Malware Analysis Report

2025-08-05 11:14

Sample ID 241027-sev2nawnfm
Target a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
SHA256 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
Tags
xmrig evasion execution miner persistence upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7

Threat Level: Known bad

The file a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7 was found to be: Known bad.

Malicious Activity Summary

xmrig evasion execution miner persistence upx

xmrig

Xmrig family

XMRig Miner payload

Creates new service(s)

Command and Scripting Interpreter: PowerShell

Stops running service(s)

Drops file in Drivers directory

Executes dropped EXE

Legitimate hosting services abused for malware hosting/C2

Power Settings

Suspicious use of SetThreadContext

Drops file in System32 directory

UPX packed file

Drops file in Windows directory

Launches sc.exe

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 15:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 15:02

Reported

2024-10-27 15:05

Platform

win7-20240903-en

Max time kernel

149s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"

Signatures

Xmrig family

xmrig

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
File created C:\Windows\system32\drivers\etc\hosts C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2904 set thread context of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 set thread context of 1972 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A
File created C:\Windows\wusa.lock C:\Windows\system32\wusa.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 90880e528128db01 C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1156 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 1156 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 1156 wrote to memory of 2960 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 888 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 888 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 888 wrote to memory of 1944 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 2260 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 2904 wrote to memory of 1972 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 2904 wrote to memory of 1972 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 2904 wrote to memory of 1972 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 2904 wrote to memory of 1972 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 2904 wrote to memory of 1972 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe

"C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"

C:\ProgramData\GoogleUP\Chrome\Updater.exe

C:\ProgramData\GoogleUP\Chrome\Updater.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
FR 212.47.253.124:10343 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
PL 54.37.137.114:10343 xmr-eu1.nanopool.org tcp

Files

memory/2364-0-0x000000013FDD0000-0x00000001409D6000-memory.dmp

memory/2932-6-0x000007FEF5C8E000-0x000007FEF5C8F000-memory.dmp

memory/2932-7-0x000000001B600000-0x000000001B8E2000-memory.dmp

memory/2932-8-0x00000000026A0000-0x00000000026A8000-memory.dmp

memory/2932-9-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

memory/2932-10-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

memory/2932-11-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

memory/2932-12-0x000000000289B000-0x0000000002902000-memory.dmp

memory/2932-14-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

memory/2932-13-0x000007FEF59D0000-0x000007FEF636D000-memory.dmp

C:\ProgramData\GoogleUP\Chrome\Updater.exe

MD5 190e68a764f232fa236a23317f80892b
SHA1 a37b9e226334bc69abaacb539fb7ba9722831a76
SHA256 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
SHA512 34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2

memory/2904-19-0x000000013F660000-0x0000000140266000-memory.dmp

memory/1732-22-0x00000000009A0000-0x00000000009A8000-memory.dmp

memory/1732-21-0x0000000019E30000-0x000000001A112000-memory.dmp

memory/2260-32-0x0000000140000000-0x000000014000E000-memory.dmp

memory/1972-36-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-37-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-35-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-34-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-40-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-39-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-41-0x0000000000400000-0x0000000000420000-memory.dmp

memory/1972-43-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-44-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-45-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-46-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-42-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-38-0x0000000140000000-0x0000000140848000-memory.dmp

memory/2260-29-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2260-28-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2260-27-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2260-26-0x0000000140000000-0x000000014000E000-memory.dmp

memory/2260-25-0x0000000140000000-0x000000014000E000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 3e9af076957c5b2f9c9ce5ec994bea05
SHA1 a8c7326f6bceffaeed1c2bb8d7165e56497965fe
SHA256 e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e
SHA512 933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

memory/1972-48-0x0000000140000000-0x0000000140848000-memory.dmp

memory/1972-47-0x0000000140000000-0x0000000140848000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 15:02

Reported

2024-10-27 15:05

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"

Signatures

Xmrig family

xmrig

xmrig

miner xmrig

XMRig Miner payload

miner
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Creates new service(s)

persistence execution

Drops file in Drivers directory

Description Indicator Process Target
File created C:\Windows\system32\drivers\etc\hosts C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
File created C:\Windows\system32\drivers\etc\hosts C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A

Stops running service(s)

evasion execution

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\system32\MRT.exe C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\system32\MRT.exe C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4508 set thread context of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 set thread context of 3164 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A
N/A N/A C:\Windows\explorer.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\system32\powercfg.exe N/A
Token: SeLockMemoryPrivilege N/A C:\Windows\explorer.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4224 wrote to memory of 1292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4224 wrote to memory of 1292 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4868 wrote to memory of 4500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4868 wrote to memory of 4500 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\wusa.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 916 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\system32\conhost.exe
PID 4508 wrote to memory of 3164 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 4508 wrote to memory of 3164 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 4508 wrote to memory of 3164 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 4508 wrote to memory of 3164 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe
PID 4508 wrote to memory of 3164 N/A C:\ProgramData\GoogleUP\Chrome\Updater.exe C:\Windows\explorer.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe

"C:\Users\Admin\AppData\Local\Temp\a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7.exe"

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineK"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineK" binpath= "C:\ProgramData\GoogleUP\Chrome\Updater.exe" start= "auto"

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop eventlog

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineK"

C:\ProgramData\GoogleUP\Chrome\Updater.exe

C:\ProgramData\GoogleUP\Chrome\Updater.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop UsoSvc

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop WaaSMedicSvc

C:\Windows\system32\wusa.exe

wusa /uninstall /kb:890830 /quiet /norestart

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop wuauserv

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop bits

C:\Windows\system32\sc.exe

C:\Windows\system32\sc.exe stop dosvc

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0

C:\Windows\system32\powercfg.exe

C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0

C:\Windows\system32\conhost.exe

C:\Windows\system32\conhost.exe

C:\Windows\explorer.exe

explorer.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 xmr-eu1.nanopool.org udp
NL 51.15.58.224:10343 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 224.58.15.51.in-addr.arpa udp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
PL 54.37.232.103:10343 xmr-eu1.nanopool.org tcp
US 8.8.8.8:53 24.19.67.172.in-addr.arpa udp
US 8.8.8.8:53 103.232.37.54.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 66.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/3260-0-0x00007FF65D920000-0x00007FF65E526000-memory.dmp

memory/4636-2-0x00007FFDEE073000-0x00007FFDEE075000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zj5do40c.dli.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/4636-12-0x00000126755F0000-0x0000012675612000-memory.dmp

memory/4636-13-0x00007FFDEE070000-0x00007FFDEEB31000-memory.dmp

memory/4636-14-0x00007FFDEE070000-0x00007FFDEEB31000-memory.dmp

memory/4636-17-0x00007FFDEE070000-0x00007FFDEEB31000-memory.dmp

C:\ProgramData\GoogleUP\Chrome\Updater.exe

MD5 190e68a764f232fa236a23317f80892b
SHA1 a37b9e226334bc69abaacb539fb7ba9722831a76
SHA256 a074f13421954fe7e4a87b68d23179df440cc15b0aa3019752fdbece9379d9e7
SHA512 34c5d7d35a639a2c6ea183ad808a10bc0adaebf806975f6949da119c1d90c50f065b3d238a0bd6b7159394fe39a0322590fe229cae73f7c9cc393e721449c0a2

memory/4508-22-0x00007FF62CD30000-0x00007FF62D936000-memory.dmp

memory/5036-42-0x000002085DC30000-0x000002085DC4C000-memory.dmp

memory/5036-43-0x0000020860070000-0x0000020860125000-memory.dmp

memory/5036-44-0x000002085DC50000-0x000002085DC5A000-memory.dmp

memory/5036-45-0x000002085DC80000-0x000002085DC9C000-memory.dmp

memory/5036-46-0x000002085DC60000-0x000002085DC6A000-memory.dmp

memory/5036-47-0x000002085DCC0000-0x000002085DCDA000-memory.dmp

memory/5036-48-0x000002085DC70000-0x000002085DC78000-memory.dmp

memory/5036-49-0x000002085DCA0000-0x000002085DCA6000-memory.dmp

memory/5036-50-0x000002085DCB0000-0x000002085DCBA000-memory.dmp

memory/916-59-0x0000000140000000-0x000000014000E000-memory.dmp

memory/916-58-0x0000000140000000-0x000000014000E000-memory.dmp

memory/916-57-0x0000000140000000-0x000000014000E000-memory.dmp

memory/916-56-0x0000000140000000-0x000000014000E000-memory.dmp

memory/916-55-0x0000000140000000-0x000000014000E000-memory.dmp

C:\Windows\system32\drivers\etc\hosts

MD5 00930b40cba79465b7a38ed0449d1449
SHA1 4b25a89ee28b20ba162f23772ddaf017669092a5
SHA256 eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512 cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

memory/3164-64-0x0000000140000000-0x0000000140848000-memory.dmp

memory/916-62-0x0000000140000000-0x000000014000E000-memory.dmp

memory/3164-66-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-63-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-65-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-70-0x00000000014D0000-0x00000000014F0000-memory.dmp

memory/3164-69-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-68-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-67-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-71-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-72-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-75-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-74-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-73-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-76-0x0000000140000000-0x0000000140848000-memory.dmp

memory/3164-77-0x0000000140000000-0x0000000140848000-memory.dmp