glupteba | 7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a

Analysis

max time kernel
136s
max time network
196s
platform
windows10-1703_x64
resource
win10-20230915-en
resource tags

arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
submitted
12/10/2023, 06:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe
Size

11.4MB
MD5

83641f68c3d137c867ba96e05488a6f2
SHA1

1576f8241d3f3349940636951511c400021ed16f
SHA256

7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a
SHA512

b682b4a7e8830349d63b9d0ee6cf340db1f2b31bbbaec0eb491ab2783ff6e2bb18c868d33ae6c19908e8612e91200cd525356e0216aed13ac4ca72525e0ef067
SSDEEP

196608:d+Vl3y6ZHYgg8K6RrpICn9UG8k7StZW4S80UehjyKmFyaculAMhxPuZOof:aVZHYaKorptn9X7SS4fn8aPAQ2Y

Score

10^/10

glupteba xmrig discovery dropper evasion loader miner persistence trojan upx

Malware Config

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 13 IoCs

resource	yara_rule
behavioral1/memory/4248-62-0x0000000004770000-0x000000000505B000-memory.dmp	family_glupteba
behavioral1/memory/4248-72-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/4248-95-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/4248-102-0x0000000004770000-0x000000000505B000-memory.dmp	family_glupteba
behavioral1/memory/4248-105-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/4248-168-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/4248-333-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/4248-489-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/3204-556-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/3204-948-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/3204-1298-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/3736-1961-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba
behavioral1/memory/3736-2430-0x0000000000400000-0x0000000002663000-memory.dmp	family_glupteba

Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs

description	pid	Process	procid_target
PID 1160 created 3264	1160	latestX.exe	26
PID 1160 created 3264	1160	latestX.exe	26
PID 1160 created 3264	1160	latestX.exe	26
PID 1160 created 3264	1160	latestX.exe	26
PID 1160 created 3264	1160	latestX.exe	26
PID 2280 created 3264	2280	updater.exe	26
PID 2280 created 3264	2280	updater.exe	26
PID 2280 created 3264	2280	updater.exe	26
PID 2280 created 3264	2280	updater.exe	26

Windows security bypass 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d21cbe21e38b385a41a68c5e6dd32f4c.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral1/memory/2280-2533-0x00007FF6B10A0000-0x00007FF6B1641000-memory.dmp	xmrig

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
4832	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 13 IoCs

pid	Process
5008	toolspub2.exe
4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe
1872	kos1.exe
1160	latestX.exe
5056	set16.exe
4476	kos.exe
5108	is-TKLO3.tmp
5112	previewer.exe
212	previewer.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
2280	updater.exe
3736	csrss.exe
836	injector.exe

Loads dropped DLL 3 IoCs

pid	Process
5108	is-TKLO3.tmp
5108	is-TKLO3.tmp
5108	is-TKLO3.tmp

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001afc5-2544.dat	upx
behavioral1/files/0x000800000001afc5-2546.dat	upx
behavioral1/files/0x000800000001afc5-2547.dat	upx

