Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 02:13
Static task
static1
Behavioral task
behavioral1
Sample
829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe
Resource
win7-20240220-en
General
-
Target
829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe
-
Size
5.3MB
-
MD5
7cb35be5ff69f1d6ac6fda8c63159e49
-
SHA1
048cd03b6a8aff39074aa0c9132cdaf980fa76fa
-
SHA256
829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670
-
SHA512
eb35047cd754ae47e3019aab74983b311cbcc2937548b9d951bda137d718fffdecf1574bac75e344f9abdd2f2a4ddd6a9032c7f0ab137446cca2ac987e6765a3
-
SSDEEP
98304:xRjPz9KDzUU8O5/B/LJ25E9SVh86sS3TRknQ3ss2MApp9meypA3cPDu7:xFKoU8O5/b2XViSjX310SeyGc7u7
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 15 IoCs
Processes:
resource yara_rule behavioral2/memory/4972-60-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-62-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-61-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-59-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-58-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-57-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-68-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-66-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-67-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-64-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-65-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-69-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-71-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-72-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/4972-73-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4972-62-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-61-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-68-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-66-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-67-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-64-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-65-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-69-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-71-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-72-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/4972-73-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3004 powershell.exe 1920 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
lutlgidagtja.exepid process 2816 lutlgidagtja.exe -
Processes:
resource yara_rule behavioral2/memory/4972-60-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-62-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-61-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-59-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-58-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-56-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-57-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-68-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-66-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-67-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-64-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-65-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-69-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-71-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-72-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/4972-73-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exelutlgidagtja.exe829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe lutlgidagtja.exe File opened for modification C:\Windows\system32\MRT.exe 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
lutlgidagtja.exedescription pid process target process PID 2816 set thread context of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 set thread context of 4972 2816 lutlgidagtja.exe nslookup.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2280 sc.exe 3740 sc.exe 4248 sc.exe 4140 sc.exe 2168 sc.exe 4364 sc.exe 4708 sc.exe 4476 sc.exe 4392 sc.exe 4452 sc.exe 592 sc.exe 4072 sc.exe 3820 sc.exe 4640 sc.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exepowershell.exelutlgidagtja.exepowershell.exenslookup.exepid process 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1920 powershell.exe 1920 powershell.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 1616 829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe 2816 lutlgidagtja.exe 3004 powershell.exe 3004 powershell.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 2816 lutlgidagtja.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe 4972 nslookup.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exenslookup.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1920 powershell.exe Token: SeShutdownPrivilege 3364 powercfg.exe Token: SeCreatePagefilePrivilege 3364 powercfg.exe Token: SeShutdownPrivilege 5044 powercfg.exe Token: SeCreatePagefilePrivilege 5044 powercfg.exe Token: SeShutdownPrivilege 2084 powercfg.exe Token: SeCreatePagefilePrivilege 2084 powercfg.exe Token: SeShutdownPrivilege 1444 powercfg.exe Token: SeCreatePagefilePrivilege 1444 powercfg.exe Token: SeDebugPrivilege 3004 powershell.exe Token: SeShutdownPrivilege 3060 powercfg.exe Token: SeCreatePagefilePrivilege 3060 powercfg.exe Token: SeLockMemoryPrivilege 4972 nslookup.exe Token: SeShutdownPrivilege 3556 powercfg.exe Token: SeCreatePagefilePrivilege 3556 powercfg.exe Token: SeShutdownPrivilege 4672 powercfg.exe Token: SeCreatePagefilePrivilege 4672 powercfg.exe Token: SeShutdownPrivilege 2044 powercfg.exe Token: SeCreatePagefilePrivilege 2044 powercfg.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
cmd.execmd.execmd.exelutlgidagtja.exedescription pid process target process PID 4972 wrote to memory of 2964 4972 cmd.exe wusa.exe PID 4972 wrote to memory of 2964 4972 cmd.exe wusa.exe PID 432 wrote to memory of 5072 432 cmd.exe choice.exe PID 432 wrote to memory of 5072 432 cmd.exe choice.exe PID 3440 wrote to memory of 816 3440 cmd.exe wusa.exe PID 3440 wrote to memory of 816 3440 cmd.exe wusa.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 756 2816 lutlgidagtja.exe conhost.exe PID 2816 wrote to memory of 4972 2816 lutlgidagtja.exe nslookup.exe PID 2816 wrote to memory of 4972 2816 lutlgidagtja.exe nslookup.exe PID 2816 wrote to memory of 4972 2816 lutlgidagtja.exe nslookup.exe PID 2816 wrote to memory of 4972 2816 lutlgidagtja.exe nslookup.exe PID 2816 wrote to memory of 4972 2816 lutlgidagtja.exe nslookup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe"C:\Users\Admin\AppData\Local\Temp\829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "JIOGRCSG"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "JIOGRCSG" binpath= "C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe" start= "auto"2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "JIOGRCSG"2⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 33⤵
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeC:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\system32\nslookup.exenslookup.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\zvycwxhpsxqt\lutlgidagtja.exeFilesize
5.3MB
MD57cb35be5ff69f1d6ac6fda8c63159e49
SHA1048cd03b6a8aff39074aa0c9132cdaf980fa76fa
SHA256829a7217425797382c0bf0e4af76ba49ed1e6592725a445e6e5da48ea53f6670
SHA512eb35047cd754ae47e3019aab74983b311cbcc2937548b9d951bda137d718fffdecf1574bac75e344f9abdd2f2a4ddd6a9032c7f0ab137446cca2ac987e6765a3
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mpn1xbvo.uxt.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/756-48-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/756-51-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/756-52-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/756-50-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/756-49-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/756-55-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/1920-11-0x00007FFD4E0F0000-0x00007FFD4EBB1000-memory.dmpFilesize
10.8MB
-
memory/1920-0-0x00007FFD4E0F3000-0x00007FFD4E0F5000-memory.dmpFilesize
8KB
-
memory/1920-15-0x00007FFD4E0F0000-0x00007FFD4EBB1000-memory.dmpFilesize
10.8MB
-
memory/1920-12-0x00007FFD4E0F0000-0x00007FFD4EBB1000-memory.dmpFilesize
10.8MB
-
memory/1920-1-0x0000026B2BBD0000-0x0000026B2BBF2000-memory.dmpFilesize
136KB
-
memory/3004-39-0x000001C89C430000-0x000001C89C43A000-memory.dmpFilesize
40KB
-
memory/3004-44-0x000001C89C6A0000-0x000001C89C6A6000-memory.dmpFilesize
24KB
-
memory/3004-45-0x000001C89C6B0000-0x000001C89C6BA000-memory.dmpFilesize
40KB
-
memory/3004-43-0x000001C89C670000-0x000001C89C678000-memory.dmpFilesize
32KB
-
memory/3004-42-0x000001C89C6C0000-0x000001C89C6DA000-memory.dmpFilesize
104KB
-
memory/3004-41-0x000001C89C660000-0x000001C89C66A000-memory.dmpFilesize
40KB
-
memory/3004-40-0x000001C89C680000-0x000001C89C69C000-memory.dmpFilesize
112KB
-
memory/3004-38-0x000001C89C460000-0x000001C89C515000-memory.dmpFilesize
724KB
-
memory/3004-37-0x000001C89C440000-0x000001C89C45C000-memory.dmpFilesize
112KB
-
memory/4972-59-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-66-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-62-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-61-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-60-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-58-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-56-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-57-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-68-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-63-0x000001E2B2610000-0x000001E2B2630000-memory.dmpFilesize
128KB
-
memory/4972-67-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-64-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-65-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-69-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-71-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-72-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/4972-73-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB