meduza | b9c1b9b0080c47159b024c8cdabeac604e66aeec4022a89b120300290ae4a733

Analysis

max time kernel
152s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
30-11-2024 19:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox.exe
Size

649.7MB
MD5

4ccbe16c40cc36f2b845f6aaef1ba4cb
SHA1

4ee86cb4045ab514b25af0b7a81092d3a9c49242
SHA256

9f6b4e433a721a96b742e150031e57901fcd6f98cab714255d9bb72e0648a350
SHA512

cc1b1a8be443e00a6e8d779318042d24cf5a81e619b0f14edf7d673228e8e517b480513f452dd843fe86b4ba98ff6bd53f8f19c363854035184227f5a6995c76
SSDEEP

98304:b57FKBSfaYFYL8AnEOp0NTbeLvam4w0nY:Z8ofp8EOp0NTSvam4wQY

Score

10^/10

meduza xmrig collection discovery evasion execution miner persistence spyware stealer upx

Malware Config

Extracted

Family

meduza

45.130.145.152

Attributes

anti_dbg
true
anti_vm
true
build_name
Work
extensions
.txt;.doc;.docx;.pdf;.xls;.xlsx;.log;.db;.sqlite
grabber_max_size
4.194304e+06
port
15666
self_destruct
false

Signatures

Meduza
Meduza is a crypto wallet and info stealer written in C++.
stealer meduza

Meduza Stealer payload 3 IoCs

Processes:

resource	yara_rule
behavioral6/memory/548-33-0x000001EFF4E30000-0x000001EFF4F6E000-memory.dmp	family_meduza
behavioral6/memory/548-41-0x000001EFF4E30000-0x000001EFF4F6E000-memory.dmp	family_meduza
behavioral6/memory/548-110-0x000001EFF4E30000-0x000001EFF4F6E000-memory.dmp	family_meduza

Meduza family
meduza
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

Processes:

resource	yara_rule
behavioral6/memory/4292-101-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-100-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-107-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-106-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-105-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-104-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-103-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-108-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral6/memory/4292-109-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
3024	powershell.exe
3188	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Roblox.exerevcon.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	Roblox.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	revcon.exe

Executes dropped EXE 3 IoCs

Processes:

birdflower.exerevcon.exevzppfnnlsyit.exe

pid	Process
3168	birdflower.exe
548	revcon.exe
4424	vzppfnnlsyit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 5 IoCs

collection

Email Collection

T1114

Processes:

revcon.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Office\12.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
27	api.ipify.org
28	api.ipify.org

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	Process
4596	powercfg.exe
672	powercfg.exe
5052	powercfg.exe
1512	powercfg.exe
1856	powercfg.exe
376	powercfg.exe
4728	powercfg.exe
1740	powercfg.exe

Drops file in System32 directory 4 IoCs

Processes:

birdflower.exepowershell.exevzppfnnlsyit.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	birdflower.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	vzppfnnlsyit.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

vzppfnnlsyit.exe

description	pid	Process	procid_target
PID 4424 set thread context of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 set thread context of 4292	4424	vzppfnnlsyit.exe	148

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral6/memory/4292-96-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-99-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-101-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-98-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-100-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-97-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-95-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-107-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-106-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-105-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-104-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-103-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-108-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral6/memory/4292-109-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	Process
1636	sc.exe
2212	sc.exe
3436	sc.exe
916	sc.exe
4920	sc.exe
2168	sc.exe
1576	sc.exe
4132	sc.exe
696	sc.exe
1780	sc.exe
2508	sc.exe
2512	sc.exe
3576	sc.exe
2284	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

Processes:

powershell.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Roblox.exerevcon.exebirdflower.exepowershell.exevzppfnnlsyit.exepowershell.exesvchost.exe

pid	Process
3572	Roblox.exe
548	revcon.exe
548	revcon.exe
3168	birdflower.exe
3024	powershell.exe
3024	powershell.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
3168	birdflower.exe
4424	vzppfnnlsyit.exe
3188	powershell.exe
3188	powershell.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4424	vzppfnnlsyit.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe
4292	svchost.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

Processes:

