Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/12/2024, 06:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe
Resource
win7-20240903-en
General
-
Target
2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe
-
Size
4.6MB
-
MD5
ef95c78351b1b8efaf2f5483ef7052fd
-
SHA1
1353ec5c2936ccb1c73a0004f54a35231d6af670
-
SHA256
d6e6dbcb94ff187fa5275d966b8dec8f67d0e05f2683de719bbd81ddd4e4f7e5
-
SHA512
277604b19a70eb6c468f36ea679adcf739af1b7ee3c14b85e131e49eb50567d373c322c4204ba935e8140ca696126bcf514934072dcc73e89b1474e1bcd3fcbe
-
SSDEEP
98304:ZNudyith6XvmDrF45j9NEsCJAvMZCr72ikrweJSDTEiMLHwvDxl+Ji:Z2fth6XvmDrFQh6sCabyrweJ5iEHcDe8
Malware Config
Extracted
phorphiex
http://185.215.113.66/
http://91.202.233.141/
0xCa90599132C4D88907Bd8E046540284aa468a035
TRuGGXNDM1cavQ1AqMQHG8yfxP4QWVSMN6
qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
XryzFMFVpDUvU7famUGf214EXD3xNUSmQf
rsXCXBf9SagxV8JfC12d8Bybk84oPdMNN9
AULzfBuUAPfCGAXoG5Vq14aP9s6fx3AH4Z
LdgchXq1sKbAaAJ1EXAPSRBzLb8jnTZstT
MP8GEm8QpYgQYaMo8oM5NQhRBgDGiLZW5Q
4AtjkCVKbtEC3UEN77SQHuH9i1XkzNiRi5VCbA2XGsJh46nJSXfGQn4GjLuupCqmC57Lo7LvKmFUyRfhtJSvKvuw3h9ReKK
15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC
1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK
ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp
3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc
3ESHude8zUHksQg1h6hHmzY79BS36L91Yn
DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA
t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh
stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj
bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2
bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr
bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd
GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3
bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r
-
mutex
753f85d83d
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Extracted
phorphiex
http://185.215.113.84
Signatures
-
Phorphiex family
-
Phorphiex payload 1 IoCs
resource yara_rule behavioral1/files/0x0005000000019d62-230.dat family_phorphiex -
Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
description pid Process procid_target PID 2884 created 1208 2884 1001127032.exe 21 PID 2884 created 1208 2884 1001127032.exe 21 PID 108 created 1208 108 winupsecvmgr.exe 21 PID 108 created 1208 108 winupsecvmgr.exe 21 PID 108 created 1208 108 winupsecvmgr.exe 21 -
Xmrig family
-
XMRig Miner payload 11 IoCs
resource yara_rule behavioral1/memory/108-309-0x000000013FCB0000-0x0000000140247000-memory.dmp xmrig behavioral1/memory/672-312-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-316-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-318-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-320-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-322-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-324-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-326-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-329-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-331-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig behavioral1/memory/672-333-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
pid Process 1684 B4ED.exe 1832 2822715102.exe 636 sysnldcvmr.exe 1912 2269016211.exe 2824 167134229.exe 2884 1001127032.exe 2576 1073625014.exe 108 winupsecvmgr.exe 2420 2993614811.exe -
Loads dropped DLL 9 IoCs
pid Process 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 1684 B4ED.exe 1684 B4ED.exe 636 sysnldcvmr.exe 636 sysnldcvmr.exe 2824 167134229.exe 636 sysnldcvmr.exe 1236 taskeng.exe 636 sysnldcvmr.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe" 2822715102.exe -
Checks for any installed AV software in registry 1 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\AVAST Software\Avast 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast\Version 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key opened \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Avira 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Avira 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