Windows security modification 2 TTPs 7 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\csrss.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\windefender.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\d21cbe21e38b385a41a68c5e6dd32f4c.exe = "0"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1894964180-3551943068-3090682958-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	Conhost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PA Previewer\unins000.dat	is-TKLO3.tmp
File created	C:\Program Files (x86)\PA Previewer\is-0I3EU.tmp	is-TKLO3.tmp
File created	C:\Program Files (x86)\PA Previewer\is-D4DCU.tmp	is-TKLO3.tmp
File created	C:\Program Files (x86)\PA Previewer\is-OHRK2.tmp	is-TKLO3.tmp
File created	C:\Program Files (x86)\PA Previewer\is-I7PE0.tmp	is-TKLO3.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\unins000.dat	is-TKLO3.tmp
File opened for modification	C:\Program Files (x86)\PA Previewer\previewer.exe	is-TKLO3.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	d21cbe21e38b385a41a68c5e6dd32f4c.exe
File created	C:\Windows\rss\csrss.exe	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1552	sc.exe
3608	sc.exe
3780	sc.exe
3384	sc.exe
3116	sc.exe
4056	sc.exe
3780	sc.exe
356	sc.exe
3252	sc.exe
644	sc.exe
2504	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2876	schtasks.exe
3384	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	csrss.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\NetTrace\Session	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	Conhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	d21cbe21e38b385a41a68c5e6dd32f4c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4216	powershell.exe
4216	powershell.exe
4216	powershell.exe
1160	latestX.exe
1160	latestX.exe
776	powershell.exe
776	powershell.exe
776	powershell.exe
1160	latestX.exe
1160	latestX.exe
1160	latestX.exe
1160	latestX.exe
1160	latestX.exe
1160	latestX.exe
232	powershell.exe
4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe
4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe
232	powershell.exe
232	powershell.exe
1880	powershell.exe
1880	powershell.exe
1160	latestX.exe
1160	latestX.exe
1880	powershell.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe
3456	powershell.exe
3456	powershell.exe
3456	powershell.exe
376	powershell.exe
376	powershell.exe
376	powershell.exe
2280	updater.exe
2280	updater.exe
4156	powershell.exe
4156	powershell.exe
4156	powershell.exe
984	Conhost.exe
984	Conhost.exe
984	Conhost.exe
2280	updater.exe
2280	updater.exe
2280	updater.exe
2280	updater.exe
2280	updater.exe
2280	updater.exe
3020	powershell.exe
3020	powershell.exe
3020	powershell.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
4020	powershell.exe
4020	powershell.exe
4020	powershell.exe
836	injector.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	kos.exe
Token: SeDebugPrivilege	5112	previewer.exe
Token: SeDebugPrivilege	212	previewer.exe
Token: SeDebugPrivilege	4216	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeIncreaseQuotaPrivilege	776	powershell.exe
Token: SeSecurityPrivilege	776	powershell.exe
Token: SeTakeOwnershipPrivilege	776	powershell.exe
Token: SeLoadDriverPrivilege	776	powershell.exe
Token: SeSystemProfilePrivilege	776	powershell.exe
Token: SeSystemtimePrivilege	776	powershell.exe
Token: SeProfSingleProcessPrivilege	776	powershell.exe
Token: SeIncBasePriorityPrivilege	776	powershell.exe
Token: SeCreatePagefilePrivilege	776	powershell.exe
Token: SeBackupPrivilege	776	powershell.exe
Token: SeRestorePrivilege	776	powershell.exe
Token: SeShutdownPrivilege	776	powershell.exe
Token: SeDebugPrivilege	776	powershell.exe
Token: SeSystemEnvironmentPrivilege	776	powershell.exe
Token: SeRemoteShutdownPrivilege	776	powershell.exe
Token: SeUndockPrivilege	776	powershell.exe
Token: SeManageVolumePrivilege	776	powershell.exe
Token: 33	776	powershell.exe
Token: 34	776	powershell.exe
Token: 35	776	powershell.exe
Token: 36	776	powershell.exe
Token: SeShutdownPrivilege	3908	powercfg.exe
Token: SeCreatePagefilePrivilege	3908	powercfg.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeShutdownPrivilege	4556	powercfg.exe
Token: SeCreatePagefilePrivilege	4556	powercfg.exe
Token: SeShutdownPrivilege	1872	powercfg.exe
Token: SeCreatePagefilePrivilege	1872	powercfg.exe
Token: SeDebugPrivilege	4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeImpersonatePrivilege	4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe
Token: SeShutdownPrivilege	436	powercfg.exe
Token: SeCreatePagefilePrivilege	436	powercfg.exe
Token: SeIncreaseQuotaPrivilege	232	powershell.exe
Token: SeSecurityPrivilege	232	powershell.exe
Token: SeTakeOwnershipPrivilege	232	powershell.exe
Token: SeLoadDriverPrivilege	232	powershell.exe
Token: SeSystemProfilePrivilege	232	powershell.exe
Token: SeSystemtimePrivilege	232	powershell.exe
Token: SeProfSingleProcessPrivilege	232	powershell.exe
Token: SeIncBasePriorityPrivilege	232	powershell.exe
Token: SeCreatePagefilePrivilege	232	powershell.exe
Token: SeBackupPrivilege	232	powershell.exe
