91650b8ba04935b967fcd70c59de46ac7e3184d2c2ad9c68ada7134918348bb3

Analysis

max time kernel
63s
max time network
65s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
03-09-2023 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OneDrive.exe
Size

4.6MB
MD5

432d68cb451bb59c7deb1a632abd697e
SHA1

2b32d06fbd91b0f12043aa4ba2f3ebfa4dcfe12e
SHA256

91650b8ba04935b967fcd70c59de46ac7e3184d2c2ad9c68ada7134918348bb3
SHA512

256ca2742c3b085c40f9b716ff1a75b02bf5723a0e12b02e32742158560ddd7f0451b5d6167f22708cf8c3ccf17810281875152169133147920cad71f373b1b3
SSDEEP

49152:TBpcpjCuXgrVKjom2IdED5Fg0A3a0P4PKa4M3MQhkAwPSIzzWkooMlFaLwVsTq7G:YptwGomzbP4wMlVCVH3jM5su0

Score

10^/10

evasion

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs

description	pid	Process	procid_target
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 2128 created 3264	2128	OneDrive.exe	54
PID 1272 created 3264	1272	updater.exe	54

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 1 IoCs

pid	Process
1272	updater.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2128 set thread context of 2604	2128	OneDrive.exe	98

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	OneDrive.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
4660	sc.exe
2288	sc.exe
4628	sc.exe
4420	sc.exe
1020	sc.exe
2008	sc.exe
4836	sc.exe
1844	sc.exe
4960	sc.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
736	616	WerFault.exe	3
4848	680	WerFault.exe	1
4016	316	WerFault.exe	10
4124	2208	WerFault.exe	34

