f6f6c2feba4ee906ce5865601a8b36bda692ffb70e49751552e9b88b53b971d0

Analysis

max time kernel
132s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae17ef325a1db4139e9090b07f996e99.exe
Size 1.7MB
Sample240107-yc6chacgem
SHA256 f6f6c2feba4ee906ce5865601a8b36bda692ffb70e49751552e9b88b53b971d0
MD5 ae17ef325a1db4139e9090b07f996e99
SHA1 760786ce6036a8f3bf954de53ed1a0a07cba23c9
SHA512 7d2ead21688cbfc5b86265fd6c83d37f04007f17fbf7ec9c00e050b93e1c878af34f2994704a0a68692ebcfd4fda4bd3a29b9ac28bbeb6b9a020dd903cb43d6c
SSDEEP 12288:UZWtI6RkqOB0fOjOB0Ru9OwOB0fOjOB0RudOwOB0fOjOB0Ru9OwOB0fOjOB0RuH+:UuhaqOZO9OZOtOZO9OZOi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	regedit.exe

Blocks application from running via registry modification 17 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "RfwMain.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "RavStub.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "Rav.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "Rfwsrv.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "RavMon.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "RavService.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "KAV32.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "CCenter.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "KPFW32X.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "KAVPFW.EXE"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "KAVStart.EXE"	regedit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	regedit.exe
Key created	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "avp.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "RavMoD.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "rfwcfg.exe"	regedit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "KPFW32.EXE"	regedit.exe

Sets file execution options in registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.EXE\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RfwMain.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rfwsrv.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMoD.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "D:\\RECYCLER\\????8.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
4764	KavUpda.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\Autorun.inf	KavUpda.exe
File opened for modification	C:\Autorun.inf	KavUpda.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	KavUpda.exe
File opened for modification	C:\Windows\SysWOW64\WordRes	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Windows\SysWOW64\ExceRes	ae17ef325a1db4139e9090b07f996e99.exe

