glupteba | 7b101e4c3f86d6b121d25c79d718af9b24ad1ba2bbf9ad83dc285b8ba2e4756a

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2023, 20:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

12.5MB
MD5

d9ebd26ee58f71cde091943042318e1e
SHA1

dd769d691f1b937aa4db724c7d0686dfe09989d4
SHA256

7b101e4c3f86d6b121d25c79d718af9b24ad1ba2bbf9ad83dc285b8ba2e4756a
SHA512

c542bbac2afdc4371a42fc7a678a9f12855a0fa07bf9ea32403acdae7bc460da3b2d8990af6fb47ed82e74aaeaa4277ce8093e8fe9d75a8151a4e3493136c7ef
SSDEEP

393216:Y3Jwzzz3BmMupONDnuc6zhVu2fX5xQnRh7UBlLKcOLyjM:4/zhNiEB9Kq

Score

10^/10

glupteba smokeloader xmrig up3 backdoor discovery dropper evasion loader miner persistence rootkit trojan upx

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32

Signatures

Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 14 IoCs

resource	yara_rule
behavioral2/memory/4904-63-0x0000000002E70000-0x000000000375B000-memory.dmp	family_glupteba
behavioral2/memory/4904-69-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4904-136-0x0000000002E70000-0x000000000375B000-memory.dmp	family_glupteba
behavioral2/memory/4904-139-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4904-141-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4904-205-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/2392-208-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/2392-248-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/2392-347-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4732-413-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4732-470-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4732-484-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4732-557-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba
behavioral2/memory/4732-573-0x0000000000400000-0x0000000000D1B000-memory.dmp	family_glupteba

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 2260 created 3308	2260	latestX.exe	59
PID 2260 created 3308	2260	latestX.exe	59
PID 2260 created 3308	2260	latestX.exe	59
PID 2260 created 3308	2260	latestX.exe	59
PID 2260 created 3308	2260	latestX.exe	59
PID 2916 created 3308	2916	updater.exe	59
PID 2916 created 3308	2916	updater.exe	59
PID 2916 created 3308	2916	updater.exe	59
PID 2916 created 3308	2916	updater.exe	59
PID 2916 created 3308	2916	updater.exe	59
PID 2916 created 3308	2916	updater.exe	59

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/2916-565-0x00007FF7AF9C0000-0x00007FF7AFF61000-memory.dmp	xmrig

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe
File created	C:\Windows\System32\drivers\etc\hosts	latestX.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
1760	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	kos4.exe

Executes dropped EXE 17 IoCs

pid	Process
2820	InstallSetup5.exe
3996	toolspub2.exe
4904	e0cbefcb1af40c7d4aff4aca26621a98.exe
5060	kos4.exe
4420	Broom.exe
2260	latestX.exe
4920	LzmwAqmV.exe
4304	LzmwAqmV.tmp
4864	SRadioStation.exe
2776	SRadioStation.exe
3504	toolspub2.exe
2392	e0cbefcb1af40c7d4aff4aca26621a98.exe
4732	csrss.exe
2916	updater.exe
4316	injector.exe
3556	windefender.exe
4328	windefender.exe

Loads dropped DLL 1 IoCs

pid	Process
4304	LzmwAqmV.tmp

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000800000001e79b-475.dat	upx
behavioral2/files/0x000800000001e79b-477.dat	upx
behavioral2/files/0x000800000001e79b-478.dat	upx
behavioral2/memory/3556-481-0x0000000000400000-0x00000000008DF000-memory.dmp	upx

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	51.159.66.125

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Manipulates WinMonFS driver. 1 IoCs

Roottkits write to WinMonFS to hide directories/files from being detected.

rootkit evasion

description	ioc	Process
File opened for modification	\??\WinMonFS	csrss.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3996 set thread context of 3504	3996	toolspub2.exe	104
PID 2916 set thread context of 2928	2916	updater.exe	191
PID 2916 set thread context of 2988	2916	updater.exe	192

