xmrig | 6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe
Size 7.3MB
Sample240125-w7cybschb5
SHA256 6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5
MD5 c71f6deffe17db3aa681b529dd463c97
SHA1 6d0c42c9b88d127f01e4cac1effc8f9c19e43cf1
SHA512 55be1ebc18d1320e7c38f8cd5467e3c156b3b01b16425f3ac47660f3e5b9e062bc1f028d57a8c357dcac609d0a67c41f3f6605b85035884ddbf1b15088475cb5
SSDEEP 196608:KZF2W7HBBbvyq54FpdPSYefCd1lasZWfTUveli+:KZF7H7b679Py2SlZll
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion miner persistence upx vmprotect

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/3376-132-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-133-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-135-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-136-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-137-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-138-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-139-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-141-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-142-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-171-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-172-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-174-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3376-173-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe

Executes dropped EXE 2 IoCs

pid	Process
2944	Adobe.exe
4492	Reader.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3376-126-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-127-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-128-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-129-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-130-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-132-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-133-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-135-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-136-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-137-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-138-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-139-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-141-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-142-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-171-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-172-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-174-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3376-173-0x0000000140000000-0x0000000140848000-memory.dmp	upx

VMProtect packed file 10 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/files/0x0006000000023233-6.dat	vmprotect
behavioral2/files/0x0006000000023233-12.dat	vmprotect
behavioral2/files/0x0006000000023233-13.dat	vmprotect
behavioral2/memory/2944-37-0x00007FF6C4910000-0x00007FF6C5657000-memory.dmp	vmprotect
behavioral2/memory/2944-73-0x00007FF6C4910000-0x00007FF6C5657000-memory.dmp	vmprotect
behavioral2/files/0x0007000000023242-75.dat	vmprotect
behavioral2/files/0x0007000000023242-74.dat	vmprotect
behavioral2/memory/4492-79-0x00007FF7BB800000-0x00007FF7BC547000-memory.dmp	vmprotect
behavioral2/memory/4492-80-0x00007FF7BB800000-0x00007FF7BC547000-memory.dmp	vmprotect
behavioral2/memory/4492-131-0x00007FF7BB800000-0x00007FF7BC547000-memory.dmp	vmprotect

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	pastebin.com
35	pastebin.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	Reader.exe
File opened for modification	C:\Windows\system32\MRT.exe	Adobe.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2944	Adobe.exe
4492	Reader.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4492 set thread context of 4056	4492	Reader.exe	145
PID 4492 set thread context of 3376	4492	Reader.exe	142

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2672	sc.exe
4708	sc.exe
3656	sc.exe
1604	sc.exe
1660	sc.exe
4724	sc.exe
4056	sc.exe
4896	sc.exe
216	sc.exe
4880	sc.exe
1592	sc.exe
1608	sc.exe
484	sc.exe
1196	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE

Modifies data under HKEY_USERS 50 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000_Classes\Local Settings	6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
1648	WINWORD.EXE
1648	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
1860	powershell.exe
1860	powershell.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
2944	Adobe.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
2396	powershell.exe
2396	powershell.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
4492	Reader.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe
3376	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
668	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	powershell.exe
Token: SeShutdownPrivilege	4156	powercfg.exe
Token: SeCreatePagefilePrivilege	4156	powercfg.exe
Token: SeShutdownPrivilege	4756	powercfg.exe
Token: SeCreatePagefilePrivilege	4756	powercfg.exe
Token: SeShutdownPrivilege	4976	powercfg.exe
Token: SeCreatePagefilePrivilege	4976	powercfg.exe
Token: SeShutdownPrivilege	3108	powercfg.exe
Token: SeCreatePagefilePrivilege	3108	powercfg.exe
Token: SeDebugPrivilege	2396	powershell.exe
Token: SeShutdownPrivilege	4708	powercfg.exe
Token: SeCreatePagefilePrivilege	4708	powercfg.exe
Token: SeShutdownPrivilege	432	powercfg.exe
Token: SeCreatePagefilePrivilege	432	powercfg.exe
Token: SeShutdownPrivilege	1372	powercfg.exe
Token: SeCreatePagefilePrivilege	1372	powercfg.exe
Token: SeShutdownPrivilege	412	powercfg.exe
Token: SeCreatePagefilePrivilege	412	powercfg.exe
Token: SeLockMemoryPrivilege	3376	svchost.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE
1648	WINWORD.EXE

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2944	2964	6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe	87
PID 2964 wrote to memory of 2944	2964	6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe	87
PID 2964 wrote to memory of 1648	2964	6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe	89
PID 2964 wrote to memory of 1648	2964	6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe	89
PID 916 wrote to memory of 4812	916	cmd.exe	107
PID 916 wrote to memory of 4812	916	cmd.exe	107
PID 5076 wrote to memory of 220	5076	cmd.exe	135
PID 5076 wrote to memory of 220	5076	cmd.exe	135
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 4056	4492	Reader.exe	145
PID 4492 wrote to memory of 3376	4492	Reader.exe	142
PID 4492 wrote to memory of 3376	4492	Reader.exe	142
PID 4492 wrote to memory of 3376	4492	Reader.exe	142
PID 4492 wrote to memory of 3376	4492	Reader.exe	142
PID 4492 wrote to memory of 3376	4492	Reader.exe	142

C:\Users\Admin\AppData\Local\Temp\6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe
"C:\Users\Admin\AppData\Local\Temp\6d63f0185be09b4bfa681058cdf666093419960d31be9f4de35e96a66f3daeb5.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\Adobe.exe
  "C:\Users\Admin\AppData\Local\Temp\Adobe.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1860
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2672
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4708
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4056
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3656
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4156
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "Adobe"
    3⤵
    - Launches sc.exe
    PID:4896
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "Adobe" binpath= "C:\ProgramData\Adobe\Reader.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:484
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:216
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "Adobe"
    3⤵
    - Launches sc.exe
    PID:4880
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1592
- C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Kripta.docx" /o ""
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:1648

C:\ProgramData\Adobe\Reader.exe
C:\ProgramData\Adobe\Reader.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2396
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1608
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:1604
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1660
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4056
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1372
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:412
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1196
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5076

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

Reader.exe

Path C:\ProgramData\Adobe\Reader.exe
Size 2.4MB
SHA256 e14f12923d2cfb6c0373abafbc4e46e05518e44e257c08b8625306170c0a883f
MD5 b0f1943f40d4178150ae7a93f4533a80
SHA1 f7e991971d7cea3c5b4804e2bd5ec53804dce7c3
SHA512 983df31476a51f439b2266f4ef30bb24a422f5f2682162cf5994f5d6a4c8cf5400bea29d06da50b6f615d73c6c2c46f5f259d07112c9f0692767f978ca20831c
SSDEEP 49152:Uj9go06oStSqM6SFYJXRlpYrKLnK555etIMAD5KE:e2o0bStVM6UeRsrCnGzVR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Reader.exe

Path C:\ProgramData\Adobe\Reader.exe
Size 1.8MB
SHA256 8f8459eb0666f85ae3a4a59bbccde48f54febbfbbcc79e9dc285c47d1f801e2a
MD5 5e15c4d32cf466c8ace2bfb9b12d4a00
SHA1 39b92e94f9d190ab8ee9a46bbb655ba3811b6faa
SHA512 33f8d2cafe615bae967c7110426d53c37da6c582c2124a4bb64f3cba24d8595803db43b23177d89b57d0d6d59ebb075ed3c6beacf2445e63d69ad6768855fd85
SSDEEP 49152:Uj9go06oStSqM6SFYJXRlpYrKLnK555etIu:e2o0bStVM6UeRsrCnGza
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adobe.exe

Path C:\Users\Admin\AppData\Local\Temp\Adobe.exe
Size 1.7MB
SHA256 ab5e27a99dbaf9a66e2d78cdccd2b116eb5b0bbbfcab4e80f16541f254a70376
MD5 0280ff1cdfbb6047afeedbc1ce14a272
SHA1 f5bf3bab64d5a14e4425edda2d0210a1b87efc77
SHA512 c00b9bbab47d169c47b0af48143e999c5031ca2327b834c60894184f2dead52f6b1c0c8f176a55bbecb17c25791d71fa1ef1d57285028f24e3fa0adb2366c069
SSDEEP 24576:UHmI0uevfo0aYBQYrSgw6sgyS4w+zI6g3FY9fbKBFlcbdwwte50bY5jCeTKLqmjQ:Uj9go06oStSqM6SFYJXRlpYrKLnK555r
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adobe.exe

Path C:\Users\Admin\AppData\Local\Temp\Adobe.exe
Size 1.5MB
SHA256 43b5d0f387b584e724ce88a2a8e8c2621b5c2f39b31eb4cd7b0c464aab85d7e7
MD5 cab26f3dfd1e9df6d8d2d4c04dd69ed0
SHA1 6c77652e4db0ace9aa4593bdeae3dfb9929c5b41
SHA512 46eff7c0b7a92cc53bbe2c297ed388762dd1fab05e41904e1bd3e6466bcad747ed885880098162b53093aaa75be02669e52a073b4c49d39bdd2a3e26a0e69a6d
SSDEEP 24576:UHmI0uevfo0aYBQYrSgw6sgyS4w+zI6g3FY9fbKBFlcbdwwte50bY5jCeTKLqmf:Uj9go06oStSqM6SFYJXRlpYrKLnf
MD5 SHA1 SHA512 SSDEEP

Submit Download

Adobe.exe

Path C:\Users\Admin\AppData\Local\Temp\Adobe.exe
Size 4.4MB
SHA256 5aa32844c9825ff05fc2aa619f0de675d69e9f88dc2115e37c6b43176df43310
MD5 0621c3ff640c782bbf0de966bf10caab
SHA1 3a1dd02a9409537459a5524cc987cbab99131d81
SHA512 14cc71f4961a1b5a1659537e08d982e00a56e785fea3c5473a7338889dd93c94f85ef692277bcc83b3b09c82852652c8e5472f261be22aa0e8a76e8373ef2069
SSDEEP 98304:e2o0bStVM6UeRsrCnGzVVHzC31pLg5nej3TeMnAUcERIcXAFuc:ed0AVdUYsrJmLgmjpn7xqcXfc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Kripta.docx

Path C:\Users\Admin\AppData\Local\Temp\Kripta.docx
Size 11KB
SHA256 4a4633699ea8f0c3d6cb011aaa6e6d2ce0f76f4fd111680fcb14fc5693ea3509
MD5 167abf2cd409b80b1d30181dbb286eac
SHA1 d72fb3a63ebb58f0ee7109dc902ed847c49fd66b
SHA512 7a8ba1552d1b188a4618867650f2aeef167810500627582cab670c77e8031dea957c86d2f8a44c562a1f265d410c235c0554c35f4e0ea67213953966c6ead6c4
SSDEEP 192:CtqcYhCx3HMr1lwkHciBoOP4eTbeicjYm0hMpIa+/bXDvZN:aoheXKdHoOPhb0j8wiDBN
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_rzjihekm.pxr.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rzjihekm.pxr.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/1648-169-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-35-0x00007FFC9B460000-0x00007FFC9B470000-memory.dmp

Download

memory/1648-23-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-25-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-26-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-24-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-21-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-28-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-29-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-30-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-31-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-19-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-34-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-170-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-27-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-22-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-167-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-40-0x00007FFC9B460000-0x00007FFC9B470000-memory.dmp

Download

memory/1648-81-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-20-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-165-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-166-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-76-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-68-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1648-17-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-168-0x00007FFC9D990000-0x00007FFC9D9A0000-memory.dmp

Download

memory/1648-18-0x00007FFCDD910000-0x00007FFCDDB05000-memory.dmp

Download

memory/1860-71-0x00007FFCB0DD0000-0x00007FFCB1891000-memory.dmp

Download

memory/1860-66-0x000001E39C650000-0x000001E39C660000-memory.dmp

Download

memory/1860-67-0x000001E39C650000-0x000001E39C660000-memory.dmp

Download

memory/1860-65-0x00007FFCB0DD0000-0x00007FFCB1891000-memory.dmp

Download

memory/1860-61-0x000001E39DED0000-0x000001E39DEF2000-memory.dmp

Download

memory/2396-106-0x0000013271D20000-0x0000013271DD5000-memory.dmp

Download

memory/2396-108-0x0000013271F50000-0x0000013271F6C000-memory.dmp

Download

memory/2396-92-0x00007FFCB0DD0000-0x00007FFCB1891000-memory.dmp

Download

memory/2396-93-0x0000013259290000-0x00000132592A0000-memory.dmp

Download

memory/2396-94-0x0000013259290000-0x00000132592A0000-memory.dmp

Download

memory/2396-105-0x00007FF4053D0000-0x00007FF4053E0000-memory.dmp

Download

memory/2396-104-0x0000013271D00000-0x0000013271D1C000-memory.dmp

Download

memory/2396-114-0x0000013259290000-0x00000132592A0000-memory.dmp

Download

memory/2396-107-0x0000013271DE0000-0x0000013271DEA000-memory.dmp

Download

memory/2396-117-0x00007FFCB0DD0000-0x00007FFCB1891000-memory.dmp

Download

memory/2396-109-0x0000013271F30000-0x0000013271F3A000-memory.dmp

Download

memory/2396-111-0x0000013271F40000-0x0000013271F48000-memory.dmp

Download

memory/2396-112-0x0000013271F70000-0x0000013271F76000-memory.dmp

Download

memory/2396-113-0x0000013271F80000-0x0000013271F8A000-memory.dmp

Download

memory/2396-110-0x0000013271F90000-0x0000013271FAA000-memory.dmp

Download

memory/2944-32-0x00007FFCDDB10000-0x00007FFCDDB12000-memory.dmp

Download

memory/2944-33-0x00007FFCDDB20000-0x00007FFCDDB22000-memory.dmp

Download

memory/2944-37-0x00007FF6C4910000-0x00007FF6C5657000-memory.dmp

Download

memory/2944-73-0x00007FF6C4910000-0x00007FF6C5657000-memory.dmp

Download

memory/3376-143-0x000001F36C9B0000-0x000001F36C9D0000-memory.dmp

Download

memory/3376-141-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-128-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-129-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-178-0x000001F36C9D0000-0x000001F36C9F0000-memory.dmp

Download

memory/3376-130-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-177-0x000001F36C9B0000-0x000001F36C9D0000-memory.dmp

Download

memory/3376-176-0x000001F36C9D0000-0x000001F36C9F0000-memory.dmp

Download

memory/3376-175-0x000001F36C9B0000-0x000001F36C9D0000-memory.dmp

Download

memory/3376-132-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-133-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-134-0x000001F36C1D0000-0x000001F36C1F0000-memory.dmp

Download

memory/3376-135-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-136-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-137-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-138-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-139-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-126-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-140-0x000001F36C970000-0x000001F36C9B0000-memory.dmp

Download

memory/3376-127-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-142-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-173-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-148-0x000001F36C9B0000-0x000001F36C9D0000-memory.dmp

Download

memory/3376-174-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-172-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3376-171-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4056-122-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4056-121-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4056-120-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4056-119-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4056-118-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4056-124-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4492-79-0x00007FF7BB800000-0x00007FF7BC547000-memory.dmp

Download

memory/4492-77-0x00007FFCDDB10000-0x00007FFCDDB12000-memory.dmp

Download

memory/4492-78-0x00007FFCDDB20000-0x00007FFCDDB22000-memory.dmp

Download

memory/4492-80-0x00007FF7BB800000-0x00007FF7BC547000-memory.dmp

Download

memory/4492-131-0x00007FF7BB800000-0x00007FF7BC547000-memory.dmp

Download