Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 01:05
Static task
static1
Behavioral task
behavioral1
Sample
301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe
Resource
win7-20240419-en
General
-
Target
301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe
-
Size
4.6MB
-
MD5
f3633e3e1bc67dd770d72c79d1e1f665
-
SHA1
47443903cfbcd8fefb314c1b29324b7909142634
-
SHA256
301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec
-
SHA512
f7211899a4dfa6979f3bd0d797e55e32e264212635f4569c7aee4cba63c3ca0fe2ec27b86d2e27b36f4b28b7ff50a0202116d0e44a0fbe684ef814e96d4e2a35
-
SSDEEP
98304:KrLVoBkwXnc+AdMIm8r3ctMmKCOQhMCTgeZ1lcvdq:IhIkwt+x31/CICj1lg
Malware Config
Extracted
lumma
https://composepayyersellew.shop/api
https://publicitycharetew.shop/api
https://computerexcudesp.shop/api
https://leafcalfconflcitw.shop/api
https://injurypiggyoewirog.shop/api
https://bargainnygroandjwk.shop/api
https://disappointcredisotw.shop/api
https://doughtdrillyksow.shop/api
https://facilitycoursedw.shop/api
Signatures
-
UPX dump on OEP (original entry point) 13 IoCs
Processes:
resource yara_rule behavioral2/memory/2004-102-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-118-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-116-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-115-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-114-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-117-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-106-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-104-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-107-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-105-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-103-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-119-0x0000000140000000-0x0000000140848000-memory.dmp UPX behavioral2/memory/2004-120-0x0000000140000000-0x0000000140848000-memory.dmp UPX -
XMRig Miner payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/2004-118-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-116-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-115-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-114-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-117-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-106-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-107-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-119-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/2004-120-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 1096 powershell.exe 4068 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
WeMod.exeSirus.exeleirdnhqqedj.exepid process 2372 WeMod.exe 1976 Sirus.exe 5048 leirdnhqqedj.exe -
Processes:
resource yara_rule behavioral2/memory/2004-101-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-102-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-118-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-116-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-115-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-114-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-117-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-106-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-104-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-107-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-105-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-103-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-119-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/2004-120-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepid process 5112 powercfg.exe 3996 powercfg.exe 4368 powercfg.exe 2276 powercfg.exe 3048 powercfg.exe 4528 powercfg.exe 4596 powercfg.exe 3464 powercfg.exe -
Drops file in System32 directory 6 IoCs
Processes:
leirdnhqqedj.exeWeMod.exepowershell.exedescription ioc process File opened for modification C:\Windows\system32\MRT.exe leirdnhqqedj.exe File opened for modification C:\Windows\system32\MRT.exe WeMod.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439} leirdnhqqedj.exe File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}\5048.obs leirdnhqqedj.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
