Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
FieroHack.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
FieroHack.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
#/Sirus.exe
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
#/Sirus.exe
Resource
win10v2004-20240508-en
General
-
Target
FieroHack.exe
-
Size
6.3MB
-
MD5
b88f61a7938ef8af011259c59efc3d3d
-
SHA1
ba6f4356993959799fbd88bb350558045c363a85
-
SHA256
640397d3d855cbb8e3400f7564294bae51d591f7adb0f7856b7acfeb47f4e3d2
-
SHA512
ba7a3564327f2ec4e0c34710205bdb297b8c4a29f020f973462897d52f4d99fefbb74c1f511195d2ac3bae0e44a8dc749cdf6d043ff5fba9939cdd73c59e7d40
-
SSDEEP
98304:0rLVoBkwXnc+AdMIm8r3ctMmKCOQhMCTgeZ1lcvd6:uhIkwt+x31/CICj1lg6
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/476-25-0x0000000000FD0000-0x000000000101A000-memory.dmp family_redline -
XMRig Miner payload 9 IoCs
Processes:
resource yara_rule behavioral2/memory/524-112-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-111-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-119-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-123-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-122-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-121-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-120-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-126-0x0000000140000000-0x0000000140848000-memory.dmp xmrig behavioral2/memory/524-127-0x0000000140000000-0x0000000140848000-memory.dmp xmrig -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2988 powershell.exe 4344 powershell.exe -
Creates new service(s) 2 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
WeMod.exeSirus.exeleirdnhqqedj.exepid process 1536 WeMod.exe 476 Sirus.exe 4428 leirdnhqqedj.exe -
Processes:
resource yara_rule behavioral2/memory/524-106-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-112-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-111-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-110-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-109-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-108-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-107-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-119-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-123-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-122-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-121-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-120-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-126-0x0000000140000000-0x0000000140848000-memory.dmp upx behavioral2/memory/524-127-0x0000000140000000-0x0000000140848000-memory.dmp upx -
Power Settings 1 TTPs 8 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Processes:
powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepid process 4620 powercfg.exe 3684 powercfg.exe 4612 powercfg.exe 1684 powercfg.exe 2656 powercfg.exe 2100 powercfg.exe 3040 powercfg.exe 3220 powercfg.exe -
Drops file in System32 directory 6 IoCs
Processes:
leirdnhqqedj.exepowershell.exeWeMod.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439}\4428.obs leirdnhqqedj.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\MRT.exe leirdnhqqedj.exe File opened for modification C:\Windows\system32\MRT.exe WeMod.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\Obsidium\{3D20819C-5D02B5C8-D5AE7FCB-C4F5C439} leirdnhqqedj.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
WeMod.exeleirdnhqqedj.exepid process 1536 WeMod.exe 4428 leirdnhqqedj.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
leirdnhqqedj.exedescription pid process target process PID 4428 set thread context of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 set thread context of 524 4428 leirdnhqqedj.exe explorer.exe -
Launches sc.exe 14 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3216 sc.exe 4580 sc.exe 4748 sc.exe 3460 sc.exe 3700 sc.exe 4032 sc.exe 4388 sc.exe 2776 sc.exe 1112 sc.exe 1876 sc.exe 2884 sc.exe 3372 sc.exe 1236 sc.exe 4560 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 46 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