Token: SeRestorePrivilege	232	powershell.exe
Token: SeShutdownPrivilege	232	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeSystemEnvironmentPrivilege	232	powershell.exe
Token: SeRemoteShutdownPrivilege	232	powershell.exe
Token: SeUndockPrivilege	232	powershell.exe
Token: SeManageVolumePrivilege	232	powershell.exe
Token: 33	232	powershell.exe
Token: 34	232	powershell.exe
Token: 35	232	powershell.exe
Token: 36	232	powershell.exe
Token: SeIncreaseQuotaPrivilege	232	powershell.exe
Token: SeSecurityPrivilege	232	powershell.exe
Token: SeTakeOwnershipPrivilege	232	powershell.exe
Token: SeLoadDriverPrivilege	232	powershell.exe
Token: SeSystemProfilePrivilege	232	powershell.exe
Token: SeSystemtimePrivilege	232	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 5008	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	70
PID 1016 wrote to memory of 5008	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	70
PID 1016 wrote to memory of 5008	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	70
PID 1016 wrote to memory of 4248	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	71
PID 1016 wrote to memory of 4248	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	71
PID 1016 wrote to memory of 4248	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	71
PID 1016 wrote to memory of 1872	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	72
PID 1016 wrote to memory of 1872	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	72
PID 1016 wrote to memory of 1872	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	72
PID 1016 wrote to memory of 1160	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	73
PID 1016 wrote to memory of 1160	1016	7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe	73
PID 1872 wrote to memory of 5056	1872	powercfg.exe	74
PID 1872 wrote to memory of 5056	1872	powercfg.exe	74
PID 1872 wrote to memory of 5056	1872	powercfg.exe	74
PID 1872 wrote to memory of 4476	1872	powercfg.exe	75
PID 1872 wrote to memory of 4476	1872	powercfg.exe	75
PID 5056 wrote to memory of 5108	5056	set16.exe	76
PID 5056 wrote to memory of 5108	5056	set16.exe	76
PID 5056 wrote to memory of 5108	5056	set16.exe	76
PID 5108 wrote to memory of 444	5108	is-TKLO3.tmp	78
PID 5108 wrote to memory of 444	5108	is-TKLO3.tmp	78
PID 5108 wrote to memory of 444	5108	is-TKLO3.tmp	78
PID 5108 wrote to memory of 5112	5108	is-TKLO3.tmp	77
PID 5108 wrote to memory of 5112	5108	is-TKLO3.tmp	77
PID 5108 wrote to memory of 5112	5108	is-TKLO3.tmp	77
PID 5108 wrote to memory of 212	5108	is-TKLO3.tmp	80
PID 5108 wrote to memory of 212	5108	is-TKLO3.tmp	80
PID 5108 wrote to memory of 212	5108	is-TKLO3.tmp	80
PID 444 wrote to memory of 776	444	net.exe	87
PID 444 wrote to memory of 776	444	net.exe	87
PID 444 wrote to memory of 776	444	net.exe	87
PID 4248 wrote to memory of 4216	4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe	85
PID 4248 wrote to memory of 4216	4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe	85
PID 4248 wrote to memory of 4216	4248	d21cbe21e38b385a41a68c5e6dd32f4c.exe	85
PID 2604 wrote to memory of 3780	2604	cmd.exe	128
PID 2604 wrote to memory of 3780	2604	cmd.exe	128
PID 2604 wrote to memory of 3384	2604	cmd.exe	94
PID 2604 wrote to memory of 3384	2604	cmd.exe	94
PID 2604 wrote to memory of 1552	2604	cmd.exe	93
PID 2604 wrote to memory of 1552	2604	cmd.exe	93
PID 2604 wrote to memory of 3608	2604	cmd.exe	95
PID 2604 wrote to memory of 3608	2604	cmd.exe	95
PID 2604 wrote to memory of 3116	2604	cmd.exe	96
PID 2604 wrote to memory of 3116	2604	cmd.exe	96
PID 1888 wrote to memory of 3908	1888	Process not Found	101
PID 1888 wrote to memory of 3908	1888	Process not Found	101
PID 1888 wrote to memory of 4556	1888	Process not Found	103
PID 1888 wrote to memory of 4556	1888	Process not Found	103
PID 1888 wrote to memory of 1872	1888	Process not Found	104
PID 1888 wrote to memory of 1872	1888	Process not Found	104
PID 1888 wrote to memory of 436	1888	Process not Found	106
PID 1888 wrote to memory of 436	1888	Process not Found	106
PID 3204 wrote to memory of 1880	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	108
PID 3204 wrote to memory of 1880	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	108
PID 3204 wrote to memory of 1880	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	108
PID 3204 wrote to memory of 2604	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	113
PID 3204 wrote to memory of 2604	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	113
PID 2604 wrote to memory of 4832	2604	cmd.exe	115
PID 2604 wrote to memory of 4832	2604	cmd.exe	115
PID 3204 wrote to memory of 3456	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	117
PID 3204 wrote to memory of 3456	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	117
PID 3204 wrote to memory of 3456	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	117
PID 3204 wrote to memory of 376	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	118
PID 3204 wrote to memory of 376	3204	d21cbe21e38b385a41a68c5e6dd32f4c.exe	118

