glupteba | c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe
Size

13.3MB
MD5

2eadf9045ac431174e4bd101584983a8
SHA1

3d1b54d531afad80e51ec04dcc80e00f53b6505e
SHA256

c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc
SHA512

d5056860dbfa0f5e9f49a31d73f1af62f0c92db6c80bd1819791098d58375cbf7733599e49b3513c5bfbf54ab216e8de4f1bb6d91fb1aaf9c84f0f0298f48599
SSDEEP

196608:vJ53FaC5MGewrlcf7qE4C11FO4Pt651rdH1cfdSp3+JHmeNFSutuomP+3B:vJ5wWDewrGefCAKw5efdM3+EepupP8

Score

10^/10

glupteba smokeloader stealc up3 backdoor discovery dropper evasion loader persistence rootkit spyware stealer trojan upx

Malware Config

Extracted

Family

stealc

http://5.42.65.39

Attributes

url_path
/bed95ea4798a5204.php

rc4.plain

Extracted

Family

smokeloader

Botnet

up3

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 4 IoCs

resource	yara_rule
behavioral1/memory/4108-304-0x0000000005190000-0x0000000005A7B000-memory.dmp	family_glupteba
behavioral1/memory/4108-305-0x0000000000400000-0x0000000002FB3000-memory.dmp	family_glupteba
behavioral1/memory/4108-329-0x0000000005190000-0x0000000005A7B000-memory.dmp	family_glupteba
behavioral1/memory/4108-333-0x0000000000400000-0x0000000002FB3000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 4276 created 3104	4276	latestX.exe	44
PID 4276 created 3104	4276	latestX.exe	44
PID 4276 created 3104	4276	latestX.exe	44
PID 4276 created 3104	4276	latestX.exe	44
PID 4276 created 3104	4276	latestX.exe	44
PID 792 created 3104	792	updater.exe	44
PID 792 created 3104	792	updater.exe	44
PID 792 created 3104	792	updater.exe	44
PID 792 created 3104	792	updater.exe	44
PID 792 created 3104	792	updater.exe	44
PID 792 created 3104	792	updater.exe	44

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4424	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	kos1.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	kos.exe

Executes dropped EXE 16 IoCs

pid	Process
520	toolspub2.exe
4108	31839b57a4f11171d6abc8bbc4451ee4.exe
5072	Setup.exe
3960	kos1.exe
4276	latestX.exe
1724	set16.exe
4388	is-RNR78.tmp
2112	kos.exe
772	previewer.exe
3556	previewer.exe
792	updater.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
1408	csrss.exe
4136	injector.exe
2168	windefender.exe
4336	windefender.exe

Loads dropped DLL 5 IoCs

pid	Process
4388	is-RNR78.tmp
4388	is-RNR78.tmp
4388	is-RNR78.tmp
3384	InstallUtil.exe
3384	InstallUtil.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002325d-668.dat	upx
behavioral1/files/0x000700000002325d-673.dat	upx
behavioral1/files/0x000700000002325d-674.dat	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31839b57a4f11171d6abc8bbc4451ee4.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5072 set thread context of 3384	5072	Setup.exe	109
PID 792 set thread context of 560	792	updater.exe	164
PID 792 set thread context of 2744	792	updater.exe	165

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	31839b57a4f11171d6abc8bbc4451ee4.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PA Previewer\is-JAVVB.tmp	is-RNR78.tmp
File created	C:\Program Files (x86)\PA Previewer\is-UE8UV.tmp	is-RNR78.tmp
File created	C:\Program Files (x86)\PA Previewer\is-GSKGP.tmp	is-RNR78.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-RNR78.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-RNR78.tmp
File created	C:\Program Files (x86)\PA Previewer\is-T66E7.tmp	is-RNR78.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-RNR78.tmp