Roblox.exerevcon.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exe

description	pid	Process
Token: SeDebugPrivilege	3572	Roblox.exe
Token: SeDebugPrivilege	548	revcon.exe
Token: SeImpersonatePrivilege	548	revcon.exe
Token: SeIncreaseQuotaPrivilege	3572	Roblox.exe
Token: SeSecurityPrivilege	3572	Roblox.exe
Token: SeTakeOwnershipPrivilege	3572	Roblox.exe
Token: SeLoadDriverPrivilege	3572	Roblox.exe
Token: SeSystemProfilePrivilege	3572	Roblox.exe
Token: SeSystemtimePrivilege	3572	Roblox.exe
Token: SeProfSingleProcessPrivilege	3572	Roblox.exe
Token: SeIncBasePriorityPrivilege	3572	Roblox.exe
Token: SeCreatePagefilePrivilege	3572	Roblox.exe
Token: SeBackupPrivilege	3572	Roblox.exe
Token: SeRestorePrivilege	3572	Roblox.exe
Token: SeShutdownPrivilege	3572	Roblox.exe
Token: SeDebugPrivilege	3572	Roblox.exe
Token: SeSystemEnvironmentPrivilege	3572	Roblox.exe
Token: SeRemoteShutdownPrivilege	3572	Roblox.exe
Token: SeUndockPrivilege	3572	Roblox.exe
Token: SeManageVolumePrivilege	3572	Roblox.exe
Token: 33	3572	Roblox.exe
Token: 34	3572	Roblox.exe
Token: 35	3572	Roblox.exe
Token: 36	3572	Roblox.exe
Token: SeDebugPrivilege	3024	powershell.exe
Token: SeShutdownPrivilege	672	powercfg.exe
Token: SeCreatePagefilePrivilege	672	powercfg.exe
Token: SeShutdownPrivilege	1856	powercfg.exe
Token: SeCreatePagefilePrivilege	1856	powercfg.exe
Token: SeShutdownPrivilege	1512	powercfg.exe
Token: SeCreatePagefilePrivilege	1512	powercfg.exe
Token: SeShutdownPrivilege	5052	powercfg.exe
Token: SeCreatePagefilePrivilege	5052	powercfg.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeShutdownPrivilege	376	powercfg.exe
Token: SeCreatePagefilePrivilege	376	powercfg.exe
Token: SeShutdownPrivilege	4728	powercfg.exe
Token: SeCreatePagefilePrivilege	4728	powercfg.exe
Token: SeShutdownPrivilege	1740	powercfg.exe
Token: SeCreatePagefilePrivilege	1740	powercfg.exe
Token: SeShutdownPrivilege	4596	powercfg.exe
Token: SeCreatePagefilePrivilege	4596	powercfg.exe
Token: SeLockMemoryPrivilege	4292	svchost.exe

Suspicious use of WriteProcessMemory 22 IoCs

Processes:

Roblox.execmd.execmd.exevzppfnnlsyit.exe

description	pid	Process	procid_target
PID 3572 wrote to memory of 3168	3572	Roblox.exe	88
PID 3572 wrote to memory of 3168	3572	Roblox.exe	88
PID 3572 wrote to memory of 548	3572	Roblox.exe	89
PID 3572 wrote to memory of 548	3572	Roblox.exe	89
PID 1056 wrote to memory of 3812	1056	cmd.exe	98
PID 1056 wrote to memory of 3812	1056	cmd.exe	98
PID 4088 wrote to memory of 4540	4088	cmd.exe	130
PID 4088 wrote to memory of 4540	4088	cmd.exe	130
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 3600	4424	vzppfnnlsyit.exe	143
PID 4424 wrote to memory of 4292	4424	vzppfnnlsyit.exe	148
PID 4424 wrote to memory of 4292	4424	vzppfnnlsyit.exe	148
PID 4424 wrote to memory of 4292	4424	vzppfnnlsyit.exe	148
PID 4424 wrote to memory of 4292	4424	vzppfnnlsyit.exe	148
PID 4424 wrote to memory of 4292	4424	vzppfnnlsyit.exe	148

outlook_office_path 1 IoCs

Processes:

revcon.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe

outlook_win_path 1 IoCs

Processes:

revcon.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	revcon.exe

C:\Users\Admin\AppData\Local\Temp\Roblox.exe
"C:\Users\Admin\AppData\Local\Temp\Roblox.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Users\Admin\AppData\Local\Temp\birdflower.exe
  "C:\Users\Admin\AppData\Local\Temp\birdflower.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3812
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1636
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2168
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1576
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1780
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:3576
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:672
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "LBFXRZGB"
    3⤵
    - Launches sc.exe
    PID:2284
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "LBFXRZGB" binpath= "C:\ProgramData\spvpfblnegdb\vzppfnnlsyit.exe" start= "auto"
    3⤵
    - Launches sc.exe
    PID:4132
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:2212
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "LBFXRZGB"
    3⤵
    - Launches sc.exe
    PID:3436
- C:\Users\Admin\AppData\Local\Temp\revcon.exe
  "C:\Users\Admin\AppData\Local\Temp\revcon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - outlook_office_path
  - outlook_win_path
  PID:548

C:\ProgramData\spvpfblnegdb\vzppfnnlsyit.exe
C:\ProgramData\spvpfblnegdb\vzppfnnlsyit.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4088
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4540
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:916
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2508
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2512
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:696
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:376
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4728
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4596
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3600
- C:\Windows\system32\svchost.exe
  svchost.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
fc3efe479324410856822cfc06454fb1

SHA1
684ade4167a5bb9d788d8b50fffaea72bf5b2b32

SHA256
956cb9889287a1bfd31f462a9ed76f67c3be7310cff4bf3f148968069f82ea0b

SHA512
c06a323aa7691641ddb51fe245c4dc4495b500a02759bb87c1f8e685d6e71854aa26f926294512c434c5d171372190d8b6d3a60f866d05c6b3c0d6f75dc439a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cnq2omob.xrd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\birdflower.exe

Filesize
5.0MB

MD5
769ea3d0e0cf22eaa7526a89c0f438cf

SHA1
5221042ad60744e2bdcf8319ff00bdbfc253eb59

SHA256
b369c94a835882a2267ff0a7a4ebb9a91621c3f134f63010d491121a7827b448

SHA512
d50130430911f16f4d2f7e4d3552f51ceb74601eda13cfbc374c9327e11d7865bdfc49803b54cf7b595b89996db28d3173d7a22993e968fd9a1a080c6b434c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\revcon.exe

Filesize
3.2MB

MD5
1f453ea0b228aaa80fc1b49de8209816

SHA1
62299a245f28ec9cf2a902b79b2af4aa76ca3ef5

SHA256
576f4f144c08fdbfbb44e7d679d26ab8b1526b58a781625deb095a4ba9f2105f

SHA512
fdbb42caef70e8ec84e0ede91e86ef209fd413c2f01eacba72bd128433a27d9234fbee940f87f1d3726cb4e6a0a0737f99a835787ebf44e2b66d75c6f34c6c94

Download Submit
memory/548-110-0x000001EFF4E30000-0x000001EFF4F6E000-memory.dmp

Filesize
1.2MB

Download
memory/548-41-0x000001EFF4E30000-0x000001EFF4F6E000-memory.dmp

Filesize
1.2MB

Download
memory/548-33-0x000001EFF4E30000-0x000001EFF4F6E000-memory.dmp

Filesize
1.2MB

Download
memory/548-32-0x00007FFBC7150000-0x00007FFBC7345000-memory.dmp

Filesize
2.0MB

Download
memory/3188-83-0x000001E574A20000-0x000001E574A26000-memory.dmp

Filesize
24KB

Download
memory/3188-82-0x000001E5749F0000-0x000001E5749F8000-memory.dmp

Filesize
32KB

Download
memory/3188-84-0x000001E574A30000-0x000001E574A3A000-memory.dmp

Filesize
40KB

Download
memory/3188-81-0x000001E574A40000-0x000001E574A5A000-memory.dmp

Filesize
104KB

Download
memory/3188-80-0x000001E5749E0000-0x000001E5749EA000-memory.dmp

Filesize
40KB

Download
memory/3188-79-0x000001E574A00000-0x000001E574A1C000-memory.dmp

Filesize
112KB

Download
memory/3188-78-0x000001E574890000-0x000001E57489A000-memory.dmp

Filesize
40KB

Download
memory/3188-76-0x000001E5747B0000-0x000001E5747CC000-memory.dmp

Filesize
112KB

Download
memory/3188-77-0x000001E5747D0000-0x000001E574885000-memory.dmp

Filesize
724KB

Download
memory/3572-2-0x00007FFBA8910000-0x00007FFBA93D1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-3-0x00007FFBA8913000-0x00007FFBA8915000-memory.dmp

Filesize
8KB

Download
memory/3572-40-0x00007FFBA8910000-0x00007FFBA93D1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-4-0x00007FFBA8910000-0x00007FFBA93D1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-15-0x00000284D96B0000-0x00000284D96D2000-memory.dmp

Filesize
136KB

Download
memory/3572-0-0x00007FFBA8913000-0x00007FFBA8915000-memory.dmp

Filesize
8KB

Download
memory/3572-5-0x00007FFBA8910000-0x00007FFBA93D1000-memory.dmp

Filesize
10.8MB

Download
memory/3572-1-0x0000028500000000-0x0000028501000000-memory.dmp

Filesize
16.0MB

Download
memory/3600-89-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3600-91-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3600-87-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3600-88-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3600-94-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/3600-90-0x0000000140000000-0x000000014000E000-memory.dmp

Filesize
56KB

Download
memory/4292-100-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-107-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-95-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-96-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-98-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-102-0x000001E15CD40000-0x000001E15CD60000-memory.dmp

Filesize
128KB

Download
memory/4292-101-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-97-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-106-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-105-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-104-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-103-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-108-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-109-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download
memory/4292-99-0x0000000140000000-0x0000000140848000-memory.dmp

Filesize
8.3MB

Download