Analysis

  • max time kernel
    33s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 11:22

Errors

Reason
Machine shutdown

General

  • Target

    nfd49_64.msi

  • Size

    14.4MB

  • MD5

    28be818ac9500048abe00f46c93def8c

  • SHA1

    11dd4516325e2d032f07f8a90aa66c035fb48c3c

  • SHA256

    6468178241c7f17fce1237634265d9aed547976c891d517e4fcac37421ca03f0

  • SHA512

    55f80e299a0e548586100a6cbd1d5af0741a5d1e19b67648fb2a2fe51c6e43475e9066386711c824750cb4a3331c5c7d5208d5037dcfa1f873f1679738baa12f

  • SSDEEP

    393216:+/j2n3TlfPqX5sL1AAaB1/s7qUYCGMkqT2LY:T3TBoyQ+aA6

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 9 IoCs
  • Executes dropped EXE 1 IoCs
  • Launches sc.exe 64 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 1 IoCs
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 20 IoCs
  • Modifies registry class 22 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nfd49_64.msi
    1⤵
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:636
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:1944
      • C:\Windows\System32\MsiExec.exe
        C:\Windows\System32\MsiExec.exe -Embedding 06AD235FB4EDD0A72A3A429BE96CD6C8 E Global\MSI0000
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1568
        • C:\Windows\System32\cmd.exe
          cmd.exe /c 7za.exe x -bd -y locale3.dat -pasfasdf79yf9layslofs
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1460
          • C:\Program Files (x86)\Windows NT\7za.exe
            7za.exe x -bd -y locale3.dat -pasfasdf79yf9layslofs
            4⤵
            • Drops file in Program Files directory
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3548
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c shutdown -f -r -t 00
          3⤵
            PID:2292
            • C:\Windows\system32\shutdown.exe
              shutdown -f -r -t 00
              4⤵
                PID:4940
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:3372
        • C:\Windows\system32\cmd.exe
          cmd /c start sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4376
          • C:\Windows\system32\sc.exe
            sc create CleverSoar displayname= CleverSoar binPath= "C:\Program Files (x86)\Windows NT\tProtect.dll" type= kernel start= auto
            2⤵
            • Launches sc.exe
            PID:4432
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4572
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
            • Launches sc.exe
            PID:2680
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:1324
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
            • Launches sc.exe
            PID:2820
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3692
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
            • Launches sc.exe
            PID:2556
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
            • Launches sc.exe
            PID:208
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:5040
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
            • Launches sc.exe
            PID:1600
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:3740
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
            • Launches sc.exe
            PID:1176
        • C:\Windows\system32\cmd.exe
          cmd /c start sc start CleverSoar
          1⤵
          • Suspicious use of WriteProcessMemory
          PID:2696
          • C:\Windows\system32\sc.exe
            sc start CleverSoar
            2⤵
              PID:1572
          • C:\Windows\system32\cmd.exe
            cmd /c start sc start CleverSoar
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:5032
            • C:\Windows\system32\sc.exe
              sc start CleverSoar
              2⤵
              • Launches sc.exe
              PID:2596
          • C:\Windows\system32\cmd.exe
            cmd /c start sc start CleverSoar
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:4496
            • C:\Windows\system32\sc.exe
              sc start CleverSoar
              2⤵
                PID:2800
            • C:\Windows\system32\cmd.exe
              cmd /c start sc start CleverSoar
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:4828
              • C:\Windows\system32\sc.exe
                sc start CleverSoar
                2⤵
                  PID:4424
              • C:\Windows\system32\cmd.exe
                cmd /c start sc start CleverSoar
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:4804
                • C:\Windows\system32\sc.exe
                  sc start CleverSoar
                  2⤵
                  • Launches sc.exe
                  PID:4344
              • C:\Windows\system32\cmd.exe
                cmd /c start sc start CleverSoar
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:3112
                • C:\Windows\system32\sc.exe
                  sc start CleverSoar
                  2⤵
                  • Launches sc.exe
                  PID:404
              • C:\Windows\system32\cmd.exe
                cmd /c start sc start CleverSoar
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:3996
                • C:\Windows\system32\sc.exe
                  sc start CleverSoar
                  2⤵
                  • Launches sc.exe
                  PID:4572
              • C:\Windows\system32\cmd.exe
                cmd /c start sc start CleverSoar
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:632
                • C:\Windows\system32\sc.exe
                  sc start CleverSoar
                  2⤵
                  • Launches sc.exe
                  PID:2740
              • C:\Windows\system32\cmd.exe
                cmd /c start sc start CleverSoar
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:2488
                • C:\Windows\system32\sc.exe
                  sc start CleverSoar
                  2⤵
                  • Launches sc.exe
                  PID:4444
              • C:\Windows\system32\cmd.exe
                cmd /c start sc start CleverSoar
                1⤵
                • Suspicious use of WriteProcessMemory
                PID:4340
                • C:\Windows\system32\sc.exe
                  sc start CleverSoar
                  2⤵
                    PID:4856
                • C:\Windows\system32\cmd.exe
                  cmd /c start sc start CleverSoar
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3032
                  • C:\Windows\system32\sc.exe
                    sc start CleverSoar
                    2⤵
                    • Launches sc.exe
                    PID:3340
                • C:\Windows\system32\cmd.exe
                  cmd /c start sc start CleverSoar
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2384
                  • C:\Windows\system32\sc.exe
                    sc start CleverSoar
                    2⤵
                    • Launches sc.exe
                    PID:624
                • C:\Windows\system32\cmd.exe
                  cmd /c start sc start CleverSoar
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3300
                  • C:\Windows\system32\sc.exe
                    sc start CleverSoar
                    2⤵
                    • Launches sc.exe
                    PID:2512
                    • C:\Windows\System32\Conhost.exe
                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                      3⤵
                        PID:1572
                  • C:\Windows\system32\cmd.exe
                    cmd /c start sc start CleverSoar
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4084
                    • C:\Windows\system32\sc.exe
                      sc start CleverSoar
                      2⤵
                        PID:2840
                        • C:\Windows\System32\Conhost.exe
                          \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                          3⤵
                            PID:2596
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1712
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:2828
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4376
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:4424
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4324
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:4636
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4604
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:3212
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4572
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:3548
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:4852
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:2620
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:1476
                        • C:\Windows\system32\sc.exe
                          sc start CleverSoar
                          2⤵
                          • Launches sc.exe
                          PID:1120
                      • C:\Windows\system32\cmd.exe
                        cmd /c start sc start CleverSoar
                        1⤵
                          PID:3540
                          • C:\Windows\system32\sc.exe
                            sc start CleverSoar
                            2⤵
                            • Launches sc.exe
                            PID:3032
                        • C:\Windows\system32\cmd.exe
                          cmd /c start sc start CleverSoar
                          1⤵
                            PID:1348
                            • C:\Windows\system32\sc.exe
                              sc start CleverSoar
                              2⤵
                              • Launches sc.exe
                              PID:1516
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:1176
                            • C:\Windows\system32\cmd.exe
                              cmd /c start sc start CleverSoar
                              1⤵
                                PID:2248
                                • C:\Windows\system32\sc.exe
                                  sc start CleverSoar