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\rss\csrss.exe	31839b57a4f11171d6abc8bbc4451ee4.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4240	sc.exe
4004	sc.exe
556	sc.exe
3280	sc.exe
5084	sc.exe
4772	sc.exe
548	sc.exe
2696	sc.exe
3616	sc.exe
3052	sc.exe
1076	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	InstallUtil.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	InstallUtil.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2764	schtasks.exe
3444	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-391 = "Arab Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-492 = "India Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-751 = "Tonga Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-572 = "China Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1721 = "Libya Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2161 = "Altai Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-211 = "Pacific Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3052 = "Qyzylorda Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1971 = "Belarus Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2162 = "Altai Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-1722 = "Libya Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2571 = "Turks and Caicos Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-392 = "Arab Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-3141 = "South Sudan Daylight Time"	31839b57a4f11171d6abc8bbc4451ee4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3384	InstallUtil.exe
3384	InstallUtil.exe
4276	latestX.exe
4276	latestX.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
4276	latestX.exe
4276	latestX.exe
4276	latestX.exe
4276	latestX.exe
4276	latestX.exe
4276	latestX.exe
3896	powershell.exe
3896	powershell.exe
3896	powershell.exe
4276	latestX.exe
4276	latestX.exe
4692	powershell.exe
4692	powershell.exe
4108	31839b57a4f11171d6abc8bbc4451ee4.exe
4108	31839b57a4f11171d6abc8bbc4451ee4.exe
4240	powershell.exe
4240	powershell.exe
792	updater.exe
792	updater.exe
1284	powershell.exe
1284	powershell.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
4872	31839b57a4f11171d6abc8bbc4451ee4.exe
3644	powershell.exe
792	updater.exe
792	updater.exe
3644	powershell.exe
792	updater.exe
792	updater.exe
792	updater.exe
792	updater.exe
3300	powershell.exe
3300	powershell.exe
4708	powershell.exe
4708	powershell.exe
792	updater.exe
792	updater.exe
792	updater.exe
792	updater.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe
2744	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	kos.exe
Token: SeDebugPrivilege	772	previewer.exe
Token: SeDebugPrivilege	3556	previewer.exe
Token: SeDebugPrivilege	5072	Setup.exe
Token: SeDebugPrivilege	3560	powershell.exe
Token: SeShutdownPrivilege	3804	powercfg.exe
Token: SeCreatePagefilePrivilege	3804	powercfg.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeShutdownPrivilege	720	powercfg.exe
Token: SeCreatePagefilePrivilege	720	powercfg.exe
Token: SeShutdownPrivilege	1568	powercfg.exe
Token: SeCreatePagefilePrivilege	1568	powercfg.exe
Token: SeShutdownPrivilege	3912	powercfg.exe
Token: SeCreatePagefilePrivilege	3912	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3896	powershell.exe
Token: SeSecurityPrivilege	3896	powershell.exe
Token: SeTakeOwnershipPrivilege	3896	powershell.exe
Token: SeLoadDriverPrivilege	3896	powershell.exe
Token: SeSystemProfilePrivilege	3896	powershell.exe
Token: SeSystemtimePrivilege	3896	powershell.exe
Token: SeProfSingleProcessPrivilege	3896	powershell.exe
Token: SeIncBasePriorityPrivilege	3896	powershell.exe
Token: SeCreatePagefilePrivilege	3896	powershell.exe
Token: SeBackupPrivilege	3896	powershell.exe
Token: SeRestorePrivilege	3896	powershell.exe
Token: SeShutdownPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeSystemEnvironmentPrivilege	3896	powershell.exe
Token: SeRemoteShutdownPrivilege	3896	powershell.exe
Token: SeUndockPrivilege	3896	powershell.exe
Token: SeManageVolumePrivilege	3896	powershell.exe
