26c64c2fafcd264b8130462ff6e40a6498ec6937fe95d5e83964388ae9597c4d

General

Target

Optimizer.exe
Size

2.4MB
MD5

cc4ed359031db8b3816f280a0cbda217
SHA1

537f393978f91eef2ac22ce82ee1b2f9c6dd2d72
SHA256

26c64c2fafcd264b8130462ff6e40a6498ec6937fe95d5e83964388ae9597c4d
SHA512

e443b5cb8b86a919a800825204624b651b5196e043d83529014625d7e161a6f7a6083857d2415eaa6293cf312389fbf39ea9a338307e8270dcc4812136e84077
SSDEEP

24576:S2mofuHtzyxlMOlJv8EC8KJWGlF+Bjk38WuBcAbwoA/BkjSHXP36RMG:S2msuHtzyxl+EC8KoVCSA/Bkj0

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

Optimizer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	Optimizer.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Optimizer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe	Optimizer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe\Debugger = "%windir%\\System32\\taskkill.exe"	Optimizer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe	Optimizer.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Optimizer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	Optimizer.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4184 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

38 raw.githubusercontent.com
37 raw.githubusercontent.com
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exe

pid process

3664 sc.exe
980 sc.exe
1708 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

4020 ipconfig.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1748 vssadmin.exe

pid	process
4184	icacls.exe

flow	ioc
38	raw.githubusercontent.com
37	raw.githubusercontent.com

pid	process
3664	sc.exe
980	sc.exe
1708	sc.exe

pid	process
4020	ipconfig.exe

pid	process
1748	vssadmin.exe

Modifies Control Panel 7 IoCs

evasion

Processes:

Optimizer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Accessibility\Keyboard Response\Flags = "122"	Optimizer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Accessibility\ToggleKeys\Flags = "58"	Optimizer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\AutoEndTasks = "1"	Optimizer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\HungAppTimeout = "1000"	Optimizer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000"	Optimizer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000"	Optimizer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Accessibility\StickyKeys\Flags = "506"	Optimizer.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

Optimizer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys\Flags = "506"	Optimizer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response\Flags = "122"	Optimizer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys\Flags = "58"	Optimizer.exe

Modifies registry class 4 IoCs

Processes:

Optimizer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To	Optimizer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}"	Optimizer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To	Optimizer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}"	Optimizer.exe

Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

732 regedit.exe
Runs net.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Optimizer.exe

pid process

2092 Optimizer.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Optimizer.exe

pid process

2092 Optimizer.exe

pid	process
732	regedit.exe

pid	process
2092	Optimizer.exe

pid	process
2092	Optimizer.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

Optimizer.exevssvc.exe

description	pid	process
Token: SeDebugPrivilege	2092	Optimizer.exe
Token: SeTakeOwnershipPrivilege	2092	Optimizer.exe
Token: SeBackupPrivilege	3992	vssvc.exe
Token: SeRestorePrivilege	3992	vssvc.exe
Token: SeAuditPrivilege	3992	vssvc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Optimizer.execmd.execmd.execmd.execmd.execmd.execmd.exenet.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2092 wrote to memory of 3328	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 3328	2092	Optimizer.exe	cmd.exe
PID 3328 wrote to memory of 3664	3328	cmd.exe	sc.exe
PID 3328 wrote to memory of 3664	3328	cmd.exe	sc.exe
PID 2092 wrote to memory of 2304	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 2304	2092	Optimizer.exe	cmd.exe
PID 2304 wrote to memory of 4184	2304	cmd.exe	icacls.exe
PID 2304 wrote to memory of 4184	2304	cmd.exe	icacls.exe
PID 2092 wrote to memory of 5004	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 5004	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 736	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 736	2092	Optimizer.exe	cmd.exe
PID 736 wrote to memory of 2132	736	cmd.exe	schtasks.exe
PID 736 wrote to memory of 2132	736	cmd.exe	schtasks.exe
PID 2092 wrote to memory of 2496	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 2496	2092	Optimizer.exe	cmd.exe
PID 2496 wrote to memory of 3884	2496	cmd.exe	schtasks.exe
PID 2496 wrote to memory of 3884	2496	cmd.exe	schtasks.exe
PID 2092 wrote to memory of 1368	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 1368	2092	Optimizer.exe	cmd.exe
PID 1368 wrote to memory of 1116	1368	cmd.exe	schtasks.exe
PID 1368 wrote to memory of 1116	1368	cmd.exe	schtasks.exe
PID 2092 wrote to memory of 4336	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 4336	2092	Optimizer.exe	cmd.exe
PID 4336 wrote to memory of 4660	4336	cmd.exe	net.exe
PID 4336 wrote to memory of 4660	4336	cmd.exe	net.exe
PID 4660 wrote to memory of 4932	4660	net.exe	net1.exe
PID 4660 wrote to memory of 4932	4660	net.exe	net1.exe
PID 2092 wrote to memory of 1080	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 1080	2092	Optimizer.exe	cmd.exe
PID 1080 wrote to memory of 980	1080	cmd.exe	sc.exe
PID 1080 wrote to memory of 980	1080	cmd.exe	sc.exe
PID 2092 wrote to memory of 4828	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 4828	2092	Optimizer.exe	cmd.exe
PID 4828 wrote to memory of 1708	4828	cmd.exe	sc.exe
PID 4828 wrote to memory of 1708	4828	cmd.exe	sc.exe
PID 2092 wrote to memory of 1856	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 1856	2092	Optimizer.exe	cmd.exe
PID 1856 wrote to memory of 3188	1856	cmd.exe	schtasks.exe
PID 1856 wrote to memory of 3188	1856	cmd.exe	schtasks.exe
PID 2092 wrote to memory of 2764	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 2764	2092	Optimizer.exe	cmd.exe
PID 2764 wrote to memory of 3888	2764	cmd.exe	schtasks.exe
PID 2764 wrote to memory of 3888	2764	cmd.exe	schtasks.exe
PID 2092 wrote to memory of 3540	2092	Optimizer.exe	cmd.exe
PID 2092 wrote to memory of 3540	2092	Optimizer.exe	cmd.exe
PID 3540 wrote to memory of 332	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 332	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 3148	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 3148	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 5052	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 5052	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4008	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4008	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4688	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4688	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 3548	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 3548	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 3572	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 3572	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4312	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4312	3540	cmd.exe	schtasks.exe
PID 3540 wrote to memory of 4224	3540	cmd.exe	reg.exe
PID 3540 wrote to memory of 4224	3540	cmd.exe	reg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Optimizer.exe
"C:\Users\Admin\AppData\Local\Temp\Optimizer.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Sets file execution options in registry
- Checks computer location settings
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled
2⤵
- Suspicious use of WriteProcessMemory
PID:3328

C:\Windows\system32\sc.exe
sc config "RemoteRegistry" start= disabled
3⤵
- Launches sc.exe
PID:3664

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F
2⤵
- Suspicious use of WriteProcessMemory
PID:2304

C:\Windows\system32\icacls.exe
icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F
3⤵
- Modifies file permissions
PID:4184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat""
2⤵
PID:5004

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"
3⤵
PID:3792

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable
3⤵
PID:4600

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM"
3⤵
PID:1528

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /disable
3⤵
PID:428

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"
3⤵
PID:728

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable
3⤵
PID:1364

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"
3⤵
PID:3808

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable
3⤵
PID:4396

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader"
3⤵
PID:3420

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader" /disable
3⤵
PID:3884

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"
3⤵
PID:1368

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable
3⤵
PID:1200

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"
3⤵
PID:3224

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable
3⤵
PID:4676

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"
3⤵
PID:1284

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable"
3⤵
PID:4352

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"
3⤵
PID:4964

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable
3⤵
PID:4588

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"
3⤵
PID:1112

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable
3⤵
PID:4936

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
3⤵
PID:2744

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /disable
3⤵
PID:3672

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"
3⤵
PID:4920

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /disable
3⤵
PID:5016

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh"
3⤵
PID:4020

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /disable
3⤵
PID:1992

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyUpload"
3⤵
PID:1556

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyUpload" /disable
3⤵
PID:3960

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Autochk\Proxy"
3⤵
PID:4252

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable
3⤵
PID:3500

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Maintenance\WinSAT"
3⤵
PID:4700