WeMod.exeSirus.exepowershell.exepid process 1536 WeMod.exe 1536 WeMod.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 1536 WeMod.exe 4344 powershell.exe 4344 powershell.exe 4344 powershell.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 1536 WeMod.exe 1536 WeMod.exe 1536 WeMod.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe 476 Sirus.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Sirus.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exeexplorer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 476 Sirus.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeDebugPrivilege 4344 powershell.exe Token: SeShutdownPrivilege 4612 powercfg.exe Token: SeCreatePagefilePrivilege 4612 powercfg.exe Token: SeShutdownPrivilege 2656 powercfg.exe Token: SeCreatePagefilePrivilege 2656 powercfg.exe Token: SeShutdownPrivilege 3684 powercfg.exe Token: SeCreatePagefilePrivilege 3684 powercfg.exe Token: SeShutdownPrivilege 1684 powercfg.exe Token: SeCreatePagefilePrivilege 1684 powercfg.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeLockMemoryPrivilege 524 explorer.exe Token: SeShutdownPrivilege 3220 powercfg.exe Token: SeCreatePagefilePrivilege 3220 powercfg.exe Token: SeShutdownPrivilege 2100 powercfg.exe Token: SeCreatePagefilePrivilege 2100 powercfg.exe Token: SeShutdownPrivilege 3040 powercfg.exe Token: SeCreatePagefilePrivilege 3040 powercfg.exe Token: SeShutdownPrivilege 4620 powercfg.exe Token: SeCreatePagefilePrivilege 4620 powercfg.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeBackupPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe Token: SeSecurityPrivilege 476 Sirus.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
FieroHack.execmd.execmd.execmd.exeleirdnhqqedj.exedescription pid process target process PID 2944 wrote to memory of 1536 2944 FieroHack.exe WeMod.exe PID 2944 wrote to memory of 1536 2944 FieroHack.exe WeMod.exe PID 2944 wrote to memory of 476 2944 FieroHack.exe Sirus.exe PID 2944 wrote to memory of 476 2944 FieroHack.exe Sirus.exe PID 2944 wrote to memory of 476 2944 FieroHack.exe Sirus.exe PID 4940 wrote to memory of 4156 4940 cmd.exe wusa.exe PID 4940 wrote to memory of 4156 4940 cmd.exe wusa.exe PID 4552 wrote to memory of 1368 4552 cmd.exe choice.exe PID 4552 wrote to memory of 1368 4552 cmd.exe choice.exe PID 3064 wrote to memory of 2616 3064 cmd.exe wusa.exe PID 3064 wrote to memory of 2616 3064 cmd.exe wusa.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 2068 4428 leirdnhqqedj.exe conhost.exe PID 4428 wrote to memory of 524 4428 leirdnhqqedj.exe explorer.exe PID 4428 wrote to memory of 524 4428 leirdnhqqedj.exe explorer.exe PID 4428 wrote to memory of 524 4428 leirdnhqqedj.exe explorer.exe PID 4428 wrote to memory of 524 4428 leirdnhqqedj.exe explorer.exe PID 4428 wrote to memory of 524 4428 leirdnhqqedj.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FieroHack.exe"C:\Users\Admin\AppData\Local\Temp\FieroHack.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WeMod.exeC:\Users\Admin\AppData\Roaming\WeMod.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "BFFESVJT"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "BFFESVJT" binpath= "C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe" start= "auto"3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "BFFESVJT"3⤵
- Launches sc.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Roaming\WeMod.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 34⤵
-
C:\Users\Admin\AppData\Roaming\Sirus.exeC:\Users\Admin\AppData\Roaming\Sirus.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4436,i,17325488789339133686,9539570259395798500,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:81⤵
-
C:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exeC:\ProgramData\wdcnrrcmzwhi\leirdnhqqedj.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop UsoSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop WaaSMedicSvc2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop wuauserv2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop bits2⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop dosvc2⤵
- Launches sc.exe
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 02⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r3f52jgc.uu5.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/476-31-0x0000000008FF0000-0x00000000090FA000-memory.dmpFilesize
1.0MB
-
memory/476-124-0x00000000745BE000-0x00000000745BF000-memory.dmpFilesize
4KB
-
memory/476-125-0x00000000745B0000-0x0000000074D60000-memory.dmpFilesize
7.7MB
-
memory/476-34-0x0000000009100000-0x000000000914C000-memory.dmpFilesize
304KB
-
memory/476-33-0x0000000008F90000-0x0000000008FCC000-memory.dmpFilesize
240KB
-
memory/476-25-0x0000000000FD0000-0x000000000101A000-memory.dmpFilesize
296KB
-
memory/476-32-0x0000000008F30000-0x0000000008F42000-memory.dmpFilesize
72KB
-
memory/476-30-0x00000000094A0000-0x0000000009AB8000-memory.dmpFilesize
6.1MB
-
memory/476-29-0x0000000005E60000-0x0000000005E6A000-memory.dmpFilesize
40KB
-
memory/476-28-0x0000000005BA0000-0x0000000005C32000-memory.dmpFilesize
584KB
-
memory/476-24-0x00000000745BE000-0x00000000745BF000-memory.dmpFilesize
4KB
-
memory/476-27-0x00000000745B0000-0x0000000074D60000-memory.dmpFilesize
7.7MB
-
memory/476-26-0x00000000060B0000-0x0000000006654000-memory.dmpFilesize
5.6MB
-
memory/524-113-0x0000000001630000-0x0000000001650000-memory.dmpFilesize
128KB
-
memory/524-106-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-127-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-126-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-120-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-121-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-122-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-123-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-119-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-107-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-108-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-109-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-110-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-111-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/524-112-0x0000000140000000-0x0000000140848000-memory.dmpFilesize
8.3MB
-
memory/1536-54-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-15-0x000001E39FCC0000-0x000001E39FCC1000-memory.dmpFilesize
4KB
-
memory/1536-22-0x00007FF81B230000-0x00007FF81B4F9000-memory.dmpFilesize
2.8MB
-
memory/1536-20-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-5-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-10-0x000001E39FC50000-0x000001E39FC97000-memory.dmpFilesize
284KB
-
memory/1536-21-0x00007FF81DA10000-0x00007FF81DC05000-memory.dmpFilesize
2.0MB
-
memory/1536-14-0x00007FF81D790000-0x00007FF81D82E000-memory.dmpFilesize
632KB
-
memory/1536-55-0x00007FF67CD21000-0x00007FF67CFD0000-memory.dmpFilesize
2.7MB
-
memory/1536-6-0x00007FF67CD21000-0x00007FF67CFD0000-memory.dmpFilesize
2.7MB
-
memory/1536-7-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-8-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-9-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-53-0x00007FF81D790000-0x00007FF81D82E000-memory.dmpFilesize
632KB
-
memory/1536-52-0x00007FF81B230000-0x00007FF81B4F9000-memory.dmpFilesize
2.8MB
-
memory/1536-4-0x00007FF67CA90000-0x00007FF67CFD0000-memory.dmpFilesize
5.2MB
-
memory/1536-51-0x00007FF81DA10000-0x00007FF81DC05000-memory.dmpFilesize
2.0MB
-
memory/1536-23-0x00007FF81D790000-0x00007FF81D82E000-memory.dmpFilesize
632KB
-
memory/2068-102-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2068-101-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2068-100-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2068-99-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2068-98-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2068-105-0x0000000140000000-0x000000014000E000-memory.dmpFilesize
56KB
-
memory/2988-94-0x00000197F0980000-0x00000197F0986000-memory.dmpFilesize
24KB
-
memory/2988-93-0x00000197F0950000-0x00000197F0958000-memory.dmpFilesize
32KB
-
memory/2988-92-0x00000197F09A0000-0x00000197F09BA000-memory.dmpFilesize
104KB
-
memory/2988-91-0x00000197F0940000-0x00000197F094A000-memory.dmpFilesize
40KB
-
memory/2988-90-0x00000197F0960000-0x00000197F097C000-memory.dmpFilesize
112KB
-
memory/2988-95-0x00000197F0990000-0x00000197F099A000-memory.dmpFilesize
40KB
-
memory/2988-89-0x00000197F07F0000-0x00000197F07FA000-memory.dmpFilesize
40KB
-
memory/2988-88-0x00000197F0730000-0x00000197F07E5000-memory.dmpFilesize
724KB
-
memory/2988-87-0x00000197F0710000-0x00000197F072C000-memory.dmpFilesize
112KB
-
memory/4344-42-0x000001E179630000-0x000001E179652000-memory.dmpFilesize
136KB
-
memory/4428-67-0x00007FF81D790000-0x00007FF81D82E000-memory.dmpFilesize
632KB
-
memory/4428-61-0x00007FF72A8C0000-0x00007FF72AE00000-memory.dmpFilesize
5.2MB
-
memory/4428-58-0x00007FF72A8C0000-0x00007FF72AE00000-memory.dmpFilesize
5.2MB
-
memory/4428-118-0x00007FF72A8C0000-0x00007FF72AE00000-memory.dmpFilesize
5.2MB
-
memory/4428-116-0x00007FF81B230000-0x00007FF81B4F9000-memory.dmpFilesize
2.8MB
-
memory/4428-115-0x00007FF81DA10000-0x00007FF81DC05000-memory.dmpFilesize
2.0MB
-
memory/4428-117-0x00007FF81D790000-0x00007FF81D82E000-memory.dmpFilesize
632KB
-
memory/4428-62-0x000001E889B80000-0x000001E889BC7000-memory.dmpFilesize
284KB
-
memory/4428-63-0x00007FF72A8C0000-0x00007FF72AE00000-memory.dmpFilesize
5.2MB
-
memory/4428-60-0x00007FF72A8C0000-0x00007FF72AE00000-memory.dmpFilesize
5.2MB
-
memory/4428-59-0x00007FF72A8C0000-0x00007FF72AE00000-memory.dmpFilesize
5.2MB