                                  2⤵
                                  • Launches sc.exe
                                  PID:2056
                              • C:\Windows\system32\cmd.exe
                                cmd /c start sc start CleverSoar
                                1⤵
                                  PID:2032
                                  • C:\Windows\system32\sc.exe
                                    sc start CleverSoar
                                    2⤵
                                      PID:4716
                                  • C:\Windows\system32\cmd.exe
                                    cmd /c start sc start CleverSoar
                                    1⤵
                                      PID:2600
                                      • C:\Windows\system32\sc.exe
                                        sc start CleverSoar
                                        2⤵
                                        • Launches sc.exe
                                        PID:2800
                                    • C:\Windows\system32\cmd.exe
                                      cmd /c start sc start CleverSoar
                                      1⤵
                                        PID:4808
                                        • C:\Windows\system32\sc.exe
                                          sc start CleverSoar
                                          2⤵
                                          • Launches sc.exe
                                          PID:1144
                                      • C:\Windows\system32\cmd.exe
                                        cmd /c start sc start CleverSoar
                                        1⤵
                                          PID:2972
                                          • C:\Windows\system32\sc.exe
                                            sc start CleverSoar
                                            2⤵
                                            • Launches sc.exe
                                            PID:4524
                                        • C:\Windows\system32\cmd.exe
                                          cmd /c start sc start CleverSoar
                                          1⤵
                                            PID:4744
                                            • C:\Windows\system32\sc.exe
                                              sc start CleverSoar
                                              2⤵
                                              • Launches sc.exe
                                              PID:2724
                                          • C:\Windows\system32\cmd.exe
                                            cmd /c start sc start CleverSoar
                                            1⤵
                                              PID:2740
                                              • C:\Windows\system32\sc.exe
                                                sc start CleverSoar
                                                2⤵
                                                • Launches sc.exe
                                                PID:632
                                            • C:\Windows\system32\cmd.exe
                                              cmd /c start sc start CleverSoar
                                              1⤵
                                                PID:2620
                                                • C:\Windows\system32\sc.exe
                                                  sc start CleverSoar
                                                  2⤵
                                                  • Launches sc.exe
                                                  PID:3956
                                              • C:\Windows\system32\cmd.exe
                                                cmd /c start sc start CleverSoar
                                                1⤵
                                                  PID:3404
                                                  • C:\Windows\system32\sc.exe
                                                    sc start CleverSoar
                                                    2⤵
                                                    • Launches sc.exe
                                                    PID:652
                                                • C:\Windows\system32\cmd.exe
                                                  cmd /c start sc start CleverSoar
                                                  1⤵
                                                    PID:3340
                                                    • C:\Windows\system32\sc.exe
                                                      sc start CleverSoar
                                                      2⤵
                                                      • Launches sc.exe
                                                      PID:2384
                                                  • C:\Windows\system32\cmd.exe
                                                    cmd /c start sc start CleverSoar
                                                    1⤵
                                                      PID:3292
                                                      • C:\Windows\system32\sc.exe
                                                        sc start CleverSoar
                                                        2⤵
                                                        • Launches sc.exe
                                                        PID:2052
                                                    • C:\Windows\system32\cmd.exe
                                                      cmd /c start sc start CleverSoar
                                                      1⤵
                                                        PID:4084
                                                        • C:\Windows\system32\sc.exe
                                                          sc start CleverSoar
                                                          2⤵
                                                          • Launches sc.exe
                                                          PID:1496
                                                      • C:\Windows\system32\cmd.exe
                                                        cmd /c start sc start CleverSoar
                                                        1⤵
                                                          PID:2840
                                                          • C:\Windows\system32\sc.exe
                                                            sc start CleverSoar
                                                            2⤵
                                                            • Launches sc.exe
                                                            PID:2140
                                                        • C:\Windows\system32\cmd.exe
                                                          cmd /c start sc start CleverSoar
                                                          1⤵
                                                            PID:4228
                                                            • C:\Windows\system32\sc.exe
                                                              sc start CleverSoar
                                                              2⤵
                                                              • Launches sc.exe
                                                              PID:3224
                                                          • C:\Windows\system32\cmd.exe
                                                            cmd /c start sc start CleverSoar
                                                            1⤵
                                                              PID:4324
                                                              • C:\Windows\system32\sc.exe
                                                                sc start CleverSoar
                                                                2⤵
                                                                • Launches sc.exe
                                                                PID:3112
                                                            • C:\Windows\system32\cmd.exe
                                                              cmd /c start sc start CleverSoar
                                                              1⤵
                                                                PID:5012
                                                                • C:\Windows\system32\sc.exe
                                                                  sc start CleverSoar
                                                                  2⤵
                                                                  • Launches sc.exe
                                                                  PID:4656
                                                              • C:\Windows\system32\cmd.exe
                                                                cmd /c start sc start CleverSoar
                                                                1⤵
                                                                  PID:4572
                                                                  • C:\Windows\system32\sc.exe
                                                                    sc start CleverSoar
                                                                    2⤵
                                                                      PID:3548
                                                                  • C:\Windows\system32\cmd.exe
                                                                    cmd /c start sc start CleverSoar
                                                                    1⤵
