xmrig | 26a181e5b6ea5beabd5b58c241e9181bfbe4bd791181c8dbf0311f3512293850

Analysis

max time kernel
150s
max time network
133s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30/05/2024, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
miner (2).TMP/num2.exe
Size 4.3MB
Sample240530-ww3plsha66
SHA256 48aaa21d99bf5fb15abc6945911438e5f3ac4c378ac89bc4eb850200f9f648d5
MD5 e6fe75c4390d3970545f0fdbb3274244
SHA1 8b6ed33f1778800cf0549bd7214249bdb81fbb58
SHA512 17b0911f13a1348e6511faf412f63721e7df7b196ae3a6acb86789eb04a2f8a90a42a6931a0c0ad45ee98910c4661c6db7e43623c560a963cd4d021ce9b1ad20
SSDEEP 98304:964joDvotqdFGNQPhzexAgEC3ziTnaK9vHQR1kUe3HB1ih:9RvtwFmQZ6xXECDAnaSswBM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig evasion execution miner persistence upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/4512-27-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4512-30-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4512-29-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4512-31-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4512-33-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4512-32-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/4512-26-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4980	powershell.exe
632	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4676	jhi_service.exe
4748	MicrosoftEdgeUpdater.exe
2536	kanilzbpgdul.exe
4280	fdjrmaypnxal.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4512-21-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-24-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-25-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-27-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-30-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-29-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-31-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-33-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-32-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-23-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-26-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/4512-22-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	num2.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	MicrosoftEdgeUpdater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	fdjrmaypnxal.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2536 set thread context of 4924	2536	kanilzbpgdul.exe	105
PID 2536 set thread context of 4512	2536	kanilzbpgdul.exe	109
PID 4748 set thread context of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4280 set thread context of 5080	4280	fdjrmaypnxal.exe	165
PID 4280 set thread context of 2008	4280	fdjrmaypnxal.exe	168
PID 4280 set thread context of 344	4280	fdjrmaypnxal.exe	169

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2872	sc.exe
4264	sc.exe
4112	sc.exe
4964	sc.exe
2624	sc.exe
3760	sc.exe
2392	sc.exe
4684	sc.exe
1044	sc.exe
4772	sc.exe
1344	sc.exe
736	sc.exe
344	sc.exe
804	sc.exe
4012	sc.exe
4260	sc.exe
440	sc.exe
2900	sc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe

Modifies data under HKEY_USERS 57 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	jhi_service.exe
4676	jhi_service.exe
4676	jhi_service.exe
4676	jhi_service.exe
4676	jhi_service.exe
4676	jhi_service.exe
4676	jhi_service.exe
4676	jhi_service.exe
2536	kanilzbpgdul.exe
2536	kanilzbpgdul.exe
2536	kanilzbpgdul.exe
2536	kanilzbpgdul.exe
2536	kanilzbpgdul.exe
2536	kanilzbpgdul.exe
4748	MicrosoftEdgeUpdater.exe
632	powershell.exe
632	powershell.exe
4512	svchost.exe
4512	svchost.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
972	dialer.exe
972	dialer.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4748	MicrosoftEdgeUpdater.exe
4280	fdjrmaypnxal.exe
972	dialer.exe
972	dialer.exe
4980	powershell.exe
4512	svchost.exe
4512	svchost.exe
4980	powershell.exe
4980	powershell.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
4980	powershell.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
4980	powershell.exe
972	dialer.exe
972	dialer.exe
4980	powershell.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe
972	dialer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2268	powercfg.exe
Token: SeCreatePagefilePrivilege	2268	powercfg.exe
Token: SeShutdownPrivilege	3756	powercfg.exe
Token: SeCreatePagefilePrivilege	3756	powercfg.exe
Token: SeShutdownPrivilege	4612	powercfg.exe
Token: SeCreatePagefilePrivilege	4612	powercfg.exe
Token: SeShutdownPrivilege	3032	powercfg.exe
Token: SeCreatePagefilePrivilege	3032	powercfg.exe
Token: SeShutdownPrivilege	4968	powercfg.exe
Token: SeCreatePagefilePrivilege	4968	powercfg.exe
Token: SeShutdownPrivilege	2376	powercfg.exe
Token: SeCreatePagefilePrivilege	2376	powercfg.exe
Token: SeShutdownPrivilege	4940	powercfg.exe
Token: SeCreatePagefilePrivilege	4940	powercfg.exe
Token: SeShutdownPrivilege	5108	powercfg.exe
Token: SeCreatePagefilePrivilege	5108	powercfg.exe
Token: SeLockMemoryPrivilege	4512	svchost.exe
Token: SeDebugPrivilege	632	powershell.exe
Token: SeDebugPrivilege	972	dialer.exe
Token: SeShutdownPrivilege	3332	powercfg.exe
Token: SeCreatePagefilePrivilege	3332	powercfg.exe
Token: SeShutdownPrivilege	3388	powercfg.exe
Token: SeCreatePagefilePrivilege	3388	powercfg.exe
Token: SeShutdownPrivilege	3400	powercfg.exe
Token: SeCreatePagefilePrivilege	3400	powercfg.exe
Token: SeShutdownPrivilege	2340	powercfg.exe
Token: SeCreatePagefilePrivilege	2340	powercfg.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	5080	dialer.exe
Token: SeShutdownPrivilege	4864	powercfg.exe
Token: SeCreatePagefilePrivilege	4864	powercfg.exe
Token: SeShutdownPrivilege	2876	powercfg.exe
Token: SeCreatePagefilePrivilege	2876	powercfg.exe
Token: SeShutdownPrivilege	3392	powercfg.exe
Token: SeCreatePagefilePrivilege	3392	powercfg.exe
Token: SeShutdownPrivilege	2108	powercfg.exe
Token: SeCreatePagefilePrivilege	2108	powercfg.exe
Token: SeLockMemoryPrivilege	344	dialer.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe
Token: SeSecurityPrivilege	2688	svchost.exe
Token: SeTakeOwnershipPrivilege	2688	svchost.exe
Token: SeLoadDriverPrivilege	2688	svchost.exe
Token: SeSystemtimePrivilege	2688	svchost.exe
Token: SeBackupPrivilege	2688	svchost.exe
Token: SeRestorePrivilege	2688	svchost.exe
Token: SeShutdownPrivilege	2688	svchost.exe
Token: SeSystemEnvironmentPrivilege	2688	svchost.exe
Token: SeUndockPrivilege	2688	svchost.exe
Token: SeManageVolumePrivilege	2688	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2688	svchost.exe
Token: SeIncreaseQuotaPrivilege	2688	svchost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3296	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4676	4584	num2.exe	81
PID 4584 wrote to memory of 4676	4584	num2.exe	81
PID 4584 wrote to memory of 4748	4584	num2.exe	98
PID 4584 wrote to memory of 4748	4584	num2.exe	98
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4924	2536	kanilzbpgdul.exe	105
PID 2536 wrote to memory of 4512	2536	kanilzbpgdul.exe	109
PID 2536 wrote to memory of 4512	2536	kanilzbpgdul.exe	109
PID 2536 wrote to memory of 4512	2536	kanilzbpgdul.exe	109
PID 2536 wrote to memory of 4512	2536	kanilzbpgdul.exe	109
PID 2536 wrote to memory of 4512	2536	kanilzbpgdul.exe	109
PID 4256 wrote to memory of 3116	4256	cmd.exe	119
PID 4256 wrote to memory of 3116	4256	cmd.exe	119
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 4748 wrote to memory of 972	4748	MicrosoftEdgeUpdater.exe	130
PID 972 wrote to memory of 652	972	dialer.exe	5
PID 972 wrote to memory of 708	972	dialer.exe	7
PID 972 wrote to memory of 992	972	dialer.exe	12
PID 972 wrote to memory of 568	972	dialer.exe	13
PID 972 wrote to memory of 548	972	dialer.exe	14
PID 708 wrote to memory of 2644	708	lsass.exe	44
PID 972 wrote to memory of 780	972	dialer.exe	15
PID 972 wrote to memory of 1060	972	dialer.exe	16
PID 972 wrote to memory of 1104	972	dialer.exe	17
PID 972 wrote to memory of 1128	972	dialer.exe	18
PID 972 wrote to memory of 1204	972	dialer.exe	20
PID 972 wrote to memory of 1280	972	dialer.exe	21
PID 972 wrote to memory of 1288	972	dialer.exe	22
PID 972 wrote to memory of 1420	972	dialer.exe	24
PID 972 wrote to memory of 1428	972	dialer.exe	25
PID 972 wrote to memory of 1524	972	dialer.exe	26
PID 972 wrote to memory of 1536	972	dialer.exe	27
PID 972 wrote to memory of 1692	972	dialer.exe	28
PID 972 wrote to memory of 1736	972	dialer.exe	29
PID 972 wrote to memory of 1780	972	dialer.exe	30
PID 972 wrote to memory of 1796	972	dialer.exe	31
PID 972 wrote to memory of 1832	972	dialer.exe	32
PID 972 wrote to memory of 1840	972	dialer.exe	33
PID 972 wrote to memory of 1860	972	dialer.exe	34
PID 972 wrote to memory of 1940	972	dialer.exe	35
PID 972 wrote to memory of 1948	972	dialer.exe	36
PID 972 wrote to memory of 2132	972	dialer.exe	37
PID 972 wrote to memory of 2244	972	dialer.exe	39
PID 972 wrote to memory of 2428	972	dialer.exe	40
PID 972 wrote to memory of 2540	972	dialer.exe	41
PID 972 wrote to memory of 2548	972	dialer.exe	42
PID 972 wrote to memory of 2576	972	dialer.exe	43
PID 972 wrote to memory of 2644	972	dialer.exe	44
PID 972 wrote to memory of 2652	972	dialer.exe	45
PID 972 wrote to memory of 2680	972	dialer.exe	46
PID 972 wrote to memory of 2688	972	dialer.exe	47
PID 972 wrote to memory of 2696	972	dialer.exe	48