WeMod.exeleirdnhqqedj.exepid process 2372 WeMod.exe 5048 leirdnhqqedj.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Sirus.exeleirdnhqqedj.exedescription pid process target process PID 1976 set thread context of 548 1976 Sirus.exe RegAsm.exe PID 5048 set thread context of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 set thread context of 2004 5048 leirdnhqqedj.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 4560 sc.exe 2864 sc.exe 896 sc.exe 4704 sc.exe 2844 sc.exe 4808 sc.exe 3300 sc.exe 1892 sc.exe 3752 sc.exe 4224 sc.exe 1512 sc.exe 4444 sc.exe 3600 sc.exe 5076 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2692 1976 WerFault.exe Sirus.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WeMod.exepowershell.exeleirdnhqqedj.exepowershell.exeexplorer.exepid process 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 1096 powershell.exe 1096 powershell.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 2372 WeMod.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 4068 powershell.exe 4068 powershell.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 5048 leirdnhqqedj.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe 2004 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1096 powershell.exe Token: SeShutdownPrivilege 2276 powercfg.exe Token: SeCreatePagefilePrivilege 2276 powercfg.exe Token: SeShutdownPrivilege 4368 powercfg.exe Token: SeCreatePagefilePrivilege 4368 powercfg.exe Token: SeShutdownPrivilege 3048 powercfg.exe Token: SeCreatePagefilePrivilege 3048 powercfg.exe Token: SeShutdownPrivilege 3996 powercfg.exe Token: SeCreatePagefilePrivilege 3996 powercfg.exe Token: SeDebugPrivilege 4068 powershell.exe Token: SeShutdownPrivilege 5112 powercfg.exe Token: SeCreatePagefilePrivilege 5112 powercfg.exe Token: SeShutdownPrivilege 4596 powercfg.exe Token: SeCreatePagefilePrivilege 4596 powercfg.exe Token: SeShutdownPrivilege 3464 powercfg.exe Token: SeCreatePagefilePrivilege 3464 powercfg.exe Token: SeShutdownPrivilege 4528 powercfg.exe Token: SeCreatePagefilePrivilege 4528 powercfg.exe Token: SeLockMemoryPrivilege 2004 explorer.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exeSirus.execmd.execmd.execmd.exeleirdnhqqedj.exedescription pid process target process PID 5068 wrote to memory of 2372 5068 301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe WeMod.exe PID 5068 wrote to memory of 2372 5068 301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe WeMod.exe PID 5068 wrote to memory of 1976 5068 301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe Sirus.exe PID 5068 wrote to memory of 1976 5068 301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe Sirus.exe PID 5068 wrote to memory of 1976 5068 301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe Sirus.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1976 wrote to memory of 548 1976 Sirus.exe RegAsm.exe PID 1888 wrote to memory of 4116 1888 cmd.exe wusa.exe PID 1888 wrote to memory of 4116 1888 cmd.exe wusa.exe PID 2404 wrote to memory of 3524 2404 cmd.exe choice.exe PID 2404 wrote to memory of 3524 2404 cmd.exe choice.exe PID 5068 wrote to memory of 2348 5068 cmd.exe wusa.exe PID 5068 wrote to memory of 2348 5068 cmd.exe wusa.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 4620 5048 leirdnhqqedj.exe conhost.exe PID 5048 wrote to memory of 2004 5048 leirdnhqqedj.exe explorer.exe PID 5048 wrote to memory of 2004 5048 leirdnhqqedj.exe explorer.exe PID 5048 wrote to memory of 2004 5048 leirdnhqqedj.exe explorer.exe PID 5048 wrote to memory of 2004 5048 leirdnhqqedj.exe explorer.exe PID 5048 wrote to memory of 2004 5048 leirdnhqqedj.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe"C:\Users\Admin\AppData\Local\Temp\301394de0a1858f4e7b20244ec2d938cce91c61e7c9e224b4fa00177b6bf9cec.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WeMod.exeC:\Users\Admin\AppData\Roaming\WeMod.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "BFFESVJT"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "BFFESVJT" binpath= "C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "BFFESVJT"3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Users\Admin\AppData\Roaming\Sirus.exeC:\Users\Admin\AppData\Roaming\Sirus.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 3123⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1976 -ip 19761⤵
-
C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exeC:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2m3bv4uh.mf2.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/548-20-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/548-28-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/548-24-0x0000000000400000-0x0000000000457000-memory.dmpFilesize
348KB
-