                                                                      PID:2488
                                                                      • C:\Windows\system32\sc.exe
                                                                        sc start CleverSoar
                                                                        2⤵
                                                                        • Launches sc.exe
                                                                        PID:5020
                                                                    • C:\Windows\system32\cmd.exe
                                                                      cmd /c start sc start CleverSoar
                                                                      1⤵
                                                                        PID:4584
                                                                        • C:\Windows\system32\sc.exe
                                                                          sc start CleverSoar
                                                                          2⤵
                                                                            PID:3404
                                                                        • C:\Windows\system32\cmd.exe
                                                                          cmd /c start sc start CleverSoar
                                                                          1⤵
                                                                            PID:4600
                                                                            • C:\Windows\system32\sc.exe
                                                                              sc start CleverSoar
                                                                              2⤵
                                                                              • Launches sc.exe
                                                                              PID:3340
                                                                          • C:\Windows\system32\cmd.exe
                                                                            cmd /c start sc start CleverSoar
                                                                            1⤵
                                                                              PID:1516
                                                                              • C:\Windows\system32\sc.exe
                                                                                sc start CleverSoar
                                                                                2⤵
                                                                                • Launches sc.exe
                                                                                PID:4504
                                                                            • C:\Windows\system32\cmd.exe
                                                                              cmd /c start sc start CleverSoar
                                                                              1⤵
                                                                                PID:1904
                                                                                • C:\Windows\system32\sc.exe
                                                                                  sc start CleverSoar
                                                                                  2⤵
                                                                                    PID:2680
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  cmd /c start sc start CleverSoar
                                                                                  1⤵
                                                                                    PID:3392
                                                                                    • C:\Windows\system32\sc.exe
                                                                                      sc start CleverSoar
                                                                                      2⤵
                                                                                      • Launches sc.exe
                                                                                      PID:2140
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    cmd /c start sc start CleverSoar
                                                                                    1⤵
                                                                                      PID:4008
                                                                                      • C:\Windows\system32\sc.exe
                                                                                        sc start CleverSoar
                                                                                        2⤵
                                                                                          PID:5072
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        cmd /c start sc start CleverSoar
                                                                                        1⤵
                                                                                          PID:2340
                                                                                          • C:\Windows\system32\sc.exe
                                                                                            sc start CleverSoar
                                                                                            2⤵
                                                                                            • Launches sc.exe
                                                                                            PID:2972
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          cmd /c start sc start CleverSoar
                                                                                          1⤵
                                                                                            PID:1200
                                                                                            • C:\Windows\system32\sc.exe
                                                                                              sc start CleverSoar
                                                                                              2⤵
                                                                                              • Launches sc.exe
                                                                                              PID:4656
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            cmd /c start sc start CleverSoar
                                                                                            1⤵
                                                                                              PID:4720
                                                                                              • C:\Windows\system32\sc.exe
                                                                                                sc start CleverSoar
                                                                                                2⤵
                                                                                                • Launches sc.exe
                                                                                                PID:632
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              cmd /c start sc start CleverSoar
                                                                                              1⤵
                                                                                                PID:4128
                                                                                                • C:\Windows\system32\sc.exe
                                                                                                  sc start CleverSoar
                                                                                                  2⤵
                                                                                                  • Launches sc.exe
                                                                                                  PID:3596
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                cmd /c start sc start CleverSoar
                                                                                                1⤵
                                                                                                  PID:2292
                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                    sc start CleverSoar
                                                                                                    2⤵
                                                                                                    • Launches sc.exe
                                                                                                    PID:3032
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  cmd /c start sc start CleverSoar
                                                                                                  1⤵
                                                                                                    PID:1988
                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                      sc start CleverSoar
                                                                                                      2⤵
                                                                                                        PID:3292
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      cmd /c start sc start CleverSoar
                                                                                                      1⤵