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	e0cbefcb1af40c7d4aff4aca26621a98.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-CDGC3.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-1T08R.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-GM3OB.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-B86AP.tmp	LzmwAqmV.tmp
File created	C:\Program Files\Google\Chrome\updater.exe	latestX.exe
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-ASAV6.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-283VJ.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-SP7GC.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-8LK0J.tmp	LzmwAqmV.tmp
File opened for modification	C:\Program Files (x86)\Radio Station 1.7.10.31\unins000.dat	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-LTJ2U.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-LCPNC.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-S5IC0.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-3DJ99.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-8UMO3.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\is-K8HOV.tmp	LzmwAqmV.tmp
File created	C:\Program Files (x86)\Radio Station 1.7.10.31\XML\Styles\is-H88KT.tmp	LzmwAqmV.tmp
File opened for modification	C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe	LzmwAqmV.tmp
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\rss	e0cbefcb1af40c7d4aff4aca26621a98.exe
File created	C:\Windows\rss\csrss.exe	e0cbefcb1af40c7d4aff4aca26621a98.exe
File created	C:\Windows\windefender.exe	csrss.exe
File opened for modification	C:\Windows\windefender.exe	csrss.exe

Launches sc.exe 11 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3040	sc.exe
4996	sc.exe
2384	sc.exe
2020	sc.exe
3992	sc.exe
4652	sc.exe
3480	sc.exe
3284	sc.exe
1048	sc.exe
2640	sc.exe
4180	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
972	4904	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	toolspub2.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2356	schtasks.exe
4500	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-622 = "Korea Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-51 = "Greenland Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-791 = "SA Western Daylight Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-462 = "Afghanistan Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2751 = "Tomsk Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2492 = "Aus Central W. Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2142 = "Transbaikal Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1841 = "Russia TZ 4 Daylight Time"	windefender.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2531 = "Chatham Islands Daylight Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-432 = "Iran Standard Time"	windefender.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-752 = "Tonga Standard Time"	windefender.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time"	e0cbefcb1af40c7d4aff4aca26621a98.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\@tzres.dll,-1662 = "Bahia Standard Time"	windefender.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3504	toolspub2.exe
3504	toolspub2.exe
4624	powershell.exe
4624	powershell.exe
4624	powershell.exe
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE
3308	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3504	toolspub2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	kos4.exe
Token: SeDebugPrivilege	4624	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	4904	e0cbefcb1af40c7d4aff4aca26621a98.exe
Token: SeImpersonatePrivilege	4904	e0cbefcb1af40c7d4aff4aca26621a98.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeDebugPrivilege	4412	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeShutdownPrivilege	4772	powercfg.exe
Token: SeCreatePagefilePrivilege	4772	powercfg.exe
Token: SeShutdownPrivilege	4884	powercfg.exe
Token: SeCreatePagefilePrivilege	4884	powercfg.exe
Token: SeShutdownPrivilege	2816	powercfg.exe
Token: SeCreatePagefilePrivilege	2816	powercfg.exe
Token: SeShutdownPrivilege	4840	powercfg.exe
Token: SeCreatePagefilePrivilege	4840	powercfg.exe
Token: SeIncreaseQuotaPrivilege	788	powershell.exe
Token: SeSecurityPrivilege	788	powershell.exe
Token: SeTakeOwnershipPrivilege	788	powershell.exe
Token: SeLoadDriverPrivilege	788	powershell.exe
Token: SeSystemProfilePrivilege	788	powershell.exe
Token: SeSystemtimePrivilege	788	powershell.exe
Token: SeProfSingleProcessPrivilege	788	powershell.exe
Token: SeIncBasePriorityPrivilege	788	powershell.exe
Token: SeCreatePagefilePrivilege	788	powershell.exe
Token: SeBackupPrivilege	788	powershell.exe
Token: SeRestorePrivilege	788	powershell.exe
Token: SeShutdownPrivilege	788	powershell.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeSystemEnvironmentPrivilege	788	powershell.exe
Token: SeRemoteShutdownPrivilege	788	powershell.exe
Token: SeUndockPrivilege	788	powershell.exe
Token: SeManageVolumePrivilege	788	powershell.exe
Token: 33	788	powershell.exe
Token: 34	788	powershell.exe
Token: 35	788	powershell.exe
Token: 36	788	powershell.exe
Token: SeShutdownPrivilege	3308	Explorer.EXE
Token: SeCreatePagefilePrivilege	3308	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	788	powershell.exe
Token: SeSecurityPrivilege	788	powershell.exe
Token: SeTakeOwnershipPrivilege	788	powershell.exe
Token: SeLoadDriverPrivilege	788	powershell.exe
Token: SeSystemProfilePrivilege	788	powershell.exe
Token: SeSystemtimePrivilege	788	powershell.exe
Token: SeProfSingleProcessPrivilege	788	powershell.exe
Token: SeIncBasePriorityPrivilege	788	powershell.exe
Token: SeCreatePagefilePrivilege	788	powershell.exe
Token: SeBackupPrivilege	788	powershell.exe
Token: SeRestorePrivilege	788	powershell.exe
Token: SeShutdownPrivilege	788	powershell.exe
Token: SeDebugPrivilege	788	powershell.exe
Token: SeSystemEnvironmentPrivilege	788	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4304	LzmwAqmV.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4420	Broom.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3308	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2820	1764	tmp.exe	89
PID 1764 wrote to memory of 2820	1764	tmp.exe	89
PID 1764 wrote to memory of 2820	1764	tmp.exe	89
PID 1764 wrote to memory of 3996	1764	tmp.exe	90
PID 1764 wrote to memory of 3996	1764	tmp.exe	90
PID 1764 wrote to memory of 3996	1764	tmp.exe	90
PID 1764 wrote to memory of 4904	1764	tmp.exe	91
PID 1764 wrote to memory of 4904	1764	tmp.exe	91
PID 1764 wrote to memory of 4904	1764	tmp.exe	91
PID 1764 wrote to memory of 5060	1764	tmp.exe	93
PID 1764 wrote to memory of 5060	1764	tmp.exe	93
PID 2820 wrote to memory of 4420	2820	InstallSetup5.exe	92
PID 2820 wrote to memory of 4420	2820	InstallSetup5.exe	92
PID 2820 wrote to memory of 4420	2820	InstallSetup5.exe	92
PID 1764 wrote to memory of 2260	1764	tmp.exe	94
PID 1764 wrote to memory of 2260	1764	tmp.exe	94
PID 5060 wrote to memory of 4920	5060	kos4.exe	96
PID 5060 wrote to memory of 4920	5060	kos4.exe	96
PID 5060 wrote to memory of 4920	5060	kos4.exe	96
PID 4920 wrote to memory of 4304	4920	LzmwAqmV.exe	97
PID 4920 wrote to memory of 4304	4920	LzmwAqmV.exe	97
PID 4920 wrote to memory of 4304	4920	LzmwAqmV.exe	97
PID 4304 wrote to memory of 2284	4304	LzmwAqmV.tmp	99
PID 4304 wrote to memory of 2284	4304	LzmwAqmV.tmp	99
PID 4304 wrote to memory of 2284	4304	LzmwAqmV.tmp	99
PID 4304 wrote to memory of 4864	4304	LzmwAqmV.tmp	100
PID 4304 wrote to memory of 4864	4304	LzmwAqmV.tmp	100
PID 4304 wrote to memory of 4864	4304	LzmwAqmV.tmp	100
PID 4304 wrote to memory of 2776	4304	LzmwAqmV.tmp	102
PID 4304 wrote to memory of 2776	4304	LzmwAqmV.tmp	102
PID 4304 wrote to memory of 2776	4304	LzmwAqmV.tmp	102
PID 2284 wrote to memory of 4632	2284	net.exe	103
PID 2284 wrote to memory of 4632	2284	net.exe	103
PID 2284 wrote to memory of 4632	2284	net.exe	103
PID 3996 wrote to memory of 3504	3996	toolspub2.exe	104
PID 3996 wrote to memory of 3504	3996	toolspub2.exe	104
PID 3996 wrote to memory of 3504	3996	toolspub2.exe	104
PID 3996 wrote to memory of 3504	3996	toolspub2.exe	104
PID 3996 wrote to memory of 3504	3996	toolspub2.exe	104
PID 3996 wrote to memory of 3504	3996	toolspub2.exe	104
PID 4904 wrote to memory of 4624	4904	e0cbefcb1af40c7d4aff4aca26621a98.exe	108
PID 4904 wrote to memory of 4624	4904	e0cbefcb1af40c7d4aff4aca26621a98.exe	108
PID 4904 wrote to memory of 4624	4904	e0cbefcb1af40c7d4aff4aca26621a98.exe	108
PID 2392 wrote to memory of 2284	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	118
PID 2392 wrote to memory of 2284	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	118
PID 2392 wrote to memory of 2284	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	118
PID 2392 wrote to memory of 3284	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	135
PID 2392 wrote to memory of 3284	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	135
PID 3284 wrote to memory of 1760	3284	sc.exe	123
PID 3284 wrote to memory of 1760	3284	sc.exe	123
PID 2392 wrote to memory of 2056	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	124
PID 2392 wrote to memory of 2056	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	124
PID 2392 wrote to memory of 2056	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	124
PID 2392 wrote to memory of 4412	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	126
PID 2392 wrote to memory of 4412	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	126
PID 2392 wrote to memory of 4412	2392	e0cbefcb1af40c7d4aff4aca26621a98.exe	126
PID 1716 wrote to memory of 3480	1716	cmd.exe	132
PID 1716 wrote to memory of 3480	1716	cmd.exe	132
PID 1716 wrote to memory of 3040	1716	cmd.exe	133
PID 1716 wrote to memory of 3040	1716	cmd.exe	133
PID 1716 wrote to memory of 4996	1716	cmd.exe	134
PID 1716 wrote to memory of 4996	1716	cmd.exe	134
PID 1716 wrote to memory of 3284	1716	cmd.exe	135
PID 1716 wrote to memory of 3284	1716	cmd.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3308
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe
    "C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\Broom.exe
      C:\Users\Admin\AppData\Local\Temp\Broom.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4420
- - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
    "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
      "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3504
- - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
    "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe
      "C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Checks for VirtualBox DLLs, possible anti-VM trick
      Drops file in Windows directory
      Modifies data under HKEY_USERS
      Suspicious use of WriteProcessMemory
      PID:2392
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        5⤵
        
