Analysis
-
max time kernel
69s -
max time network
71s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 09:02
Static task
static1
Behavioral task
behavioral1
Sample
Optimizer.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
Optimizer.exe
Resource
win10v2004-20240426-en
General
-
Target
Optimizer.exe
-
Size
2.4MB
-
MD5
cc4ed359031db8b3816f280a0cbda217
-
SHA1
537f393978f91eef2ac22ce82ee1b2f9c6dd2d72
-
SHA256
26c64c2fafcd264b8130462ff6e40a6498ec6937fe95d5e83964388ae9597c4d
-
SHA512
e443b5cb8b86a919a800825204624b651b5196e043d83529014625d7e161a6f7a6083857d2415eaa6293cf312389fbf39ea9a338307e8270dcc4812136e84077
-
SSDEEP
24576:S2mofuHtzyxlMOlJv8EC8KJWGlF+Bjk38WuBcAbwoA/BkjSHXP36RMG:S2msuHtzyxl+EC8KoVCSA/Bkj0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
Optimizer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0" Optimizer.exe -
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Disables use of System Restore points 1 TTPs
-
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
Optimizer.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "%windir%\\System32\\taskkill.exe" Optimizer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe Optimizer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DeviceCensus.exe\Debugger = "%windir%\\System32\\taskkill.exe" Optimizer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe Optimizer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Optimizer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation Optimizer.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exepid process 3664 sc.exe 980 sc.exe 1708 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 4020 ipconfig.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1748 vssadmin.exe -
Modifies Control Panel 7 IoCs
Processes:
Optimizer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Accessibility\Keyboard Response\Flags = "122" Optimizer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Accessibility\ToggleKeys\Flags = "58" Optimizer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\AutoEndTasks = "1" Optimizer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\HungAppTimeout = "1000" Optimizer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\WaitToKillAppTimeout = "2000" Optimizer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Desktop\LowLevelHooksTimeout = "1000" Optimizer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\Accessibility\StickyKeys\Flags = "506" Optimizer.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
Optimizer.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\StickyKeys\Flags = "506" Optimizer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\Keyboard Response\Flags = "122" Optimizer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Control Panel\Accessibility\ToggleKeys\Flags = "58" Optimizer.exe -
Modifies registry class 4 IoCs
Processes:
Optimizer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To Optimizer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Copy To\ = "{C2FBB630-2971-11D1-A18C-00C04FD75D13}" Optimizer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To Optimizer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\Move To\ = "{C2FBB631-2971-11D1-A18C-00C04FD75D13}" Optimizer.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 732 regedit.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Optimizer.exepid process 2092 Optimizer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Optimizer.exepid process 2092 Optimizer.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Optimizer.exevssvc.exedescription pid process Token: SeDebugPrivilege 2092 Optimizer.exe Token: SeTakeOwnershipPrivilege 2092 Optimizer.exe Token: SeBackupPrivilege 3992 vssvc.exe Token: SeRestorePrivilege 3992 vssvc.exe Token: SeAuditPrivilege 3992 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Optimizer.execmd.execmd.execmd.execmd.execmd.execmd.exenet.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2092 wrote to memory of 3328 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 3328 2092 Optimizer.exe cmd.exe PID 3328 wrote to memory of 3664 3328 cmd.exe sc.exe PID 3328 wrote to memory of 3664 3328 cmd.exe sc.exe PID 2092 wrote to memory of 2304 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 2304 2092 Optimizer.exe cmd.exe PID 2304 wrote to memory of 4184 2304 cmd.exe icacls.exe PID 2304 wrote to memory of 4184 2304 cmd.exe icacls.exe PID 2092 wrote to memory of 5004 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 5004 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 736 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 736 2092 Optimizer.exe cmd.exe PID 736 wrote to memory of 2132 736 cmd.exe schtasks.exe PID 736 wrote to memory of 2132 736 cmd.exe schtasks.exe PID 2092 wrote to memory of 2496 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 2496 2092 Optimizer.exe cmd.exe PID 2496 wrote to memory of 3884 2496 cmd.exe schtasks.exe PID 2496 wrote to memory of 3884 2496 cmd.exe schtasks.exe PID 2092 wrote to memory of 1368 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 1368 2092 Optimizer.exe cmd.exe PID 1368 wrote to memory of 1116 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 1116 1368 cmd.exe schtasks.exe PID 2092 wrote to memory of 4336 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 4336 2092 Optimizer.exe cmd.exe PID 4336 wrote to memory of 4660 4336 cmd.exe net.exe PID 4336 wrote to memory of 4660 4336 cmd.exe net.exe PID 4660 wrote to memory of 4932 4660 net.exe net1.exe PID 4660 wrote to memory of 4932 4660 net.exe net1.exe PID 2092 wrote to memory of 1080 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 1080 2092 Optimizer.exe cmd.exe PID 1080 wrote to memory of 980 1080 cmd.exe sc.exe PID 1080 wrote to memory of 980 1080 cmd.exe sc.exe PID 2092 wrote to memory of 4828 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 4828 2092 Optimizer.exe cmd.exe PID 4828 wrote to memory of 1708 4828 cmd.exe sc.exe PID 4828 wrote to memory of 1708 4828 cmd.exe sc.exe PID 2092 wrote to memory of 1856 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 1856 2092 Optimizer.exe cmd.exe PID 1856 wrote to memory of 3188 1856 cmd.exe schtasks.exe PID 1856 wrote to memory of 3188 1856 cmd.exe schtasks.exe PID 2092 wrote to memory of 2764 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 2764 2092 Optimizer.exe cmd.exe PID 2764 wrote to memory of 3888 2764 cmd.exe schtasks.exe PID 2764 wrote to memory of 3888 2764 cmd.exe schtasks.exe PID 2092 wrote to memory of 3540 2092 Optimizer.exe cmd.exe PID 2092 wrote to memory of 3540 2092 Optimizer.exe cmd.exe PID 3540 wrote to memory of 332 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 332 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 3148 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 3148 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 5052 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 5052 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4008 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4008 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4688 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4688 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 3548 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 3548 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 3572 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 3572 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4312 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4312 3540 cmd.exe schtasks.exe PID 3540 wrote to memory of 4224 3540 cmd.exe reg.exe PID 3540 wrote to memory of 4224 3540 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Optimizer.exe"C:\Users\Admin\AppData\Local\Temp\Optimizer.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Sets file execution options in registry
- Checks computer location settings
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc config "RemoteRegistry" start= disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config "RemoteRegistry" start= disabled3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C icacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\icacls.exeicacls C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger /deny SYSTEM:`(OI`)`(CI`)F3⤵
- Modifies file permissions
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableTelemetryTasks.bat""2⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\BthSQM" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Uploader" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Application Experience\StartupAppTask"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyMonitor" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyRefresh" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Shell\FamilySafetyUpload"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Shell\FamilySafetyUpload" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Autochk\Proxy"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Maintenance\WinSAT"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Maintenance\WinSAT" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Application Experience\AitAgent"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\AitAgent" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Windows Error Reporting\QueueReporting" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\CloudExperienceHost\CreateObjectTask" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\DiskFootprint\Diagnostics"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskFootprint\Diagnostics" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\FileHistory\File History (maintenance mode)" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\PI\Sqm-Tasks"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\AppID\SmartScreenSpecific"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\AppID\SmartScreenSpecific" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /Disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime" /Disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /Change /TN "\Microsoft\Windows\Time Synchronization\SynchronizeTime" /Disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\HelloFace\FODCleanupTask"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\HelloFace\FODCleanupTask" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClient"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Device Information\Device"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Windows\Device Information\Device User"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn NvTmRepOnLogon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /tn NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8} /disable3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C net.exe stop NvTelemetryContainer2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net.exenet.exe stop NvTelemetryContainer3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop NvTelemetryContainer4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc.exe config NvTelemetryContainer start= disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe config NvTelemetryContainer start= disabled3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C sc.exe stop NvTelemetryContainer2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc.exe stop NvTelemetryContainer3⤵
- Launches sc.exe
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent 308046B0AF4A39CB"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /change /disable /tn "\Mozilla\Firefox Default Browser Agent D2CEEC440E2074BD"3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /end /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn"3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Mail" /v "EnableLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Outlook\Options\Calendar" /v "EnableCalendarLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Word\Options" /v "EnableLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Office\15.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Policies\Microsoft\Office\16.0\OSM" /v "EnableUpload" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "DisableTelemetry" /t REG_DWORD /d 1 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\ClientTelemetry" /v "VerboseLogging" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common" /v "QMEnable" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\15.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Feedback" /v "Enabled" /t REG_DWORD /d 0 /f3⤵
-
C:\Windows\regedit.exe"C:\Windows\regedit.exe" /s "C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.reg"2⤵
- Runs .reg file with regedit
-
C:\Windows\SYSTEM32\vssadmin.exe"vssadmin" delete shadows /for=c: /all /quiet2⤵
- Interacts with shadow copies
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C ipconfig /flushdns2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
System Services
2Service Execution
2Windows Management Instrumentation
1Command and Scripting Interpreter
1Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Optimizer\Optimizer.logFilesize
793B
MD58c29e4a9cf15a98c4524581dbd5bf72b
SHA1e4ca0ad58d71556280b73d36f06d2cf8add94bfe
SHA25655cde894903e3634b238f45be201b3c5383e83574175514aac3ba338ebb8c957
SHA512c1814e6d503632a92063a916759c8c57b4a7924ac4a65b094075ca7d9529ab2e3be36572c30119beddeaf785a9e77ce121245fa7b121ffc40cb55e7bc7a5820b
-
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.batFilesize
2KB
MD574d8445be29f93a57f3427d36307a650
SHA1dac24aad0dffa278693e219f6773d04a700a8540
SHA2569b4e4f516b45f4d8c6fc399b5fe25797298fd51782c922a1372a57807635b3ef
SHA512bacac50ceb07d80553e7391df29eab746eeffee16009173fa48f93fc042c405e543d50bbd22ba1970238319312c121e5d8a28515d7f382ef61eeda0282f078d1
-
C:\ProgramData\Optimizer\Required\DisableOfficeTelemetryTasks.regFilesize
648B
MD57f7b192506491e4105e2ae1cf5ea9067
SHA15dafd2516bd4a4b3d230624f8ea590f640e2c381
SHA25641cf9db9e395349b94ec7a1ee99db68062f27bf95c3b364aa6b035dc39ff1dc0
SHA5125fcfbec12316f24bdbadb3d4a018945de9afb849fcfc026e601728b1dce107eaf1b8ce56d5e646461006a45bb305f16e3160d760649f7716b70a3e2fd195763f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_euptdk5h.5ju.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/2092-43-0x000001E9B59B0000-0x000001E9B59BA000-memory.dmpFilesize
40KB
-
memory/2092-61-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-27-0x000001E999720000-0x000001E99973E000-memory.dmpFilesize
120KB
-
memory/2092-28-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-29-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-30-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-24-0x000001E9B1FD0000-0x000001E9B1FF2000-memory.dmpFilesize
136KB
-
memory/2092-42-0x000001E9B59C0000-0x000001E9B59D6000-memory.dmpFilesize
88KB
-
memory/2092-0-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmpFilesize
8KB
-
memory/2092-44-0x000001E9B5A50000-0x000001E9B5A76000-memory.dmpFilesize
152KB
-
memory/2092-60-0x000001E9B60E0000-0x000001E9B60F2000-memory.dmpFilesize
72KB
-
memory/2092-25-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-63-0x00007FF9A0683000-0x00007FF9A0685000-memory.dmpFilesize
8KB
-
memory/2092-64-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-65-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-66-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-67-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-23-0x000001E9B21A0000-0x000001E9B2216000-memory.dmpFilesize
472KB
-
memory/2092-2-0x000001E9B1F20000-0x000001E9B1FD2000-memory.dmpFilesize
712KB
-
memory/2092-1-0x000001E997800000-0x000001E997A6A000-memory.dmpFilesize
2.4MB
-
memory/2092-92-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB
-
memory/2092-93-0x00007FF9A0680000-0x00007FF9A1141000-memory.dmpFilesize
10.8MB