Analysis
-
max time kernel
151s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
28-07-2024 07:19
Behavioral task
behavioral1
Sample
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
Resource
win10v2004-20240709-en
General
-
Target
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe
-
Size
21.3MB
-
MD5
416de11d210ae0ff50214021ff57b32b
-
SHA1
3142453c18080b83d8dbdeba89524beea1c94ff3
-
SHA256
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850
-
SHA512
e1f061f99e9e4e42c21269a32c9f3cfa711a8a95caf7628637d5606ae7846fc73ae982b0ee78646026c41e5c1e61e21a15829967d2fed534070e3c40e2731e4c
-
SSDEEP
393216:TYTogFuaMaKQy6SSTMX3q7wLta40K3pNPS4n+yubbcEVPxEV+aqdvx1LB1x8NFN:TYT1Fu/6SSTMq+YK3Hx+3r5Np1FL8NF
Malware Config
Extracted
redline
cheat
154.81.220.233:28105
Extracted
quasar
1.4.1
themdas
auroraforge.art:55326
thesirenmika.com:55713
0cbdfe7f-0215-41e8-a7b5-d4fbbc555089
-
encryption_key
A730DFF691ED1723ED88E36A2C5E7ED5CCF91DD1
-
install_name
up2.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Quasar Client Startup
-
subdirectory
SubDir
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4736-82-0x0000000000400000-0x0000000000724000-memory.dmp family_quasar -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe family_redline behavioral2/memory/4708-65-0x0000000000230000-0x000000000024E000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe family_sectoprat behavioral2/memory/4708-65-0x0000000000230000-0x000000000024E000-memory.dmp family_sectoprat -
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Shurk Stealer payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Aurora.exe shurk_stealer behavioral2/memory/1040-100-0x00007FF61EB90000-0x00007FF62045F000-memory.dmp shurk_stealer -
Suspicious use of NtCreateUserProcessOtherParentProcess 7 IoCs
Processes:
vlc.exesvchost.exedescription pid process target process PID 644 created 3572 644 vlc.exe Explorer.EXE PID 644 created 3572 644 vlc.exe Explorer.EXE PID 644 created 3572 644 vlc.exe Explorer.EXE PID 3200 created 3572 3200 svchost.exe Explorer.EXE PID 3200 created 3572 3200 svchost.exe Explorer.EXE PID 3200 created 3572 3200 svchost.exe Explorer.EXE PID 3200 created 3572 3200 svchost.exe Explorer.EXE -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
XMRig Miner payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3200-168-0x00007FF699650000-0x00007FF699BEA000-memory.dmp xmrig behavioral2/memory/4728-171-0x00007FF746310000-0x00007FF746AFF000-memory.dmp xmrig behavioral2/memory/4728-173-0x00007FF746310000-0x00007FF746AFF000-memory.dmp xmrig behavioral2/memory/4728-175-0x00007FF746310000-0x00007FF746AFF000-memory.dmp xmrig behavioral2/memory/4728-177-0x00007FF746310000-0x00007FF746AFF000-memory.dmp xmrig behavioral2/memory/4728-179-0x00007FF746310000-0x00007FF746AFF000-memory.dmp xmrig behavioral2/memory/4728-181-0x00007FF746310000-0x00007FF746AFF000-memory.dmp xmrig -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Executes dropped EXE 7 IoCs
Processes:
AdobeUpdate.exebuild.exeOneDrive.exevlc.exeMsedge.exeAurora.exesvchost.exepid process 1956 AdobeUpdate.exe 4708 build.exe 2484 OneDrive.exe 644 vlc.exe 1700 Msedge.exe 1040 Aurora.exe 3200 svchost.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Processes:
resource yara_rule behavioral2/memory/3824-78-0x0000000000520000-0x0000000001FEA000-memory.dmp themida -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
AdobeUpdate.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Edge = "C:\\Users\\Admin\\AppData\\Local\\Msedge.exe" AdobeUpdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OneDriveUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OneDriveUpdate\\OneDrive Updater.exe" powershell.exe -
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Processes:
