Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03-06-2024 04:06
Static task
static1
Behavioral task
behavioral1
Sample
c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe
Resource
win11-20240508-en
General
-
Target
c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe
-
Size
5.3MB
-
MD5
3974c5d0b92366bbc9af950c8d7f898d
-
SHA1
1b141b9cced64d1b86cd9d3460062ee7ecd34357
-
SHA256
c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820
-
SHA512
6b786fcf6ad40c3f8007e55242db7794f640177f3394a49a3ac9dc3b6cf3588eefe8e3db8ed21d9fcc3962de50d48c6c28867ab92a7da324389e19b9642170fa
-
SSDEEP
98304:6dabsLaGmmo105PwezFkinGRvGmWxsEI9KHkfK7JwzlHhvSasMwpHNr:6E1m1iiEuf9WN6Qm5
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4996 powershell.exe 1384 powershell.exe -
Creates new service(s) 2 TTPs
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe -
Executes dropped EXE 1 IoCs
pid Process 4424 updater.exe -
Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\MRT.exe updater.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\MRT.exe c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1920 set thread context of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 4424 set thread context of 5016 4424 updater.exe 119 PID 4424 set thread context of 1920 4424 updater.exe 121 PID 4424 set thread context of 3484 4424 updater.exe 125 -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4948 sc.exe 2416 sc.exe 3628 sc.exe 3496 sc.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={7EFE0617-D683-4C35-884A-21AB35BE4EA0}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 03 Jun 2024 04:08:14 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 4996 powershell.exe 4996 powershell.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 4424 updater.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 1384 powershell.exe 1384 powershell.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 1384 powershell.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 1384 powershell.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 1384 powershell.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 3280 dialer.exe 1384 powershell.exe 3280 dialer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4996 powershell.exe Token: SeDebugPrivilege 3280 dialer.exe Token: SeShutdownPrivilege 4784 powercfg.exe Token: SeCreatePagefilePrivilege 4784 powercfg.exe Token: SeShutdownPrivilege 1960 powercfg.exe Token: SeCreatePagefilePrivilege 1960 powercfg.exe Token: SeShutdownPrivilege 4364 powercfg.exe Token: SeCreatePagefilePrivilege 4364 powercfg.exe Token: SeShutdownPrivilege 3892 powercfg.exe Token: SeCreatePagefilePrivilege 3892 powercfg.exe Token: SeDebugPrivilege 1384 powershell.exe Token: SeDebugPrivilege 5016 dialer.exe Token: SeLockMemoryPrivilege 3484 dialer.exe Token: SeShutdownPrivilege 4880 powercfg.exe Token: SeCreatePagefilePrivilege 4880 powercfg.exe Token: SeShutdownPrivilege 4396 powercfg.exe Token: SeCreatePagefilePrivilege 4396 powercfg.exe Token: SeShutdownPrivilege 3428 powercfg.exe Token: SeCreatePagefilePrivilege 3428 powercfg.exe Token: SeShutdownPrivilege 1940 powercfg.exe Token: SeCreatePagefilePrivilege 1940 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 2096 svchost.exe Token: SeIncreaseQuotaPrivilege 2096 svchost.exe Token: SeSecurityPrivilege 2096 svchost.exe Token: SeTakeOwnershipPrivilege 2096 svchost.exe Token: SeLoadDriverPrivilege 2096 svchost.exe Token: SeSystemtimePrivilege 2096 svchost.exe Token: SeBackupPrivilege 2096 svchost.exe Token: SeRestorePrivilege 2096 svchost.exe Token: SeShutdownPrivilege 2096 svchost.exe Token: SeSystemEnvironmentPrivilege 2096 svchost.exe Token: SeUndockPrivilege 2096 svchost.exe Token: SeManageVolumePrivilege 2096 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2096 svchost.exe Token: SeIncreaseQuotaPrivilege 2096 svchost.exe Token: SeSecurityPrivilege 2096 svchost.exe Token: SeTakeOwnershipPrivilege 2096 svchost.exe Token: SeLoadDriverPrivilege 2096 svchost.exe Token: SeSystemtimePrivilege 2096 svchost.exe Token: SeBackupPrivilege 2096 svchost.exe Token: SeRestorePrivilege 2096 svchost.exe Token: SeShutdownPrivilege 2096 svchost.exe Token: SeSystemEnvironmentPrivilege 2096 svchost.exe Token: SeUndockPrivilege 2096 svchost.exe Token: SeManageVolumePrivilege 2096 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2096 svchost.exe Token: SeIncreaseQuotaPrivilege 2096 svchost.exe Token: SeSecurityPrivilege 2096 svchost.exe Token: SeTakeOwnershipPrivilege 2096 svchost.exe Token: SeLoadDriverPrivilege 2096 svchost.exe Token: SeSystemtimePrivilege 2096 svchost.exe Token: SeBackupPrivilege 2096 svchost.exe Token: SeRestorePrivilege 2096 svchost.exe Token: SeShutdownPrivilege 2096 svchost.exe Token: SeSystemEnvironmentPrivilege 2096 svchost.exe Token: SeUndockPrivilege 2096 svchost.exe Token: SeManageVolumePrivilege 2096 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2096 svchost.exe Token: SeIncreaseQuotaPrivilege 2096 svchost.exe Token: SeSecurityPrivilege 2096 svchost.exe Token: SeTakeOwnershipPrivilege 2096 svchost.exe Token: SeLoadDriverPrivilege 2096 svchost.exe Token: SeSystemtimePrivilege 2096 svchost.exe Token: SeBackupPrivilege 2096 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 1920 wrote to memory of 3280 1920 c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe 97 PID 3280 wrote to memory of 612 3280 dialer.exe 5 PID 3280 wrote to memory of 672 3280 dialer.exe 7 PID 3280 wrote to memory of 964 3280 dialer.exe 12 PID 3280 wrote to memory of 376 3280 dialer.exe 13 PID 3280 wrote to memory of 508 3280 dialer.exe 14 PID 3280 wrote to memory of 932 3280 dialer.exe 15 PID 1428 wrote to memory of 1660 1428 cmd.exe 104 PID 1428 wrote to memory of 1660 1428 cmd.exe 104 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 3280 wrote to memory of 1088 3280 dialer.exe 17 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 3280 wrote to memory of 1100 3280 dialer.exe 18 PID 3280 wrote to memory of 1148 3280 dialer.exe 19 PID 3280 wrote to memory of 1176 3280 dialer.exe 20 PID 3280 wrote to memory of 1284 3280 dialer.exe 21 PID 3280 wrote to memory of 1340 3280 dialer.exe 22 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 3280 wrote to memory of 1352 3280 dialer.exe 23 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 3280 wrote to memory of 1392 3280 dialer.exe 24 PID 3280 wrote to memory of 1516 3280 dialer.exe 25 PID 3280 wrote to memory of 1540 3280 dialer.exe 26 PID 3280 wrote to memory of 1564 3280 dialer.exe 27 PID 3280 wrote to memory of 1680 3280 dialer.exe 28 PID 3280 wrote to memory of 1696 3280 dialer.exe 29 PID 3280 wrote to memory of 1760 3280 dialer.exe 30 PID 3280 wrote to memory of 1788 3280 dialer.exe 31 PID 3280 wrote to memory of 1828 3280 dialer.exe 32 PID 3280 wrote to memory of 1944 3280 dialer.exe 33 PID 3280 wrote to memory of 1952 3280 dialer.exe 34 PID 3280 wrote to memory of 1996 3280 dialer.exe 35 PID 3280 wrote to memory of 1144 3280 dialer.exe 36 PID 3280 wrote to memory of 2080 3280 dialer.exe 37 PID 3280 wrote to memory of 2096 3280 dialer.exe 38 PID 3280 wrote to memory of 2236 3280 dialer.exe 40 PID 3280 wrote to memory of 2288 3280 dialer.exe 41 PID 3280 wrote to memory of 2464 3280 dialer.exe 42 PID 3280 wrote to memory of 2472 3280 dialer.exe 43 PID 3280 wrote to memory of 2616 3280 dialer.exe 44 PID 3280 wrote to memory of 2632 3280 dialer.exe 45 PID 3280 wrote to memory of 2756 3280 dialer.exe 46 PID 3280 wrote to memory of 2768 3280 dialer.exe 47 PID 3280 wrote to memory of 2776 3280 dialer.exe 48 PID 3280 wrote to memory of 2828 3280 dialer.exe 49 PID 3280 wrote to memory of 2852 3280 dialer.exe 50 PID 3280 wrote to memory of 2880 3280 dialer.exe 51 PID 3280 wrote to memory of 2908 3280 dialer.exe 52 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 3280 wrote to memory of 3168 3280 dialer.exe 53 PID 3280 wrote to memory of 3420 3280 dialer.exe 55 PID 3280 wrote to memory of 3516 3280 dialer.exe 56 PID 672 wrote to memory of 2852 672 lsass.exe 50 PID 3280 wrote to memory of 3660 3280 dialer.exe 57 PID 3280 wrote to memory of 3840 3280 dialer.exe 58
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:376
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
PID:672
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:964
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:508
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:932
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1148
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2776
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
PID:1176
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1516
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2616
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1540
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1564
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1696
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1760
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1788
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1944
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1952
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1996
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1144
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2096
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2236
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2472
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2632
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2756
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2828
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2852
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2880
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2908
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3420
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe"C:\Users\Admin\AppData\Local\Temp\c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820.exe"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵PID:1660
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3892
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3280
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"3⤵
- Launches sc.exe
PID:4948
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"3⤵
- Launches sc.exe
PID:3496
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
PID:2416
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"3⤵
- Launches sc.exe
PID:3628 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:2296
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3660
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3988
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3532
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:3752
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:2440
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3228
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:452
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵PID:3952
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:448
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1736
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:1936
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
PID:748
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵PID:2572
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:1860
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:2704
-
C:\ProgramData\Google\Chrome\updater.exeC:\ProgramData\Google\Chrome\updater.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:4424 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2448
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵PID:3836
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3972
-
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:1172
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:3428 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4444
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4396 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3632
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2628
-
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:4880 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:112
-
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵PID:1920
-
-
C:\Windows\system32\dialer.exedialer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.3MB
MD53974c5d0b92366bbc9af950c8d7f898d
SHA11b141b9cced64d1b86cd9d3460062ee7ecd34357
SHA256c88dbfa8510ba03e204e2458434be95cb232f34a0b530a299ba6fdecd3c39820
SHA5126b786fcf6ad40c3f8007e55242db7794f640177f3394a49a3ac9dc3b6cf3588eefe8e3db8ed21d9fcc3962de50d48c6c28867ab92a7da324389e19b9642170fa
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62