Drops file in Program Files directory 36 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\StopCompare.xls	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\createdump.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\LockStep.doc	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\createdump.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\UnprotectRead.xls	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	ae17ef325a1db4139e9090b07f996e99.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Help\HelpCat.exe	ae17ef325a1db4139e9090b07f996e99.exe
File created	C:\Windows\Sysinf.bat	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Windows\Sysinf.bat	KavUpda.exe
File created	C:\Windows\system\KavUpda.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Windows\system\KavUpda.exe	ae17ef325a1db4139e9090b07f996e99.exe
File opened for modification	C:\Windows\system\KavUpda.exe	KavUpda.exe
File opened for modification	C:\Windows\regedt32.sys	KavUpda.exe
File created	C:\Windows\regedt32.sys	KavUpda.exe
File opened for modification	C:\Windows\Help\HelpCat.exe	ae17ef325a1db4139e9090b07f996e99.exe
File created	C:\Windows\regedt32.sys	ae17ef325a1db4139e9090b07f996e99.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1512	sc.exe
412	sc.exe
432	sc.exe
4984	sc.exe
1940	sc.exe
1240	sc.exe
1672	sc.exe
2792	sc.exe
2332	sc.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
3204	regedit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	4764	KavUpda.exe
Token: SeIncBasePriorityPrivilege	4764	KavUpda.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: 33	2432	ae17ef325a1db4139e9090b07f996e99.exe
Token: SeIncBasePriorityPrivilege	2432	ae17ef325a1db4139e9090b07f996e99.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	ae17ef325a1db4139e9090b07f996e99.exe
4764	KavUpda.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2716	2432	ae17ef325a1db4139e9090b07f996e99.exe	23
PID 2432 wrote to memory of 2716	2432	ae17ef325a1db4139e9090b07f996e99.exe	23
PID 2432 wrote to memory of 2716	2432	ae17ef325a1db4139e9090b07f996e99.exe	23
PID 2432 wrote to memory of 4128	2432	ae17ef325a1db4139e9090b07f996e99.exe	80
PID 2432 wrote to memory of 4128	2432	ae17ef325a1db4139e9090b07f996e99.exe	80
PID 2432 wrote to memory of 4128	2432	ae17ef325a1db4139e9090b07f996e99.exe	80
PID 4128 wrote to memory of 2564	4128	Conhost.exe	17
PID 4128 wrote to memory of 2564	4128	Conhost.exe	17
PID 4128 wrote to memory of 2564	4128	Conhost.exe	17
PID 2432 wrote to memory of 5020	2432	ae17ef325a1db4139e9090b07f996e99.exe	231
PID 2432 wrote to memory of 5020	2432	ae17ef325a1db4139e9090b07f996e99.exe	231
PID 2432 wrote to memory of 5020	2432	ae17ef325a1db4139e9090b07f996e99.exe	231
PID 2432 wrote to memory of 2632	2432	ae17ef325a1db4139e9090b07f996e99.exe	223
PID 2432 wrote to memory of 2632	2432	ae17ef325a1db4139e9090b07f996e99.exe	223
PID 2432 wrote to memory of 2632	2432	ae17ef325a1db4139e9090b07f996e99.exe	223
PID 2432 wrote to memory of 1748	2432	ae17ef325a1db4139e9090b07f996e99.exe	217
PID 2432 wrote to memory of 1748	2432	ae17ef325a1db4139e9090b07f996e99.exe	217
PID 2432 wrote to memory of 1748	2432	ae17ef325a1db4139e9090b07f996e99.exe	217
PID 2432 wrote to memory of 2092	2432	ae17ef325a1db4139e9090b07f996e99.exe	97
PID 2432 wrote to memory of 2092	2432	ae17ef325a1db4139e9090b07f996e99.exe	97
PID 2432 wrote to memory of 2092	2432	ae17ef325a1db4139e9090b07f996e99.exe	97
PID 2432 wrote to memory of 4980	2432	ae17ef325a1db4139e9090b07f996e99.exe	95
PID 2432 wrote to memory of 4980	2432	ae17ef325a1db4139e9090b07f996e99.exe	95
PID 2432 wrote to memory of 4980	2432	ae17ef325a1db4139e9090b07f996e99.exe	95
PID 2432 wrote to memory of 740	2432	ae17ef325a1db4139e9090b07f996e99.exe	146
PID 2432 wrote to memory of 740	2432	ae17ef325a1db4139e9090b07f996e99.exe	146
PID 2432 wrote to memory of 740	2432	ae17ef325a1db4139e9090b07f996e99.exe	146
PID 2432 wrote to memory of 2028	2432	ae17ef325a1db4139e9090b07f996e99.exe	91
PID 2432 wrote to memory of 2028	2432	ae17ef325a1db4139e9090b07f996e99.exe	91
PID 2432 wrote to memory of 2028	2432	ae17ef325a1db4139e9090b07f996e99.exe	91
PID 2432 wrote to memory of 1968	2432	ae17ef325a1db4139e9090b07f996e99.exe	87
PID 2432 wrote to memory of 1968	2432	ae17ef325a1db4139e9090b07f996e99.exe	87
PID 2432 wrote to memory of 1968	2432	ae17ef325a1db4139e9090b07f996e99.exe	87
PID 2432 wrote to memory of 1512	2432	ae17ef325a1db4139e9090b07f996e99.exe	140
PID 2432 wrote to memory of 1512	2432	ae17ef325a1db4139e9090b07f996e99.exe	140
PID 2432 wrote to memory of 1512	2432	ae17ef325a1db4139e9090b07f996e99.exe	140
PID 2432 wrote to memory of 1940	2432	ae17ef325a1db4139e9090b07f996e99.exe	57
PID 2432 wrote to memory of 1940	2432	ae17ef325a1db4139e9090b07f996e99.exe	57
PID 2432 wrote to memory of 1940	2432	ae17ef325a1db4139e9090b07f996e99.exe	57
PID 2432 wrote to memory of 1672	2432	ae17ef325a1db4139e9090b07f996e99.exe	82
PID 2432 wrote to memory of 1672	2432	ae17ef325a1db4139e9090b07f996e99.exe	82
PID 2432 wrote to memory of 1672	2432	ae17ef325a1db4139e9090b07f996e99.exe	82
PID 2432 wrote to memory of 1240	2432	ae17ef325a1db4139e9090b07f996e99.exe	79
PID 2432 wrote to memory of 1240	2432	ae17ef325a1db4139e9090b07f996e99.exe	79
PID 2432 wrote to memory of 1240	2432	ae17ef325a1db4139e9090b07f996e99.exe	79
PID 2432 wrote to memory of 3204	2432	ae17ef325a1db4139e9090b07f996e99.exe	78
PID 2432 wrote to memory of 3204	2432	ae17ef325a1db4139e9090b07f996e99.exe	78
PID 2432 wrote to memory of 3204	2432	ae17ef325a1db4139e9090b07f996e99.exe	78
PID 2028 wrote to memory of 2648	2028	net.exe	248
PID 2028 wrote to memory of 2648	2028	net.exe	248
PID 2028 wrote to memory of 2648	2028	net.exe	248
PID 740 wrote to memory of 2428	740	Conhost.exe	222
PID 740 wrote to memory of 2428	740	Conhost.exe	222
PID 740 wrote to memory of 2428	740	Conhost.exe	222
PID 1968 wrote to memory of 2824	1968	net.exe	132
PID 1968 wrote to memory of 2824	1968	net.exe	132
PID 1968 wrote to memory of 2824	1968	net.exe	132
PID 2432 wrote to memory of 1432	2432	ae17ef325a1db4139e9090b07f996e99.exe	69
PID 2432 wrote to memory of 1432	2432	ae17ef325a1db4139e9090b07f996e99.exe	69
PID 2432 wrote to memory of 1432	2432	ae17ef325a1db4139e9090b07f996e99.exe	69
PID 2432 wrote to memory of 2748	2432	ae17ef325a1db4139e9090b07f996e99.exe	67
PID 2432 wrote to memory of 2748	2432	ae17ef325a1db4139e9090b07f996e99.exe	67
PID 2432 wrote to memory of 2748	2432	ae17ef325a1db4139e9090b07f996e99.exe	67
PID 1748 wrote to memory of 1756	1748	TrustedInstaller.exe	66

