filesize
512KB

Download
memory/2440-88-0x000007FEF5060000-0x000007FEF59FD000-memory.dmp

Filesize
9.6MB

Download
memory/2440-86-0x000000001B090000-0x000000001B372000-memory.dmp

Filesize
2.9MB

Download
memory/2516-79-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-78-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2516-76-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2516-77-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2516-73-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-75-0x000007FEF5A00000-0x000007FEF639D000-memory.dmp

Filesize
9.6MB

Download
memory/2516-74-0x0000000002420000-0x00000000024A0000-memory.dmp

Filesize
512KB

Download
memory/2516-72-0x0000000001E20000-0x0000000001E28000-memory.dmp

Filesize
32KB

Download
memory/2516-71-0x000000001B0E0000-0x000000001B3C2000-memory.dmp

Filesize
2.9MB

Download
memory/2676-142-0x00000000006D0000-0x00000000006F0000-memory.dmp

Filesize
128KB

Download
memory/2676-167-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-187-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-185-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-183-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-181-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-179-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-177-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-175-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-173-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-171-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-169-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-139-0x0000000000040000-0x0000000000060000-memory.dmp

Filesize
128KB

Download
memory/2676-165-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-163-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-161-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-159-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-157-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-144-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-145-0x00000000006D0000-0x00000000006F0000-memory.dmp

Filesize
128KB

Download
memory/2676-147-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-149-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-155-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-151-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/2676-153-0x0000000140000000-0x00000001407EF000-memory.dmp

Filesize
7.9MB

Download
memory/3020-103-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-104-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-108-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-138-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-140-0x000007FEFD420000-0x000007FEFD48C000-memory.dmp

Filesize
432KB

Download
memory/3020-141-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/3020-121-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-109-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-107-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-106-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-105-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-110-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download
memory/3020-111-0x000007FEFD420000-0x000007FEFD48C000-memory.dmp

Filesize
432KB

Download
memory/3020-112-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/3020-114-0x000007FE80010000-0x000007FE80011000-memory.dmp

Filesize
4KB

Download
memory/3020-113-0x00000000775A0000-0x0000000077749000-memory.dmp

Filesize
1.7MB

Download
memory/3020-124-0x000000013FD60000-0x0000000140DD8000-memory.dmp

Filesize
16.5MB

Download