Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 18:44
General
-
Target
Aurora.exe
-
Size
21.3MB
-
MD5
416de11d210ae0ff50214021ff57b32b
-
SHA1
3142453c18080b83d8dbdeba89524beea1c94ff3
-
SHA256
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
-
SHA512
e1f061f99e9e4e42c21269a32c9f3cfa711a8a95caf7628637d5606ae7846fc73ae982b0ee78646026c41e5c1e61e21a15829967d2fed534070e3c40e2731e4c
-
SSDEEP
393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF
Malware Config
Extracted
redline
cheat
154.81.220.233:28105
Extracted
quasar
1.4.1
themdas
auroraforge.art:55326
thesirenmika.com:55713
0cbdfe7f-0215-41e8-a7b5-d4fbbc555089
-
encryption_key
A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1
-
install_name
up2.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3164-64-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe family_redline behavioral2/memory/3384-43-0x0000000000280000-0x000000000029E000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe family_sectoprat behavioral2/memory/3384-43-0x0000000000280000-0x000000000029E000-memory.dmp family_sectoprat -
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
Processes:
vlc.exesvchost.exedescription pid process target process PID 3236 created 3432 3236 vlc.exe Explorer.EXE PID 3236 created 3432 3236 vlc.exe Explorer.EXE PID 3236 created 3432 3236 vlc.exe Explorer.EXE PID 1528 created 3432 1528 svchost.exe Explorer.EXE PID 1528 created 3432 1528 svchost.exe Explorer.EXE PID 1528 created 3432 1528 svchost.exe Explorer.EXE PID 1528 created 3432 1528 svchost.exe Explorer.EXE -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Aurora.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Aurora.exe -
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/1528-152-0x00007FF79A0C0000-0x00007FF79A65A000-memory.dmp xmrig behavioral2/memory/4052-154-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-156-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-158-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-160-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-162-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-164-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-166-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-168-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-170-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-172-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig behavioral2/memory/4052-174-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmp xmrig -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Aurora.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Aurora.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Aurora.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Aurora.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation Aurora.exe -
Executes dropped EXE 6 IoCs
Processes:
AdobeUpdate.exebuild.exeOneDrive.exevlc.exeMsedge.exesvchost.exepid process 1072 AdobeUpdate.exe 3384 build.exe 2444 OneDrive.exe 3236 vlc.exe 816 Msedge.exe 1528 svchost.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral2/memory/4824-63-0x0000000000140000-0x0000000001C0A000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AdobeUpdate.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Local\\Msedge.exe" AdobeUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OneDriveUpdate\\OneDrive Updater.exe" powershell.exe -
Processes:
Aurora.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Aurora.exe -
Processes:
powershell.exepowershell.exepowershell.exepid process 2568 powershell.exe 5076 powershell.exe 1096 powershell.exe -
Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
cmd.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.execmd.exepowercfg.exepid process 2112 cmd.exe 2668 powercfg.exe 1072 powercfg.exe 892 powercfg.exe 5052 powercfg.exe 1544 powercfg.exe 2092 powercfg.exe 208 powercfg.exe 1428 cmd.exe 2076 powercfg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Aurora.exepid process 4824 Aurora.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