powershell.exepowershell.exepowershell.exepid process 4912 powershell.exe 4168 powershell.exe 744 powershell.exe -
Power Settings 1 TTPs 10 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.execmd.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.execmd.exepowercfg.exepowercfg.exepid process 1396 powercfg.exe 4060 cmd.exe 320 powercfg.exe 4172 powercfg.exe 1924 powercfg.exe 952 powercfg.exe 2904 powercfg.exe 3776 cmd.exe 1752 powercfg.exe 412 powercfg.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exepid process 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
OneDrive.exesvchost.exedescription pid process target process PID 2484 set thread context of 4736 2484 OneDrive.exe RegAsm.exe PID 3200 set thread context of 3468 3200 svchost.exe conhost.exe PID 3200 set thread context of 4728 3200 svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exebuild.exeOneDrive.exepowershell.execmd.exeschtasks.exeRegAsm.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OneDrive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegAsm.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.execmd.exePING.EXEpid process 4052 cmd.exe 2164 cmd.exe 4488 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exepowershell.exevlc.exepowershell.exesvchost.exepowershell.exesvchost.exepid process 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe 4912 powershell.exe 4912 powershell.exe 4912 powershell.exe 644 vlc.exe 644 vlc.exe 644 vlc.exe 644 vlc.exe 4168 powershell.exe 4168 powershell.exe 4168 powershell.exe 644 vlc.exe 644 vlc.exe 3200 svchost.exe 3200 svchost.exe 3200 svchost.exe 3200 svchost.exe 744 powershell.exe 744 powershell.exe 3200 svchost.exe 3200 svchost.exe 3200 svchost.exe 3200 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe 4728 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exeRegAsm.exebuild.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 4912 powershell.exe Token: SeDebugPrivilege 4736 RegAsm.exe Token: SeDebugPrivilege 4708 build.exe Token: SeShutdownPrivilege 1752 powercfg.exe Token: SeCreatePagefilePrivilege 1752 powercfg.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeShutdownPrivilege 1396 powercfg.exe Token: SeCreatePagefilePrivilege 1396 powercfg.exe Token: SeShutdownPrivilege 412 powercfg.exe Token: SeCreatePagefilePrivilege 412 powercfg.exe Token: SeShutdownPrivilege 4172 powercfg.exe Token: SeCreatePagefilePrivilege 4172 powercfg.exe Token: SeIncreaseQuotaPrivilege 4168 powershell.exe Token: SeSecurityPrivilege 4168 powershell.exe Token: SeTakeOwnershipPrivilege 4168 powershell.exe Token: SeLoadDriverPrivilege 4168 powershell.exe Token: SeSystemProfilePrivilege 4168 powershell.exe Token: SeSystemtimePrivilege 4168 powershell.exe Token: SeProfSingleProcessPrivilege 4168 powershell.exe Token: SeIncBasePriorityPrivilege 4168 powershell.exe Token: SeCreatePagefilePrivilege 4168 powershell.exe Token: SeBackupPrivilege 4168 powershell.exe Token: SeRestorePrivilege 4168 powershell.exe Token: SeShutdownPrivilege 4168 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeSystemEnvironmentPrivilege 4168 powershell.exe Token: SeRemoteShutdownPrivilege 4168 powershell.exe Token: SeUndockPrivilege 4168 powershell.exe Token: SeManageVolumePrivilege 4168 powershell.exe Token: 33 4168 powershell.exe Token: 34 4168 powershell.exe Token: 35 4168 powershell.exe Token: 36 4168 powershell.exe Token: SeIncreaseQuotaPrivilege 4168 powershell.exe Token: SeSecurityPrivilege 4168 powershell.exe Token: SeTakeOwnershipPrivilege 4168 powershell.exe Token: SeLoadDriverPrivilege 4168 powershell.exe Token: SeSystemProfilePrivilege 4168 powershell.exe Token: SeSystemtimePrivilege 4168 powershell.exe Token: SeProfSingleProcessPrivilege 4168 powershell.exe Token: SeIncBasePriorityPrivilege 4168 powershell.exe Token: SeCreatePagefilePrivilege 4168 powershell.exe Token: SeBackupPrivilege 4168 powershell.exe Token: SeRestorePrivilege 4168 powershell.exe Token: SeShutdownPrivilege 4168 powershell.exe Token: SeDebugPrivilege 4168 powershell.exe Token: SeSystemEnvironmentPrivilege 4168 powershell.exe Token: SeRemoteShutdownPrivilege 4168 powershell.exe Token: SeUndockPrivilege 4168 powershell.exe Token: SeManageVolumePrivilege 4168 powershell.exe Token: 33 4168 powershell.exe Token: 34 4168 powershell.exe Token: 35 4168 powershell.exe Token: 36 4168 powershell.exe Token: SeIncreaseQuotaPrivilege 4168 powershell.exe Token: SeSecurityPrivilege 4168 powershell.exe Token: SeTakeOwnershipPrivilege 4168 powershell.exe Token: SeLoadDriverPrivilege 4168 powershell.exe Token: SeSystemProfilePrivilege 4168 powershell.exe Token: SeSystemtimePrivilege 4168 powershell.exe Token: SeProfSingleProcessPrivilege 4168 powershell.exe Token: SeIncBasePriorityPrivilege 4168 powershell.exe Token: SeCreatePagefilePrivilege 4168 powershell.exe Token: SeBackupPrivilege 4168 powershell.exe -
Suspicious use of WriteProcessMemory 61 IoCs
Processes:
72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exeAdobeUpdate.execmd.execmd.execmd.exeOneDrive.execmd.execmd.execmd.exesvchost.exedescription pid process target process PID 3824 wrote to memory of 1956 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe AdobeUpdate.exe PID 3824 wrote to memory of 1956 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe AdobeUpdate.exe PID 1956 wrote to memory of 4052 1956 AdobeUpdate.exe cmd.exe PID 1956 wrote to memory of 4052 1956 AdobeUpdate.exe cmd.exe PID 3824 wrote to memory of 4708 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe build.exe PID 3824 wrote to memory of 4708 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe build.exe PID 3824 wrote to memory of 4708 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe build.exe PID 4052 wrote to memory of 2164 4052 cmd.exe cmd.exe PID 4052 wrote to memory of 2164 4052 cmd.exe cmd.exe PID 3824 wrote to memory of 2484 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe OneDrive.exe PID 3824 wrote to memory of 2484 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe OneDrive.exe PID 3824 wrote to memory of 2484 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe OneDrive.exe PID 3824 wrote to memory of 644 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe vlc.exe PID 3824 wrote to memory of 644 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe vlc.exe PID 2164 wrote to memory of 4488 2164 cmd.exe PING.EXE PID 2164 wrote to memory of 4488 2164 cmd.exe PING.EXE PID 2164 wrote to memory of 4600 2164 cmd.exe attrib.exe PID 2164 wrote to memory of 4600 2164 cmd.exe attrib.exe PID 2164 wrote to memory of 4460 2164 cmd.exe icacls.exe PID 2164 wrote to memory of 4460 2164 cmd.exe icacls.exe PID 2164 wrote to memory of 368 2164 cmd.exe cmd.exe PID 2164 wrote to memory of 368 2164 cmd.exe cmd.exe PID 368 wrote to memory of 1700 368 cmd.exe Msedge.exe PID 368 wrote to memory of 1700 368 cmd.exe Msedge.exe PID 3824 wrote to memory of 1040 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Aurora.exe PID 3824 wrote to memory of 1040 3824 72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe Aurora.exe PID 2484 wrote to memory of 4912 2484 OneDrive.exe powershell.exe PID 2484 wrote to memory of 4912 2484 OneDrive.exe powershell.exe PID 2484 wrote to memory of 4912 2484 OneDrive.exe powershell.exe PID 2484 wrote to memory of 1728 2484 OneDrive.exe cmd.exe PID 2484 wrote to memory of 1728 2484 OneDrive.exe cmd.exe PID 2484 wrote to memory of 1728 2484 OneDrive.exe cmd.exe PID 1728 wrote to memory of 4616 1728 cmd.exe schtasks.exe PID 1728 wrote to memory of 4616 1728 cmd.exe schtasks.exe PID 1728 wrote to memory of 4616 1728 cmd.exe schtasks.