Malware Analysis Report

2024-10-19 08:08

Sample ID 240530-ww3plsha66
Target virus exposed.zip
SHA256 26a181e5b6ea5beabd5b58c241e9181bfbe4bd791181c8dbf0311f3512293850
Tags
pyinstaller njrat evasion persistence trojan xmrig execution miner upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

26a181e5b6ea5beabd5b58c241e9181bfbe4bd791181c8dbf0311f3512293850

Threat Level: Known bad

The file virus exposed.zip was found to be: Known bad.

Malicious Activity Summary

pyinstaller njrat evasion persistence trojan xmrig execution miner upx

njRAT/Bladabindi

xmrig

XMRig Miner payload

Command and Scripting Interpreter: PowerShell

Stops running service(s)

Creates new service(s)

Modifies Windows Firewall

Drops startup file

UPX packed file

Executes dropped EXE

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in System32 directory

Launches sc.exe

Enumerates physical storage devices

Unsigned PE

Detects Pyinstaller

Uses Task Scheduler COM API

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious use of UnmapMainImage

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-30 18:17

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-30 18:17

Reported

2024-05-30 18:20

Platform

win11-20240419-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe"

Signatures

njRAT/Bladabindi

trojan njrat

Modifies Windows Firewall

evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\netsh.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b22a0109880b3427de44fee115dc40ce.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b22a0109880b3427de44fee115dc40ce.exe C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\b22a0109880b3427de44fee115dc40ce = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b22a0109880b3427de44fee115dc40ce = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsServices.exe\" .." C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe

"C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\Client.exe"

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe

"C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe"

C:\Windows\SysWOW64\netsh.exe

netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe" "WindowsServices.exe" ENABLE

Network

Country Destination Domain Proto
NL 91.92.241.69:5555 tcp
US 8.8.8.8:53 69.241.92.91.in-addr.arpa udp
N/A 88.221.83.105:80 tcp
N/A 192.229.221.95:80 tcp

Files

memory/3916-0-0x0000000074CC1000-0x0000000074CC2000-memory.dmp

memory/3916-1-0x0000000074CC0000-0x0000000075271000-memory.dmp

memory/3916-2-0x0000000074CC0000-0x0000000075271000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\WindowsServices.exe

MD5 2560eaeea2f78be73934dff77dc21115
SHA1 47da9e0270fdd3c762dcb371614eaf4ff67add03
SHA256 c5bbe1f75d15903b38f0c1e944b8205dcbbb8033206b22921ad90bc64b0699e6
SHA512 5ac9af16716e2e9ffa1cec0f74f273468789caf157ddfe7cbf20e6efdf03ad5f0c86d46bf8944c15a79c8d890ec4f683a9c4758c44c3ce5a5f0d3915f9fe977c

memory/3916-12-0x0000000074CC0000-0x0000000075271000-memory.dmp

memory/4912-13-0x0000000074CC0000-0x0000000075271000-memory.dmp

memory/4912-14-0x0000000074CC0000-0x0000000075271000-memory.dmp

memory/4912-16-0x0000000074CC0000-0x0000000075271000-memory.dmp

memory/4912-17-0x0000000074CC0000-0x0000000075271000-memory.dmp

memory/4912-18-0x0000000074CC0000-0x0000000075271000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-30 18:17

Reported

2024-05-30 18:20

Platform

win11-20240508-en

Max time kernel

150s

Max time network

133s

Command Line

winlogon.exe

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Stops running service(s)

evasion execution

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier C:\Windows\system32\wbem\wmiprvse.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\wbem\wmiprvse.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information C:\Windows\system32\wbem\wmiprvse.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of UnmapMainImage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4584 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 4584 wrote to memory of 4676 N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe
PID 4584 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 4584 wrote to memory of 4748 N/A C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4924 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 2536 wrote to memory of 4512 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2536 wrote to memory of 4512 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2536 wrote to memory of 4512 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2536 wrote to memory of 4512 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 2536 wrote to memory of 4512 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 4256 wrote to memory of 3116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4256 wrote to memory of 3116 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4748 wrote to memory of 972 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 972 wrote to memory of 652 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 972 wrote to memory of 708 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 972 wrote to memory of 992 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 568 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\dwm.exe
PID 972 wrote to memory of 548 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 708 wrote to memory of 2644 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 972 wrote to memory of 780 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1060 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1104 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1128 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1204 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1280 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1288 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1420 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1428 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1524 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1536 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1692 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1736 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1780 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1796 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1832 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1840 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1860 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 1940 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 1948 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 2132 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 972 wrote to memory of 2244 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 2428 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 2540 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 2548 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 2576 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 2644 N/A C:\Windows\system32\dialer.exe C:\Windows\sysmon.exe
PID 972 wrote to memory of 2652 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 2680 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 972 wrote to memory of 2688 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 972 wrote to memory of 2696 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe

"C:\Users\Admin\AppData\Local\Temp\miner (2).TMP\num2.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "HDNFMUHS"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "HDNFMUHS"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "YWZWALUU"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "YWZWALUU"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

dialer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp
DE 45.76.89.70:80 pool.hashvault.pro tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jhi_service.exe

MD5 1994ad04639f3d12c7bbfa37feb3434f
SHA1 4979247e5a9771286a91827851527e5dbfb80c8e
SHA256 c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
SHA512 adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MicrosoftEdgeUpdater.exe

MD5 19c095e1c399bdaa0663caa9162f0b0e
SHA1 cb5504712ec965f7c43883f2f251823755b1e37e
SHA256 38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512 a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

memory/4924-17-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4924-20-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4512-21-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-24-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-25-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-28-0x0000018D2E950000-0x0000018D2E970000-memory.dmp

memory/4512-27-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-30-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-29-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-31-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-33-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-32-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-23-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-26-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4512-22-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4924-16-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4924-15-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4924-14-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4924-13-0x0000000140000000-0x000000014000D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q0zejj2x.uzn.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/632-42-0x0000016BB5370000-0x0000016BB5392000-memory.dmp

memory/972-46-0x0000000140000000-0x000000014002B000-memory.dmp

memory/972-50-0x0000000140000000-0x000000014002B000-memory.dmp

memory/972-52-0x00007FFCD45F0000-0x00007FFCD46AD000-memory.dmp

memory/972-51-0x00007FFCD5B40000-0x00007FFCD5D49000-memory.dmp

memory/972-48-0x0000000140000000-0x000000014002B000-memory.dmp

memory/972-47-0x0000000140000000-0x000000014002B000-memory.dmp

memory/972-45-0x0000000140000000-0x000000014002B000-memory.dmp

memory/992-73-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/548-77-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/548-76-0x00000192377B0000-0x00000192377DB000-memory.dmp

memory/992-72-0x0000012F9FEF0000-0x0000012F9FF1B000-memory.dmp

memory/1104-90-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/1104-89-0x000002BD314C0000-0x000002BD314EB000-memory.dmp

memory/1060-87-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/1060-86-0x0000023B69D20000-0x0000023B69D4B000-memory.dmp

memory/780-84-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/780-83-0x0000015B76FC0000-0x0000015B76FEB000-memory.dmp

memory/568-70-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/568-69-0x000001A455CB0000-0x000001A455CDB000-memory.dmp

memory/708-66-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/708-64-0x00000216556D0000-0x00000216556FB000-memory.dmp

memory/652-62-0x00007FFC95BD0000-0x00007FFC95BE0000-memory.dmp

memory/652-61-0x000001D102280000-0x000001D1022AB000-memory.dmp

memory/652-59-0x000001D102250000-0x000001D102274000-memory.dmp

memory/972-56-0x0000000140000000-0x000000014002B000-memory.dmp

memory/4980-335-0x000001409ABF0000-0x000001409AC0C000-memory.dmp

memory/4980-336-0x000001409AC10000-0x000001409ACC3000-memory.dmp

memory/4980-337-0x000001409A9E0000-0x000001409A9EA000-memory.dmp

memory/4980-338-0x000001409ADF0000-0x000001409AE0C000-memory.dmp

memory/4980-339-0x000001409ADD0000-0x000001409ADDA000-memory.dmp

memory/4980-340-0x000001409AE30000-0x000001409AE4A000-memory.dmp

memory/4980-341-0x000001409ADE0000-0x000001409ADE8000-memory.dmp

memory/4980-343-0x000001409AE20000-0x000001409AE2A000-memory.dmp

memory/4980-342-0x000001409AE10000-0x000001409AE16000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-05-30 18:17

Reported

2024-05-30 18:20

Platform

win11-20240426-en

Max time kernel

150s

Max time network

150s

Command Line

winlogon.exe

Signatures

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4580 set thread context of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 1032 set thread context of 3732 N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe C:\Windows\system32\dialer.exe
PID 1032 set thread context of 896 N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe C:\Windows\system32\dialer.exe
PID 1032 set thread context of 1904 N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe C:\Windows\system32\dialer.exe

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\system32\svchost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A
N/A N/A C:\Windows\system32\dialer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\dialer.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\system32\svchost.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4700 wrote to memory of 3980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4700 wrote to memory of 3980 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4580 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe C:\Windows\system32\dialer.exe
PID 4808 wrote to memory of 640 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\winlogon.exe
PID 4808 wrote to memory of 696 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\lsass.exe
PID 4808 wrote to memory of 996 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 540 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\dwm.exe
PID 4808 wrote to memory of 864 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 992 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1076 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 1084 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1148 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1268 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1308 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1372 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 1420 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 4808 wrote to memory of 1460 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 1472 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1548 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1560 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 1696 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1768 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 1808 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1832 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 1912 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 1996 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 2004 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 2020 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 4808 wrote to memory of 1876 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 2180 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\spoolsv.exe
PID 4808 wrote to memory of 2272 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 2392 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 2532 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 2540 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 2576 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 2656 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 2676 N/A C:\Windows\system32\dialer.exe C:\Windows\sysmon.exe
PID 4808 wrote to memory of 2712 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\svchost.exe
PID 4808 wrote to memory of 2724 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 4808 wrote to memory of 2732 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 696 wrote to memory of 2676 N/A C:\Windows\system32\lsass.exe C:\Windows\sysmon.exe
PID 4808 wrote to memory of 2880 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\sihost.exe
PID 4808 wrote to memory of 2908 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 3088 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\wbem\unsecapp.exe
PID 4808 wrote to memory of 3288 N/A C:\Windows\system32\dialer.exe C:\Windows\Explorer.EXE
PID 4808 wrote to memory of 3428 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 3484 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 3848 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\RuntimeBroker.exe
PID 4808 wrote to memory of 3916 N/A C:\Windows\system32\dialer.exe C:\Windows\System32\RuntimeBroker.exe
PID 4808 wrote to memory of 4012 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\DllHost.exe
PID 4808 wrote to memory of 4064 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\svchost.exe
PID 4808 wrote to memory of 4340 N/A C:\Windows\system32\dialer.exe C:\Windows\system32\DllHost.exe

Processes

C:\Windows\system32\winlogon.exe

winlogon.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\lsass.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM

C:\Windows\system32\dwm.exe

"dwm.exe"

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s nsi

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k NetworkService -p

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer

C:\Windows\sysmon.exe

C:\Windows\sysmon.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\wbem\unsecapp.exe

C:\Windows\system32\wbem\unsecapp.exe -Embedding

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe

"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service

C:\Windows\system32\SppExtComObj.exe

C:\Windows\system32\SppExtComObj.exe -Embedding

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe

"C:\Users\Admin\AppData\Local\Temp\miner.TMP\MicrosoftEdgeUpdater.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "YWZWALUU"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "YWZWALUU" binpath= "C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "YWZWALUU"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

C:\Windows\system32\dialer.exe

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\dialer.exe

dialer.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
NL 52.111.243.30:443 tcp

Files

memory/2852-0-0x00007FF8AD863000-0x00007FF8AD865000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cesjzkhr.wow.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2852-9-0x00000196AC960000-0x00000196AC982000-memory.dmp

memory/2852-10-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

memory/2852-11-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

memory/2852-12-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

memory/2852-15-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

memory/2852-16-0x00007FF8AD860000-0x00007FF8AE322000-memory.dmp

memory/4808-20-0x0000000140000000-0x000000014002B000-memory.dmp

memory/4808-24-0x00007FF8CD130000-0x00007FF8CD1ED000-memory.dmp

memory/4808-23-0x00007FF8CE760000-0x00007FF8CE969000-memory.dmp

memory/696-36-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/540-39-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/540-38-0x0000014CAE610000-0x0000014CAE63B000-memory.dmp

memory/864-46-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/1308-72-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

C:\ProgramData\bbskkvrqdoji\fdjrmaypnxal.exe

MD5 19c095e1c399bdaa0663caa9162f0b0e
SHA1 cb5504712ec965f7c43883f2f251823755b1e37e
SHA256 38edfd7aa66f3ae1f376b9cdce558befd877d749e38306f412e8db436cb56713
SHA512 a2a8e9e5140d7b306ba98d3674aa89b3e287cdf39bcf4b326148d963c38052fc65e99a17c0bf846150d71ff3efbd2c9d4b61b4c2d5847f8c9afa222af4c946d9

memory/1308-71-0x00000252CFA60000-0x00000252CFA8B000-memory.dmp

memory/1372-70-0x000001B266000000-0x000001B26602B000-memory.dmp

memory/1268-68-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/1268-67-0x00000226F00B0000-0x00000226F00DB000-memory.dmp