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:652
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:568

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:992

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1128

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1204

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1428
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1860

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1948

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2576

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2652

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2300

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3088

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of UnmapMainImage
PID:3296
- C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe
  "C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4584
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2268
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3032
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3756
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4612
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "HDNFMUHS"
      4⤵
      Launches sc.exe
      PID:4260
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:2624
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:3760
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "HDNFMUHS"
      4⤵
      Launches sc.exe
      PID:4772
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:632
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4256
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:3116
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:2392
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:804
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:1344
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:4684
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:2872
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2340
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3388
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3400
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3332
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:972
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe delete "YWZWALUU"
      4⤵
      Launches sc.exe
      PID:344
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"
      4⤵
      Launches sc.exe
      PID:736
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop eventlog
      4⤵
      Launches sc.exe
      PID:4012
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe start "YWZWALUU"
      4⤵
      Launches sc.exe
      PID:440
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3440

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3804

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3864

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3980

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1032

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1200

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2460

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4120

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4520

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2164

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2376
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4940
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5108
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:4924
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks processor information in registry
PID:788

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4280
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:2124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5104
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5060
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4264
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2952
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:4112
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2904
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:1044
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2536
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4964
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4088
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4132
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3828
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4420
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1052
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:2008
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

MicrosoftEdgeUpdater.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
Size 2.7MB
SHA256 38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
MD5 19c095e1c399bdaa0663caa9162f0b0e
SHA1 cb5504712ec965f7c43883f2f251823755b1e37e
SHA512 a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9
SSDEEP 49152:9fYIxVYU98IqK6VW6tE1ZWD4Zs52YeycKk4BVhGJneLriO:VYIxVZ98I71/ZsQIcKDoYr
MD5 SHA1 SHA512 SSDEEP

Submit Download

jhi_service.exe

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
Size 2.5MB
SHA256 c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
MD5 1994ad04639f3d12c7bbfa37feb3434f
SHA1 4979247e5a9771286a91827851527e5dbfb80c8e
SHA512 adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43
SSDEEP 49152:JeyI4v7SO1chT1kPoGyH22x8wfc3QC/FGQAC8TnWhVpihDHdggjrKCnQPzkwG:JtjehT1kA4wXGMRyk7Kg/nnY
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_q0zejj2x.uzn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0zejj2x.uzn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/548-76-0x00000192377B0000-0x00000192377DB000-memory.dmp

Download

memory/548-77-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/568-69-0x000001A455CB0000-0x000001A455CDB000-memory.dmp

Download

memory/568-70-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/632-42-0x0000016BB5370000-0x0000016BB5392000-memory.dmp

Download

memory/652-59-0x000001D102250000-0x000001D102274000-memory.dmp

Download

memory/652-61-0x000001D102280000-0x000001D1022AB000-memory.dmp

Download

memory/652-62-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/708-66-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/708-64-0x00000216556D0000-0x00000216556FB000-memory.dmp

Download

memory/780-84-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/780-83-0x0000015B76FC0000-0x0000015B76FEB000-memory.dmp

Download

memory/972-47-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/972-52-0x00007FFCD45F0000-0x00007FFCD46AD000-memory.dmp

Download

memory/972-56-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/972-45-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/972-48-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/972-51-0x00007FFCD5B40000-0x00007FFCD5D49000-memory.dmp

Download

memory/972-46-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/972-50-0x0000000140000000-0x000000014002B000-memory.dmp

Download

memory/992-72-0x0000012F9FEF0000-0x0000012F9FF1B000-memory.dmp

Download

memory/992-73-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/1060-87-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/1060-86-0x0000023B69D20000-0x0000023B69D4B000-memory.dmp

Download

memory/1104-90-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

Download

memory/1104-89-0x000002BD314C0000-0x000002BD314EB000-memory.dmp

Download

memory/4512-24-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-25-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-33-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-31-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-23-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-21-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-32-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-22-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-26-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-29-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-30-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-27-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/4512-28-0x0000018D2E950000-0x0000018D2E970000-memory.dmp

Download

memory/4924-15-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4924-14-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4924-13-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4924-20-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4924-17-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4924-16-0x0000000140000000-0x000000014000D000-memory.dmp

Download

memory/4980-335-0x000001409ABF0000-0x000001409AC0C000-memory.dmp

Download

memory/4980-336-0x000001409AC10000-0x000001409ACC3000-memory.dmp

Download

memory/4980-337-0x000001409A9E0000-0x000001409A9EA000-memory.dmp

Download

memory/4980-338-0x000001409ADF0000-0x000001409AE0C000-memory.dmp

Download

memory/4980-339-0x000001409ADD0000-0x000001409ADDA000-memory.dmp

Download

memory/4980-340-0x000001409AE30000-0x000001409AE4A000-memory.dmp

Download

memory/4980-341-0x000001409ADE0000-0x000001409ADE8000-memory.dmp

Download

memory/4980-343-0x000001409AE20000-0x000001409AE2A000-memory.dmp

Download

memory/4980-342-0x000001409AE10000-0x000001409AE16000-memory.dmp

Download