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3304	schtasks.exe
744	schtasks.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2128	OneDrive.exe
2128	OneDrive.exe
4656	powershell.exe
4656	powershell.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2604	dialer.exe
2604	dialer.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2128	OneDrive.exe
2604	dialer.exe
2604	dialer.exe
1272	updater.exe
1272	updater.exe
1016	powershell.exe
1016	powershell.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
3052	Process not Found
4960	Process not Found
2688	Process not Found
4864	Process not Found
3880	Process not Found
2424	Process not Found
3528	Process not Found
4156	Process not Found
3900	Process not Found
3356	Process not Found
4624	Process not Found
2756	Process not Found
4716	Process not Found
2188	Process not Found
1336	Process not Found
1080	Process not Found
4440	Process not Found
2016	Process not Found
4432	cmd.exe
4328	Process not Found
5044	Process not Found
2072	Process not Found
3440	Process not Found
1596	Process not Found
1092	Process not Found
3392	Process not Found
4660	sc.exe
1860	Process not Found
2352	Process not Found
2348	Process not Found
1920	Process not Found
2908	Process not Found
1924	Process not Found
2000	Process not Found
232	Process not Found
4360	Process not Found
4856	Process not Found
2288	sc.exe
1536	Process not Found
4928	Process not Found
2376	Process not Found
2964	Process not Found
3692	Process not Found
4132	Process not Found
4100	Process not Found
956	Process not Found
4824	Process not Found
1044	Process not Found
3396	Process not Found
2468	Process not Found
1364	Process not Found
756	Process not Found
4280	Process not Found
4652	Process not Found
740	Process not Found
3240	Process not Found
2256	Process not Found
4684	Process not Found
2216	Process not Found
420	Process not Found
4460	Process not Found
2600	Process not Found
1432	Process not Found
4392	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	2604	dialer.exe
Token: SeShutdownPrivilege	1916	powercfg.exe
Token: SeCreatePagefilePrivilege	1916	powercfg.exe
Token: SeShutdownPrivilege	4496	powercfg.exe
Token: SeCreatePagefilePrivilege	4496	powercfg.exe
Token: SeShutdownPrivilege	3964	powercfg.exe
Token: SeCreatePagefilePrivilege	3964	powercfg.exe
Token: SeShutdownPrivilege	4432	powercfg.exe
Token: SeCreatePagefilePrivilege	4432	powercfg.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1844	2680	cmd.exe	91
PID 2680 wrote to memory of 1844	2680	cmd.exe	91
PID 2680 wrote to memory of 4628	2680	cmd.exe	92
PID 2680 wrote to memory of 4628	2680	cmd.exe	92
PID 2680 wrote to memory of 4420	2680	cmd.exe	93
PID 2680 wrote to memory of 4420	2680	cmd.exe	93
PID 2680 wrote to memory of 4960	2680	cmd.exe	94
PID 2680 wrote to memory of 4960	2680	cmd.exe	94
PID 2680 wrote to memory of 3060	2680	cmd.exe	95
PID 2680 wrote to memory of 3060	2680	cmd.exe	95
PID 2128 wrote to memory of 2604	2128	OneDrive.exe	98
PID 4360 wrote to memory of 1916	4360	cmd.exe	103
PID 4360 wrote to memory of 1916	4360	cmd.exe	103
PID 4360 wrote to memory of 4496	4360	cmd.exe	104
PID 4360 wrote to memory of 4496	4360	cmd.exe	104
PID 4360 wrote to memory of 3964	4360	cmd.exe	109
PID 4360 wrote to memory of 3964	4360	cmd.exe	109
PID 3332 wrote to memory of 4928	3332	cmd.exe	110
PID 3332 wrote to memory of 4928	3332	cmd.exe	110
PID 4360 wrote to memory of 4432	4360	cmd.exe	112
PID 4360 wrote to memory of 4432	4360	cmd.exe	112
PID 2604 wrote to memory of 616	2604	dialer.exe	3
PID 2604 wrote to memory of 680	2604	dialer.exe	1
PID 2604 wrote to memory of 960	2604	dialer.exe	80
PID 2604 wrote to memory of 316	2604	dialer.exe	10
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 2604 wrote to memory of 752	2604	dialer.exe	79
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 2604 wrote to memory of 1028	2604	dialer.exe	78
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 2604 wrote to memory of 1064	2604	dialer.exe	77
PID 2604 wrote to memory of 1072	2604	dialer.exe	14
PID 2604 wrote to memory of 1168	2604	dialer.exe	12
PID 2604 wrote to memory of 1208	2604	dialer.exe	13
PID 2604 wrote to memory of 1252	2604	dialer.exe	76
PID 2604 wrote to memory of 1308	2604	dialer.exe	75
PID 2604 wrote to memory of 1328	2604	dialer.exe	74
PID 2604 wrote to memory of 1440	2604	dialer.exe	73
PID 2604 wrote to memory of 1464	2604	dialer.exe	72
PID 2604 wrote to memory of 1480	2604	dialer.exe	15
PID 2604 wrote to memory of 1600	2604	dialer.exe	71
PID 2604 wrote to memory of 1632	2604	dialer.exe	70
PID 2604 wrote to memory of 1680	2604	dialer.exe	16
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 2604 wrote to memory of 1752	2604	dialer.exe	69
PID 2604 wrote to memory of 1808	2604	dialer.exe	68
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 1328 wrote to memory of 2596	1328	svchost.exe	122
PID 1328 wrote to memory of 2596	1328	svchost.exe	122
PID 680 wrote to memory of 2540	680	lsass.exe	60
PID 1328 wrote to memory of 1944	1328	svchost.exe	123
PID 1328 wrote to memory of 1944	1328	svchost.exe	123
PID 1328 wrote to memory of 2388	1328	svchost.exe	125
PID 1328 wrote to memory of 2388	1328	svchost.exe	125
PID 1328 wrote to memory of 3280	1328	svchost.exe	129
PID 1328 wrote to memory of 3280	1328	svchost.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 680 -s 2932
  2⤵
  - Program crash
  PID:4848

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:316
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 316 -s 3608
    3⤵
    - Program crash
    PID:4016
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 616 -s 796
  2⤵
  - Program crash
  PID:736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1168
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
    3⤵
    - Suspicious behavior: LoadsDriver
    PID:4432
  - - C:\Windows\System32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1020
  - - C:\Windows\System32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      Suspicious behavior: LoadsDriver
      PID:4660
  - - C:\Windows\System32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:2008
  - - C:\Windows\System32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:4836
  - - C:\Windows\System32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      Suspicious behavior: LoadsDriver
      PID:2288
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:2384
  - - C:\Windows\System32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      PID:4304
  - - C:\Windows\System32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      PID:956
- - C:\Windows\System32\schtasks.exe
    C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\fbermxmkwuwg.xml"
    3⤵
    - Creates scheduled task(s)
    PID:744
- - C:\Windows\System32\dialer.exe
    C:\Windows\System32\dialer.exe
    3⤵
    PID:3084
- - C:\Windows\System32\dialer.exe
    C:\Windows\System32\dialer.exe
    3⤵
    PID:2308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1072

