Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 19:02
Static task
static1
Behavioral task
behavioral1
Sample
dab687d0562daae2c789f4ee10c3d440N.exe
Resource
win7-20240708-en
General
-
Target
dab687d0562daae2c789f4ee10c3d440N.exe
-
Size
113KB
-
MD5
dab687d0562daae2c789f4ee10c3d440
-
SHA1
5171bb133961d258fa38c4a48481cbc0e5960d2e
-
SHA256
a32ef391573926562422a7dd7547429114258f4c6e530caa0a578d78d6c76058
-
SHA512
22319aaca532123e17a48053b3bd416c66d6b333c82e5dab407e4719a42c3b6ad6293186bbdc7b470d83cae3fe1a3bff8ccb53617183d56f8ab6e5e5589ae6ad
-
SSDEEP
3072:OVS1/eI4pnTfEFYJE3nwzPdCNU/efHYTo+:OEHGnTcFYOXwJigT
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
LLeT2zkStY3cvxMBFhoWXkG5VuZPoezduv
rwc4LVd9ABpULQ1CuCpDkgX2xVB1fUijyb
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
17hgMFyLDwMjxWqw5GhijhnPdJDyFDqecY
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3FerB8kUraAVGCVCNkgv57zTBjUGjAUkU3
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1epx67ne4vckqmaj4gwke8m322f4yjr6eh52wqw
bc1qmpkehfffkr6phuklsksnd7nhgx0369sxu772m3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
-
mutex
x88767657x
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4" sysmysldrv.exe -
Phorphiex payload 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023491-10.dat family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
description pid Process procid_target PID 2120 created 3544 2120 1250119744.exe 56 PID 2120 created 3544 2120 1250119744.exe 56 PID 2180 created 3544 2180 wupgrdsv.exe 56 PID 2180 created 3544 2180 wupgrdsv.exe 56 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmysldrv.exe -
XMRig Miner payload 7 IoCs
resource yara_rule behavioral2/memory/2180-114-0x00007FF7D0B80000-0x00007FF7D10F6000-memory.dmp xmrig behavioral2/memory/4516-116-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp xmrig behavioral2/memory/4516-118-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp xmrig behavioral2/memory/4516-119-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp xmrig behavioral2/memory/4516-120-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp xmrig behavioral2/memory/4516-121-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp xmrig behavioral2/memory/4516-122-0x00007FF7B5A60000-0x00007FF7B624F000-memory.dmp xmrig -
pid Process 220 powershell.exe 4488 powershell.exe 904 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation sysmysldrv.exe -
Executes dropped EXE 8 IoCs
pid Process 1480 8A8D.exe 4804 2881922775.exe 3184 sysmysldrv.exe 4100 2094227408.exe 4328 2470919132.exe 2636 1168826113.exe 2120 1250119744.exe 2180 wupgrdsv.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" sysmysldrv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" sysmysldrv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysmysldrv.exe" 2881922775.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2180 set thread context of 4516 2180 wupgrdsv.exe 114 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysmysldrv.exe 2881922775.exe File opened for modification C:\Windows\sysmysldrv.exe 2881922775.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2092 sc.exe 1680 sc.exe 4324 sc.exe 4880 sc.exe 3852 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2470919132.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1168826113.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2881922775.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysmysldrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2094227408.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8A8D.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 904 powershell.exe 904 powershell.exe 2120 1250119744.exe 2120 1250119744.exe 220 powershell.exe 220 powershell.exe 2120 1250119744.exe 2120 1250119744.exe 2180 wupgrdsv.exe 2180 wupgrdsv.exe 4488 powershell.exe 4488 powershell.exe 2180 wupgrdsv.exe 2180 wupgrdsv.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 904 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeIncreaseQuotaPrivilege 220 powershell.exe Token: SeSecurityPrivilege 220 powershell.exe Token: SeTakeOwnershipPrivilege 220 powershell.exe Token: SeLoadDriverPrivilege 220 powershell.exe Token: SeSystemProfilePrivilege 220 powershell.exe Token: SeSystemtimePrivilege 220 powershell.exe Token: SeProfSingleProcessPrivilege 220 powershell.exe Token: SeIncBasePriorityPrivilege 220 powershell.exe Token: SeCreatePagefilePrivilege 220 powershell.exe Token: SeBackupPrivilege 220 powershell.exe Token: SeRestorePrivilege 220 powershell.exe Token: SeShutdownPrivilege 220 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeSystemEnvironmentPrivilege 220 powershell.exe Token: SeRemoteShutdownPrivilege 220 powershell.exe Token: SeUndockPrivilege 220 powershell.exe Token: SeManageVolumePrivilege 220 powershell.exe Token: 33 220 powershell.exe Token: 34 220 powershell.exe Token: 35 220 powershell.exe Token: 36 220 powershell.exe Token: SeIncreaseQuotaPrivilege 220 powershell.exe Token: SeSecurityPrivilege 220 powershell.exe Token: SeTakeOwnershipPrivilege 220 powershell.exe Token: SeLoadDriverPrivilege 220 powershell.exe Token: SeSystemProfilePrivilege 220 powershell.exe Token: SeSystemtimePrivilege 220 powershell.exe Token: SeProfSingleProcessPrivilege 220 powershell.exe Token: SeIncBasePriorityPrivilege 220 powershell.exe Token: SeCreatePagefilePrivilege 220 powershell.exe Token: SeBackupPrivilege 220 powershell.exe Token: SeRestorePrivilege 220 powershell.exe Token: SeShutdownPrivilege 220 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeSystemEnvironmentPrivilege 220 powershell.exe Token: SeRemoteShutdownPrivilege 220 powershell.exe Token: SeUndockPrivilege 220 powershell.exe Token: SeManageVolumePrivilege 220 powershell.exe Token: 33 220 powershell.exe Token: 34 220 powershell.exe Token: 35 220 powershell.exe Token: 36 220 powershell.exe Token: SeIncreaseQuotaPrivilege 220 powershell.exe Token: SeSecurityPrivilege 220 powershell.exe Token: SeTakeOwnershipPrivilege 220 powershell.exe Token: SeLoadDriverPrivilege 220 powershell.exe Token: SeSystemProfilePrivilege 220 powershell.exe Token: SeSystemtimePrivilege 220 powershell.exe Token: SeProfSingleProcessPrivilege 220 powershell.exe Token: SeIncBasePriorityPrivilege 220 powershell.exe Token: SeCreatePagefilePrivilege 220 powershell.exe Token: SeBackupPrivilege 220 powershell.exe Token: SeRestorePrivilege 220 powershell.exe Token: SeShutdownPrivilege 220 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeSystemEnvironmentPrivilege 220 powershell.exe Token: SeRemoteShutdownPrivilege 220 powershell.exe Token: SeUndockPrivilege 220 powershell.exe Token: SeManageVolumePrivilege 220 powershell.exe Token: 33 220 powershell.exe Token: 34 220 powershell.exe Token: 35 220 powershell.exe -
Suspicious use of WriteProcessMemory 45 IoCs
description pid Process procid_target PID 4436 wrote to memory of 1480 4436 dab687d0562daae2c789f4ee10c3d440N.exe 86 PID 4436 wrote to memory of 1480 4436 dab687d0562daae2c789f4ee10c3d440N.exe 86 PID 4436 wrote to memory of 1480 4436 dab687d0562daae2c789f4ee10c3d440N.exe 86 PID 1480 wrote to memory of 4804 1480 8A8D.exe 88 PID 1480 wrote to memory of 4804 1480 8A8D.exe 88 PID 1480 wrote to memory of 4804 1480 8A8D.exe 88 PID 4804 wrote to memory of 3184 4804 2881922775.exe 89 PID 4804 wrote to memory of 3184 4804 2881922775.exe 89 PID 4804 wrote to memory of 3184 4804 2881922775.exe 89 PID 3184 wrote to memory of 4200 3184 sysmysldrv.exe 90 PID 3184 wrote to memory of 4200 3184 sysmysldrv.exe 90 PID 3184 wrote to memory of 4200 3184 sysmysldrv.exe 90 PID 3184 wrote to memory of 4076 3184 sysmysldrv.exe 92 PID 3184 wrote to memory of 4076 3184 sysmysldrv.exe 92 PID 3184 wrote to memory of 4076 3184 sysmysldrv.exe 92 PID 4200 wrote to memory of 904 4200 cmd.exe 94 PID 4200 wrote to memory of 904 4200 cmd.exe 94 PID 4200 wrote to memory of 904 4200 cmd.exe 94 PID 4076 wrote to memory of 4324 4076 cmd.exe 95 PID 4076 wrote to memory of 4324 4076 cmd.exe 95 PID 4076 wrote to memory of 4324 4076 cmd.exe 95 PID 4076 wrote to memory of 4880 4076 cmd.exe 96 PID 4076 wrote to memory of 4880 4076 cmd.exe 96 PID 4076 wrote to memory of 4880 4076 cmd.exe 96 PID 4076 wrote to memory of 3852 4076 cmd.exe 97 PID 4076 wrote to memory of 3852 4076 cmd.exe 97 PID 4076 wrote to memory of 3852 4076 cmd.exe 97 PID 4076 wrote to memory of 2092 4076 cmd.exe 98 PID 4076 wrote to memory of 2092 4076 cmd.exe 98 PID 4076 wrote to memory of 2092 4076 cmd.exe 98 PID 4076 wrote to memory of 1680 4076 cmd.exe 99 PID 4076 wrote to memory of 1680 4076 cmd.exe 99 PID 4076 wrote to memory of 1680 4076 cmd.exe 99 PID 3184 wrote to memory of 4100 3184 sysmysldrv.exe 100 PID 3184 wrote to memory of 4100 3184 sysmysldrv.exe 100 PID 3184 wrote to memory of 4100 3184 sysmysldrv.exe 100 PID 3184 wrote to memory of 4328 3184 sysmysldrv.exe 101 PID 3184 wrote to memory of 4328 3184 sysmysldrv.exe 101 PID 3184 wrote to memory of 4328 3184 sysmysldrv.exe 101 PID 3184 wrote to memory of 2636 3184 sysmysldrv.exe 104 PID 3184 wrote to memory of 2636 3184 sysmysldrv.exe 104 PID 3184 wrote to memory of 2636 3184 sysmysldrv.exe 104 PID 2636 wrote to memory of 2120 2636 1168826113.exe 106 PID 2636 wrote to memory of 2120 2636 1168826113.exe 106 PID 2180 wrote to memory of 4516 2180 wupgrdsv.exe 114 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\dab687d0562daae2c789f4ee10c3d440N.exe"C:\Users\Admin\AppData\Local\Temp\dab687d0562daae2c789f4ee10c3d440N.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\8A8D.exe"C:\Users\Admin\AppData\Local\Temp\8A8D.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\2881922775.exeC:\Users\Admin\AppData\Local\Temp\2881922775.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\sysmysldrv.exeC:\Windows\sysmysldrv.exe5⤵
- Modifies security service
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"7⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:904
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS6⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Windows\SysWOW64\sc.exesc stop UsoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4324
-
-
C:\Windows\SysWOW64\sc.exesc stop WaaSMedicSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4880
-
-
C:\Windows\SysWOW64\sc.exesc stop wuauserv7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:3852
-
-
C:\Windows\SysWOW64\sc.exesc stop DoSvc7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:2092
-
-
C:\Windows\SysWOW64\sc.exesc stop BITS7⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:1680
-
-
-
C:\Users\Admin\AppData\Local\Temp\2094227408.exeC:\Users\Admin\AppData\Local\Temp\2094227408.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4100
-
-
C:\Users\Admin\AppData\Local\Temp\2470919132.exeC:\Users\Admin\AppData\Local\Temp\2470919132.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4328
-
-
C:\Users\Admin\AppData\Local\Temp\1168826113.exeC:\Users\Admin\AppData\Local\Temp\1168826113.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\1250119744.exeC:\Users\Admin\AppData\Local\Temp\1250119744.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2120
-
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Windows Upgrade Manager"2⤵PID:3688
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#llzqlmcx#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Windows Upgrade Manager' /tr '''C:\Users\Admin\Windows Upgrade\wupgrdsv.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Windows Upgrade\wupgrdsv.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Windows Upgrade Manager' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4488
-
-
C:\Windows\System32\notepad.exeC:\Windows\System32\notepad.exe2⤵PID:4516
-
-
C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"C:\Users\Admin\Windows Upgrade\wupgrdsv.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2180
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
2Windows Service
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5fee026663fcb662152188784794028ee
SHA13c02a26a9cb16648fad85c6477b68ced3cb0cb45
SHA256dbd4136bc342e3e92902ec3a30d165452c82997a7ae24ac90775e42d88959e6b
SHA5127b12bd5c8fc4356b9123d6586b4980cf76012663b41c0dab6f6f21567e2f4005c5bcea2cc2158d157e4f801a281f3e04bad3774cddb3122db309ccf662184bd6
-
Filesize
1KB
MD5d95b08252ed624f6d91b46523f110f29
SHA117577997bc1fb5d3fbe59be84013165534415dc3
SHA256342ce7c39bf9992d31d4b61ef138b2b084c96c74736ed00bb19aae49be16ca02
SHA5120c4288176d56f4ee6d8f08f568fba07ad859f50a395c39d2afd3baf55d3d29ca065a1ce305d1bd790477c35977c0ffa230543e805622f80a77bcee71b24eb257
-
Filesize
18KB
MD523c8f15ed37c01aefc2b72e1ff53ead7
SHA162f1d9f45e61b1e96ed0325af4a31e623911f885
SHA256697fe38bca7d113a67cde2c718a1bc23227a0a16c878d6667b734ca24e0452f1
SHA512c4440b6d78dfa8d8ca6835cdffcd1e305f23d8eb1f9e662e38a46cfc9a98c01811a9ad1605043207a4b65d2ec630b1fec0a8a114ea2d8258c66c7523082073c3
-
Filesize
10KB
MD54fe8dc617311f7b6a4b8ebe0b1e24090
SHA12bd9341f17c8c0c62e56e1863b1d2f9c43cb30e5
SHA2565016e413b0c563efc920165e7235c9f2706808877668bd297b41435acc7aade4
SHA512910a12fbaffd45b0f797a95c6678a32c4a27adbb7d1474f183f8863d310d31fbba17d5d747da87ac4a30dd7cb22c67a4d1c25b302ef0c3f6954d91a459c692db
-
Filesize
5.4MB
MD541ab08c1955fce44bfd0c76a64d1945a
SHA12b9cb05f4de5d98c541d15175d7f0199cbdd0eea
SHA256dd12cb27b3867341bf6ca48715756500d3ec56c19b21bb1c1290806aa74cb493
SHA51238834ae703a8541b4fec9a1db94cfe296ead58649bb1d4873b517df14d0c6a9d25e49ff04c2bf6bb0188845116a4e894aae930d849f9be8c98d2ce51da1ef116
-
Filesize
7KB
MD5af0622340ed8ba48efa92e0b2d9aca7b
SHA177e7181b4d4e6957cf13ba37f590cf219aac88cb
SHA2567b7d433c6c204ed3bcd1ea74106592edfa1a30b6ef7bbc3ed21efcbadc51e526
SHA512e1368c1c292789115b51cae549bd2d484dbc614eb3e57aa5fce324385d28e9fbddf60064b4c88237b38cded294d090d07c491b646651c45bcd6235630d94ef46
-
Filesize
92KB
MD5be9388b42333b3d4e163b0ace699897b
SHA14e1109772eb9cb59c557380822166fe1664403bd
SHA256d281e0a0f1e1073f2d290a7eb1f77bed4c210dbf83a0f4f4e22073f50faa843f
SHA5125f887f1060b898c9a88745cde7cf509fdf42947ab8e5948b46c2df659468dc245b24d089bdbec0b314c40b83934698bf4b6feb8954e32810ff8f522aab0af19a
-
Filesize
9KB
MD58d8e6c7952a9dc7c0c73911c4dbc5518
SHA19098da03b33b2c822065b49d5220359c275d5e94
SHA256feb4c3ae4566f0acbb9e0f55417b61fefd89dc50a4e684df780813fb01d61278
SHA51291a573843c28dd32a9f31a60ba977f9a3d4bb19ffd1b7254333e09bcecef348c1b3220a348ebb2cb08edb57d56cb7737f026519da52199c9dc62c10aea236645
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82