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3264
- C:\Users\Admin\AppData\Local\Temp\7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe
  "C:\Users\Admin\AppData\Local\Temp\7b56b03a973a7f1d05ae4936c945ddb59601fe808dd6149fd5d4571dda90ca7a.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    PID:5008
- - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
    "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4248
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
      "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
      4⤵
      Windows security bypass
      Executes dropped EXE
      Windows security modification
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3204
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:1880
    - - C:\Windows\System32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2604
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        Modifies data under HKEY_USERS
        
        PID:4832
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:3456
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:376
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Modifies data under HKEY_USERS
        
        PID:3736
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        
        PID:984
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2876
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:1592
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4140
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:836
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:3384
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        
        PID:4064
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        
        PID:984
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:2504
- - C:\Users\Admin\AppData\Local\Temp\kos1.exe
    "C:\Users\Admin\AppData\Local\Temp\kos1.exe"
    3⤵
    - Executes dropped EXE
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\set16.exe
      "C:\Users\Admin\AppData\Local\Temp\set16.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\is-PPKIP.tmp\is-TKLO3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-PPKIP.tmp\is-TKLO3.tmp" /SL4 $A0054 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1232936 52224
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of WriteProcessMemory
        
        PID:5108
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -i
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:5112
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 8
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 8
        7⤵
        
        PID:776
      - C:\Program Files (x86)\PA Previewer\previewer.exe
        
        "C:\Program Files (x86)\PA Previewer\previewer.exe" -s
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\kos.exe
      "C:\Users\Admin\AppData\Local\Temp\kos.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:776
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:2604
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3780
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1552
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3384
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3608
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3116
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1888
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3908
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1872
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:232
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3456
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4156
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1616
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3780
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:356
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3252
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:644
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4620
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3896
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4516
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:2276
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:4336
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4860

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2280

C:\Windows\System32\sc.exe
sc stop UsoSvc
1⤵
- Launches sc.exe
PID:4056

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
PID:4188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files (x86)\PA Previewer\previewer.exe

Filesize
1.9MB

MD5
27b85a95804a760da4dbee7ca800c9b4

SHA1
f03136226bf3dd38ba0aa3aad1127ccab380197c

SHA256
f98b98404ecf3871a10a290ade21ad77d0b2633f47247debc53d094b9bdff245

SHA512
e760a15370272aa9541f1afceaaf4f5a8068dad21c6a8d50ebd01514e16bbc8f867c8af349080f3d1fa7a19eafe7cde74921d01716dea69ef801da1b74eae4a7

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
40f03b1237e9b41ad121c2bc0c9fa63b

SHA1
a02185347b2cbe59209f1e50748da597f9a7e04f

SHA256
386078c4f3eec6e8c39c4d2790aa1d512c13a3f87577ae504cde3f619927f984

SHA512
ce8b2c81616ed18422aef7a03ab445ad54984d3a808e8c49601b3ce5e407fa3466c48d3e6a1e93fc1f05269dd79fbbc3bc440e419f91ab713a0aadd2e4eb7a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xr5qlcnb.5bd.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.1MB

MD5
5bf8459b7c594292b7f0f227392e191a

SHA1
35de385bb103bdd9718f256fe28d6b41488a152a

SHA256
cc4093e90e8d52e25ae8f28d8354a853e9a851068d9d6a78b6047ae587831300

SHA512
f9f048b5f6f346c6cace9055e8f12486cefeff5b2ebb31d63f758536311bc77eeeb1f9676eeb97f6c32c2c629f917c62a1b48369c8c86b8856924357452e13f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.1MB