memory/1148-65-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/1148-64-0x00000222A19A0000-0x00000222A19CB000-memory.dmp

memory/1084-62-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/1084-61-0x000002035C6B0000-0x000002035C6DB000-memory.dmp

memory/1076-59-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/1076-58-0x0000018CD3D70000-0x0000018CD3D9B000-memory.dmp

memory/992-56-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/992-55-0x0000014BC4E60000-0x0000014BC4E8B000-memory.dmp

memory/864-45-0x000001F6048D0000-0x000001F6048FB000-memory.dmp

memory/996-42-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/996-41-0x0000026A1D0D0000-0x0000026A1D0FB000-memory.dmp

memory/696-35-0x000001663FB30000-0x000001663FB5B000-memory.dmp

memory/640-30-0x00007FF88E7F0000-0x00007FF88E800000-memory.dmp

memory/640-29-0x000002041DC30000-0x000002041DC5B000-memory.dmp

memory/640-28-0x000002041DC00000-0x000002041DC24000-memory.dmp

memory/4808-25-0x0000000140000000-0x000000014002B000-memory.dmp

memory/4808-22-0x0000000140000000-0x000000014002B000-memory.dmp

memory/4808-19-0x0000000140000000-0x000000014002B000-memory.dmp

memory/4808-17-0x0000000140000000-0x000000014002B000-memory.dmp

memory/4808-18-0x0000000140000000-0x000000014002B000-memory.dmp

memory/2952-293-0x000001971D140000-0x000001971D15C000-memory.dmp

memory/2952-294-0x000001971D160000-0x000001971D213000-memory.dmp

memory/2952-295-0x000001971D220000-0x000001971D22A000-memory.dmp

memory/2952-296-0x000001971D360000-0x000001971D37C000-memory.dmp

memory/2952-297-0x000001971D230000-0x000001971D23A000-memory.dmp

memory/2952-298-0x000001971D380000-0x000001971D39A000-memory.dmp

memory/2952-301-0x000001971D3A0000-0x000001971D3AA000-memory.dmp

memory/2952-300-0x000001971D350000-0x000001971D356000-memory.dmp

memory/2952-299-0x000001971D340000-0x000001971D348000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-05-30 18:17

Reported

2024-05-30 18:20

Platform

win11-20240426-en

Max time kernel

148s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe"

Signatures

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Creates new service(s)

persistence execution

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3828 set thread context of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 set thread context of 4100 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe

Launches sc.exe

Description Indicator Process Target
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A
N/A N/A C:\Windows\system32\sc.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A
N/A N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\system32\svchost.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4816 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\conhost.exe
PID 3828 wrote to memory of 4100 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3828 wrote to memory of 4100 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3828 wrote to memory of 4100 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3828 wrote to memory of 4100 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe
PID 3828 wrote to memory of 4100 N/A C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe C:\Windows\system32\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe

"C:\Users\Admin\AppData\Local\Temp\miner.TMP\jhi_service.exe"

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "HDNFMUHS"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "HDNFMUHS" binpath= "C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "HDNFMUHS"

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\system32\svchost.exe

svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 pool.hashvault.pro udp
DE 45.76.89.70:80 pool.hashvault.pro tcp
US 8.8.8.8:53 70.89.76.45.in-addr.arpa udp

Files

C:\ProgramData\hvforlxxtnuo\kanilzbpgdul.exe

MD5 1994ad04639f3d12c7bbfa37feb3434f
SHA1 4979247e5a9771286a91827851527e5dbfb80c8e
SHA256 c75f76cf5b34b4a165ad5705ae5229f67fc081d958239bf0faea58e6c342301c
SHA512 adc4eb990fc6721a0a39cf9832f133bde025a31b3ecd4d84e076d8c454b40dd043f1f045f6f989febf2478999a190d116a58192c49d8b878414490e7ce451b43

memory/4816-10-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4100-11-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-13-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-15-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-17-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-19-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-21-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-22-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-23-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-20-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-16-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-18-0x00000267BA1A0000-0x00000267BA1C0000-memory.dmp

memory/4100-14-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-12-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4816-7-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4816-6-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4816-5-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4816-4-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4816-3-0x0000000140000000-0x000000014000D000-memory.dmp

memory/4100-24-0x0000000140000000-0x0000000140848000-memory.dmp

memory/4100-25-0x0000000140000000-0x0000000140848000-memory.dmp