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1480

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3264
- C:\Users\Admin\AppData\Local\Temp\OneDrive.exe
  "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4656
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1844
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4628
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4420
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4960
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3060
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4496
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3964
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4432
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2604
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4236
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\fbermxmkwuwg.xml"
  2⤵
  - Creates scheduled task(s)
  PID:3304
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:1400
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\OneDrive.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\System32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2540

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1464

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2596
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:1944
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2388
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 456 -p 616 -ip 616
1⤵
PID:880

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 500 -p 680 -ip 680
1⤵
PID:2352

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 544 -p 316 -ip 316
1⤵
PID:2008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1840

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 2208 -ip 2208
1⤵
PID:3776

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2208 -s 356
1⤵
- Program crash
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
4.6MB

MD5
432d68cb451bb59c7deb1a632abd697e

SHA1
2b32d06fbd91b0f12043aa4ba2f3ebfa4dcfe12e

SHA256
91650b8ba04935b967fcd70c59de46ac7e3184d2c2ad9c68ada7134918348bb3

SHA512
256ca2742c3b085c40f9b716ff1a75b02bf5723a0e12b02e32742158560ddd7f0451b5d6167f22708cf8c3ccf17810281875152169133147920cad71f373b1b3

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
4.6MB

MD5
432d68cb451bb59c7deb1a632abd697e

SHA1
2b32d06fbd91b0f12043aa4ba2f3ebfa4dcfe12e

SHA256
91650b8ba04935b967fcd70c59de46ac7e3184d2c2ad9c68ada7134918348bb3

SHA512
256ca2742c3b085c40f9b716ff1a75b02bf5723a0e12b02e32742158560ddd7f0451b5d6167f22708cf8c3ccf17810281875152169133147920cad71f373b1b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2aqke123.25s.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\fbermxmkwuwg.xml

Filesize
1KB

MD5
546d67a48ff2bf7682cea9fac07b942e

SHA1
a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

SHA256
eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

SHA512
10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

Download Submit
C:\Windows\System32\catroot2\dberr.txt

Filesize
147KB

MD5
2698d0fe22cd0335827ddec2e9fd2d0b

SHA1
539108fd8e3cfd467d6cc64570fee130c0eaac7b

SHA256
402c4a0e66acfaa12853c7b8708067b10295516c81e6332842c2d444be1a6059

SHA512
bc3bca8b4b49d8d59542e506322c7b745715c1741e2336515c06a0a1344e44eefa35414131911814d566309cd269f3b5138f242c580a493f86311ea2ff53769e

Download Submit
memory/316-47-0x00000266C0840000-0x00000266C086B000-memory.dmp

Filesize
172KB

Download
memory/316-39-0x00000266C0840000-0x00000266C086B000-memory.dmp

Filesize
172KB

Download
memory/316-133-0x00000266C0840000-0x00000266C086B000-memory.dmp

Filesize
172KB

Download
memory/616-30-0x00000190FCE40000-0x00000190FCE6B000-memory.dmp

Filesize
172KB

Download
memory/616-27-0x00000190FCE10000-0x00000190FCE34000-memory.dmp

Filesize
144KB

Download
memory/616-36-0x00007FF8C1B8F000-0x00007FF8C1B90000-memory.dmp

Filesize
4KB

Download
memory/616-72-0x00000190FCE40000-0x00000190FCE6B000-memory.dmp

Filesize
172KB

Download
memory/616-33-0x00007FF8C1B8D000-0x00007FF8C1B8E000-memory.dmp

Filesize
4KB

Download
memory/616-118-0x00000190FCE40000-0x00000190FCE6B000-memory.dmp

Filesize
172KB

Download
memory/680-32-0x00000181D4000000-0x00000181D402B000-memory.dmp

Filesize
172KB

Download
memory/680-34-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/680-40-0x00000181D4000000-0x00000181D402B000-memory.dmp

Filesize
172KB

Download
memory/680-43-0x00007FF8C1B8D000-0x00007FF8C1B8E000-memory.dmp

Filesize
4KB

Download
memory/752-51-0x0000025C8F6D0000-0x0000025C8F6FB000-memory.dmp

Filesize
172KB

Download
memory/752-45-0x0000025C8F6D0000-0x0000025C8F6FB000-memory.dmp

Filesize
172KB

Download
memory/752-265-0x0000025C8F730000-0x0000025C8F75B000-memory.dmp

Filesize
172KB

Download
memory/752-48-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/960-37-0x000001D184700000-0x000001D18472B000-memory.dmp