Token: 33	3896	powershell.exe
Token: 34	3896	powershell.exe
Token: 35	3896	powershell.exe
Token: 36	3896	powershell.exe
Token: SeIncreaseQuotaPrivilege	3896	powershell.exe
Token: SeSecurityPrivilege	3896	powershell.exe
Token: SeTakeOwnershipPrivilege	3896	powershell.exe
Token: SeLoadDriverPrivilege	3896	powershell.exe
Token: SeSystemProfilePrivilege	3896	powershell.exe
Token: SeSystemtimePrivilege	3896	powershell.exe
Token: SeProfSingleProcessPrivilege	3896	powershell.exe
Token: SeIncBasePriorityPrivilege	3896	powershell.exe
Token: SeCreatePagefilePrivilege	3896	powershell.exe
Token: SeBackupPrivilege	3896	powershell.exe
Token: SeRestorePrivilege	3896	powershell.exe
Token: SeShutdownPrivilege	3896	powershell.exe
Token: SeDebugPrivilege	3896	powershell.exe
Token: SeSystemEnvironmentPrivilege	3896	powershell.exe
Token: SeRemoteShutdownPrivilege	3896	powershell.exe
Token: SeUndockPrivilege	3896	powershell.exe
Token: SeManageVolumePrivilege	3896	powershell.exe
Token: 33	3896	powershell.exe
Token: 34	3896	powershell.exe
Token: 35	3896	powershell.exe
Token: 36	3896	powershell.exe
Token: SeIncreaseQuotaPrivilege	3896	powershell.exe
Token: SeSecurityPrivilege	3896	powershell.exe
Token: SeTakeOwnershipPrivilege	3896	powershell.exe
Token: SeLoadDriverPrivilege	3896	powershell.exe
Token: SeSystemProfilePrivilege	3896	powershell.exe
Token: SeSystemtimePrivilege	3896	powershell.exe
Token: SeProfSingleProcessPrivilege	3896	powershell.exe
Token: SeIncBasePriorityPrivilege	3896	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 520	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	87
PID 3552 wrote to memory of 520	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	87
PID 3552 wrote to memory of 520	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	87
PID 3552 wrote to memory of 4108	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	88
PID 3552 wrote to memory of 4108	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	88
PID 3552 wrote to memory of 4108	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	88
PID 3552 wrote to memory of 5072	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	89
PID 3552 wrote to memory of 5072	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	89
PID 3552 wrote to memory of 5072	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	89
PID 3552 wrote to memory of 3960	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	90
PID 3552 wrote to memory of 3960	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	90
PID 3552 wrote to memory of 3960	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	90
PID 3552 wrote to memory of 4276	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	91
PID 3552 wrote to memory of 4276	3552	c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe	91
PID 3960 wrote to memory of 1724	3960	kos1.exe	93
PID 3960 wrote to memory of 1724	3960	kos1.exe	93
PID 3960 wrote to memory of 1724	3960	kos1.exe	93
PID 1724 wrote to memory of 4388	1724	set16.exe	92
PID 1724 wrote to memory of 4388	1724	set16.exe	92
PID 1724 wrote to memory of 4388	1724	set16.exe	92
PID 3960 wrote to memory of 2112	3960	kos1.exe	94
PID 3960 wrote to memory of 2112	3960	kos1.exe	94
PID 4388 wrote to memory of 1276	4388	is-RNR78.tmp	95
PID 4388 wrote to memory of 1276	4388	is-RNR78.tmp	95
PID 4388 wrote to memory of 1276	4388	is-RNR78.tmp	95
PID 4388 wrote to memory of 772	4388	is-RNR78.tmp	97
PID 4388 wrote to memory of 772	4388	is-RNR78.tmp	97
PID 4388 wrote to memory of 772	4388	is-RNR78.tmp	97
PID 4388 wrote to memory of 3556	4388	is-RNR78.tmp	99
PID 4388 wrote to memory of 3556	4388	is-RNR78.tmp	99
PID 4388 wrote to memory of 3556	4388	is-RNR78.tmp	99
PID 1276 wrote to memory of 2752	1276	net.exe	100
PID 1276 wrote to memory of 2752	1276	net.exe	100
PID 1276 wrote to memory of 2752	1276	net.exe	100
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 5072 wrote to memory of 3384	5072	Setup.exe	109
PID 4996 wrote to memory of 5084	4996	cmd.exe	118
PID 4996 wrote to memory of 5084	4996	cmd.exe	118