MD5
5bf8459b7c594292b7f0f227392e191a

SHA1
35de385bb103bdd9718f256fe28d6b41488a152a

SHA256
cc4093e90e8d52e25ae8f28d8354a853e9a851068d9d6a78b6047ae587831300

SHA512
f9f048b5f6f346c6cace9055e8f12486cefeff5b2ebb31d63f758536311bc77eeeb1f9676eeb97f6c32c2c629f917c62a1b48369c8c86b8856924357452e13f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

Filesize
4.1MB

MD5
5bf8459b7c594292b7f0f227392e191a

SHA1
35de385bb103bdd9718f256fe28d6b41488a152a

SHA256
cc4093e90e8d52e25ae8f28d8354a853e9a851068d9d6a78b6047ae587831300

SHA512
f9f048b5f6f346c6cace9055e8f12486cefeff5b2ebb31d63f758536311bc77eeeb1f9676eeb97f6c32c2c629f917c62a1b48369c8c86b8856924357452e13f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PPKIP.tmp\is-TKLO3.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PPKIP.tmp\is-TKLO3.tmp

Filesize
647KB

MD5
2fba5642cbcaa6857c3995ccb5d2ee2a

SHA1
91fe8cd860cba7551fbf78bc77cc34e34956e8cc

SHA256
ddec51f3741f3988b9cc792f6f8fc0dfa2098ef0eb84c6a2af7f8da5a72b40fa

SHA512
30613b43427d17115134798506f197c0f5f8b2b9f247668fa25b9dd4853bbd97ac1e27f4e3325dec4f6dfc0e448ebbddb2969ad1a1781aa59ebf522d436aed7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos.exe

Filesize
8KB

MD5
076ab7d1cc5150a5e9f8745cc5f5fb6c

SHA1
7b40783a27a38106e2cc91414f2bc4d8b484c578

SHA256
d1b71081d7ba414b589338329f278ba51c6ccf542d74f131f96c2337ee0a4c90

SHA512
75e274a654e88feb0d66156f387bc5e420811f4f62939396a7455d12e835d7e134b2579ab59976c591b416d1ec1acdf05e9eb290c8f01383c6a50bf43854420b

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos1.exe

Filesize
1.4MB

MD5
85b698363e74ba3c08fc16297ddc284e

SHA1
171cfea4a82a7365b241f16aebdb2aad29f4f7c0

SHA256
78efcbb0c6eb6a4c76c036adc65154b8ff028849f79d508e45babfb527cb7cfe

SHA512
7e4816c43e0addba088709948e8aedc9e39d6802c74a75cfbc2a0e739b44c5b5eef2bb2453b7032c758b0bdb38e4e7a598aa29be015796361b81d7f9e8027796

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\set16.exe

Filesize
1.4MB

MD5
22d5269955f256a444bd902847b04a3b

SHA1
41a83de3273270c3bd5b2bd6528bdc95766aa268

SHA256
ab16986253bd187e3134f27495ef0db4b648f769721bc8c84b708c7ba69156fd

SHA512
d85ada5d8c2c02932a79241a484b088ba70bda0497fd8ad638300935a16841d7cbc8258be93055907cb533bc534fdd48c7c91109fa22f87e65a6b374cd51055c

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
213KB

MD5
92505d71d65f3fd132de5d032d371d63

SHA1
a381f472b41aab5f1241f58e522cfe73b36c7a67

SHA256
3adc2d21a85e8f73b72c75cf9450a7eb2fe843df24b827a9afe1201316d07944

SHA512
4dca261185cdaf561b42e7210e1b3dd7d2eb4832354cbadb6ebbb5da2f07fa3917ddbb1433d19c358587f63483d6e59a1891aa26fb5e33e3c04cd6a353de9cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
213KB

MD5
92505d71d65f3fd132de5d032d371d63

SHA1
a381f472b41aab5f1241f58e522cfe73b36c7a67

SHA256
3adc2d21a85e8f73b72c75cf9450a7eb2fe843df24b827a9afe1201316d07944

SHA512
4dca261185cdaf561b42e7210e1b3dd7d2eb4832354cbadb6ebbb5da2f07fa3917ddbb1433d19c358587f63483d6e59a1891aa26fb5e33e3c04cd6a353de9cdc