Filesize
172KB

Download
memory/960-42-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/960-262-0x000001D184760000-0x000001D18478B000-memory.dmp

Filesize
172KB

Download
memory/960-49-0x00007FF8C1B8C000-0x00007FF8C1B8D000-memory.dmp

Filesize
4KB

Download
memory/960-46-0x000001D184700000-0x000001D18472B000-memory.dmp

Filesize
172KB

Download
memory/1016-164-0x000001683E5A0000-0x000001683E5B0000-memory.dmp

Filesize
64KB

Download
memory/1016-243-0x00000168572E0000-0x00000168572FA000-memory.dmp

Filesize
104KB

Download
memory/1016-252-0x000001683E5A0000-0x000001683E5B0000-memory.dmp

Filesize
64KB

Download
memory/1016-151-0x000001683E5A0000-0x000001683E5B0000-memory.dmp

Filesize
64KB

Download
memory/1016-247-0x00000168572C0000-0x00000168572C6000-memory.dmp

Filesize
24KB

Download
memory/1016-255-0x00007FF8A2D10000-0x00007FF8A37D1000-memory.dmp

Filesize
10.8MB

Download
memory/1016-245-0x0000016857290000-0x0000016857298000-memory.dmp

Filesize
32KB

Download
memory/1016-249-0x00000168572D0000-0x00000168572DA000-memory.dmp

Filesize
40KB

Download
memory/1016-152-0x000001683E5A0000-0x000001683E5B0000-memory.dmp

Filesize
64KB

Download
memory/1016-169-0x00007FF4737D0000-0x00007FF4737E0000-memory.dmp

Filesize
64KB

Download
memory/1016-147-0x00007FF8A2D10000-0x00007FF8A37D1000-memory.dmp

Filesize
10.8MB

Download
memory/1016-179-0x0000016857190000-0x00000168571AC000-memory.dmp

Filesize
112KB

Download
memory/1016-185-0x0000016857270000-0x000001685727A000-memory.dmp

Filesize
40KB

Download
memory/1016-238-0x0000016857280000-0x000001685728A000-memory.dmp

Filesize
40KB

Download
memory/1016-194-0x00000168572A0000-0x00000168572BC000-memory.dmp

Filesize
112KB

Download
memory/1028-270-0x0000017527B10000-0x0000017527B3B000-memory.dmp

Filesize
172KB

Download
memory/1028-57-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1028-55-0x0000017527AB0000-0x0000017527ADB000-memory.dmp

Filesize
172KB

Download
memory/1028-92-0x0000017527AB0000-0x0000017527ADB000-memory.dmp

Filesize
172KB

Download
memory/1064-274-0x00000207012F0000-0x000002070131B000-memory.dmp

Filesize
172KB

Download
memory/1064-61-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1064-59-0x0000020701290000-0x00000207012BB000-memory.dmp

Filesize
172KB

Download
memory/1064-149-0x0000020701290000-0x00000207012BB000-memory.dmp

Filesize
172KB

Download
memory/1072-66-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1072-63-0x0000020E7D540000-0x0000020E7D56B000-memory.dmp

Filesize
172KB

Download
memory/1072-277-0x0000020E7D5A0000-0x0000020E7D5CB000-memory.dmp

Filesize
172KB

Download
memory/1072-150-0x0000020E7D540000-0x0000020E7D56B000-memory.dmp

Filesize
172KB

Download
memory/1168-280-0x000001BEF6F70000-0x000001BEF6F9B000-memory.dmp

Filesize
172KB

Download
memory/1168-67-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1168-153-0x000001BEF69B0000-0x000001BEF69DB000-memory.dmp

Filesize
172KB

Download
memory/1168-64-0x000001BEF69B0000-0x000001BEF69DB000-memory.dmp

Filesize
172KB

Download
memory/1208-74-0x000001ABF58B0000-0x000001ABF58DB000-memory.dmp

Filesize
172KB

Download
memory/1208-71-0x000001ABF58B0000-0x000001ABF58DB000-memory.dmp

Filesize
172KB

Download
memory/1208-73-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1208-233-0x000001ABF58B0000-0x000001ABF58DB000-memory.dmp