Views/modifies file attributes 1 TTPs 16 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4948	attrib.exe
4360	attrib.exe
2428	attrib.exe
4608	attrib.exe
60	attrib.exe
2292	attrib.exe
1092	attrib.exe
3668	attrib.exe
3604	attrib.exe
2240	attrib.exe
1356	attrib.exe
3940	attrib.exe
1256	attrib.exe
2648	attrib.exe
3412	attrib.exe
2528	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ae17ef325a1db4139e9090b07f996e99.exe
"C:\Users\Admin\AppData\Local\Temp\ae17ef325a1db4139e9090b07f996e99.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\net.exe
  net.exe start schedule /y
  2⤵
  PID:4128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  PID:2716
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:1940
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:2748
- C:\Windows\SysWOW64\reg.exe
  C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
  2⤵
  PID:1432
- C:\Windows\system\KavUpda.exe
  C:\Windows\system\KavUpda.exe
  2⤵
  - Executes dropped EXE
  - Drops autorun.inf file
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4764
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:412
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3412
- - C:\Windows\SysWOW64\reg.exe
    C:\Windows\system32\reg.exe delete "hklm\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}" /f
    3⤵
    PID:2100
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    PID:432
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    PID:2792
- - C:\Windows\SysWOW64\sc.exe
    C:\Windows\system32\sc.exe config srservice start= disabled
    3⤵
    - Launches sc.exe
    PID:2332
- - C:\Windows\SysWOW64\net.exe
    net.exe stop 360timeprot /y
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\net.exe
    net.exe stop srservice /y
    3⤵
    PID:1184
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wuauserv /y
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\net.exe
    net.exe stop sharedaccess /y
    3⤵
    PID:4580
- - C:\Windows\SysWOW64\net.exe
    net.exe stop wscsvc /y
    3⤵
    PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:45:14 PM C:\Windows\Sysinf.bat
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c at 7:42:14 PM C:\Windows\Sysinf.bat
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\At.exe
    At.exe 7:43:12 PM C:\Windows\Help\HelpCat.exe
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3680
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:4608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:3968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:1812
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:4324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1584
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:60
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:2844
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:1432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r F:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4884
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r C:\Autorun.inf\*.* /s /d
      4⤵
      Views/modifies file attributes
      PID:3604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir F:\Autorun.inf /s /q
    3⤵
    PID:3636
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r F:\Autorun.inf\*.* /s /d
    3⤵
    PID:4020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rmdir C:\Autorun.inf /s /q
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r C:\Autorun.inf\*.* /s /d
    3⤵
    PID:4380
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Windows\regedt32.sys
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Blocks application from running via registry modification
  - Sets file execution options in registry
  - Runs regedit.exe
  PID:3204
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:1240
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:1672
- C:\Windows\SysWOW64\sc.exe
  C:\Windows\system32\sc.exe config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:1512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop 360timeprot /y
    3⤵
    PID:3612
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1968
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:740
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:4980
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:45:10 PM C:\Windows\Sysinf.bat
  2⤵
  PID:1748
- C:\Windows\SysWOW64\cmd.exe
  cmd /c at 7:42:10 PM C:\Windows\Sysinf.bat
  2⤵
  PID:2632
- C:\Windows\SysWOW64\At.exe
  At.exe 7:43:08 PM C:\Windows\Help\HelpCat.exe
  2⤵
  PID:5020
- C:\Windows\SysWOW64\net.exe
  net.exe stop 360timeprot /y
  2⤵
  PID:1512
- C:\Windows\SysWOW64\net.exe
  net.exe stop srservice /y
  2⤵
  PID:1492
- C:\Windows\SysWOW64\net.exe
  net.exe stop wuauserv /y
  2⤵
  PID:2548
- C:\Windows\SysWOW64\net.exe
  net.exe stop sharedaccess /y
  2⤵
  PID:4584
- C:\Windows\SysWOW64\net.exe
  net.exe stop wscsvc /y
  2⤵
  PID:536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:2564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:2648