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Maintenance\WinSAT" /disable
3⤵
PID:3484

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\AitAgent"
3⤵
PID:3356

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Application Experience\AitAgent" /disable
3⤵
PID:860

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting"
3⤵
PID:3996

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /disable
3⤵
PID:3516

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask"
3⤵
PID:4356

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /disable
3⤵
PID:4636

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\DiskFootprint\Diagnostics"
3⤵
PID:3588

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /disable
3⤵
PID:1104

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)"
3⤵
PID:216

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)" /disable
3⤵
PID:4904

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\PI\Sqm-Tasks"
3⤵
PID:3908

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable
3⤵
PID:2352

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo"
3⤵
PID:1636

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable
3⤵
PID:2692

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\AppID\SmartScreenSpecific"
3⤵
PID:3212

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\AppID\SmartScreenSpecific" /disable
3⤵
PID:3100

C:\Windows\system32\schtasks.exe
schtasks /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /Disable
3⤵
PID:2856

C:\Windows\system32\schtasks.exe
schtasks /Change /TN "\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable
3⤵
PID:2820

C:\Windows\system32\schtasks.exe
schtasks /Change /TN "\Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable
3⤵
PID:2348

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\HelloFace\FODCleanupTask"
3⤵
PID:3664

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\HelloFace\FODCleanupTask" /disable
3⤵
PID:4756

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClient"
3⤵
PID:4228

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable
3⤵
PID:3424

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload"
3⤵
PID:3724

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable
3⤵
PID:5068

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask"
3⤵
PID:5044

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable
3⤵
PID:2148

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Device Information\Device"
3⤵
PID:4152

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable
3⤵
PID:2368

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Windows\Device Information\Device User"
3⤵
PID:556

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable
3⤵
PID:1552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
2⤵
- Suspicious use of WriteProcessMemory
PID:736

C:\Windows\system32\schtasks.exe
schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
3⤵
PID:2132

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
2⤵
- Suspicious use of WriteProcessMemory
PID:2496

C:\Windows\system32\schtasks.exe
schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
3⤵
PID:3884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
2⤵
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\system32\schtasks.exe
schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable
3⤵
PID:1116

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C net.exe stop NvTelemetryContainer
2⤵
- Suspicious use of WriteProcessMemory
PID:4336

C:\Windows\system32\net.exe
net.exe stop NvTelemetryContainer
3⤵
- Suspicious use of WriteProcessMemory
PID:4660

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop NvTelemetryContainer
4⤵
PID:4932

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc.exe config NvTelemetryContainer start= disabled
2⤵
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\system32\sc.exe
sc.exe config NvTelemetryContainer start= disabled
3⤵
- Launches sc.exe
PID:980

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C sc.exe stop NvTelemetryContainer
2⤵
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\system32\sc.exe
sc.exe stop NvTelemetryContainer
3⤵
- Launches sc.exe
PID:1708

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
2⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\system32\schtasks.exe
schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"
3⤵
PID:3188

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
2⤵
- Suspicious use of WriteProcessMemory
PID:2764

C:\Windows\system32\schtasks.exe
schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"
3⤵
PID:3888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat""
2⤵
- Suspicious use of WriteProcessMemory
PID:3540

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"
3⤵
PID:332

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable
3⤵
PID:3148

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"
3⤵
PID:5052

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable
3⤵
PID:4008

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack"
3⤵
PID:4688

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable
3⤵
PID:3548

C:\Windows\system32\schtasks.exe
schtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn"
3⤵
PID:3572

C:\Windows\system32\schtasks.exe
schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable
3⤵
PID:4312

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
3⤵
PID:4224

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f
3⤵
PID:3088

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
3⤵
PID:3744

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f
3⤵
PID:4004

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
3⤵
PID:3624

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f
3⤵
PID:5096

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
3⤵
PID:1696

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f
3⤵
PID:1328

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
3⤵
PID:3512

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f
3⤵
PID:3728

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
3⤵
PID:4800

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f
3⤵
PID:3376

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
3⤵
PID:5012

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f
3⤵
PID:2616

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
3⤵
PID:4416

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f
3⤵
PID:5024

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
3⤵
PID:3764

C:\Windows\system32\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f
3⤵
PID:2688

C:\Windows\regedit.exe
"C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg"
2⤵
- Runs .reg file with regedit
PID:732

C:\Windows\SYSTEM32\vssadmin.exe
"vssadmin" delete shadows /for=c: /all /quiet
2⤵
- Interacts with shadow copies
PID:1748

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C ipconfig /flushdns
2⤵
PID:4880

C:\Windows\system32\ipconfig.exe
ipconfig /flushdns
3⤵
- Gathers network information
PID:4020

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

2

T1569

Service Execution

2

T1569.002

Windows Management Instrumentation

1

T1047

Command and Scripting Interpreter

1

T1059

Persistence

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Create or Modify System Process

2

T1543

Windows Service

2

T1543.003

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Modify Registry

3

T1112

Indicator Removal

2

T1070

File Deletion

2

T1070.004

Impair Defenses

2

T1562

Disable or Modify Tools

1

T1562.001

File and Directory Permissions Modification

1

T1222

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Service Stop

2

T1489

Inhibit System Recovery

3

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Optimizer\Optimizer.log
Filesize
793B

MD5
8c29e4a9cf15a98c4524581dbd5bf72b

SHA1
e4ca0ad58d71556280b73d36f06d2cf8add94bfe

SHA256
55cde894903e3634b238f45be201b3c5383e83574175514aac3ba338ebb8c957

SHA512
c1814e6d503632a92063a916759c8c57b4a7924ac4a65b094075ca7d9529ab2e3be36572c30119beddeaf785a9e77ce121245fa7b121ffc40cb55e7bc7a5820b

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat
Filesize
2KB

MD5
74d8445be29f93a57f3427d36307a650

SHA1
dac24aad0dffa278693e219f6773d04a700a8540

SHA256
9b4e4f516b45f4d8c6fc399b5fe25797298fd51782c922a1372a57807635b3ef

SHA512
bacac50ceb07d80553e7391df29eab746eeffee16009173fa48f93fc042c405e543d50bbd22ba1970238319312c121e5d8a28515d7f382ef61eeda0282f078d1

Download Submit
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg
Filesize
648B

MD5
7f7b192506491e4105e2ae1cf5ea9067

SHA1
5dafd2516bd4a4b3d230624f8ea590f640e2c381

SHA256
41cf9db9e395349b94ec7a1ee99db68062f27bf95c3b364aa6b035dc39ff1dc0

SHA512
5fcfbec12316f24bdbadb3d4a018945de9afb849fcfc026e601728b1dce107eaf1b8ce56d5e646461006a45bb305f16e3160d760649f7716b70a3e2fd195763f

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_euptdk5h.5ju.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2092-43-0x000001E9B59B0000-0x000001E9B59BA000-memory.dmp

Filesize
40KB

Download
memory/2092-61-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-27-0x000001E999720000-0x000001E99973E000-memory.dmp

Filesize
120KB

Download
memory/2092-28-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-29-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-30-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-24-0x000001E9B1FD0000-0x000001E9B1FF2000-memory.dmp

Filesize
136KB

Download
memory/2092-42-0x000001E9B59C0000-0x000001E9B59D6000-memory.dmp

Filesize
88KB

Download
memory/2092-0-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmp

Filesize
8KB

Download
memory/2092-44-0x000001E9B5A50000-0x000001E9B5A76000-memory.dmp

Filesize
152KB

Download
memory/2092-60-0x000001E9B60E0000-0x000001E9B60F2000-memory.dmp

Filesize
72KB

Download
memory/2092-25-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-63-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmp

Filesize
8KB

Download
memory/2092-64-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-65-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-66-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-67-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-23-0x000001E9B21A0000-0x000001E9B2216000-memory.dmp

Filesize
472KB

Download
memory/2092-2-0x000001E9B1F20000-0x000001E9B1FD2000-memory.dmp

Filesize
712KB

Download
memory/2092-1-0x000001E997800000-0x000001E997A6A000-memory.dmp

Filesize
2.4MB

Download
memory/2092-92-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download
memory/2092-93-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmp

Filesize
10.8MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads