Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/10/2024, 16:11

General

  • Target

    61b72b2d4099b7ca2af5318b4ea6a668.exe

  • Size

    704KB

  • MD5

    61b72b2d4099b7ca2af5318b4ea6a668

  • SHA1

    7c38e00060124176ae1b5ad7f17dd8a202445f26

  • SHA256

    b3b766fc82f285fbdfdfd1246fa7a227e7e8d4228a0a13c6187c4aab2149d0be

  • SHA512

    b764e2204f473c7d09186a1dd8f4111344066a5219c76fe08076c46053d2ff620c43257f09e249931b684f1c055be2db3cffac1d4543c062ca7f956aca7f8106

  • SSDEEP

    12288:q3IbtEqk/k9aqG1G7uSuYC7QQhguHuM+hECDgLEoX5+rUKHRmc65L2Vl2:q3C+BMQqGESMAh/OMknD4jcrJHRmbOl

Malware Config

Extracted

Family

stealc

Botnet

LogsDiller

C2

http://185.235.128.16

Attributes
  • url_path

    /562c1eb14955c897.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

  • Stealc family
  • Xmrig family
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • XMRig Miner payload 18 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Creates new service(s) 2 TTPs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 2 IoCs
  • Stops running service(s) 4 TTPs
  • Uses browser remote debugging 2 TTPs 9 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 12 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Power Settings 1 TTPs 8 IoCs

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 8 IoCs
  • Modifies data under HKEY_USERS 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61b72b2d4099b7ca2af5318b4ea6a668.exe
    "C:\Users\Admin\AppData\Local\Temp\61b72b2d4099b7ca2af5318b4ea6a668.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1584
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
      2⤵
      • Uses browser remote debugging
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa20d4cc40,0x7ffa20d4cc4c,0x7ffa20d4cc58
        3⤵
          PID:3640
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:2
          3⤵
            PID:1852
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2148,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
            3⤵
              PID:2776
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2444 /prefetch:8
              3⤵
                PID:2008
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3148,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:2992
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3220 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:724
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4500,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4484 /prefetch:1
                3⤵
                • Uses browser remote debugging
                PID:2948
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4448,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4704 /prefetch:8
                3⤵
                  PID:796
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4220,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4588 /prefetch:8
                  3⤵
                    PID:468
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4920 /prefetch:8
                    3⤵
                      PID:1684
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4600,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4564 /prefetch:8
                      3⤵
                        PID:3512
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4576,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4932 /prefetch:8
                        3⤵
                          PID:212
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5060,i,180374262779941717,15997048353104495180,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5092 /prefetch:8
                          3⤵
                            PID:1412
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
                          2⤵
                          • Uses browser remote debugging
                          • Enumerates system info in registry
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          PID:2116
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa219b46f8,0x7ffa219b4708,0x7ffa219b4718
                            3⤵
                            • Checks processor information in registry
                            • Enumerates system info in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5032
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
                            3⤵
                              PID:2336
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3932
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
                              3⤵
                                PID:3240
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:2840
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:4576
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:2164
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
                                3⤵
                                • Uses browser remote debugging
                                PID:1816
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15983640285776558172,10100217345752069130,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
                                3⤵
                                  PID:2936
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\CGIDGCGIEG.exe"
                                2⤵
                                • System Location Discovery: System Language Discovery
                                PID:1204
                                • C:\ProgramData\CGIDGCGIEG.exe
                                  "C:\ProgramData\CGIDGCGIEG.exe"
                                  3⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Drops file in Drivers directory
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Checks whether UAC is enabled
                                  • Drops file in System32 directory
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:808
                                  • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                    4⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2536
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                    4⤵
                                      PID:2408
                                      • C:\Windows\system32\wusa.exe
                                        wusa /uninstall /kb:890830 /quiet /norestart
                                        5⤵
                                          PID:3892
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop UsoSvc
                                        4⤵
                                        • Launches sc.exe
                                        PID:1752
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                        4⤵
                                        • Launches sc.exe
                                        PID:4396
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop wuauserv
                                        4⤵
                                        • Launches sc.exe
                                        PID:1092
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop bits
                                        4⤵
                                        • Launches sc.exe
                                        PID:1536
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop dosvc
                                        4⤵
                                        • Launches sc.exe
                                        PID:3568
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                        4⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2600
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                        4⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2948
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                        4⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1020
                                      • C:\Windows\system32\powercfg.exe
                                        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                        4⤵
                                        • Power Settings
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3044
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
                                        4⤵
                                        • Launches sc.exe
                                        PID:5080
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
                                        4⤵
                                        • Launches sc.exe
                                        PID:884
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe stop eventlog
                                        4⤵
                                        • Launches sc.exe
                                        PID:4044
                                      • C:\Windows\system32\sc.exe
                                        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
                                        4⤵
                                        • Launches sc.exe
                                        PID:4548
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 2544
                                    2⤵
                                    • Program crash
                                    PID:1368
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                  1⤵
                                    PID:3560
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:5108
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1584 -ip 1584
                                      1⤵
                                        PID:5076
                                      • C:\ProgramData\Google\Chrome\updater.exe
                                        C:\ProgramData\Google\Chrome\updater.exe
                                        1⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Drops file in Drivers directory
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Checks whether UAC is enabled
                                        • Drops file in System32 directory
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious use of SetThreadContext
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:1668
                                        • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                          C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Drops file in System32 directory
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3292
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                          2⤵
                                            PID:2556
                                            • C:\Windows\system32\wusa.exe
                                              wusa /uninstall /kb:890830 /quiet /norestart
                                              3⤵
                                                PID:4808
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop UsoSvc
                                              2⤵
                                              • Launches sc.exe
                                              PID:3740
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop WaaSMedicSvc
                                              2⤵
                                              • Launches sc.exe
                                              PID:4880
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop wuauserv
                                              2⤵
                                              • Launches sc.exe
                                              PID:4528
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop bits
                                              2⤵
                                              • Launches sc.exe
                                              PID:216
                                            • C:\Windows\system32\sc.exe
                                              C:\Windows\system32\sc.exe stop dosvc
                                              2⤵
                                              • Launches sc.exe
                                              PID:4408
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2500
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4132
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1244
                                            • C:\Windows\system32\powercfg.exe
                                              C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                              2⤵
                                              • Power Settings
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2168
                                            • C:\Windows\system32\conhost.exe
                                              C:\Windows\system32\conhost.exe
                                              2⤵
                                                PID:2564
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1352

                                            Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\ProgramData\CGIDGCGIEG.exe

                                                    Filesize

                                                    8.3MB

                                                    MD5

                                                    d9a5e741b1f67593422bfb1a165288bb

                                                    SHA1

                                                    0bc42e46e97fbf3b0754d26d88e43945edc31a0b

                                                    SHA256

                                                    c81a924446d324b3aeb0772dfd9cbed34fb878aff823ba2888362a22f7328fe8

                                                    SHA512

                                                    5a463b581c18e2a2076bbf888ee838745eb8fea6e718b5882951e18a213f530589cb5cf3d61e2cc4014556dc65a327b56b42b915bd9cea488adb4782af151ea4

                                                  • C:\ProgramData\chrome.dll

                                                    Filesize

                                                    676KB

                                                    MD5

                                                    eda18948a989176f4eebb175ce806255

                                                    SHA1

                                                    ff22a3d5f5fb705137f233c36622c79eab995897

                                                    SHA256

                                                    81a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4

                                                    SHA512

                                                    160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85

                                                  • C:\ProgramData\mozglue.dll

                                                    Filesize

                                                    593KB

                                                    MD5

                                                    c8fd9be83bc728cc04beffafc2907fe9

                                                    SHA1

                                                    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                                    SHA256

                                                    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                                    SHA512

                                                    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                                  • C:\ProgramData\nss3.dll

                                                    Filesize

                                                    2.0MB

                                                    MD5

                                                    1cc453cdf74f31e4d913ff9c10acdde2

                                                    SHA1

                                                    6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                                    SHA256

                                                    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                                    SHA512

                                                    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                    Filesize

                                                    649B

                                                    MD5

                                                    83138fd0196e5303573c0433d6a3e374

                                                    SHA1

                                                    1f75213aa42df9b3411f648ade030e0fb7477f48

                                                    SHA256

                                                    bef4c61ffda306511aaea481c41430ec240792200c047663ac6a90a8331f9673

                                                    SHA512

                                                    921b015c2bb9d987abc9bcebe508e87d78ca00aa39961716fedb1fd3ef9fe6d6e0a577890c505ac58f5491105ccd84ece047bf736905efe8d043bac0851623bd

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                    Filesize

                                                    2B

                                                    MD5

                                                    d751713988987e9331980363e24189ce

                                                    SHA1

                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                    SHA256

                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                    SHA512

                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\5aa4de6b-d72f-44e5-b67f-0564adb64305.dmp

                                                    Filesize

                                                    826KB

                                                    MD5

                                                    6d7510d314e7f49ea7ce641b904d0894

                                                    SHA1

                                                    9f52ce5786c91797d0e10018ef26742fb1907968

                                                    SHA256

                                                    ee3e4696502bef393eeaf8acb142e1b11c478fd3da991cb8855c53d3dfefbd82

                                                    SHA512

                                                    a690ba080f7d8994fffa55b2136ea1d392182b7a5671fbe918563b214de42ee8d983cc400fc2a7bb42fcd7d7ce4c23c11c6706fb1245e3ec128fcbae6e7ce4eb

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    2c020b81ce381f90c34f791d7dc16492

                                                    SHA1

                                                    0889797280b8520f74eaeaf7610d66c6841958da

                                                    SHA256

                                                    8ecd39b5d58815539a5a6a1f9aa31e2a125642f6c260b64f91e3254d8dbb70ae

                                                    SHA512

                                                    9a18048252434cb6762f99db5bf5b19b44a9adaf08325a3c543269ae502ffd8fb3ab5194f9ac8ac3475b7e5603e9998c4331b3542e3b205a96274ab0516f3205

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    443a627d539ca4eab732bad0cbe7332b

                                                    SHA1

                                                    86b18b906a1acd2a22f4b2c78ac3564c394a9569

                                                    SHA256

                                                    1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                                                    SHA512

                                                    923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                    Filesize

                                                    152B

                                                    MD5

                                                    99afa4934d1e3c56bbce114b356e8a99

                                                    SHA1

                                                    3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                                                    SHA256

                                                    08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                                                    SHA512

                                                    76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                    Filesize

                                                    5KB

                                                    MD5

                                                    f91404767eb794bb36dfb2963a2ad89e

                                                    SHA1

                                                    82af97c15e50f9b1c7a5dc44e4a4c0e32a83bbda

                                                    SHA256

                                                    3e373d2fa32f2a7251be680df3cc63e82fd8c015ac8182e8b3593b6bc98da76f

                                                    SHA512

                                                    ec113b0c16618677051d7ec9ee7a9811e47da53d3289dfb69d7060f0fe9e22794a67e97f39b3075f6770e36e161eb31defd9cac5680c42d4842e909b3a2d6b9a

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gnzbm5bd.5yf.ps1

                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                  • C:\Windows\system32\drivers\etc\hosts

                                                    Filesize

                                                    3KB

                                                    MD5

                                                    00930b40cba79465b7a38ed0449d1449

                                                    SHA1

                                                    4b25a89ee28b20ba162f23772ddaf017669092a5

                                                    SHA256

                                                    eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

                                                    SHA512

                                                    cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

                                                  • memory/808-202-0x00007FF7B2F90000-0x00007FF7B3F16000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/808-203-0x00007FF7B2F90000-0x00007FF7B3F16000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/808-201-0x00007FF7B2F90000-0x00007FF7B3F16000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/808-205-0x00007FF7B2F90000-0x00007FF7B3F16000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/808-221-0x00007FF7B2F90000-0x00007FF7B3F16000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/808-200-0x00007FF7B2F90000-0x00007FF7B3F16000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/1352-274-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-273-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-283-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-282-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-280-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-279-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-278-0x0000000001500000-0x0000000001520000-memory.dmp

                                                    Filesize

                                                    128KB

                                                  • memory/1352-290-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-271-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-272-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-289-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-288-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-286-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-270-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-267-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-275-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-277-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-281-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-268-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1352-269-0x0000000140000000-0x000000014082C000-memory.dmp

                                                    Filesize

                                                    8.2MB

                                                  • memory/1584-193-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                    Filesize

                                                    2.9MB

                                                  • memory/1584-2-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                    Filesize

                                                    2.9MB

                                                  • memory/1584-3-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                    Filesize

                                                    972KB

                                                  • memory/1584-1-0x00000000023B0000-0x000000000248A000-memory.dmp

                                                    Filesize

                                                    872KB

                                                  • memory/1584-67-0x0000000000840000-0x00000000008B6000-memory.dmp

                                                    Filesize

                                                    472KB

                                                  • memory/1584-204-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                    Filesize

                                                    2.9MB

                                                  • memory/1584-74-0x00000000023B0000-0x000000000248A000-memory.dmp

                                                    Filesize

                                                    872KB

                                                  • memory/1584-76-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                    Filesize

                                                    2.9MB

                                                  • memory/1584-167-0x0000000000400000-0x00000000006ED000-memory.dmp

                                                    Filesize

                                                    2.9MB

                                                  • memory/1584-0-0x0000000000840000-0x00000000008B6000-memory.dmp

                                                    Filesize

                                                    472KB

                                                  • memory/1668-227-0x00007FF71D5A0000-0x00007FF71E526000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/1668-226-0x00007FF71D5A0000-0x00007FF71E526000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/1668-285-0x00007FF71D5A0000-0x00007FF71E526000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/1668-224-0x00007FF71D5A0000-0x00007FF71E526000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/1668-225-0x00007FF71D5A0000-0x00007FF71E526000-memory.dmp

                                                    Filesize

                                                    15.5MB

                                                  • memory/2536-206-0x000001D2D18D0000-0x000001D2D18F2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                  • memory/2564-260-0x0000000140000000-0x000000014000E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/2564-261-0x0000000140000000-0x000000014000E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/2564-262-0x0000000140000000-0x000000014000E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/2564-263-0x0000000140000000-0x000000014000E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/2564-266-0x0000000140000000-0x000000014000E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/2564-259-0x0000000140000000-0x000000014000E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                  • memory/3292-251-0x0000023FE3B60000-0x0000023FE3B7A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                  • memory/3292-249-0x0000023FE3B20000-0x0000023FE3B3C000-memory.dmp

                                                    Filesize

                                                    112KB

                                                  • memory/3292-248-0x0000023FE34E0000-0x0000023FE34EA000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/3292-247-0x0000023FE3900000-0x0000023FE39B5000-memory.dmp

                                                    Filesize

                                                    724KB

                                                  • memory/3292-246-0x0000023FE34C0000-0x0000023FE34DC000-memory.dmp

                                                    Filesize

                                                    112KB

                                                  • memory/3292-250-0x0000023FE3B00000-0x0000023FE3B0A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                  • memory/3292-252-0x0000023FE3B10000-0x0000023FE3B18000-memory.dmp

                                                    Filesize

                                                    32KB

                                                  • memory/3292-253-0x0000023FE3B40000-0x0000023FE3B46000-memory.dmp

                                                    Filesize

                                                    24KB

                                                  • memory/3292-254-0x0000023FE3B50000-0x0000023FE3B5A000-memory.dmp

                                                    Filesize

                                                    40KB