                                                                                                        PID:3912
                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                          sc start CleverSoar
                                                                                                          2⤵
                                                                                                          • Launches sc.exe
                                                                                                          PID:548
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        cmd /c start sc start CleverSoar
                                                                                                        1⤵
                                                                                                          PID:1712
                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                            sc start CleverSoar
                                                                                                            2⤵
                                                                                                              PID:2828
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            cmd /c start sc start CleverSoar
                                                                                                            1⤵
                                                                                                              PID:4808
                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                sc start CleverSoar
                                                                                                                2⤵
                                                                                                                • Launches sc.exe
                                                                                                                PID:664
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              cmd /c start sc start CleverSoar
                                                                                                              1⤵
                                                                                                                PID:1120
                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                  sc start CleverSoar
                                                                                                                  2⤵
                                                                                                                  • Launches sc.exe
                                                                                                                  PID:3144
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                cmd /c start sc start CleverSoar
                                                                                                                1⤵
                                                                                                                  PID:1012
                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                    sc start CleverSoar
                                                                                                                    2⤵
                                                                                                                    • Launches sc.exe
                                                                                                                    PID:3440
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /c start sc start CleverSoar
                                                                                                                  1⤵
                                                                                                                    PID:4444
                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                      sc start CleverSoar
                                                                                                                      2⤵
                                                                                                                      • Launches sc.exe
                                                                                                                      PID:2488
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd /c start sc start CleverSoar
                                                                                                                    1⤵
                                                                                                                      PID:4128
                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                        sc start CleverSoar
                                                                                                                        2⤵
                                                                                                                          PID:2068
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        cmd /c start sc start CleverSoar
                                                                                                                        1⤵
                                                                                                                          PID:3616
                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                            sc start CleverSoar
                                                                                                                            2⤵
                                                                                                                            • Launches sc.exe
                                                                                                                            PID:624
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          cmd /c start sc start CleverSoar
                                                                                                                          1⤵
                                                                                                                            PID:4084
                                                                                                                            • C:\Windows\system32\sc.exe
                                                                                                                              sc start CleverSoar
                                                                                                                              2⤵
                                                                                                                              • Launches sc.exe
                                                                                                                              PID:1556
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            cmd /c start sc start CleverSoar
                                                                                                                            1⤵
                                                                                                                              PID:4792
                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                sc start CleverSoar
                                                                                                                                2⤵
                                                                                                                                • Launches sc.exe
                                                                                                                                PID:2032
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              cmd /c start sc start CleverSoar
                                                                                                                              1⤵
                                                                                                                                PID:2828
                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                  sc start CleverSoar
                                                                                                                                  2⤵
                                                                                                                                    PID:2600
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  cmd /c start sc start CleverSoar
                                                                                                                                  1⤵
                                                                                                                                    PID:664
                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                      sc start CleverSoar
                                                                                                                                      2⤵
                                                                                                                                      • Launches sc.exe
                                                                                                                                      PID:3996
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    cmd /c start sc start CleverSoar
                                                                                                                                    1⤵
                                                                                                                                      PID:1200
                                                                                                                                      • C:\Windows\system32\sc.exe
                                                                                                                                        sc start CleverSoar
                                                                                                                                        2⤵
                                                                                                                                          PID:4744
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        cmd /c start sc start CleverSoar
                                                                                                                                        1⤵
                                                                                                                                          PID:3548
                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                            sc start CleverSoar
                                                                                                                                            2⤵
                                                                                                                                              PID:4656
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            cmd /c start sc start CleverSoar
                                                                                                                                            1⤵
                                                                                                                                              PID:1476
                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                sc start CleverSoar
                                                                                                                                                2⤵
                                                                                                                                                • Launches sc.exe
                                                                                                                                                PID:1768
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              cmd /c start sc start CleverSoar
                                                                                                                                              1⤵
                                                                                                                                                PID:2832
                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                  sc start CleverSoar
                                                                                                                                                  2⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:1348
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                cmd /c start sc start CleverSoar
                                                                                                                                                1⤵
                                                                                                                                                  PID:2512
                                                                                                                                                  • C:\Windows\system32\sc.exe
                                                                                                                                                    sc start CleverSoar
                                                                                                                                                    2⤵
                                                                                                                                                    • Launches sc.exe
                                                                                                                                                    PID:2696
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  cmd /c start sc start CleverSoar
                                                                                                                                                  1⤵
                                                                                                                                                    PID:1904
                                                                                                                                                    • C:\Windows\system32\sc.exe
                                                                                                                                                      sc start CleverSoar
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4376
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      cmd /c start sc start CleverSoar
                                                                                                                                                      1⤵
                                                                                                                                                        PID:2596
                                                                                                                                                        • C:\Windows\system32\sc.exe
                                                                                                                                                          sc start CleverSoar
                                                                                                                                                          2⤵
                                                                                                                                                          • Launches sc.exe
                                                                                                                                                          PID:2268
                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                        cmd /c start sc start CleverSoar
                                                                                                                                                        1⤵
                                                                                                                                                          PID:1144
                                                                                                                                                          • C:\Windows\system32\sc.exe
                                                                                                                                                            sc start CleverSoar
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4344
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            cmd /c start sc start CleverSoar
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4604
                                                                                                                                                              • C:\Windows\system32\sc.exe
                                                                                                                                                                sc start CleverSoar
                                                                                                                                                                2⤵
                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                PID:1200
                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                              cmd /c start sc start CleverSoar
                                                                                                                                                              1⤵
                                                                                                                                                                PID:4660
                                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                                  sc start CleverSoar
                                                                                                                                                                  2⤵
                                                                                                                                                                  • Launches sc.exe
                                                                                                                                                                  PID:4720
                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                cmd /c start shutdown -f -r -t 00
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4340
                                                                                                                                                                  • C:\Windows\system32\shutdown.exe
                                                                                                                                                                    shutdown -f -r -t 00
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2724
                                                                                                                                                                  • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                    "LogonUI.exe" /flags:0x4 /state0:0xa3851055 /state1:0x41c64e6d
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                    PID:4000

                                                                                                                                                                  Network

                                                                                                                                                                  MITRE ATT&CK Enterprise v15

                                                                                                                                                                  Replay Monitor

                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                  Downloads

                                                                                                                                                                  • C:\Config.Msi\e57e11a.rbs

                                                                                                                                                                    Filesize

                                                                                                                                                                    13.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    5af662c7d1c31e07e7d8b2900c17b09f

                                                                                                                                                                    SHA1

                                                                                                                                                                    72dd7ae0183e46fda6eb5d5d0df49145f28c887a

                                                                                                                                                                    SHA256

                                                                                                                                                                    7dfb961cadd4f8d1a54c9c6b5fc00b404e7f7e4cf92a426d02e98193b336af2b

                                                                                                                                                                    SHA512

                                                                                                                                                                    d809ef03d83f088e5e48085ba5d74be8d16acb133bbf188df1d411a7b4bf21daf9b6b0df2961d2e62d1d21de9988cf1568842b0744b4c78d5ed63ac5693b7d6d

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\7za.bin

                                                                                                                                                                    Filesize

                                                                                                                                                                    577KB

                                                                                                                                                                    MD5

                                                                                                                                                                    f77c0b61806b6865c888592e178294c3

                                                                                                                                                                    SHA1

                                                                                                                                                                    e9e0b393cc977fbdbc44fe19d92879a38a4dad0c

                                                                                                                                                                    SHA256

                                                                                                                                                                    b85490de04744a2e30a815bfad752b520e87f71a1ce92dd23a0ed975b4836c82

                                                                                                                                                                    SHA512

                                                                                                                                                                    b4214f31ce76ba40d57ff64d204b3e0943a66e0b58302a22a92dbba98b847cbd6191a780e8940bea0498771a207c7024370b61fcbf310b22824d2b632efa7f12

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\7za.exe

                                                                                                                                                                    Filesize

                                                                                                                                                                    577KB

                                                                                                                                                                    MD5

                                                                                                                                                                    fbc6e272e89203cb9ddb3f88b4954deb

                                                                                                                                                                    SHA1

                                                                                                                                                                    fc75778e7e0c9f1bb67bc1097fdb9a5bcd5e7a0d

                                                                                                                                                                    SHA256

                                                                                                                                                                    99026dc8b99c6ea934b943f41a543f39040d837650d7f185ebd9f147a49ea1b6

                                                                                                                                                                    SHA512

                                                                                                                                                                    b010571d7924e35feedc32ad82020dc85903cf4e8a606ee055f6f4f6485982839ad1bad83f56301610d9b063a7fe55d403e6113a8c285c06d96c9b3ec8783425

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\locale.bin

                                                                                                                                                                    Filesize

                                                                                                                                                                    55KB

                                                                                                                                                                    MD5

                                                                                                                                                                    591cbc59b64c8592744ae5f8f02daa4b

                                                                                                                                                                    SHA1

                                                                                                                                                                    3d3556785d30ec2095beee1275b708d307e90a3c

                                                                                                                                                                    SHA256

                                                                                                                                                                    1b0852406450e6c369c8bdd600976fd52e4ed3d6125659ba0845ea537dad2bcb

                                                                                                                                                                    SHA512

                                                                                                                                                                    99af9f665bc9f2c4751825ce5a2a2da719b6db3e811668ac555f5a2a0f7cf0e6c4e902e250751084f8b7787980cd4efe1af6251f07e6d971717fb705706c3cc9

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\locale2.bin

                                                                                                                                                                    Filesize

                                                                                                                                                                    55KB

                                                                                                                                                                    MD5

                                                                                                                                                                    2f2bf41e2cae24881b7353510b3b35e8

                                                                                                                                                                    SHA1

                                                                                                                                                                    21babd383c1e89eed4993760e2f64ef8ea39aedd

                                                                                                                                                                    SHA256

                                                                                                                                                                    826a8a6b44d5ea01cf7d23b0941e8e0591e83c9d246ccd052d6739d736f35133

                                                                                                                                                                    SHA512

                                                                                                                                                                    96b878fc10c345f4090b410c51d2f6617fbaa7cd9a67c288e4e3c5c49b43a4613c030d10e89baa03d1b780ace4de0e6c7c66dbf6a7e3d92d93a16c4ce1c7845e

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\locale3.bin

                                                                                                                                                                    Filesize

                                                                                                                                                                    29KB

                                                                                                                                                                    MD5

                                                                                                                                                                    6177495bc3fe9c1c9ddb004cce5e51ac

                                                                                                                                                                    SHA1

                                                                                                                                                                    5b2d16055a93ee4fceedc0f308f3733156f5deb8

                                                                                                                                                                    SHA256

                                                                                                                                                                    5fbfd09294d7e0fc9a86964c68d646a6a74d590762b75b65ce138ce356ca1b51

                                                                                                                                                                    SHA512

                                                                                                                                                                    4f725f9a75113a192aba27c96efb3c387559d64be0ee30f26cc74bd0fddc1f57ca1592054dde18fe5dd9516ab017801705b043dfa40ca3d85a6cc5f2ee9105a7

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\locale3.dat

                                                                                                                                                                    Filesize

                                                                                                                                                                    29KB

                                                                                                                                                                    MD5

                                                                                                                                                                    c6cd33f25c71000e089e3ba2a18e907a

                                                                                                                                                                    SHA1

                                                                                                                                                                    853f963fd6edcb07e199c20eac25177f2894c5ba

                                                                                                                                                                    SHA256

                                                                                                                                                                    161196b017d1fa466c9b806e2d62614026e9d34958eb47af0dab270f4eca881c

                                                                                                                                                                    SHA512

                                                                                                                                                                    a27b014fc0df449a39111067ce21ba3ef2ead39d1a2abad9d9e61a60b43f53d50d2789a61961dced1fe3782d55e42fc084fa06eec335a51b802d6a4c13436bd7

                                                                                                                                                                  • C:\Program Files (x86)\Windows NT\locale4.bin

                                                                                                                                                                    Filesize

                                                                                                                                                                    73KB

                                                                                                                                                                    MD5

                                                                                                                                                                    1ed346bcc3cc05a73f8391ffcd7f60cc

                                                                                                                                                                    SHA1

                                                                                                                                                                    3df7906454103d79ab93148e9a3e8f0ed6e9c90d

                                                                                                                                                                    SHA256

                                                                                                                                                                    e7b4f3562ab8e296701316291a73b0aadd9ba9f5e98c64d97fea35b21a670a21

                                                                                                                                                                    SHA512

                                                                                                                                                                    e5f57a73744fecdbf2b329f6f24c816b86e883bbc56b9b9b0049271d59c39c7b677a5eea8a846c487f23f5d9c8dcf027e9df548b604cdad98fad221949f49c91

                                                                                                                                                                  • C:\Windows\Installer\MSIE39A.tmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    13.8MB

                                                                                                                                                                    MD5

                                                                                                                                                                    b847332b6221ef7b0ab9233f47934dc9

                                                                                                                                                                    SHA1

                                                                                                                                                                    6dfe21baadbdfb5b4fd4c97041f333dc879f0faa

                                                                                                                                                                    SHA256

                                                                                                                                                                    8239c85adbeeff92dfa7ae4d30eda9cea602c9bf13609c5db2250dbc995f9161

                                                                                                                                                                    SHA512

                                                                                                                                                                    7cb582c5aa8768a2032ae1c16989f8dae4650dd5b17de025277acf373182de076a2f65d44c8e534cb55647ff206a9ed86be370d7417cdaf8a6ee6c19a68922db

                                                                                                                                                                  • C:\Windows\Installer\e57e119.msi

                                                                                                                                                                    Filesize

                                                                                                                                                                    14.4MB

                                                                                                                                                                    MD5

                                                                                                                                                                    28be818ac9500048abe00f46c93def8c

                                                                                                                                                                    SHA1

                                                                                                                                                                    11dd4516325e2d032f07f8a90aa66c035fb48c3c

                                                                                                                                                                    SHA256

                                                                                                                                                                    6468178241c7f17fce1237634265d9aed547976c891d517e4fcac37421ca03f0

                                                                                                                                                                    SHA512

                                                                                                                                                                    55f80e299a0e548586100a6cbd1d5af0741a5d1e19b67648fb2a2fe51c6e43475e9066386711c824750cb4a3331c5c7d5208d5037dcfa1f873f1679738baa12f

                                                                                                                                                                  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                                                                                                                                                                    Filesize

                                                                                                                                                                    24.1MB

                                                                                                                                                                    MD5

                                                                                                                                                                    225e2fffb4c188fe887964a956af587d

                                                                                                                                                                    SHA1

                                                                                                                                                                    87afc5fbeea7ef25ec775ec241925e586b8718e0

                                                                                                                                                                    SHA256

                                                                                                                                                                    47c87f65597b3d2aad6dd734890753a6831fdbaf47c2026d47b15caa89ed4d66

                                                                                                                                                                    SHA512

                                                                                                                                                                    e91412e7b9334a6b676b0fe8d60cbb4e25c03580fb32cecce00e5316725b08f9711192f3b20a800422380574d29d61bff1fbebdc46c8732b3d4ec470f0764b5c

                                                                                                                                                                  • \??\Volume{612d9cf5-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{1c347842-f6b1-496b-ae2f-63b878de5cb0}_OnDiskSnapshotProp

                                                                                                                                                                    Filesize

                                                                                                                                                                    6KB

                                                                                                                                                                    MD5

                                                                                                                                                                    c9380c27dacd7f0865eeea49f0c9ea69

                                                                                                                                                                    SHA1

                                                                                                                                                                    3191a956962c61972dbc8fad71c3da07ecc9477f

                                                                                                                                                                    SHA256

                                                                                                                                                                    27a5e46373e5d23500433b92282d777dd0c8ef861394c3fa0f0c04d0f9a1569c

                                                                                                                                                                    SHA512

                                                                                                                                                                    389c096d5572aafaa1d7371e6bd1a692b27e6c0e1a3d374764bbe55c1711e92b50dab26c8a61fdec6d20bd76d8a9a3326e5129961c24b51544fc1d1290d3bffc

                                                                                                                                                                  • memory/1568-23-0x00007FFF05150000-0x00007FFF05152000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    8KB

                                                                                                                                                                  • memory/1568-24-0x00007FFF05160000-0x00007FFF05162000-memory.dmp

                                                                                                                                                                    Filesize

                                                                                                                                                                    8KB