        PID:3284
      - C:\Windows\system32\netsh.exe
        
        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:1760
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:2056
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        5⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious use of AdjustPrivilegeToken
        
        PID:4412
    - - C:\Windows\rss\csrss.exe
        
        C:\Windows\rss\csrss.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Manipulates WinMonFS driver.
        Drops file in Windows directory
        
        PID:4732
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:4616
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:2356
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /delete /tn ScheduledUpdate /f
        6⤵
        
        PID:2088
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1560
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -nologo -noprofile
        6⤵
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
        
        C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
        6⤵
        Executes dropped EXE
        
        PID:4316
      - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
        6⤵
        Creates scheduled task(s)
        
        PID:4500
      - C:\Windows\windefender.exe
        
        "C:\Windows\windefender.exe"
        6⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        7⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\sc.exe
        
        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
        8⤵
        Launches sc.exe
        
        PID:2020
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4904 -s 648
      4⤵
      Program crash
      PID:972
- - C:\Users\Admin\AppData\Local\Temp\kos4.exe
    "C:\Users\Admin\AppData\Local\Temp\kos4.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
      "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp" /SL5="$501D4,2889973,140800,C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4304
      - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" helpmsg 31
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 helpmsg 31
        7⤵
        
        PID:4632
      - C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
        
        "C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -i
        6⤵
        Executes dropped EXE
        
        PID:4864
      - C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe
        
        "C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe" -s
        6⤵
        Executes dropped EXE
        
        PID:2776
- - C:\Users\Admin\AppData\Local\Temp\latestX.exe
    "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1928
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3480
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3040
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4996
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    - Suspicious use of WriteProcessMemory
    PID:3284
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2384
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1768
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:788
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4224
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2660
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:4352
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1048
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3992
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2640
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4652
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4180
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:3380
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3040
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:836
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:2940
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:2696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:3824
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2928
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:2988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4904 -ip 4904
1⤵
PID:2356

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:2916

C:\Windows\windefender.exe
C:\Windows\windefender.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
4af1e45b3a6e7f3528377bd11bd83a36

SHA1
67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

SHA256
3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

SHA512
6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

Download Submit
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
4af1e45b3a6e7f3528377bd11bd83a36

SHA1
67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

SHA256
3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

SHA512
6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

Download Submit
C:\Program Files (x86)\Radio Station 1.7.10.31\SRadioStation.exe

Filesize
1.8MB

MD5
4af1e45b3a6e7f3528377bd11bd83a36

SHA1
67fa29d1119981ef8a0d935ad1f9e78dd87ad0ab

SHA256
3ee8b0739ee4fa15526c4e68cd473797f19df2fdd54c7b302b886869c7030b54

SHA512
6a25cd8eae614c4b8519098198dc0d2ea84fcde0bafaaa3ab0b043c4457c2b367ccbfe0831bfcb12cf2f7524b8fcbef90b47068572a11529c06fce21dba2a9ad

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e907f77659a6601fcc408274894da2e

SHA1
9f5b72abef1cd7145bf37547cdb1b9254b4efe9d

SHA256
385da35673330e21ac02545220552fe301fe54dedefbdafc097ac4342a295233

SHA512
34fa0fff24f6550f55f828541aaefe5d75c86f8f0842d54b50065e9746f9662bb7209c74c9a9571540b9855bb3851f01db613190024e89b198d485bb5dc07721

Download Submit
C:\Users\Admin\AppData\Local\Temp\Broom.exe

Filesize
5.3MB

MD5
00e93456aa5bcf9f60f84b0c0760a212

SHA1
6096890893116e75bd46fea0b8c3921ceb33f57d

SHA256
ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504

SHA512
abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.5MB

MD5
d04b3ad7f47bdbd80c23a91436096fc6

SHA1
dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

SHA256
994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

SHA512
0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.5MB

MD5
d04b3ad7f47bdbd80c23a91436096fc6

SHA1
dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

SHA256
994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

SHA512
0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\InstallSetup5.exe

Filesize
2.5MB

MD5
d04b3ad7f47bdbd80c23a91436096fc6

SHA1
dfe98b3bbcac34e4f55d8e1f30503f1caba7f099

SHA256
994a1ebecf6350718dc003473441d89bb493c8a79bbce8622b562fc2c0ca2757

SHA512
0777d9bb0448615e7f694b1c1e3f0a5aa2f84d8638e77f349167c2d6eb7ee27709d68b581b09c122182e85b1ccbbfd89767308457219c5c67fe613212ff47d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
3.1MB

MD5
ceb311f59f6a53c535dc69ee474f2d1d

SHA1
9b30cfb167003e07231cd9f5592b72fc8f6f7a73

SHA256
1b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360

SHA512
26db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
3.1MB

MD5
ceb311f59f6a53c535dc69ee474f2d1d

SHA1
9b30cfb167003e07231cd9f5592b72fc8f6f7a73

SHA256
1b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360

SHA512
26db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

Filesize
3.1MB

MD5
ceb311f59f6a53c535dc69ee474f2d1d

SHA1
9b30cfb167003e07231cd9f5592b72fc8f6f7a73

SHA256
1b09fe297ab295025bcc7b84d085432e3feb0eafa06135f7b0fe0188a25d4360

SHA512
26db3a59e788f8dda848ae526a1c887198df80e2577015bd3279fe0f3251cf0842f7a46e7ea6e94be5f103ce4bd54386fe08db58825b3411f435af54e60edfeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rvkoyofe.4qt.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

Filesize
281KB

MD5
d98e33b66343e7c96158444127a117f6

SHA1
bb716c5509a2bf345c6c1152f6e3e1452d39d50d

SHA256
5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

SHA512
705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

Filesize
4.1MB

MD5
6725367cdcecead21e3bb16f2c147fc5

SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a

SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

Filesize
4.1MB

MD5
6725367cdcecead21e3bb16f2c147fc5

SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a

SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

Filesize
4.1MB

MD5
6725367cdcecead21e3bb16f2c147fc5

SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a

SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\e0cbefcb1af40c7d4aff4aca26621a98.exe

Filesize
4.1MB

MD5
6725367cdcecead21e3bb16f2c147fc5

SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a

SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-5RA3P.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp

Filesize
765KB

MD5
341906c92fadb3f43dfdbbf75672e2ad

SHA1
01e846f2371b38783213847406b65da7b578067f

SHA256
730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

SHA512
b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L8HNH.tmp\LzmwAqmV.tmp