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
99cb2b6215f9c5d55810e97edccb8e4c

SHA1
102cef87866e44ca22fd9bb34d8e075783016bd1

SHA256
c2ad10465bed6f85a9175057d1381ca99e5394a7c00643834e99e6dd2a2a9935

SHA512
f09d9b36f88d7ac3f9a4c1c7455b249761aa37c0016c064f82749f3b76f74880bb3d58df9015912ab076f1ee3b6c7ad58f218b220ecd76c547a32f1980750f63

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
505b83b1556d91672fa01f067097f662

SHA1
a322c7be2e786879ea7270b8631710c3881481ea

SHA256
90618ea6b92d4d424b5852b2a2ed56aa3b88c814a388efac1eb30e1089b648fd

SHA512
f63e5af271f2b975cac7e24047ee775bde683f1260c34ff778cfd9f8f5bbdf6ccf405a0d885098c5be01a8b1efd8bed4508e9a138082e92f6fed6fbc08399d8d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
018369b58bcfee2dcbd54310670b976f

SHA1
4b994f709d78d4003cbd07c6d95e92464051e6b8

SHA256
34c432efcc0fe38ed7fca06c466e39e848ade987916af4cd7eb78e9db47ab8ca

SHA512
000fb240eb162386fd96f72bb1331fd98a9364540e4d47c462c65530dccf0a58afe1e5d20cc1b03efe792d52129e0105bbda0c48f21a789d936031ebe1f87688

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
839c2ba72920135881a96b22cc5fef14

SHA1
0890a23f959c675288e8baeb0e209e9d4b0bd257

SHA256
0005be4d08c479a610e0a0f0b2f3d3cc32747d35faf71d08d935e85643f23a71

SHA512
17611eee2d9cf9c392b3562f1529d7bd4b567a53a068f15bee731d51a324eda5e2d3e38c845afdff790438cbb279a23a46918d839d8e2e721ab83704a18577ea

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
21d822055ee952ecf62c5748d5f41cb5

SHA1
090ba299014deec2a98e3a64bbbeeab456316e77

SHA256
78062b7b6b3d27195ed372327db45cd3bbd58274d2e9af8a40ae59da8530dd39

SHA512
cc839d36fcd08f6d48cf53995a95cad21a04b929aa1afa2e8a4964a15c10b28f21a83e999808555143ba97f5fb2ed6f0a94abe28c3a216eac4affbe8855ddee5

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
5bf8459b7c594292b7f0f227392e191a

SHA1
35de385bb103bdd9718f256fe28d6b41488a152a

SHA256
cc4093e90e8d52e25ae8f28d8354a853e9a851068d9d6a78b6047ae587831300

SHA512
f9f048b5f6f346c6cace9055e8f12486cefeff5b2ebb31d63f758536311bc77eeeb1f9676eeb97f6c32c2c629f917c62a1b48369c8c86b8856924357452e13f2

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
5bf8459b7c594292b7f0f227392e191a

SHA1
35de385bb103bdd9718f256fe28d6b41488a152a

SHA256
cc4093e90e8d52e25ae8f28d8354a853e9a851068d9d6a78b6047ae587831300

SHA512
f9f048b5f6f346c6cace9055e8f12486cefeff5b2ebb31d63f758536311bc77eeeb1f9676eeb97f6c32c2c629f917c62a1b48369c8c86b8856924357452e13f2

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
5bf8459b7c594292b7f0f227392e191a

SHA1
35de385bb103bdd9718f256fe28d6b41488a152a

SHA256
cc4093e90e8d52e25ae8f28d8354a853e9a851068d9d6a78b6047ae587831300

SHA512
f9f048b5f6f346c6cace9055e8f12486cefeff5b2ebb31d63f758536311bc77eeeb1f9676eeb97f6c32c2c629f917c62a1b48369c8c86b8856924357452e13f2

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
\Users\Admin\AppData\Local\Temp\is-HPMP0.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-HPMP0.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
\Users\Admin\AppData\Local\Temp\is-HPMP0.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b4786eb1e1a93633ad1b4c112514c893

