Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-05-2024 18:17
Behavioral task
behavioral1
Sample
miner (2).TMP/Client.exe
Resource
win11-20240419-en
Behavioral task
behavioral2
Sample
miner (2).TMP/num2.exe
Resource
win11-20240508-en
Behavioral task
behavioral3
Sample
miner.TMP/MicrosoftEdgeUpdater.exe
Resource
win11-20240426-en
General
-
Target
miner.TMP/MicrosoftEdgeUpdater.exe
-
Size
2.7MB
-
MD5
19c095e1c399bdaa0663caa9162f0b0e
-
SHA1
cb5504712ec965f7c43883f2f251823755b1e37e
-
SHA256
38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
-
SHA512
a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9
-
SSDEEP
49152:9fYIxVYU98IqK6VW6tE1ZWD4Zs52YeycKk4BVhGJneLriO:VYIxVZ98I71/ZsQIcKDoYr
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2852 powershell.exe 2952 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
fdjrmaypnxal.exepid process 1032 fdjrmaypnxal.exe -
Drops file in System32 directory 5 IoCs
Processes:
MicrosoftEdgeUpdater.exesvchost.exepowershell.exefdjrmaypnxal.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe MicrosoftEdgeUpdater.exe File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe fdjrmaypnxal.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
MicrosoftEdgeUpdater.exefdjrmaypnxal.exedescription pid process target process PID 4580 set thread context of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 1032 set thread context of 3732 1032 fdjrmaypnxal.exe dialer.exe PID 1032 set thread context of 896 1032 fdjrmaypnxal.exe dialer.exe PID 1032 set thread context of 1904 1032 fdjrmaypnxal.exe dialer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1488 sc.exe 3192 sc.exe 2436 sc.exe 2140 sc.exe 3160 sc.exe 1928 sc.exe 3380 sc.exe 3936 sc.exe 1412 sc.exe 2136 sc.exe 4952 sc.exe 664 sc.exe 768 sc.exe 3304 sc.exe -
Modifies data under HKEY_USERS 57 IoCs
Processes:
powershell.exeOfficeClickToRun.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
MicrosoftEdgeUpdater.exepowershell.exedialer.exefdjrmaypnxal.exepowershell.exedialer.exepid process 4580 MicrosoftEdgeUpdater.exe 2852 powershell.exe 2852 powershell.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4580 MicrosoftEdgeUpdater.exe 4808 dialer.exe 4808 dialer.exe 4580 MicrosoftEdgeUpdater.exe 4580 MicrosoftEdgeUpdater.exe 1032 fdjrmaypnxal.exe 2952 powershell.exe 2952 powershell.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 2952 powershell.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 2952 powershell.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 4808 dialer.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 1032 fdjrmaypnxal.exe 3732 dialer.exe 3732 dialer.exe 4808 dialer.exe 4808 dialer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedialer.exesvchost.exedescription pid process Token: SeDebugPrivilege 2852 powershell.exe Token: SeDebugPrivilege 4808 dialer.exe Token: SeShutdownPrivilege 4712 powercfg.exe Token: SeCreatePagefilePrivilege 4712 powercfg.exe Token: SeShutdownPrivilege 4976 powercfg.exe Token: SeCreatePagefilePrivilege 4976 powercfg.exe Token: SeShutdownPrivilege 1316 powercfg.exe Token: SeCreatePagefilePrivilege 1316 powercfg.exe Token: SeShutdownPrivilege 3576 powercfg.exe Token: SeCreatePagefilePrivilege 3576 powercfg.exe Token: SeDebugPrivilege 2952 powershell.exe Token: SeDebugPrivilege 3732 dialer.exe Token: SeShutdownPrivilege 2552 powercfg.exe Token: SeCreatePagefilePrivilege 2552 powercfg.exe Token: SeShutdownPrivilege 3656 powercfg.exe Token: SeCreatePagefilePrivilege 3656 powercfg.exe Token: SeShutdownPrivilege 1852 powercfg.exe Token: SeCreatePagefilePrivilege 1852 powercfg.exe Token: SeShutdownPrivilege 4964 powercfg.exe Token: SeCreatePagefilePrivilege 4964 powercfg.exe Token: SeLockMemoryPrivilege 1904 dialer.exe Token: SeAssignPrimaryTokenPrivilege 2724 svchost.exe Token: SeIncreaseQuotaPrivilege 2724 svchost.exe Token: SeSecurityPrivilege 2724 svchost.exe Token: SeTakeOwnershipPrivilege 2724 svchost.exe Token: SeLoadDriverPrivilege 2724 svchost.exe Token: SeSystemtimePrivilege 2724 svchost.exe Token: SeBackupPrivilege 2724 svchost.exe Token: SeRestorePrivilege 2724 svchost.exe Token: SeShutdownPrivilege 2724 svchost.exe Token: SeSystemEnvironmentPrivilege 2724 svchost.exe Token: SeUndockPrivilege 2724 svchost.exe Token: SeManageVolumePrivilege 2724 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2724 svchost.exe Token: SeIncreaseQuotaPrivilege 2724 svchost.exe Token: SeSecurityPrivilege 2724 svchost.exe Token: SeTakeOwnershipPrivilege 2724 svchost.exe Token: SeLoadDriverPrivilege 2724 svchost.exe Token: SeSystemtimePrivilege 2724 svchost.exe Token: SeBackupPrivilege 2724 svchost.exe Token: SeRestorePrivilege 2724 svchost.exe Token: SeShutdownPrivilege 2724 svchost.exe Token: SeSystemEnvironmentPrivilege 2724 svchost.exe Token: SeUndockPrivilege 2724 svchost.exe Token: SeManageVolumePrivilege 2724 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2724 svchost.exe Token: SeIncreaseQuotaPrivilege 2724 svchost.exe Token: SeSecurityPrivilege 2724 svchost.exe Token: SeTakeOwnershipPrivilege 2724 svchost.exe Token: SeLoadDriverPrivilege 2724 svchost.exe Token: SeSystemtimePrivilege 2724 svchost.exe Token: SeBackupPrivilege 2724 svchost.exe Token: SeRestorePrivilege 2724 svchost.exe Token: SeShutdownPrivilege 2724 svchost.exe Token: SeSystemEnvironmentPrivilege 2724 svchost.exe Token: SeUndockPrivilege 2724 svchost.exe Token: SeManageVolumePrivilege 2724 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2724 svchost.exe Token: SeIncreaseQuotaPrivilege 2724 svchost.exe Token: SeSecurityPrivilege 2724 svchost.exe Token: SeTakeOwnershipPrivilege 2724 svchost.exe Token: SeLoadDriverPrivilege 2724 svchost.exe Token: SeSystemtimePrivilege 2724 svchost.exe Token: SeBackupPrivilege 2724 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeMicrosoftEdgeUpdater.exedialer.exelsass.exedescription pid process target process PID 4700 wrote to memory of 3980 4700 cmd.exe wusa.exe PID 4700 wrote to memory of 3980 4700 cmd.exe wusa.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4580 wrote to memory of 4808 4580 MicrosoftEdgeUpdater.exe dialer.exe PID 4808 wrote to memory of 640 4808 dialer.exe winlogon.exe PID 4808 wrote to memory of 696 4808 dialer.exe lsass.exe PID 4808 wrote to memory of 996 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 540 4808 dialer.exe dwm.exe PID 4808 wrote to memory of 864 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 992 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1076 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1084 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1148 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1268 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1308 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1372 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1420 4808 dialer.exe svchost.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 4808 wrote to memory of 1460 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1472 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1548 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1560 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1696 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1768 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1808 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1832 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1912 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 1996 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2004 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2020 4808 dialer.exe svchost.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 4808 wrote to memory of 1876 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2180 4808 dialer.exe spoolsv.exe PID 4808 wrote to memory of 2272 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2392 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2532 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2540 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2576 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2656 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2676 4808 dialer.exe sysmon.exe PID 4808 wrote to memory of 2712 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 2724 4808 dialer.exe svchost.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 4808 wrote to memory of 2732 4808 dialer.exe svchost.exe PID 696 wrote to memory of 2676 696 lsass.exe sysmon.exe PID 4808 wrote to memory of 2880 4808 dialer.exe sihost.exe PID 4808 wrote to memory of 2908 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 3088 4808 dialer.exe unsecapp.exe PID 4808 wrote to memory of 3288 4808 dialer.exe Explorer.EXE PID 4808 wrote to memory of 3428 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 3484 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 3848 4808 dialer.exe RuntimeBroker.exe PID 4808 wrote to memory of 3916 4808 dialer.exe RuntimeBroker.exe PID 4808 wrote to memory of 4012 4808 dialer.exe DllHost.exe PID 4808 wrote to memory of 4064 4808 dialer.exe svchost.exe PID 4808 wrote to memory of 4340 4808 dialer.exe DllHost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:640
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:540
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:696
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:996
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:992
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1084
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1148
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1268
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1308
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵PID:1372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1420
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1472
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1548
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1560
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:1808
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1912
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1876
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2272
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2656
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2676
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2712
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2724
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2908
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3088
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe"C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe"2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:3980
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
PID:768 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:2436 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
PID:2140 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
PID:3160 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
PID:3380 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4712 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3576 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1316 -
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "YWZWALUU"3⤵
- Launches sc.exe
PID:2136 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"3⤵
- Launches sc.exe
PID:3936 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:1412 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "YWZWALUU"3⤵
- Launches sc.exe
PID:1928 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:3484
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3848
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3916
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4064
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵PID:4460
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4076
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:892
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:1336
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
PID:568
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
PID:660
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:5068
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:2480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:2684
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4444
-
C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exeC:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:1032 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4612
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:1920
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:2364
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:664 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4952 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:3304 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:3192 -
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:1488 -
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3704
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3656 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3496
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4964 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3152
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1016
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3732 -
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵PID:896
-
C:\Windows\system32\dialer.exedialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:1504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD519c095e1c399bdaa0663caa9162f0b0e
SHA1cb5504712ec965f7c43883f2f251823755b1e37e
SHA25638edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82