memory/1096-38-0x00000124EB3B0000-0x00000124EB3D2000-memory.dmpFilesize
136KB
-
memory/1976-27-0x00000000011F0000-0x00000000011F1000-memory.dmpFilesize
4KB
-
memory/2004-107-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-114-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-117-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-104-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-101-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-105-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-103-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-106-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-115-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-116-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-118-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-119-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-120-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2004-108-0x00000000004E0000-0x0000000000500000-memory.dmpFilesize
128KB
-
memory/2004-102-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/2372-22-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmpFilesize
2.0MB
-
memory/2372-50-0x00007FFBBC380000-0x00007FFBBC41E000-memory.dmpFilesize
632KB
-
memory/2372-49-0x00007FFBBB2A0000-0x00007FFBBB569000-memory.dmpFilesize
2.8MB
-
memory/2372-46-0x00007FF6BB0F1000-0x00007FF6BB3A0000-memory.dmpFilesize
2.7MB
-
memory/2372-41-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-4-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-6-0x00007FF6BB0F1000-0x00007FF6BB3A0000-memory.dmpFilesize
2.7MB
-
memory/2372-8-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-7-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-10-0x000001618C090000-0x000001618C0D7000-memory.dmpFilesize
284KB
-
memory/2372-9-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-15-0x000001618C100000-0x000001618C101000-memory.dmpFilesize
4KB
-
memory/2372-48-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmpFilesize
2.0MB
-
memory/2372-14-0x00007FFBBC380000-0x00007FFBBC41E000-memory.dmpFilesize
632KB
-
memory/2372-26-0x00007FFBBC380000-0x00007FFBBC41E000-memory.dmpFilesize
632KB
-
memory/2372-25-0x00007FFBBB2A0000-0x00007FFBBB569000-memory.dmpFilesize
2.8MB
-
memory/2372-5-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-21-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/2372-44-0x00007FFBBC380000-0x00007FFBBC41E000-memory.dmpFilesize
632KB
-
memory/2372-47-0x00007FF6BAE60000-0x00007FF6BB3A0000-memory.dmpFilesize
5.2MB
-
memory/4068-82-0x000001FB32E40000-0x000001FB32E5C000-memory.dmpFilesize
112KB
-
memory/4068-85-0x000001FB33080000-0x000001FB3309C000-memory.dmpFilesize
112KB
-
memory/4068-83-0x000001FB32E60000-0x000001FB32F15000-memory.dmpFilesize
724KB
-
memory/4068-84-0x000001FB30A70000-0x000001FB30A7A000-memory.dmpFilesize
40KB
-
memory/4068-86-0x000001FB33060000-0x000001FB3306A000-memory.dmpFilesize
40KB
-
memory/4068-87-0x000001FB330C0000-0x000001FB330DA000-memory.dmpFilesize
104KB
-
memory/4068-90-0x000001FB330B0000-0x000001FB330BA000-memory.dmpFilesize
40KB
-
memory/4068-89-0x000001FB330A0000-0x000001FB330A6000-memory.dmpFilesize
24KB
-
memory/4068-88-0x000001FB33070000-0x000001FB33078000-memory.dmpFilesize
32KB
-
memory/4620-96-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4620-100-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4620-93-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4620-94-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4620-97-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/4620-95-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/5048-110-0x00007FFBBDA10000-0x00007FFBBDC05000-memory.dmpFilesize
2.0MB
-
memory/5048-111-0x00007FFBBB2A0000-0x00007FFBBB569000-memory.dmpFilesize
2.8MB
-
memory/5048-113-0x00007FF6B3C00000-0x00007FF6B4140000-memory.dmpFilesize
5.2MB
-
memory/5048-56-0x00007FF6B3C00000-0x00007FF6B4140000-memory.dmpFilesize
5.2MB
-
memory/5048-62-0x00007FFBBC380000-0x00007FFBBC41E000-memory.dmpFilesize
632KB
-
memory/5048-54-0x00007FF6B3C00000-0x00007FF6B4140000-memory.dmpFilesize
5.2MB
-
memory/5048-55-0x00007FF6B3C00000-0x00007FF6B4140000-memory.dmpFilesize
5.2MB
-
memory/5048-57-0x0000015D5F360000-0x0000015D5F3A7000-memory.dmpFilesize
284KB
-
memory/5048-112-0x00007FFBBC380000-0x00007FFBBC41E000-memory.dmpFilesize
632KB
-
memory/5048-58-0x00007FF6B3C00000-0x00007FF6B4140000-memory.dmpFilesize
5.2MB
-
memory/5048-53-0x00007FF6B3C00000-0x00007FF6B4140000-memory.dmpFilesize
5.2MB