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:4972

C:\Windows\SysWOW64\at.exe
at 7:42:10 PM C:\Windows\Sysinf.bat
1⤵
PID:4720

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1576

C:\Windows\SysWOW64\at.exe
at 7:45:10 PM C:\Windows\Sysinf.bat
1⤵
PID:1756

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:2824

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start schedule /y
1⤵
PID:4404

C:\Windows\SysWOW64\net.exe
net.exe start schedule /y
1⤵
PID:2284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
1⤵
PID:4364

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:2428

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:4128

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:1592

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2528

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:2536

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:1460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv /y
1⤵
PID:3764

C:\Windows\SysWOW64\at.exe
at 7:45:14 PM C:\Windows\Sysinf.bat
1⤵
PID:2340

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop srservice /y
1⤵
PID:3844

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop 360timeprot /y
1⤵
PID:4528

C:\Windows\SysWOW64\at.exe
at 7:42:14 PM C:\Windows\Sysinf.bat
1⤵
PID:1944

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop sharedaccess /y
1⤵
PID:1496

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1460

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc /y
1⤵
PID:1404

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2824

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of WriteProcessMemory
PID:740

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:4360

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4584

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1092

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4528

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3940

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1748

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2428

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2632

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5020

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1356

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3764

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:1256

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2648

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4984

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r F:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:2240

C:\Windows\SysWOW64\attrib.exe
attrib -s -h -r C:\Autorun.inf\*.* /s /d
1⤵
- Views/modifies file attributes
PID:3412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads