Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-06-2024 00:00
Static task
static1
Behavioral task
behavioral1
Sample
7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe
Resource
win7-20240221-en
General
-
Target
7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe
-
Size
23KB
-
MD5
086c5d7468ed9d9adaa51be45f619dbf
-
SHA1
f5ae97308e8b54463165d731131d86c2d7c51abb
-
SHA256
7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965
-
SHA512
9a187bdba18913802d108c1ca5bc1e62f9e625bd3e5c0e8348177c3025674e9749ae3ab7c665c8f1829118ff636932e63bad477be0668674d7bfc5b05f89f5cd
-
SSDEEP
384:fb/260R+KhFPBdPWepb38K+XrIN++7DHMrpGP:TepRpFsp67MQP
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://77.91.77.92/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
55a4er5wo
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
winblrsnrcs.exesysmablsvr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" sysmablsvr.exe -
Phorphiex payload 2 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\2255729627.exe family_phorphiex \Users\Admin\AppData\Local\Temp\1459532009.exe family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
Processes:
1800322494.exewupgrdsv.exedescription pid process target process PID 1380 created 1148 1380 1800322494.exe Explorer.EXE PID 1380 created 1148 1380 1800322494.exe Explorer.EXE PID 2244 created 1148 2244 wupgrdsv.exe Explorer.EXE PID 2244 created 1148 2244 wupgrdsv.exe Explorer.EXE -
Processes:
sysmablsvr.exewinblrsnrcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-99-0x000000013F780000-0x000000013FCF6000-memory.dmp xmrig behavioral1/memory/2928-123-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
C40.exe2255729627.exesysmablsvr.exe1459532009.exe770429297.exe1800322494.exe1059420423.exewupgrdsv.exe273511546.exewinblrsnrcs.exe221862976.exe1809825731.exe2650816958.exepid process 872 C40.exe 2496 2255729627.exe 2516 sysmablsvr.exe 2740 1459532009.exe 1260 770429297.exe 1380 1800322494.exe 3068 1059420423.exe 2244 wupgrdsv.exe 1844 273511546.exe 2320 winblrsnrcs.exe 2108 221862976.exe 2768 1809825731.exe 1652 2650816958.exe -
Loads dropped DLL 13 IoCs
Processes:
7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exeC40.exesysmablsvr.exe770429297.exetaskeng.exewinblrsnrcs.exepid process 2240 7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe 872 C40.exe 872 C40.exe 2516 sysmablsvr.exe 2516 sysmablsvr.exe 2516 sysmablsvr.exe 1260 770429297.exe 2516 sysmablsvr.exe 2920 taskeng.exe 2516 sysmablsvr.exe 2516 sysmablsvr.exe 2320 winblrsnrcs.exe 2320 winblrsnrcs.exe -
Processes:
sysmablsvr.exewinblrsnrcs.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmablsvr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winblrsnrcs.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" winblrsnrcs.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
273511546.exe2255729627.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Service = "C:\\Windows\\winblrsnrcs.exe" 273511546.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmablsvr.exe" 2255729627.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
wupgrdsv.exedescription pid process target process PID 2244 set thread context of 2928 2244 wupgrdsv.exe notepad.exe -
Drops file in Windows directory 4 IoCs
Processes:
2255729627.exe273511546.exedescription ioc process File opened for modification C:\Windows\sysmablsvr.exe 2255729627.exe File created C:\Windows\winblrsnrcs.exe 273511546.exe File opened for modification C:\Windows\winblrsnrcs.exe 273511546.exe File created C:\Windows\sysmablsvr.exe 2255729627.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2700 schtasks.exe 1928 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
1800322494.exepowershell.exewupgrdsv.exepowershell.exepid process 1380 1800322494.exe 1380 1800322494.exe 928 powershell.exe 1380 1800322494.exe 1380 1800322494.exe 2244 wupgrdsv.exe 2244 wupgrdsv.exe 1544 powershell.exe 2244 wupgrdsv.exe 2244 wupgrdsv.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exenotepad.exedescription pid process Token: SeDebugPrivilege 928 powershell.exe Token: SeDebugPrivilege 1544 powershell.exe Token: SeLockMemoryPrivilege 2928 notepad.exe Token: SeLockMemoryPrivilege 2928 notepad.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
notepad.exepid process 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
notepad.exepid process 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe 2928 notepad.exe -
Suspicious use of WriteProcessMemory 58 IoCs
Processes:
7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exeC40.exe2255729627.exesysmablsvr.exe770429297.exepowershell.exetaskeng.exepowershell.exewupgrdsv.exe273511546.exewinblrsnrcs.exedescription pid process target process PID 2240 wrote to memory of 872 2240 7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe C40.exe PID 2240 wrote to memory of 872 2240 7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe C40.exe PID 2240 wrote to memory of 872 2240 7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe C40.exe PID 2240 wrote to memory of 872 2240 7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe C40.exe PID 872 wrote to memory of 2496 872 C40.exe 2255729627.exe PID 872 wrote to memory of 2496 872 C40.exe 2255729627.exe PID 872 wrote to memory of 2496 872 C40.exe 2255729627.exe PID 872 wrote to memory of 2496 872 C40.exe 2255729627.exe PID 2496 wrote to memory of 2516 2496 2255729627.exe sysmablsvr.exe PID 2496 wrote to memory of 2516 2496 2255729627.exe sysmablsvr.exe PID 2496 wrote to memory of 2516 2496 2255729627.exe sysmablsvr.exe PID 2496 wrote to memory of 2516 2496 2255729627.exe sysmablsvr.exe PID 2516 wrote to memory of 2740 2516 sysmablsvr.exe 1459532009.exe PID 2516 wrote to memory of 2740 2516 sysmablsvr.exe 1459532009.exe PID 2516 wrote to memory of 2740 2516 sysmablsvr.exe 1459532009.exe PID 2516 wrote to memory of 2740 2516 sysmablsvr.exe 1459532009.exe PID 2516 wrote to memory of 1260 2516 sysmablsvr.exe 770429297.exe PID 2516 wrote to memory of 1260 2516 sysmablsvr.exe 770429297.exe PID 2516 wrote to memory of 1260 2516 sysmablsvr.exe 770429297.exe PID 2516 wrote to memory of 1260 2516 sysmablsvr.exe 770429297.exe PID 1260 wrote to memory of 1380 1260 770429297.exe 1800322494.exe PID 1260 wrote to memory of 1380 1260 770429297.exe 1800322494.exe PID 1260 wrote to memory of 1380 1260 770429297.exe 1800322494.exe PID 1260 wrote to memory of 1380 1260 770429297.exe 1800322494.exe PID 2516 wrote to memory of 3068 2516 sysmablsvr.exe 1059420423.exe PID 2516 wrote to memory of 3068 2516 sysmablsvr.exe 1059420423.exe PID 2516 wrote to memory of 3068 2516 sysmablsvr.exe 1059420423.exe PID 2516 wrote to memory of 3068 2516 sysmablsvr.exe 1059420423.exe PID 928 wrote to memory of 1928 928 powershell.exe schtasks.exe PID 928 wrote to memory of 1928 928 powershell.exe schtasks.exe PID 928 wrote to memory of 1928 928 powershell.exe schtasks.exe PID 2920 wrote to memory of 2244 2920 taskeng.exe wupgrdsv.exe PID 2920 wrote to memory of 2244 2920 taskeng.exe wupgrdsv.exe PID 2920 wrote to memory of 2244 2920 taskeng.exe wupgrdsv.exe PID 2516 wrote to memory of 1844 2516 sysmablsvr.exe 273511546.exe PID 2516 wrote to memory of 1844 2516 sysmablsvr.exe 273511546.exe PID 2516 wrote to memory of 1844 2516 sysmablsvr.exe 273511546.exe PID 2516 wrote to memory of 1844 2516 sysmablsvr.exe 273511546.exe PID 1544 wrote to memory of 2700 1544 powershell.exe schtasks.exe PID 1544 wrote to memory of 2700 1544 powershell.exe schtasks.exe PID 1544 wrote to memory of 2700 1544 powershell.exe schtasks.exe PID 2244 wrote to memory of 2928 2244 wupgrdsv.exe notepad.exe PID 1844 wrote to memory of 2320 1844 273511546.exe winblrsnrcs.exe PID 1844 wrote to memory of 2320 1844 273511546.exe winblrsnrcs.exe PID 1844 wrote to memory of 2320 1844 273511546.exe winblrsnrcs.exe PID 1844 wrote to memory of 2320 1844 273511546.exe winblrsnrcs.exe PID 2516 wrote to memory of 2108 2516 sysmablsvr.exe 221862976.exe PID 2516 wrote to memory of 2108 2516 sysmablsvr.exe 221862976.exe PID 2516 wrote to memory of 2108 2516 sysmablsvr.exe 221862976.exe PID 2516 wrote to memory of 2108 2516 sysmablsvr.exe 221862976.exe PID 2320 wrote to memory of 2768 2320 winblrsnrcs.exe 1809825731.exe PID 2320 wrote to memory of 2768 2320 winblrsnrcs.exe 1809825731.exe PID 2320 wrote to memory of 2768 2320 winblrsnrcs.exe 1809825731.exe PID 2320 wrote to memory of 2768 2320 winblrsnrcs.exe 1809825731.exe PID 2320 wrote to memory of 1652 2320 winblrsnrcs.exe 2650816958.exe PID 2320 wrote to memory of 1652 2320 winblrsnrcs.exe 2650816958.exe PID 2320 wrote to memory of 1652 2320 winblrsnrcs.exe 2650816958.exe PID 2320 wrote to memory of 1652 2320 winblrsnrcs.exe 2650816958.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe"C:\Users\Admin\AppData\Local\Temp\7963d18a574f388046440e75a89ef991177107e472b33c3534b4eeecc3254965.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\C40.exe"C:\Users\Admin\AppData\Local\Temp\C40.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\2255729627.exeC:\Users\Admin\AppData\Local\Temp\2255729627.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\sysmablsvr.exeC:\Windows\sysmablsvr.exe5⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1459532009.exeC:\Users\Admin\AppData\Local\Temp\1459532009.exe6⤵
- Executes dropped EXE
PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\770429297.exeC:\Users\Admin\AppData\Local\Temp\770429297.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1800322494.exeC:\Users\Admin\AppData\Local\Temp\1800322494.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1380
-
-
-
C:\Users\Admin\AppData\Local\Temp\1059420423.exeC:\Users\Admin\AppData\Local\Temp\1059420423.exe6⤵
- Executes dropped EXE
PID:3068
-
-
C:\Users\Admin\AppData\Local\Temp\273511546.exeC:\Users\Admin\AppData\Local\Temp\273511546.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\winblrsnrcs.exeC:\Windows\winblrsnrcs.exe7⤵
- Modifies security service
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\1809825731.exeC:\Users\Admin\AppData\Local\Temp\1809825731.exe8⤵
- Executes dropped EXE
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\2650816958.exeC:\Users\Admin\AppData\Local\Temp\2650816958.exe8⤵
- Executes dropped EXE
PID:1652
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\221862976.exeC:\Users\Admin\AppData\Local\Temp\221862976.exe6⤵
- Executes dropped EXE
PID:2108
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1928
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"2⤵PID:1012
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Windows Upgrade Manager" /tr "'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe'"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2700
-
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2928
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {FD9F1A08-4388-4C7D-AD33-E446F571F072} S-1-5-21-2297530677-1229052932-2803917579-1000:HKULBIBU\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2244
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5fe1e93f12cca3f7c0c897ef2084e1778
SHA1fb588491ddad8b24ea555a6a2727e76cec1fade3
SHA2562ebc4a92f4fdc27d4ab56e57058575a8b18adb076cbd30feea2ecdc8b7fcd41f
SHA51236e0524c465187ae9ad207c724aee45bcd61cfd3fa66a79f9434d24fcbadc0a743834d5e808e6041f3bd88e75deb5afd34193574f005ed97e4b17c6b0388cb93
-
Filesize
8KB
MD587b22e975994246dc5b7c2a3adbf85a5
SHA11e6528987190f0f5188240cdac553388c39e8590
SHA25617399263a05a9144c1571e8ef88175fd08c61a38e3fcb3a955279d4a2bb9a919
SHA51258c33379879fc75679902d1fe3db0bf1c854151cb6e4bf10496a1d657a8778699be70976bd8bba1ddd3949b24b6ae44cbc0421dd0a8cea13ef5e00179d6599db
-
Filesize
7KB
MD58e1d40b9409f28fe873c98e9ff232d9b
SHA1d12e03520dfbb6e612cb54cdafd68b5d0100a3a7
SHA2564036e1d95c9872e79ad4941240d0242e4d8238eac65041da8b71fcdec03fcf36
SHA512eceb0ed60a22289bd743bdb35b9603d3abd893a92dcc2ecd035f1cff89bdd0931bb8b79ff119d2702c77c67e29f8ed2973aba52c5546f3f3602be6ccb1e09212
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD566e13fb2abf6b15493f266a67b03264d
SHA153331ec47a1dcc768a259a777d3d334684f46c67
SHA25656f01875903d5ff86d5324e337b7417433dfe7c2277a6b134b9b30d67edea37f
SHA5120fcb1d55a89d2806a681e6e64566df3165b2b386220395e05615a2389d98fff03564f1f6faa860e818f4e19f04c2e2bfe472dcd8b793ac165ca08defe1d0a007
-
Filesize
11KB
MD5cafd277c4132f5d0f202e7ea07a27d5c
SHA172c8c16a94cce56a3e01d91bc1276dafc65b351d
SHA256e5162fa594811f0f01fc76f4acbd9fe99b2265df9cfcbc346023f28775c19f1e
SHA5127c87d1dec61b78e0f223e8f9fec019d96509813fa6d96129289aab00b2d6f05bf91fe1fafd680b7d9e746f4c2c8cbe48a3028bcaad479048d00d79a19f71b196
-
Filesize
88KB
MD5ababca6d12d96e8dd2f1d7114b406fae
SHA1dcd9798e83ec688aacb3de8911492a232cb41a32
SHA256a992920e64a64763f3dd8c2a431a0f5e56e5b3782a1496de92bc80ee71cca5ba
SHA512b7fc70c176bdc74cf68b14e694f3e53142e64d39bd6d3e0f2e3a74ce3178ea606f92f760d21db69d72ae6677545a47c7bf390fb65cd5247a48e239f6ae8f7b8f
-
Filesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
Filesize
88KB
MD54505daf4c08fc8e8e1380911e98588aa
SHA1d990eb1b2ccbb71c878944be37923b1ebd17bc72
SHA256a2139600c569365149894405d411ea1401bafc8c7e8af1983d046cf087269c40
SHA512bb57d11150086c3c61f9a8fdd2511e3e780a24362183a6b833f44484238451f23b74b244262009f38a8baa7254d07dfdd9d4209efcf426dfd4e651c47f2f8cec
-
Filesize
18KB
MD530dca8b68825d5b3db7a685aa3da0a13
SHA107320822d14d6caf8825dd6d806c0cde398584f3
SHA256f2dc635cb5fe8b8815ea98d909b67016975ca8e5a43cb39e47595ecd01038a96
SHA512b5f3be086d3f7c751028d8d8a025069743b2472cec10252627f5583492383a5a865e88ad5839d83bf3a3c31b5b630753e77a2c02433d7fbe90aa11acd0f35f0c
-
Filesize
10KB
MD56567b839ec69322ba1aa41b15fbd1e64
SHA10a2a0770afe094765a5eb88f6201847bf642bea9
SHA2568a4b87ed94fc50767d0bc91291a8b8a436b941b273b29ab0d442ba1cc10b76fb
SHA5122e4798244bf3891beea64ee0b0d106c6f47b7c7d6daf222af6192874dc0ef67491c82e93821c1ff9fbd25cf9ec50178e959adb466b210ff9754dd4e8387a30cf
-
Filesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645