pid Process 1676 powershell.exe 1496 powershell.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 108 set thread context of 2224 108 winupsecvmgr.exe 58 PID 108 set thread context of 672 108 winupsecvmgr.exe 59 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\sysnldcvmr.exe 2822715102.exe File opened for modification C:\Windows\sysnldcvmr.exe 2822715102.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language B4ED.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2822715102.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sysnldcvmr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 167134229.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2993614811.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1936 schtasks.exe 2004 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 1912 2269016211.exe 2884 1001127032.exe 2884 1001127032.exe 1676 powershell.exe 2884 1001127032.exe 2884 1001127032.exe 108 winupsecvmgr.exe 108 winupsecvmgr.exe 1496 powershell.exe 108 winupsecvmgr.exe 108 winupsecvmgr.exe 108 winupsecvmgr.exe 108 winupsecvmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1912 2269016211.exe Token: SeDebugPrivilege 1676 powershell.exe Token: SeDebugPrivilege 1496 powershell.exe Token: SeLockMemoryPrivilege 672 dwm.exe Token: SeLockMemoryPrivilege 672 dwm.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe 672 dwm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe -
Suspicious use of WriteProcessMemory 55 IoCs
description pid Process procid_target PID 2104 wrote to memory of 1684 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 31 PID 2104 wrote to memory of 1684 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 31 PID 2104 wrote to memory of 1684 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 31 PID 2104 wrote to memory of 1684 2104 2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe 31 PID 1684 wrote to memory of 1832 1684 B4ED.exe 33 PID 1684 wrote to memory of 1832 1684 B4ED.exe 33 PID 1684 wrote to memory of 1832 1684 B4ED.exe 33 PID 1684 wrote to memory of 1832 1684 B4ED.exe 33 PID 1832 wrote to memory of 636 1832 2822715102.exe 34 PID 1832 wrote to memory of 636 1832 2822715102.exe 34 PID 1832 wrote to memory of 636 1832 2822715102.exe 34 PID 1832 wrote to memory of 636 1832 2822715102.exe 34 PID 636 wrote to memory of 1912 636 sysnldcvmr.exe 36 PID 636 wrote to memory of 1912 636 sysnldcvmr.exe 36 PID 636 wrote to memory of 1912 636 sysnldcvmr.exe 36 PID 636 wrote to memory of 1912 636 sysnldcvmr.exe 36 PID 1912 wrote to memory of 2356 1912 2269016211.exe 37 PID 1912 wrote to memory of 2356 1912 2269016211.exe 37 PID 1912 wrote to memory of 2356 1912 2269016211.exe 37 PID 1912 wrote to memory of 1680 1912 2269016211.exe 39 PID 1912 wrote to memory of 1680 1912 2269016211.exe 39 PID 1912 wrote to memory of 1680 1912 2269016211.exe 39 PID 2356 wrote to memory of 2984 2356 cmd.exe 41 PID 2356 wrote to memory of 2984 2356 cmd.exe 41 PID 2356 wrote to memory of 2984 2356 cmd.exe 41 PID 1680 wrote to memory of 2764 1680 cmd.exe 42 PID 1680 wrote to memory of 2764 1680 cmd.exe 42 PID 1680 wrote to memory of 2764 1680 cmd.exe 42 PID 636 wrote to memory of 2824 636 sysnldcvmr.exe 43 PID 636 wrote to memory of 2824 636 sysnldcvmr.exe 43 PID 636 wrote to memory of 2824 636 sysnldcvmr.exe 43 PID 636 wrote to memory of 2824 636 sysnldcvmr.exe 43 PID 2824 wrote to memory of 2884 2824 167134229.exe 45 PID 2824 wrote to memory of 2884 2824 167134229.exe 45 PID 2824 wrote to memory of 2884 2824 167134229.exe 45 PID 2824 wrote to memory of 2884 2824 167134229.exe 45 PID 636 wrote to memory of 2576 636 sysnldcvmr.exe 46 PID 636 wrote to memory of 2576 636 sysnldcvmr.exe 46 PID 636 wrote to memory of 2576 636 sysnldcvmr.exe 46 PID 636 wrote to memory of 2576 636 sysnldcvmr.exe 46 PID 1676 wrote to memory of 1936 1676 powershell.exe 49 PID 1676 wrote to memory of 1936 1676 powershell.exe 49 PID 1676 wrote to memory of 1936 1676 powershell.exe 49 PID 1236 wrote to memory of 108 1236 taskeng.exe 53 PID 1236 wrote to memory of 108 1236 taskeng.exe 53 PID 1236 wrote to memory of 108 1236 taskeng.exe 53 PID 636 wrote to memory of 2420 636 sysnldcvmr.exe 54 PID 636 wrote to memory of 2420 636 sysnldcvmr.exe 54 PID 636 wrote to memory of 2420 636 sysnldcvmr.exe 54 PID 636 wrote to memory of 2420 636 sysnldcvmr.exe 54 PID 1496 wrote to memory of 2004 1496 powershell.exe 57 PID 1496 wrote to memory of 2004 1496 powershell.exe 57 PID 1496 wrote to memory of 2004 1496 powershell.exe 57 PID 108 wrote to memory of 2224 108 winupsecvmgr.exe 58 PID 108 wrote to memory of 672 108 winupsecvmgr.exe 59 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-01_ef95c78351b1b8efaf2f5483ef7052fd_avoslocker_hijackloader_luca-stealer_revil.exe"2⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\B4ED.exe"C:\Users\Admin\AppData\Local\Temp\B4ED.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\2822715102.exeC:\Users\Admin\AppData\Local\Temp\2822715102.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Windows\sysnldcvmr.exeC:\Windows\sysnldcvmr.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\2269016211.exeC:\Users\Admin\AppData\Local\Temp\2269016211.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f7⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f8⤵PID:2984
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"7⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\system32\schtasks.exeschtasks /delete /f /tn "Windows Upgrade Manager"8⤵PID:2764
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\167134229.exeC:\Users\Admin\AppData\Local\Temp\167134229.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\1001127032.exeC:\Users\Admin\AppData\Local\Temp\1001127032.exe7⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2884
-
-
-
C:\Users\Admin\AppData\Local\Temp\1073625014.exeC:\Users\Admin\AppData\Local\Temp\1073625014.exe6⤵
- Executes dropped EXE
PID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\2993614811.exeC:\Users\Admin\AppData\Local\Temp\2993614811.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2420
-
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1936
-
-
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "Microsoft Windows Security"2⤵PID:2788
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn "Microsoft Windows Security" /tr "'C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe'"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2004
-
-
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:2224
-
-
C:\Windows\System32\dwm.exeC:\Windows\System32\dwm.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:672
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {E9FC9C37-4EFB-4CB4-9FAE-B6942DF850FF} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Users\Admin\Microsoft Windows Security\winupsecvmgr.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:108
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD513b26b2c7048a92d6a843c1302618fad
SHA189c2dfc01ac12ef2704c7669844ec69f1700c1ca
SHA2561753ad35ece25ab9a19048c70062e9170f495e313d7355ebbba59c38f5d90256
SHA512d6aff89b61c9945002a6798617ad304612460a607ef1cfbdcb32f8932ca648bcee1d5f2e0321bb4c58c1f4642b1e0ececc1eb82450fdec7dff69b5389f195455
-
Filesize
8KB
MD5cb8420e681f68db1bad5ed24e7b22114
SHA1416fc65d538d3622f5ca71c667a11df88a927c31
SHA2565850892f67f85991b31fc90f62c8b7791afeb3c08ae1877d857aa2b59471a2ea
SHA512baaabcc4ad5d409267a34ed7b20e4afb4d247974bfc581d39aae945e5bf8a673a1f8eacae2e6783480c8baaeb0a80d028274a202d456f13d0af956afa0110fdf
-
Filesize
10KB
MD508dafe3bb2654c06ead4bb33fb793df8
SHA1d1d93023f1085eed136c6d225d998abf2d5a5bf0
SHA256fc16c0bf09002c93723b8ab13595db5845a50a1b6a133237ac2d148b0bb41700
SHA5129cf2bd749a9ee6e093979bc0d3aacfba03ad6469c98ff3ef35ce5d1635a052e4068ac50431626f6ba8649361802f7fb2ffffb2b325e2795c54b7014180559c99
-
Filesize
256KB
MD50f722e725ac50271f9d6db477e8c0d17
SHA1d34259cfe05b2ba9c9e5256a3ce513d4bc5afbe8
SHA2567615a4bb88a5680cfead49c1774013ce48c4c7343cb82d7585f7935c705400b0