Filesize
765KB

MD5
341906c92fadb3f43dfdbbf75672e2ad

SHA1
01e846f2371b38783213847406b65da7b578067f

SHA256
730df656be167f02b4e107bf2e0ceb3352b2c333c4212e6aef4feccd04d4e3c2

SHA512
b7a842a35b729e6efbae2c13e0bb055b0a34c395f23e115a9fc13f475cf3d505ea5274be6bb6ba81404b66e19f7c4eb60e010124f59ea44a5912c129bd18340e

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\kos4.exe

Filesize
8KB

MD5
01707599b37b1216e43e84ae1f0d8c03

SHA1
521fe10ac55a1f89eba7b8e82e49407b02b0dcb2

SHA256
cc0dbc1d31ccd9488695b690bd7e7aa4a90ba4b2a5d23ef48b296465f5aa44dd

SHA512
9f9ff29a12d26a7d42656e0faf970c908f1ef428b14e5a5fe7acd06371b96b16eb984e8fbee4e2b906c6db7fb39c9d4a221e79fc3d5e9ca9b59e377875bc5642

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\latestX.exe

Filesize
5.6MB

MD5
bae29e49e8190bfbbf0d77ffab8de59d

SHA1
4a6352bb47c7e1666a60c76f9b17ca4707872bd9

SHA256
f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

SHA512
9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

Filesize
207KB

MD5
5ff398981d2edc3bca2e1ed053090c9a

SHA1
7c0b3b52bbeec3b6370c38f47eb85a75ee92be3b

SHA256
13c420fc4656cb4eff23d8901c1777434ee40157122f3941a92eef5b7aceefaf

SHA512
4609cf82ea7dbacff3fce41da8dc29467dc348f336998f1f79c85e82261947c686ba39a77c3a4a9321596d55fb73a7c5e6aab026748fb9b3be01d45099075de4

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
875d10d7cb37a9dbd8a9a9989e5016ea

SHA1
e47fd3014005bb28c63eeaf27c465defccaab5af

SHA256
1b6b99589d7710d91cc84f7ea8ba38eb4ab8b284936b5b39e4d025b4b403d816

SHA512
6a2ff9fe5416657e532b294c21a2e2f722c29096877c89f555d19137a564d6d8274be4c3c37bf3b40fb32330966a7c062f1fba71f4f05cc46e70331069160744

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
80b95ac27d1505c6f1c152cdbb26d172

SHA1
7dd668b9aea5fb344c38a350782144b757e797b8

SHA256
5ccdd1dcb4e7c70f84afd2d1505bd1fa113f58f2f4b7cefe481dd12882421653

SHA512
4126981c368a40f4a9c3e6a7416567f89463a7236975b81aeb2962c05af3c1133d8842a409afe4f7d52ef81a02aad6c4e76852e6c6960adde6eea63fd5fb5841

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
df57d9a149c6a4a5cd56cb918dccfb7d

SHA1
41d7e46fcbaef4e6f0c403b292ecb130c19158b7

SHA256
d81dcd9dff3a37187e3b3aee20ca51656be8d7615b05094055d2a210b77cdb5f

SHA512
96f4c0a0ef72bbd7f0374c1fd80ef5f11fb752d6c527d4e3a803e7c07c11e987f9a524a6055e250feb239f2f87dcea1bacf9caf4718301c3c1ced9516bbbe824

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
b69f831a29cefe85cff2bd8703815eb8

SHA1
205e28844b5b0b2083d5e8aaa33c8d911d1f0112

SHA256
6b59ea1703e5ef15bbc5a3957a8b320ce7f4a3c68b8a89aba0b521569982671e

SHA512
b00885cddc5969bd7249e23458648504188ba302fc6cedb7703d86223e7b10178d37e013503043147d536f1eb587af1ed4e682706b5242c1eb9b4ebb2521be37

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
19KB

MD5
95e094a64e4bba8ab9a025d2efe7774c

SHA1
fd27bd2429f0ed22c1f4f22b099b7ab88a2d9029

SHA256
9bc53698abd49f569e5554b981c1e23a1cc6ff8fc4865b5839cb36b208ee31f5

SHA512
0d7dca962a556c12ca3e3634d26edc829ea587e87b276b172c341f0815ab7461cff9d53108f367b7c8c02de798c500e61a74893730bbc5cb73ec80c4654ef9c8