PID 4996 wrote to memory of 4772	4996	cmd.exe	119
PID 4996 wrote to memory of 4772	4996	cmd.exe	119
PID 4996 wrote to memory of 548	4996	cmd.exe	120
PID 4996 wrote to memory of 548	4996	cmd.exe	120
PID 4996 wrote to memory of 2696	4996	cmd.exe	121
PID 4996 wrote to memory of 2696	4996	cmd.exe	121
PID 4996 wrote to memory of 4240	4996	cmd.exe	122
PID 4996 wrote to memory of 4240	4996	cmd.exe	122
PID 4828 wrote to memory of 3804	4828	cmd.exe	127
PID 4828 wrote to memory of 3804	4828	cmd.exe	127
PID 4828 wrote to memory of 720	4828	cmd.exe	128
PID 4828 wrote to memory of 720	4828	cmd.exe	128
PID 4828 wrote to memory of 1568	4828	cmd.exe	129
PID 4828 wrote to memory of 1568	4828	cmd.exe	129
PID 4828 wrote to memory of 3912	4828	cmd.exe	130
PID 4828 wrote to memory of 3912	4828	cmd.exe	130
PID 4108 wrote to memory of 4692	4108	31839b57a4f11171d6abc8bbc4451ee4.exe	134
PID 4108 wrote to memory of 4692	4108	31839b57a4f11171d6abc8bbc4451ee4.exe	134
PID 4108 wrote to memory of 4692	4108	31839b57a4f11171d6abc8bbc4451ee4.exe	134
PID 4872 wrote to memory of 4240	4872	31839b57a4f11171d6abc8bbc4451ee4.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3104
- C:\Users\Admin\AppData\Local\Temp\c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe
  "C:\Users\Admin\AppData\Local\Temp\c81cee973bcb85d3ab943e32fe4a19cdc3fa195fbce18e6c3ea8ed16bd1678fc.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    PID:520
- - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
    "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4240
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:4736
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:4424
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3644
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4708
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        
        PID:1408
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:924
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2764
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1152
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1168
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:4136
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3444
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:3384
- - C:\Users\Admin\AppData\Local\Temp\kos1.exe
    "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3560
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:5084
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4772
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:548
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2696
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4240
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3896
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:4432
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4004
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3616
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:3052
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:556
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1076
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3704
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3268
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:3172
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:1296
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3300
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:560
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Users\Admin\AppData\Local\Temp\is-O19BK.tmp\is-RNR78.tmp
"C:\Users\Admin\AppData\Local\Temp\is-O19BK.tmp\is-RNR78.tmp" /SL4 $701D8 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\system32\net.exe" helpmsg 8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 helpmsg 8
    3⤵
    PID:2752
- C:\Program Files (x86)\PA Previewer\previewer.exe
  "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:772
- C:\Program Files (x86)\PA Previewer\previewer.exe
  "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3556

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:792

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
c16b84b87950a744970b37b3c2017a3d

SHA1
e86bc77ec93867e79570481aab63b35b1debbcd3

SHA256
00125fb874735d6abba817aabe13b50b4cc8047c76fd34dfbd581aaa860b7ad5

SHA512
2340fb3177df1ab8c6dc8469755561d2dcf77de11ce0d4488ef630e105227de28259eb9c3a335086fa7fc5e9748f5606de105e62feeed96e7fe137040ae5d383

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
116B

MD5
ec6aae2bb7d8781226ea61adca8f0586

SHA1
d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

SHA256
b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

SHA512
aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
1.9MB

MD5
4c7efd165af03d720ce4a9d381bfb29a

SHA1
92b14564856155487a57db57b8a222b7f57a81e9

SHA256
f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8

SHA512
38a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
1.9MB

MD5
4c7efd165af03d720ce4a9d381bfb29a

SHA1
92b14564856155487a57db57b8a222b7f57a81e9

SHA256
f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8

SHA512
38a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Setup.exe

Filesize
1.9MB

MD5
4c7efd165af03d720ce4a9d381bfb29a

SHA1
92b14564856155487a57db57b8a222b7f57a81e9

SHA256
f5bbe3fdc27074249c6860b8959a155e6c79571daa86e7a574656a3c5c6326b8

SHA512
38a26722e2669e7432b5a068b08ff852988a26ed875e8aa23156ea4bd0e852686ccabe6e685d5b0e888cb5755cbe424189fb8033ada37994417d3549b10637dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2bc5m0ut.b3a.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O19BK.tmp\is-RNR78.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O19BK.tmp\is-RNR78.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OVDS9.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OVDS9.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-OVDS9.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
216KB

MD5
fd134e455dc6caf3b95e7f4dfefb1550

SHA1
bc7fef4d1e9bdb19e79b2d4f0b66ef627e977882

SHA256
aadebe52d66f6c135cdccbf672ba6e7797097c830bb6ee11d8523d5de169d82f

SHA512
a38dada18974648f2291bc08d6c32b8670a86b856e15a51d9836e832e7c4074ebc31e0f78778c65da49c4d91ac23a23c6a686179c82b6a76ed0096c5e1eb83c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
216KB

MD5
fd134e455dc6caf3b95e7f4dfefb1550

SHA1
bc7fef4d1e9bdb19e79b2d4f0b66ef627e977882

SHA256
aadebe52d66f6c135cdccbf672ba6e7797097c830bb6ee11d8523d5de169d82f

SHA512
a38dada18974648f2291bc08d6c32b8670a86b856e15a51d9836e832e7c4074ebc31e0f78778c65da49c4d91ac23a23c6a686179c82b6a76ed0096c5e1eb83c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
216KB

MD5
fd134e455dc6caf3b95e7f4dfefb1550

SHA1
bc7fef4d1e9bdb19e79b2d4f0b66ef627e977882

SHA256
aadebe52d66f6c135cdccbf672ba6e7797097c830bb6ee11d8523d5de169d82f

SHA512
a38dada18974648f2291bc08d6c32b8670a86b856e15a51d9836e832e7c4074ebc31e0f78778c65da49c4d91ac23a23c6a686179c82b6a76ed0096c5e1eb83c4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
3d086a433708053f9bf9523e1d87a4e8

SHA1
b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

SHA256
6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

SHA512
931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
3d2d52b866b5881d5b297047bc9eed88

SHA1
0e7edce1e3dbe5465fc38511c34e11f95ba45192

SHA256
758eebc1dd1f87c50e7e5504fd643727df7d4aeeaeca61d100d9e9e85369c96e

SHA512
e681d7766db861a6fc1270cfbb669053911bb27cc88fb53dd5656ed08798634d71dca61634767111e80019ed896fd062aa83bc3cf845fd266a22f2483fdcb599

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
dfacc4cad63887ba4524b8fe4b7baace

SHA1
92ac25d80a48cb7878c0147ea633ee21870a6783

SHA256
fcf8191220ae29af9cfd6e7b1116ee00934912abbb1631341cd4c194307a893c

SHA512
a2dd765ef3fe2e0ee1b730db2b4bfeb84fe41136be1f8673b6450aa61e0d154e6401abad6b0d5b2978a61e083bde22cb6af241a0bbf85e6808f49d0bc304f88a

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
cd03ea7c9f133b5d8d2cccc94725a9e6

SHA1
34f3d2e059db1380464547e9f5a26473cbda9257

SHA256
a32e2f06a243f82ed823d5103ddfe5bf633eb60e6b6896ac018848c986e78c38

SHA512
59fc5a3d8406e46f91f0cca785ab93eaeb8392e2498297ac24962176f2d829f0af91fa0b55151008e2d933bd7bb23a9ff2ccffd190b293a8dc3a671970652fd2

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
9a3a5aec7c5ac694ff910ebd5a8756ad

SHA1
497f6273f306a62101401aea271a1785af29b544

SHA256
c0759fae8add6aad092691329e69883881970c51f18381427b0ca054fd4b72bb

SHA512
681c28e602c9ff09b409282caf937cd48e79e5995e55d4275f766dc529b43d4765c8dec0398039864d3650eda83bda30e275e19cbd95c498af0a6b5780b00755

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
5862f08ed44b0be3efb38adea7c8e461

SHA1
660d969c4f5ab7dafe50b88993a5d82c18a00376

SHA256
84b044b40f5b7af7af9b6221fc10208b31e27da4f6f45bfa221fc01e16f0b279

SHA512
712d2225793d4f274b74610a5eec6cbba481f6d4b51c453a496ae0c0eb2263c0646384a9bb44d172c6938b756bcc8f5da2a7d190068130687f2f614900a973d9

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
9066252ec48e20ddd82d2ec928cb7867

SHA1
222cbf0415a3166b1f55ff1ba293c4f8b5b840c8

SHA256
97501b83431f3b3f369d96c268ef1de99d588e74f0b28d7b853ff3ebf259f96c

SHA512
4be0962e8cfdb2e723b87a76c9b43c5d3bb5e432e7ef3f28146056ec0cb854256a0a67c44fd9fabfbb66e5f150047890b76bab3d5bf86175a94e33d9d6f4e7f2

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/520-302-0x0000000000700000-0x0000000000709000-memory.dmp

Filesize
36KB

Download
memory/520-309-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/520-301-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/772-128-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/772-133-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/1724-145-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1724-75-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2112-112-0x00007FF980DC0000-0x00007FF981881000-memory.dmp

Filesize
10.8MB

Download
memory/2112-113-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2112-152-0x000000001B030000-0x000000001B040000-memory.dmp

Filesize
64KB

Download
memory/2112-147-0x00007FF980DC0000-0x00007FF981881000-memory.dmp

Filesize
10.8MB

Download
memory/2112-153-0x00007FF980DC0000-0x00007FF981881000-memory.dmp

Filesize
10.8MB

Download
memory/2112-96-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/3384-182-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/3384-253-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/3384-179-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/3384-188-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/3384-186-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/3552-0-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3552-1-0x0000000000990000-0x00000000016E0000-memory.dmp

Filesize
13.3MB

Download
memory/3552-70-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3556-291-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3556-257-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3556-144-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/3560-261-0x00007FF980E20000-0x00007FF9818E1000-memory.dmp

Filesize
10.8MB

Download
memory/3560-274-0x00000165F10E0000-0x00000165F10F0000-memory.dmp

Filesize
64KB

Download
memory/3560-276-0x00007FF980E20000-0x00007FF9818E1000-memory.dmp

Filesize
10.8MB

Download
memory/3560-269-0x00000165D8A40000-0x00000165D8A62000-memory.dmp

Filesize
136KB

Download
memory/3560-263-0x00000165F10E0000-0x00000165F10F0000-memory.dmp

Filesize
64KB

Download
memory/3560-262-0x00000165F10E0000-0x00000165F10F0000-memory.dmp

Filesize
64KB

Download
memory/3896-289-0x000001C6CE7F0000-0x000001C6CE800000-memory.dmp

Filesize
64KB

Download
memory/3896-292-0x000001C6CE7F0000-0x000001C6CE800000-memory.dmp

Filesize
64KB

Download
memory/3896-294-0x00007FF980E20000-0x00007FF9818E1000-memory.dmp

Filesize
10.8MB

Download
memory/3896-287-0x00007FF980E20000-0x00007FF9818E1000-memory.dmp

Filesize
10.8MB

Download
memory/3896-288-0x000001C6CE7F0000-0x000001C6CE800000-memory.dmp

Filesize
64KB

Download
memory/3960-129-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3960-49-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/3960-48-0x00000000006D0000-0x0000000000844000-memory.dmp

Filesize
1.5MB

Download
memory/4108-305-0x0000000000400000-0x0000000002FB3000-memory.dmp

Filesize
43.7MB

Download
memory/4108-333-0x0000000000400000-0x0000000002FB3000-memory.dmp

Filesize
43.7MB

Download
memory/4108-313-0x0000000004D90000-0x0000000005189000-memory.dmp

Filesize
4.0MB

Download
memory/4108-329-0x0000000005190000-0x0000000005A7B000-memory.dmp

Filesize
8.9MB

Download
memory/4108-304-0x0000000005190000-0x0000000005A7B000-memory.dmp

Filesize
8.9MB

Download
memory/4108-303-0x0000000004D90000-0x0000000005189000-memory.dmp

Filesize
4.0MB

Download
memory/4276-297-0x00007FF74ECB0000-0x00007FF74F251000-memory.dmp

Filesize
5.6MB

Download
memory/4276-148-0x00007FF74ECB0000-0x00007FF74F251000-memory.dmp

Filesize
5.6MB

Download
memory/4388-151-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/4388-114-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/4692-336-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/4692-335-0x0000000006130000-0x0000000006174000-memory.dmp

Filesize
272KB

Download
memory/4692-331-0x0000000005C00000-0x0000000005C1E000-memory.dmp

Filesize
120KB

Download
memory/4692-328-0x0000000005730000-0x0000000005A84000-memory.dmp

Filesize
3.3MB

Download
memory/4692-310-0x0000000004620000-0x0000000004656000-memory.dmp

Filesize
216KB

Download
memory/4692-311-0x0000000074260000-0x0000000074A10000-memory.dmp

Filesize
7.7MB

Download
memory/4692-312-0x0000000004700000-0x0000000004710000-memory.dmp

Filesize
64KB

Download
memory/4692-314-0x0000000004D40000-0x0000000005368000-memory.dmp

Filesize
6.2MB

Download
memory/4692-332-0x0000000005C50000-0x0000000005C9C000-memory.dmp

Filesize
304KB

Download
memory/4692-315-0x0000000004B00000-0x0000000004B22000-memory.dmp

Filesize
136KB

Download
memory/4692-316-0x0000000005370000-0x00000000053D6000-memory.dmp

Filesize
408KB

Download
memory/4692-317-0x0000000005550000-0x00000000055B6000-memory.dmp

Filesize
408KB

Download
memory/5072-168-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-154-0x0000000005840000-0x000000000585C000-memory.dmp

Filesize
112KB

Download
memory/5072-185-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/5072-170-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-172-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-174-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-176-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-164-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-162-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-160-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-158-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-156-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-155-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-166-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-178-0x0000000005840000-0x0000000005855000-memory.dmp

Filesize
84KB

Download
memory/5072-180-0x0000000005930000-0x0000000005931000-memory.dmp

Filesize
4KB

Download
memory/5072-146-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/5072-143-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download
memory/5072-184-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/5072-86-0x00000000057F0000-0x00000000057FA000-memory.dmp

Filesize
40KB

Download
memory/5072-81-0x00000000059C0000-0x00000000059D0000-memory.dmp

Filesize
64KB

Download
memory/5072-78-0x0000000005880000-0x000000000591C000-memory.dmp

Filesize
624KB

Download
memory/5072-76-0x0000000005640000-0x00000000056D2000-memory.dmp

Filesize
584KB

Download
memory/5072-62-0x0000000005BF0000-0x0000000006194000-memory.dmp

Filesize
5.6MB

Download
memory/5072-56-0x0000000000B70000-0x0000000000D68000-memory.dmp

Filesize
2.0MB

Download
memory/5072-54-0x0000000074590000-0x0000000074D40000-memory.dmp

Filesize
7.7MB

Download