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 2484 wrote to memory of 4736 2484 OneDrive.exe RegAsm.exe PID 3776 wrote to memory of 1752 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 1752 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 1396 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 1396 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 412 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 412 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 4172 3776 cmd.exe powercfg.exe PID 3776 wrote to memory of 4172 3776 cmd.exe powercfg.exe PID 4060 wrote to memory of 1924 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 1924 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 320 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 320 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 952 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 952 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 2904 4060 cmd.exe powercfg.exe PID 4060 wrote to memory of 2904 4060 cmd.exe powercfg.exe PID 3200 wrote to memory of 3468 3200 svchost.exe conhost.exe PID 3200 wrote to memory of 4728 3200 svchost.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe"C:\Users\Admin\AppData\Local\Temp\72e1fc6da0a5cfca80413b8b24a880b0688908264971cfedaf079ee52ce4d850.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start cmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe" && exit" && && exit "4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /Q /C " ping localhost -n 1 && copy "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" "C:\Users\Admin\AppData\Local\Msedge.exe" && attrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe" && icacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA) && del "C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exe" && cmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe"5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping localhost -n 16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
C:\Windows\system32\attrib.exeattrib +r +h +a "C:\Users\Admin\AppData\Local\Msedge.exe"6⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\system32\icacls.exeicacls "C:\Users\Admin\AppData\Local\Msedge.exe" /deny "everyone":(WD,AD,WEA,WA)6⤵
- Modifies file permissions
-
C:\Windows\system32\cmd.execmd /C "start "C:\Users\Admin\AppData\Local\Msedge.exe6⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Msedge.exeC:\Users\Admin\AppData\Local\Msedge.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove -ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'OneDriveUpdate' -Value '"C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe"' -PropertyType 'String'4⤵
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /C schtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn \OneDriveUpdate /tr "C:\Users\Admin\AppData\Roaming\OneDriveUpdate\OneDrive Updater.exe" /st 00:00 /du 9999:59 /sc once /ri 60 /rl HIGHEST /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\Aurora.exe"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "ConsoleWindowsHost"2⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Power Settings
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Power Settings
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#npnsokoe#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'ConsoleWindowsHost' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ConsoleWindowsHost' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\svchost.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
64B
MD59cffa925eeba56df3e44b9c33360c2e0
SHA19eb415ce607ddd067754b239bb7c6b3e5cde4c9e
SHA256de5fb7b647ddb53538d8a59adc5ab2e6b9390d414389b83fb972086c6105374b
SHA512ea599735f9514d51edd6b4fecd356c4342851874e694d30e0474f3377a31e5cf98b23ae3147c99e646dd2f6614ffeb8687e23636d70422dfbc393f07937ad210
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
19KB
MD5aa06523313308551e52065a160b25cf4
SHA1c8825447e93aa331464d9251f93b480f99ddc3e8
SHA256999ea4738c822ea1733fb288b14fd430ef810fe440c42a8960f96c303bf342f7
SHA512ac25976d8f1bd686633081ebab69586275a008ec8183927a21eef9b2f6e2a0e0f757682792bb1edb6f59b7b99ba7519a008dc9eabb83bb165141935fb27804a5
-
C:\Users\Admin\AppData\Local\Temp\Aurora.exeFilesize
25.2MB
MD51504c863a05885816d2c8874137ae7a7
SHA15b16d440a7e9b5887886549f016f252900b5c0ac
SHA25633fc61e81efa609df51277aef261623bb291e2dd5359362d50070f7a441df0ad
SHA512055d2650ac996443130c05a742bcaabc576dbde29cc21ea956f66132f7e6da8a5771beb9cd51ff2384b2230ebe68990b35d8b14611613db2b8d2764846a487f9
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uj5ntgx1.hx0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Roaming\AdobeLicense\AdobeUpdate.exeFilesize
80KB
MD565f0a85c4b056d6bcee60c49e2372e35
SHA16af820a2030950617bf150777af4a43a06a17184
SHA256d64768ea74224057220bff451504b6128ddfb6161617b668626c490c84b3ae8e
SHA5127a50bd0b3908f830494b2bff13a051ba0cdc7900934dbf8a62616f6d29b914f05f8029bbcc429a095254ebb6ab2a2d92c05dd6aebf57e34cde20f152243df383
-
C:\Users\Admin\AppData\Roaming\Microsoft Edge\build.exeFilesize
95KB
MD5c9a9d471428a5f92068c0823e6454254
SHA18b8ee8612b9b8bfbb165b3a8ca0d4a377b589dd2
SHA256b0ffaa8c7d8fe1e804afc87e6f7659483c69d421911ddbfc410270011b91bfb5
SHA512ca34022e99a48639fb3566ec4eb901a2f91121aee6a1f1bc601492dd94387873afc8af499aefed8d644aef8f564ca46a12ea40176da7f8d7b4e60f4b505ac8af
-
C:\Users\Admin\AppData\Roaming\OneDrive Update Tool\OneDrive.exeFilesize
3.2MB
MD53b4f58cd4bca7274be25e885be00798b
SHA1eb57c281d8324a1079db97c9da43483a65debbed
SHA256a6832546e1d261c33deea58e1cbb8a391af91628b130454d55aef3e292862d80
SHA512dc909730b2feacba3c14c98a2b443d5c12dfd74ce74db53cf7e564e01707ac365811e4d3b95c0cefe2b87ebd1b074fb4a395360911c3d11de4fa8957e9bad121
-
C:\Users\Admin\AppData\Roaming\VLC Media Player\vlc.exeFilesize
5.6MB
MD5b9fc8581b52abfc6b563da731438e27d
SHA143111fe9b307c850a379fe2d64d279e994680de3
SHA256e03debe75b2f4f4c937c50773064b9a692b262bfce4472e67900edf3f7726058
SHA512c62540e73870caf9a93fbc2396ac99867f8f6e87661240d7642022130008bdb769954f1e8a58d13698172e62cc5b7d44a73b2f1d999db47822eb294c629436a5
-
memory/644-139-0x00007FF7A7970000-0x00007FF7A7F0A000-memory.dmpFilesize
5.6MB
-
memory/644-118-0x00007FF7A7970000-0x00007FF7A7F0A000-memory.dmpFilesize
5.6MB
-
memory/1040-100-0x00007FF61EB90000-0x00007FF62045F000-memory.dmpFilesize
24.8MB
-
memory/2484-69-0x0000000005850000-0x0000000005DF4000-memory.dmpFilesize
5.6MB
-
memory/2484-68-0x0000000000690000-0x00000000009BE000-memory.dmpFilesize
3.2MB
-
memory/3200-168-0x00007FF699650000-0x00007FF699BEA000-memory.dmpFilesize
5.6MB
-
memory/3200-151-0x00007FF699650000-0x00007FF699BEA000-memory.dmpFilesize
5.6MB
-
memory/3468-170-0x00007FF741220000-0x00007FF741249000-memory.dmpFilesize
164KB
-
memory/3468-174-0x00007FF741220000-0x00007FF741249000-memory.dmpFilesize
164KB
-
memory/3824-10-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-7-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-17-0x00000000754D0000-0x00000000754D1000-memory.dmpFilesize
4KB
-
memory/3824-14-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-13-0x0000000000520000-0x0000000001FEA000-memory.dmpFilesize
26.8MB
-
memory/3824-78-0x0000000000520000-0x0000000001FEA000-memory.dmpFilesize
26.8MB
-