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
6725367cdcecead21e3bb16f2c147fc5

SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a

SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

Download Submit
C:\Windows\rss\csrss.exe

Filesize
4.1MB

MD5
6725367cdcecead21e3bb16f2c147fc5

SHA1
d9634b52918cae903ab33cf5e95cec4e2d68887a

SHA256
cb935fddf7319e8608578e21e898abc9b1638b4608b8865483e429350e208a80

SHA512
1583b53edceb75399bfd3a58cd1b6841ffbc4c6590ef1d6599a7f8e788ab96425871499d91c1cebe68bf3bb69c70636cb8f6acda8246aaa210c1ab110b4e39ef

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
C:\Windows\windefender.exe

Filesize
2.0MB

MD5
8e67f58837092385dcf01e8a2b4f5783

SHA1
012c49cfd8c5d06795a6f67ea2baf2a082cf8625

SHA256
166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

SHA512
40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

Download Submit
memory/1764-0-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/1764-1-0x00000000004A0000-0x0000000001120000-memory.dmp

Filesize
12.5MB

Download
memory/1764-50-0x0000000074630000-0x0000000074DE0000-memory.dmp

Filesize
7.7MB

Download
memory/2260-162-0x00007FF77D550000-0x00007FF77DAF1000-memory.dmp

Filesize
5.6MB

Download
memory/2260-355-0x00007FF77D550000-0x00007FF77DAF1000-memory.dmp

Filesize
5.6MB

Download
memory/2284-212-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/2284-213-0x00000000053F0000-0x0000000005744000-memory.dmp

Filesize
3.3MB

Download
memory/2284-211-0x0000000073060000-0x0000000073810000-memory.dmp

Filesize
7.7MB

Download
memory/2284-223-0x0000000005D50000-0x0000000005D9C000-memory.dmp

Filesize
304KB

Download
memory/2284-224-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/2284-225-0x000000007EF00000-0x000000007EF10000-memory.dmp

Filesize
64KB

Download
memory/2284-226-0x0000000072060000-0x00000000720AC000-memory.dmp

Filesize
304KB

Download
memory/2392-207-0x0000000002C50000-0x0000000003053000-memory.dmp

Filesize
4.0MB

Download
memory/2392-248-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2392-208-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2392-347-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/2776-246-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-567-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-165-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-430-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-356-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-130-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-487-0x0000000000910000-0x00000000009BD000-memory.dmp

Filesize
692KB

Download
memory/2776-485-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-203-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2776-471-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/2916-431-0x00007FF7AF9C0000-0x00007FF7AFF61000-memory.dmp

Filesize
5.6MB

Download
memory/2916-565-0x00007FF7AF9C0000-0x00007FF7AFF61000-memory.dmp

Filesize
5.6MB

Download
memory/2988-566-0x0000000000EA0000-0x0000000000EC0000-memory.dmp

Filesize
128KB

Download
memory/3308-166-0x0000000002A00000-0x0000000002A16000-memory.dmp

Filesize
88KB

Download
memory/3504-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3504-138-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3504-167-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/3556-481-0x0000000000400000-0x00000000008DF000-memory.dmp

Filesize
4.9MB

Download
memory/3996-133-0x00000000008E0000-0x00000000009E0000-memory.dmp

Filesize
1024KB

Download
memory/3996-134-0x00000000023D0000-0x00000000023D9000-memory.dmp

Filesize
36KB

Download
memory/4304-177-0x0000000000400000-0x00000000004D0000-memory.dmp

Filesize
832KB

Download
memory/4304-85-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4304-142-0x0000000000640000-0x0000000000641000-memory.dmp

Filesize
4KB

Download
memory/4420-125-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/4420-145-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4420-51-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/4420-280-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4420-517-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/4624-173-0x0000000007840000-0x00000000078B6000-memory.dmp

Filesize
472KB

Download
memory/4624-149-0x0000000005640000-0x0000000005662000-memory.dmp

Filesize
136KB

Download
memory/4624-202-0x0000000073060000-0x0000000073810000-memory.dmp

Filesize
7.7MB

Download
memory/4624-199-0x0000000007C60000-0x0000000007C68000-memory.dmp

Filesize
32KB

Download
memory/4624-198-0x0000000007D20000-0x0000000007D3A000-memory.dmp

Filesize
104KB

Download
memory/4624-197-0x0000000007C30000-0x0000000007C44000-memory.dmp

Filesize
80KB

Download
memory/4624-196-0x0000000007C20000-0x0000000007C2E000-memory.dmp

Filesize
56KB

Download
memory/4624-195-0x0000000007BE0000-0x0000000007BF1000-memory.dmp

Filesize
68KB

Download
memory/4624-194-0x0000000007C80000-0x0000000007D16000-memory.dmp

Filesize
600KB

Download
memory/4624-193-0x0000000007BC0000-0x0000000007BCA000-memory.dmp

Filesize
40KB

Download
memory/4624-192-0x0000000007AD0000-0x0000000007B73000-memory.dmp

Filesize
652KB

Download
memory/4624-191-0x0000000007A70000-0x0000000007A8E000-memory.dmp

Filesize
120KB

Download
memory/4624-181-0x0000000072170000-0x00000000724C4000-memory.dmp

Filesize
3.3MB

Download
memory/4624-180-0x0000000072010000-0x000000007205C000-memory.dmp

Filesize
304KB

Download
memory/4624-179-0x0000000007A90000-0x0000000007AC2000-memory.dmp

Filesize
200KB

Download
memory/4624-178-0x000000007F860000-0x000000007F870000-memory.dmp

Filesize
64KB

Download
memory/4624-175-0x00000000078E0000-0x00000000078FA000-memory.dmp

Filesize
104KB

Download
memory/4624-174-0x0000000007F40000-0x00000000085BA000-memory.dmp

Filesize
6.5MB

Download
memory/4624-172-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/4624-171-0x0000000006A80000-0x0000000006AC4000-memory.dmp

Filesize
272KB

Download
memory/4624-164-0x0000000006550000-0x000000000659C000-memory.dmp

Filesize
304KB

Download
memory/4624-163-0x0000000006520000-0x000000000653E000-memory.dmp

Filesize
120KB

Download
memory/4624-161-0x0000000006020000-0x0000000006374000-memory.dmp

Filesize
3.3MB

Download
memory/4624-156-0x0000000005EB0000-0x0000000005F16000-memory.dmp

Filesize
408KB

Download
memory/4624-150-0x0000000005E40000-0x0000000005EA6000-memory.dmp

Filesize
408KB

Download
memory/4624-143-0x0000000002F60000-0x0000000002F96000-memory.dmp

Filesize
216KB

Download
memory/4624-144-0x0000000073060000-0x0000000073810000-memory.dmp

Filesize
7.7MB

Download
memory/4624-148-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/4624-147-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

Filesize
64KB

Download
memory/4624-146-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download
memory/4732-484-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4732-573-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4732-470-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4732-557-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4732-413-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4864-122-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4864-126-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4864-123-0x0000000000400000-0x00000000005D4000-memory.dmp

Filesize
1.8MB

Download
memory/4904-205-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4904-132-0x0000000002A60000-0x0000000002E66000-memory.dmp

Filesize
4.0MB

Download
memory/4904-139-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4904-69-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4904-136-0x0000000002E70000-0x000000000375B000-memory.dmp

Filesize
8.9MB

Download
memory/4904-141-0x0000000000400000-0x0000000000D1B000-memory.dmp

Filesize
9.1MB

Download
memory/4904-63-0x0000000002E70000-0x000000000375B000-memory.dmp

Filesize
8.9MB

Download
memory/4904-62-0x0000000002A60000-0x0000000002E66000-memory.dmp

Filesize
4.0MB

Download
memory/4920-140-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4920-68-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/5060-71-0x00007FFAAC230000-0x00007FFAACCF1000-memory.dmp

Filesize
10.8MB

Download
memory/5060-49-0x00007FFAAC230000-0x00007FFAACCF1000-memory.dmp

Filesize
10.8MB

Download
memory/5060-52-0x000000001B950000-0x000000001B960000-memory.dmp

Filesize
64KB

Download
memory/5060-41-0x0000000000D20000-0x0000000000D28000-memory.dmp

Filesize
32KB

Download