SHA1
734750b771d0809c88508e4feb788d7701e6dada

SHA256
2ae4169f721beb389a661e6dbb18bc84ef38556af1f46807da9d87aec2a6f06f

SHA512
0882d2aa163ece22796f837111db0d55158098035005e57cd2e9b8d59dc2e582207840bf98bee534b81c368acf60ab5d8ecbe762209273bda067a215cdb2c0c6

Download Submit
memory/212-1832-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-2426-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-235-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-1414-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-527-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-458-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-690-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-92-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-90-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-1054-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/212-874-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/232-475-0x0000019BA6200000-0x0000019BA6210000-memory.dmp

Filesize
64KB

Download
memory/232-476-0x0000019BA6200000-0x0000019BA6210000-memory.dmp

Filesize
64KB

Download
memory/232-470-0x00007FF8DCC20000-0x00007FF8DD60C000-memory.dmp

Filesize
9.9MB

Download
memory/776-411-0x00000149BE5E0000-0x00000149BE656000-memory.dmp

Filesize
472KB

Download
memory/776-382-0x00000149A5DA0000-0x00000149A5DB0000-memory.dmp

Filesize
64KB

Download
memory/776-461-0x00000149A5DA0000-0x00000149A5DB0000-memory.dmp

Filesize
64KB

Download
memory/776-375-0x00007FF8DCC20000-0x00007FF8DD60C000-memory.dmp

Filesize
9.9MB

Download
memory/776-465-0x00007FF8DCC20000-0x00007FF8DD60C000-memory.dmp

Filesize
9.9MB

Download
memory/776-383-0x00000149BE430000-0x00000149BE452000-memory.dmp

Filesize
136KB

Download
memory/776-429-0x00000149A5DA0000-0x00000149A5DB0000-memory.dmp

Filesize
64KB

Download
memory/776-380-0x00000149A5DA0000-0x00000149A5DB0000-memory.dmp

Filesize
64KB

Download
memory/1016-0-0x0000000073E60000-0x000000007454E000-memory.dmp

Filesize
6.9MB

Download
memory/1016-26-0x0000000073E60000-0x000000007454E000-memory.dmp

Filesize
6.9MB

Download
memory/1016-1-0x00000000001B0000-0x0000000000D1A000-memory.dmp

Filesize
11.4MB

Download
memory/1160-536-0x00007FF7A9050000-0x00007FF7A95F1000-memory.dmp

Filesize
5.6MB

Download
memory/1160-495-0x00007FF7A9050000-0x00007FF7A95F1000-memory.dmp

Filesize
5.6MB

Download
memory/1160-97-0x00007FF7A9050000-0x00007FF7A95F1000-memory.dmp

Filesize
5.6MB

Download
memory/1872-43-0x0000000073E60000-0x000000007454E000-memory.dmp

Filesize
6.9MB

Download
memory/1872-20-0x0000000073E60000-0x000000007454E000-memory.dmp

Filesize
6.9MB

Download
memory/1872-21-0x0000000000850000-0x00000000009C4000-memory.dmp

Filesize
1.5MB

Download
memory/2280-740-0x00007FF6B10A0000-0x00007FF6B1641000-memory.dmp

Filesize
5.6MB

Download
memory/2280-2533-0x00007FF6B10A0000-0x00007FF6B1641000-memory.dmp

Filesize
5.6MB

Download
memory/2280-1877-0x00007FF6B10A0000-0x00007FF6B1641000-memory.dmp

Filesize
5.6MB

Download
memory/2280-1580-0x00007FF6B10A0000-0x00007FF6B1641000-memory.dmp

Filesize
5.6MB

Download
memory/3204-556-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/3204-948-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/3204-1298-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/3736-2430-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/3736-1961-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4216-182-0x000000007E710000-0x000000007E720000-memory.dmp