memory/3824-8-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-59-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-80-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-0-0x0000000000520000-0x0000000001FEA000-memory.dmpFilesize
26.8MB
-
memory/3824-6-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-5-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-3-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-2-0x00000000754B0000-0x00000000755A0000-memory.dmpFilesize
960KB
-
memory/3824-1-0x00000000754D0000-0x00000000754D1000-memory.dmpFilesize
4KB
-
memory/4168-117-0x0000029946520000-0x0000029946542000-memory.dmpFilesize
136KB
-
memory/4708-75-0x0000000005210000-0x0000000005828000-memory.dmpFilesize
6.1MB
-
memory/4708-104-0x0000000004F00000-0x000000000500A000-memory.dmpFilesize
1.0MB
-
memory/4708-89-0x0000000004CB0000-0x0000000004CFC000-memory.dmpFilesize
304KB
-
memory/4708-79-0x0000000004C70000-0x0000000004CAC000-memory.dmpFilesize
240KB
-
memory/4708-76-0x0000000004C10000-0x0000000004C22000-memory.dmpFilesize
72KB
-
memory/4708-65-0x0000000000230000-0x000000000024E000-memory.dmpFilesize
120KB
-
memory/4728-171-0x00007FF746310000-0x00007FF746AFF000-memory.dmpFilesize
7.9MB
-
memory/4728-173-0x00007FF746310000-0x00007FF746AFF000-memory.dmpFilesize
7.9MB
-
memory/4728-169-0x000002409FFF0000-0x00000240A0010000-memory.dmpFilesize
128KB
-
memory/4728-175-0x00007FF746310000-0x00007FF746AFF000-memory.dmpFilesize
7.9MB
-
memory/4728-177-0x00007FF746310000-0x00007FF746AFF000-memory.dmpFilesize
7.9MB
-
memory/4728-179-0x00007FF746310000-0x00007FF746AFF000-memory.dmpFilesize
7.9MB
-
memory/4728-181-0x00007FF746310000-0x00007FF746AFF000-memory.dmpFilesize
7.9MB
-
memory/4736-103-0x0000000005870000-0x000000000587A000-memory.dmpFilesize
40KB
-
memory/4736-107-0x0000000006560000-0x0000000006612000-memory.dmpFilesize
712KB
-
memory/4736-82-0x0000000000400000-0x0000000000724000-memory.dmpFilesize
3.1MB
-
memory/4736-101-0x0000000005890000-0x0000000005922000-memory.dmpFilesize
584KB
-
memory/4736-106-0x0000000006320000-0x0000000006370000-memory.dmpFilesize
320KB
-
memory/4912-143-0x0000000007440000-0x000000000744E000-memory.dmpFilesize
56KB
-
memory/4912-131-0x00000000070C0000-0x0000000007163000-memory.dmpFilesize
652KB
-
memory/4912-133-0x0000000007210000-0x000000000722A000-memory.dmpFilesize
104KB
-
memory/4912-144-0x0000000007450000-0x0000000007464000-memory.dmpFilesize
80KB
-
memory/4912-145-0x0000000007550000-0x000000000756A000-memory.dmpFilesize
104KB
-
memory/4912-146-0x0000000007530000-0x0000000007538000-memory.dmpFilesize
32KB
-
memory/4912-147-0x0000000007590000-0x00000000075B2000-memory.dmpFilesize
136KB
-
memory/4912-119-0x0000000006470000-0x00000000064A2000-memory.dmpFilesize
200KB
-
memory/4912-130-0x00000000070A0000-0x00000000070BE000-memory.dmpFilesize
120KB
-
memory/4912-120-0x0000000074670000-0x00000000746BC000-memory.dmpFilesize
304KB
-
memory/4912-141-0x0000000007490000-0x0000000007526000-memory.dmpFilesize
600KB
-
memory/4912-142-0x0000000007410000-0x0000000007421000-memory.dmpFilesize
68KB
-
memory/4912-105-0x0000000005D20000-0x0000000005D3E000-memory.dmpFilesize
120KB
-
memory/4912-102-0x0000000005820000-0x0000000005B74000-memory.dmpFilesize
3.3MB
-
memory/4912-134-0x0000000007280000-0x000000000728A000-memory.dmpFilesize
40KB
-
memory/4912-87-0x0000000004EA0000-0x0000000004EC2000-memory.dmpFilesize
136KB
-
memory/4912-90-0x0000000005630000-0x0000000005696000-memory.dmpFilesize
408KB
-
memory/4912-88-0x0000000004F40000-0x0000000004FA6000-memory.dmpFilesize
408KB
-
memory/4912-132-0x0000000007850000-0x0000000007ECA000-memory.dmpFilesize
6.5MB
-
memory/4912-84-0x0000000005000000-0x0000000005628000-memory.dmpFilesize
6.2MB
-
memory/4912-81-0x0000000002570000-0x00000000025A6000-memory.dmpFilesize
216KB