SHA5129a58e7d1537f28f19dc6e63b36d422748d851b68a8b3eedf69f531d502d9163e41f4d9cc9d782fd6fc70fab269f04dc9907422bd80f5dd265edcc0ae6bddc77a
-
Filesize
314KB
MD52dd0a1de870af34d48d43b7cad82b8d9
SHA1440f4f1fdf17a5c8b426ac6bd4535b8fe5258c7e
SHA256057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32
SHA51283df193ab984037b940876bf6371020b4bb13af74e988abb8ad6a30d48ab6cd9dc5c08937e58abab93278cc85c9d79c373688b2c51c035fdeffed639c933e8ff
-
Filesize
176KB
MD5b9077621ce786b55c176a61456bfc077
SHA15f164e1bc0b6573bac876e38ca1bb2e60ff0627e
SHA2566cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6
SHA512b1f2c599804a2d0ac51d3adfe7b2d0a21c5fa1e3d8d83d932f42d30bfd26aad5972d96555097a60f8fdc4d34ed24bad2876a89cf0b27b8cd01c72c0ba8f4d02a
-
Filesize
289B
MD566bbb224ad04dd05ab4f95d9e6b72dc3
SHA16ec8735586a5719b25718f76124b3aafb0d19e5f
SHA256dce4e993e188be3193b6a8464a7ea23c75e8fdfcd960f187cb7ed3f7f7eeb375
SHA5120f6ba86dd854d7fc19c0be192567d3e160f5b93e2f54ff7f69033d03e020a199421e8231d4892da0d4698025a980170bd5b71c475d6fa1008841f08076316e9e
-
Filesize
619B
MD5a33ef0e924ea81b15526e8c79585834f
SHA1bf378b474cb78adf9c5dd8357d6dd629d33d5742
SHA25627bb937b5d16967a469f0766feabf451f51d774bd3b38ef1c6c28765e96ce60e
SHA512d1044b457666732acc32796edc487a0481b9c60bd028faddbf0f3cc8766b7d7b34bc5a197ddebd01c5fa950a16f95b9157e9fe7aa3a80f5d3d16cc4f5adc4d0a
-
Filesize
30KB
MD59a0a4e3f381ffdeb893fb3ba74bf63c9
SHA1746201ef390ebfd8c9f5e7ac46d9d4716eb8d204
SHA2561e60860fa9a568a50ee835ad17b77dc31ce9e7bb9f6185c442a227c5298ef09d
SHA5120f6f04f040337fab978ce06218fee0a02a009eba6e7a585cd6c39fe46364c333df7962c8ab1a094e11ee67ef500e8f6f93c9fad71d2d5444b1d4798385cb9763
-
Filesize
202KB
MD5a4fdd77e182bd2fabe300a47b5617a35
SHA1e002b335c75b5edefcd251962f61f53a2ab8e0f2
SHA2568b59592d67eadc703af6cdd5ba8d077f9f9485d01fb6405555614335f89be99b
SHA512ddcccde1c129f8f71fb39685abc615c4202b8b3dfc12cedd7d9cca2f97b308fc14b64497826421fa9df3d1cf54bdae9c085051af0a8d393cd3d556a6578d4085
-
Filesize
89KB
MD5ea75b2a8f1b4241a872b1cbddbaed154
SHA118678dd78c1f5a3525127b442bc70375faf09c16
SHA2564a62927a380e201c4ee51321dcc1e6b1f7dfbf82049cf349df990629e01e9178
SHA512dc69cd4703dcba3c8f4a52058c44a34fa7c0b6096bed20f30ce3dab872461eb6dda9d0d381137b9cb022219ad92ca7f5f25d3964ed33d5f41e9fc05efa5330fd
-
Filesize
19KB
MD5a1d597ef7be818c9fa9daa8f18ebf125
SHA18108290387bfb433c6867d6f29b28f68b6f803c6
SHA256b451d4eb04fbf6ea5a92b2d6d1b911c66ef98b7a438fbc3de867c3e91ba86c7a
SHA5124b7f09b47d182ea45f8ef50dc77e24a9c4e036f15728c11409651d4513a16e8db06f99a8132a363dc0e6870563f1d419c6e8f692ef6d08eaf340401cccc11123
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5db2652c6a17478b92705c7a6022a454e
SHA1d2d7839d42279984eb1f3b0106a6279809c39129
SHA256b2e48285e619dda6e39e9933a09b3ca914b084667f204101d42fe019920bacc0
SHA512676fb7245b168d68f0cb79ec1f198cd948d1f010b02633c73cb193109c503d871f5c438281dab0648adb48bc3127411129423ac4545262b3a94eb052a760e8ab
-
Filesize
53KB
MD584897ca8c1aa06b33248956ac25ec20a
SHA1544d5d5652069b3c5e7e29a1ca3eea46b227bbfe
SHA256023ad16f761a35bd7934e392bcf2bbf702f525303b2964e97c3e50d2d5f3eda1
SHA512c17d0e364cf29055dece3e10896f0bbd0ebdb8d2b1c15fe68ddcd9951dd2d1545362f45ad21f26302f3da2eb2ec81340a027cbd4c75cc28491151ecabae65e95
-
Filesize
10KB
MD596509ab828867d81c1693b614b22f41d
SHA1c5f82005dbda43cedd86708cc5fc3635a781a67e
SHA256a9de2927b0ec45cf900508fec18531c04ee9fa8a5dfe2fc82c67d9458cf4b744
SHA512ff603117a06da8fb2386c1d2049a5896774e41f34d05951ecd4e7b5fc9da51a373e3fcf61af3577ff78490cf898471ce8e71eae848a12812fe98cd7e76e1a9ca
-
Filesize
79KB
MD50c883b1d66afce606d9830f48d69d74b
SHA1fe431fe73a4749722496f19b3b3ca0b629b50131
SHA256d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1
SHA512c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5
-
Filesize
61KB
MD577c5eb90118287f666886fc34210c176
SHA1d7a59bf4f014304e29df1868ef82fe782432120a
SHA25659a96d66d97e202829ea79a5e0bbf71981c05a13ab700b0120f7d99d33515080
SHA5125577d167ad4748ad7917ff3f792a0caa01ba40638bdf7143c1403d2efcad4019f8da49719ae0ad88febdc1ef64207fba7ca5bb96dc12c334571d30e2e8f22cf9