Filesize
64KB

Download
memory/4216-112-0x0000000007270000-0x00000000072D6000-memory.dmp

Filesize
408KB

Download
memory/4216-400-0x0000000009A00000-0x0000000009A1A000-memory.dmp

Filesize
104KB

Download
memory/4216-378-0x0000000006600000-0x0000000006610000-memory.dmp

Filesize
64KB

Download
memory/4216-373-0x000000007E710000-0x000000007E720000-memory.dmp

Filesize
64KB

Download
memory/4216-107-0x0000000072DD0000-0x00000000734BE000-memory.dmp

Filesize
6.9MB

Download
memory/4216-192-0x0000000006600000-0x0000000006610000-memory.dmp

Filesize
64KB

Download
memory/4216-473-0x0000000072DD0000-0x00000000734BE000-memory.dmp

Filesize
6.9MB

Download
memory/4216-191-0x0000000009B40000-0x0000000009BD4000-memory.dmp

Filesize
592KB

Download
memory/4216-190-0x0000000006600000-0x0000000006610000-memory.dmp

Filesize
64KB

Download
memory/4216-189-0x0000000009920000-0x00000000099C5000-memory.dmp

Filesize
660KB

Download
memory/4216-184-0x00000000098C0000-0x00000000098DE000-memory.dmp

Filesize
120KB

Download
memory/4216-108-0x0000000006600000-0x0000000006610000-memory.dmp

Filesize
64KB

Download
memory/4216-183-0x000000006F6F0000-0x000000006FA40000-memory.dmp

Filesize
3.3MB

Download
memory/4216-181-0x0000000071870000-0x00000000718BB000-memory.dmp

Filesize
300KB

Download
memory/4216-180-0x0000000006600000-0x0000000006610000-memory.dmp

Filesize
64KB

Download
memory/4216-179-0x00000000098E0000-0x0000000009913000-memory.dmp

Filesize
204KB

Download
memory/4216-173-0x0000000072DD0000-0x00000000734BE000-memory.dmp

Filesize
6.9MB

Download
memory/4216-106-0x0000000004130000-0x0000000004166000-memory.dmp

Filesize
216KB

Download
memory/4216-167-0x0000000008AB0000-0x0000000008B26000-memory.dmp

Filesize
472KB

Download
memory/4216-136-0x0000000007BD0000-0x0000000007C0C000-memory.dmp

Filesize
240KB

Download
memory/4216-116-0x0000000007970000-0x00000000079BB000-memory.dmp

Filesize
300KB

Download
memory/4216-115-0x0000000007550000-0x000000000756C000-memory.dmp

Filesize
112KB

Download
memory/4216-114-0x0000000007620000-0x0000000007970000-memory.dmp

Filesize
3.3MB

Download
memory/4216-113-0x0000000007570000-0x00000000075D6000-memory.dmp

Filesize
408KB

Download
memory/4216-405-0x00000000099F0000-0x00000000099F8000-memory.dmp

Filesize
32KB

Download
memory/4216-111-0x0000000006AA0000-0x0000000006AC2000-memory.dmp

Filesize
136KB

Download
memory/4216-110-0x0000000006C40000-0x0000000007268000-memory.dmp

Filesize
6.2MB

Download
memory/4216-109-0x0000000006600000-0x0000000006610000-memory.dmp

Filesize
64KB

Download
memory/4248-168-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4248-489-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4248-333-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4248-105-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4248-102-0x0000000004770000-0x000000000505B000-memory.dmp

Filesize
8.9MB

Download
memory/4248-72-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4248-100-0x0000000004370000-0x0000000004769000-memory.dmp

Filesize
4.0MB

Download
memory/4248-49-0x0000000004370000-0x0000000004769000-memory.dmp

Filesize
4.0MB

Download
memory/4248-62-0x0000000004770000-0x000000000505B000-memory.dmp

Filesize
8.9MB

Download
memory/4248-95-0x0000000000400000-0x0000000002663000-memory.dmp

Filesize
34.4MB

Download
memory/4476-96-0x00007FF8DCC20000-0x00007FF8DD60C000-memory.dmp

Filesize
9.9MB

Download
memory/4476-47-0x00007FF8DCC20000-0x00007FF8DD60C000-memory.dmp

Filesize
9.9MB

Download
memory/4476-48-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/4476-99-0x0000000001010000-0x0000000001020000-memory.dmp

Filesize
64KB

Download
memory/4476-41-0x00000000007B0000-0x00000000007B8000-memory.dmp

Filesize
32KB

Download
memory/4860-2534-0x00000000006C0000-0x00000000006E0000-memory.dmp

Filesize
128KB

Download
memory/5056-94-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5056-34-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/5108-80-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/5108-101-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/5112-81-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5112-84-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/5112-87-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download