OneDrive.exesvchost.exedescription pid process target process PID 2444 set thread context of 3164 2444 OneDrive.exe RegAsm.exe PID 1528 set thread context of 3788 1528 svchost.exe conhost.exe PID 1528 set thread context of 4052 1528 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Aurora.exeOneDrive.exebuild.execmd.exepowershell.exeRegAsm.exeschtasks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Aurora.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.execmd.exePING.EXEpid process 4596 cmd.exe 1428 cmd.exe 4016 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Aurora.exeOneDrive.exepowershell.exevlc.exepowershell.exesvchost.exepowershell.exesvchost.exepid process 4824 Aurora.exe 4824 Aurora.exe 2444 OneDrive.exe 2444 OneDrive.exe 2444 OneDrive.exe 2444 OneDrive.exe 2568 powershell.exe 2568 powershell.exe 3236 vlc.exe 3236 vlc.exe 3236 vlc.exe 3236 vlc.exe 5076 powershell.exe 5076 powershell.exe 5076 powershell.exe 3236 vlc.exe 3236 vlc.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1096 powershell.exe 1096 powershell.exe 1096 powershell.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 1528 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
OneDrive.exeRegAsm.exebuild.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exedescription pid process Token: SeDebugPrivilege 2444 OneDrive.exe Token: SeDebugPrivilege 3164 RegAsm.exe Token: SeDebugPrivilege 3384 build.exe Token: SeDebugPrivilege 2568 powershell.exe Token: SeShutdownPrivilege 2668 powercfg.exe Token: SeCreatePagefilePrivilege 2668 powercfg.exe Token: SeShutdownPrivilege 2092 powercfg.exe Token: SeCreatePagefilePrivilege 2092 powercfg.exe Token: SeShutdownPrivilege 1072 powercfg.exe Token: SeCreatePagefilePrivilege 1072 powercfg.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeShutdownPrivilege 208 powercfg.exe Token: SeCreatePagefilePrivilege 208 powercfg.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe Token: SeBackupPrivilege 5076 powershell.exe Token: SeRestorePrivilege 5076 powershell.exe Token: SeShutdownPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 5076 powershell.exe Token: SeRemoteShutdownPrivilege 5076 powershell.exe Token: SeUndockPrivilege 5076 powershell.exe Token: SeManageVolumePrivilege 5076 powershell.exe Token: 33 5076 powershell.exe Token: 34 5076 powershell.exe Token: 35 5076 powershell.exe Token: 36 5076 powershell.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe Token: SeBackupPrivilege 5076 powershell.exe Token: SeRestorePrivilege 5076 powershell.exe Token: SeShutdownPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 5076 powershell.exe Token: SeRemoteShutdownPrivilege 5076 powershell.exe Token: SeUndockPrivilege 5076 powershell.exe Token: SeManageVolumePrivilege 5076 powershell.exe Token: 33 5076 powershell.exe Token: 34 5076 powershell.exe Token: 35 5076 powershell.exe Token: 36 5076 powershell.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
svchost.exepid process 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
svchost.exepid process 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe 4052 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Aurora.exeAdobeUpdate.execmd.exeOneDrive.execmd.execmd.execmd.execmd.execmd.exesvchost.exedescription pid process target process PID 4824 wrote to memory of 1072 4824 Aurora.exe AdobeUpdate.exe PID 4824 wrote to memory of 1072 4824 Aurora.exe AdobeUpdate.exe PID 1072 wrote to memory of 4596 1072 AdobeUpdate.exe cmd.exe PID 1072 wrote to memory of 4596 1072 AdobeUpdate.exe cmd.exe PID 4824 wrote to memory of 3384 4824 Aurora.exe build.exe PID 4824 wrote to memory of 3384 4824 Aurora.exe build.exe PID 4824 wrote to memory of 3384 4824 Aurora.exe build.exe PID 4824 wrote to memory of 2444 4824 Aurora.exe OneDrive.exe PID 4824 wrote to memory of 2444 4824 Aurora.exe OneDrive.exe PID 4824 wrote to memory of 2444 4824 Aurora.exe OneDrive.exe PID 4596 wrote to memory of 1428 4596 cmd.exe cmd.exe PID 4596 wrote to memory of 1428 4596 cmd.exe cmd.exe PID 4824 wrote to memory of 3236 4824 Aurora.exe vlc.exe PID 4824 wrote to memory of 3236 4824 Aurora.exe vlc.exe PID 2444 wrote to memory of 2568 2444 OneDrive.exe powershell.exe PID 2444 wrote to memory of 2568 2444 OneDrive.exe powershell.exe PID 2444 wrote to memory of 2568 2444 OneDrive.exe powershell.exe PID 2444 wrote to memory of 1760 2444 OneDrive.exe cmd.exe PID 2444 wrote to memory of 1760 2444 OneDrive.exe cmd.exe PID 2444 wrote to memory of 1760 2444 OneDrive.exe cmd.exe PID 2444 wrote to memory of 1964 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 1964 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 1964 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 1836 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 1836 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 1836 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 2444 wrote to memory of 3164 2444 OneDrive.exe RegAsm.exe PID 1428 wrote to memory of 4016 1428 cmd.exe PING.EXE PID 1428 wrote to memory of 4016 1428 cmd.exe PING.EXE PID 1760 wrote to memory of 3212 1760 cmd.exe schtasks.exe PID 1760 wrote to memory of 3212 1760 cmd.exe schtasks.exe PID 1760 wrote to memory of 3212 1760 cmd.exe schtasks.exe PID 1428 wrote to memory of 3020 1428 cmd.exe attrib.exe PID 1428 wrote to memory of 3020 1428 cmd.exe attrib.exe PID 1428 wrote to memory of 4232 1428 cmd.exe icacls.exe PID 1428 wrote to memory of 4232 1428 cmd.exe icacls.exe PID 1428 wrote to memory of 4836 1428 cmd.exe cmd.exe PID 1428 wrote to memory of 4836 1428 cmd.exe cmd.exe PID 4836 wrote to memory of 816 4836 cmd.exe Msedge.exe PID 4836 wrote to memory of 816 4836 cmd.exe Msedge.exe PID 2112 wrote to memory of 2668 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 2668 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 2092 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 2092 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 1072 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 1072 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 208 2112 cmd.exe powercfg.exe PID 2112 wrote to memory of 208 2112 cmd.exe powercfg.exe PID 1428 wrote to memory of 2076 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 2076 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 892 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 892 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 5052 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 5052 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 1544 1428 cmd.exe powercfg.exe PID 1428 wrote to memory of 1544 1428 cmd.exe powercfg.exe PID 1528 wrote to memory of 3788 1528 svchost.exe conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Aurora.exe"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\attrib.exeattrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"6⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)6⤵
- Modifies file permissions
-
C:\Windows\system32\cmd.execmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Msedge.exeC:\Users\Admin\AppData\Local\Msedge.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD59a83edb6f12fbbd39f80d0d6eb9bbae1
SHA17b0cf3ca94fc8f0efcdf74820b23476b05fb177d
SHA2565cf0874c1e9530e0e33425cf824724b967ce604e02c784aa17536d496c87f657
SHA5129c8f2a3abc3f7d8126a7ed4f51818494c392ca8ff2d1f7f7e9ceef9c75d73d39ad80c6fb85fa7788fb0dda3efeef02b40653bd53ab39692ccfb877ef4794ae29
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5d95b08252ed624f6d91b46523f110f29
SHA117577997bc1fb5d3fbe59be84013165534415dc3
SHA256342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02
SHA5120c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qguaimw1.xfl.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exeFilesize
80KB
MD565f0a85c4b056d6bcee60c49e2372e35
SHA16af820a2030950617bf150777af4a43a06a17184
SHA256d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e
SHA5127a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exeFilesize
95KB
MD5c9a9d471428a5f92068c0823e6454254
SHA18b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2
SHA256b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5
SHA512ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af
-
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exeFilesize
3.2MB
MD53b4f58cd4bca7274be25e885be00798b
SHA1eb57c281d8324a1079db97c9da43483a65debbed
SHA256a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80
SHA512dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121
-
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exeFilesize
5.6MB
MD5b9fc8581b52abfc6b563da731438e27d
SHA143111fe9b307c850a379fe2d64d279e994680de3
SHA256e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058
SHA512c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5
-
memory/1528-152-0x00007FF79A0C0000-0x00007FF79A65A000-memory.dmpFilesize
5.6MB
-
memory/1528-134-0x00007FF79A0C0000-0x00007FF79A65A000-memory.dmpFilesize
5.6MB
-
memory/2444-52-0x00000000057C0000-0x0000000005D64000-memory.dmpFilesize
5.6MB
-
memory/2444-42-0x00000000006B0000-0x00000000009DE000-memory.dmpFilesize
3.2MB
-
memory/2568-111-0x0000000007C70000-0x0000000007C8A000-memory.dmpFilesize
104KB
-
memory/2568-103-0x0000000007620000-0x00000000076C3000-memory.dmpFilesize
652KB
-
memory/2568-109-0x0000000007B60000-0x0000000007B6E000-memory.dmpFilesize
56KB
-
memory/2568-83-0x0000000006030000-0x0000000006384000-memory.dmpFilesize
3.3MB
-
memory/2568-112-0x0000000007C50000-0x0000000007C58000-memory.dmpFilesize
32KB
-
memory/2568-108-0x0000000007B30000-0x0000000007B41000-memory.dmpFilesize
68KB
-
memory/2568-107-0x0000000007BB0000-0x0000000007C46000-memory.dmpFilesize
600KB
-
memory/2568-106-0x00000000079A0000-0x00000000079AA000-memory.dmpFilesize
40KB
-
memory/2568-104-0x0000000007F80000-0x00000000085FA000-memory.dmpFilesize
6.5MB
-
memory/2568-105-0x0000000007930000-0x000000000794A000-memory.dmpFilesize
104KB
-
memory/2568-91-0x00000000075E0000-0x0000000007612000-memory.dmpFilesize
200KB
-
memory/2568-110-0x0000000007B70000-0x0000000007B84000-memory.dmpFilesize
80KB
-
memory/2568-66-0x0000000002CE0000-0x0000000002D16000-memory.dmpFilesize
216KB
-
memory/2568-92-0x000000006EFE0000-0x000000006F02C000-memory.dmpFilesize
304KB
-
memory/2568-67-0x0000000005920000-0x0000000005F48000-memory.dmpFilesize
6.2MB
-
memory/2568-102-0x0000000006C00000-0x0000000006C1E000-memory.dmpFilesize
120KB
-
memory/2568-77-0x0000000005FC0000-0x0000000006026000-memory.dmpFilesize
408KB
-
memory/2568-76-0x0000000005F50000-0x0000000005FB6000-memory.dmpFilesize
408KB
-
memory/2568-113-0x0000000007CB0000-0x0000000007CD2000-memory.dmpFilesize
136KB
-
memory/2568-84-0x0000000006600000-0x000000000661E000-memory.dmpFilesize
120KB
-
memory/2568-70-0x0000000005840000-0x0000000005862000-memory.dmpFilesize
136KB
-
memory/3164-88-0x0000000005F20000-0x0000000005F70000-memory.dmpFilesize
320KB
-
memory/3164-78-0x0000000005470000-0x000000000547A000-memory.dmpFilesize
40KB
-
memory/3164-64-0x0000000000400000-0x0000000000724000-memory.dmpFilesize
3.1MB
-
memory/3164-89-0x0000000006160000-0x0000000006212000-memory.dmpFilesize
712KB
-
memory/3164-69-0x00000000054D0000-0x0000000005562000-memory.dmpFilesize
584KB
-
memory/3236-116-0x00007FF6964A0000-0x00007FF696A3A000-memory.dmpFilesize
5.6MB
-
memory/3236-132-0x00007FF6964A0000-0x00007FF696A3A000-memory.dmpFilesize
5.6MB
-
memory/3384-68-0x0000000004E10000-0x0000000004F1A000-memory.dmpFilesize
1.0MB
-
memory/3384-62-0x0000000004BF0000-0x0000000004C3C000-memory.dmpFilesize
304KB
-
memory/3384-58-0x0000000002620000-0x000000000265C000-memory.dmpFilesize
240KB
-
memory/3384-56-0x00000000025C0000-0x00000000025D2000-memory.dmpFilesize
72KB
-
memory/3384-55-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/3384-43-0x0000000000280000-0x000000000029E000-memory.dmpFilesize
120KB
-
memory/3788-157-0x00007FF60CE50000-0x00007FF60CE79000-memory.dmpFilesize
164KB
-
memory/3788-153-0x00007FF60CE50000-0x00007FF60CE79000-memory.dmpFilesize
164KB
-
memory/4052-154-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-156-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-174-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-172-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-170-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-168-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-166-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-164-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-162-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-160-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4052-151-0x000002B4F8BC0000-0x000002B4F8BE0000-memory.dmpFilesize
128KB
-
memory/4052-158-0x00007FF7B30F0000-0x00007FF7B38DF000-memory.dmpFilesize
7.9MB
-
memory/4824-6-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-63-0x0000000000140000-0x0000000001C0A000-memory.dmpFilesize
26.8MB
-
memory/4824-61-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-0-0x0000000000140000-0x0000000001C0A000-memory.dmpFilesize
26.8MB
-
memory/4824-2-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-5-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-7-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-1-0x0000000077500000-0x0000000077501000-memory.dmpFilesize
4KB
-
memory/4824-11-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-4-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-8-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/4824-3-0x00000000774E0000-0x00000000775D0000-memory.dmpFilesize
960KB
-
memory/5076-117-0x00000139680B0000-0x00000139680D2000-memory.dmpFilesize
136KB