Filesize
172KB

Download
memory/1252-250-0x000001C8BB380000-0x000001C8BB3AB000-memory.dmp

Filesize
172KB

Download
memory/1252-79-0x000001C8BB380000-0x000001C8BB3AB000-memory.dmp

Filesize
172KB

Download
memory/1252-81-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1308-86-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1308-251-0x000002341D2B0000-0x000002341D2DB000-memory.dmp

Filesize
172KB

Download
memory/1308-83-0x000002341D2B0000-0x000002341D2DB000-memory.dmp

Filesize
172KB

Download
memory/1328-88-0x0000020B27380000-0x0000020B273AB000-memory.dmp

Filesize
172KB

Download
memory/1328-266-0x0000020B27380000-0x0000020B273AB000-memory.dmp

Filesize
172KB

Download
memory/1328-97-0x0000020B27380000-0x0000020B273AB000-memory.dmp

Filesize
172KB

Download
memory/1328-93-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1440-94-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1440-89-0x0000020D884B0000-0x0000020D884DB000-memory.dmp

Filesize
172KB

Download
memory/1440-106-0x0000020D884B0000-0x0000020D884DB000-memory.dmp

Filesize
172KB

Download
memory/1464-109-0x00000226A19B0000-0x00000226A19DB000-memory.dmp

Filesize
172KB

Download
memory/1464-101-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1464-95-0x00000226A19B0000-0x00000226A19DB000-memory.dmp

Filesize
172KB

Download
memory/1480-121-0x0000024AE92F0000-0x0000024AE931B000-memory.dmp

Filesize
172KB

Download
memory/1480-103-0x00007FF881B70000-0x00007FF881B80000-memory.dmp

Filesize
64KB

Download
memory/1480-100-0x0000024AE92F0000-0x0000024AE931B000-memory.dmp

Filesize
172KB

Download
memory/1600-269-0x00000197EBAF0000-0x00000197EBB1B000-memory.dmp

Filesize
172KB

Download
memory/1600-143-0x00000197EBAF0000-0x00000197EBB1B000-memory.dmp

Filesize
172KB

Download
memory/1632-144-0x0000019157970000-0x000001915799B000-memory.dmp

Filesize
172KB

Download
memory/1680-271-0x0000021FA7E60000-0x0000021FA7E8B000-memory.dmp

Filesize
172KB

Download
memory/1680-145-0x0000021FA7E60000-0x0000021FA7E8B000-memory.dmp

Filesize
172KB

Download
memory/1752-146-0x0000029E34740000-0x0000029E3476B000-memory.dmp

Filesize
172KB

Download
memory/1808-148-0x0000027F29F50000-0x0000027F29F7B000-memory.dmp

Filesize
172KB

Download
memory/2128-0-0x00007FF69C150000-0x00007FF69C5FD000-memory.dmp

Filesize
4.7MB

Download
memory/2128-25-0x00007FF69C150000-0x00007FF69C5FD000-memory.dmp

Filesize
4.7MB

Download
memory/2604-102-0x00007FF65A860000-0x00007FF65A88B000-memory.dmp

Filesize
172KB

Download
memory/2604-20-0x00007FF8C1AF0000-0x00007FF8C1CE5000-memory.dmp

Filesize
2.0MB

Download
memory/2604-21-0x00007FF8C1940000-0x00007FF8C19FE000-memory.dmp

Filesize
760KB

Download
memory/4656-12-0x0000014FC5110000-0x0000014FC5120000-memory.dmp

Filesize
64KB

Download
memory/4656-13-0x0000014FC5110000-0x0000014FC5120000-memory.dmp

Filesize
64KB

Download
memory/4656-15-0x0000014FC5110000-0x0000014FC5120000-memory.dmp

Filesize
64KB

Download
memory/4656-18-0x00007FF8A2D10000-0x00007FF8A37D1000-memory.dmp

Filesize
10.8MB

Download
memory/4656-14-0x0000014FC5110000-0x0000014FC5120000-memory.dmp

Filesize
64KB

Download
memory/4656-11-0x00007FF8A2D10000-0x00007FF8A37D1000-memory.dmp

Filesize
10.8MB

Download
memory/4656-10-0x0000014FC50E0000-0x0000014FC5102000-memory.dmp

Filesize
136KB

Download