Analysis
-
max time kernel
84s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
26-11-2024 15:52
General
-
Target
Optimizer.exe
-
Size
159KB
-
MD5
59c1d1b1d0e5447efc7dea6087ecee39
-
SHA1
b824b16e781a3238dfe9bbe3b34990a1054c48d5
-
SHA256
c1d0c89274c04a62eed5c41f5fe592e95dbd4e4e2e25b6000ebb5ddefd2124cb
-
SHA512
cba7c13bb2e9267d2c78bb9f98fcca1a8b2c84ad6cd27cae9e0b701107c944d292dfdc032bd8a90c4877c04b173703ff8a66246002ab9bdb85e3604a843a5ddc
-
SSDEEP
3072:+vjciRUMVLEK/NwhxaE0UojUPeKW74MELtomx9avYFZloH8:UjeJcQ900eWZxWvYFZloH8
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
Processes:
cmd.exedescription ioc Process File opened for modification C:\Windows\System32\drivers\HdAudio.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rdpdr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vmbkmcl.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WdfLdr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\pnpmem.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\tpm.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\bindflt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\EhStorTcgDrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\ndis.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\usbuhci.sys cmd.exe File opened for modification C:\Windows\System32\drivers\BthMini.SYS cmd.exe File opened for modification C:\Windows\System32\drivers\mshidumdf.sys cmd.exe File opened for modification C:\Windows\System32\drivers\raspppoe.sys cmd.exe File opened for modification C:\Windows\System32\drivers\MF7R0W~1.SYS cmd.exe File opened for modification C:\Windows\System32\drivers\sdbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\dmvsc.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\NdisImPlatform.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\sdbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\pcmcia.sys cmd.exe File opened for modification C:\Windows\System32\drivers\i8042prt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rootmdm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tdi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vmbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\EhStorPwdDrv.dll cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\idtsec.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\hidbth.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\gm.dls cmd.exe File opened for modification C:\Windows\System32\drivers\gpuenergydrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbprint.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bthmodem.sys cmd.exe File opened for modification C:\Windows\System32\drivers\MTConfig.sys cmd.exe File opened for modification C:\Windows\System32\drivers\volume.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WindowsTrustedRTProxy.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Acx01000.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\ndisuio.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hidbth.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hvcrash.sys cmd.exe File opened for modification C:\Windows\System32\drivers\isapnp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vhdmp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\dxgmms2.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\parport.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\volmgrx.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\modem.sys cmd.exe File opened for modification C:\Windows\System32\drivers\usbaudio2.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\rdpdr.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\NetAdapterCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\vmstorfl.sys cmd.exe File opened for modification C:\Windows\System32\drivers\iagpio.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ramdisk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WpdUpFltr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cdrom.sys cmd.exe File opened for modification C:\Windows\System32\drivers\umpass.sys cmd.exe File opened for modification C:\Windows\System32\drivers\VMBusHID.sys cmd.exe File opened for modification C:\Windows\System32\drivers\AppvVemgr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\wdf01000.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\fastfat.sys cmd.exe File opened for modification C:\Windows\System32\drivers\flpydisk.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Udecx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\agilevpn.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Hsp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\TsUsbGD.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wof.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\IndirectKmd.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\http.sys cmd.exe -
Possible privilege escalation attempt 2 IoCs
Processes:
takeown.exeicacls.exepid Process 1696 takeown.exe 4584 icacls.exe -
Modifies file permissions 1 TTPs 2 IoCs
Processes:
takeown.exeicacls.exepid Process 1696 takeown.exe 4584 icacls.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops desktop.ini file(s) 2 IoCs
Processes:
cmd.exedescription ioc Process File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMC91F~1.348\f\Desktop.ini cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMA81C~1.348\f\Desktop.ini cmd.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
cmd.exedescription ioc Process File opened for modification C:\Windows\BITLOC~1\autorun.inf cmd.exe -
Drops file in System32 directory 64 IoCs
Processes:
cmd.exedescription ioc Process File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_smrvolume.inf_loc cmd.exe File opened for modification C:\Windows\System32\efsutil.dll cmd.exe File opened for modification C:\Windows\System32\Dism\it-IT\GenericProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mchgr.inf_amd64_ec6b084dd265a1b9\libxprmc.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\rtucx21x64.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\dmwappushsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\CredentialEnrollmentManager.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\sdiagschd.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\ucmhc.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\SyncCenter.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\EhStorTcgDrv.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\rndiscmp.inf_loc cmd.exe File opened for modification C:\Windows\System32\Dsui.dll cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_firmware.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\sti.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\nslookup.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\msimtf.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\wiashext.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mssmbios.inf_amd64_024cf8907d50e0c7\mssmbios.inf cmd.exe File opened for modification C:\Windows\System32\fr-FR\dot3gpui.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\fsmgmt.msc cmd.exe File opened for modification C:\Windows\System32\de-DE\DeviceDisplayStatusManager.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\vdsvd.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\utcutil.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\c_hidclass.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_3a1d2b0fbf0ff772\mdmjf56e.inf cmd.exe File opened for modification C:\Windows\System32\en-US\tpmcompc.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\trkwks.dll.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\cscui.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\osk.exe.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\hiddigi.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\c_fdc.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netr28ux.inf_amd64_d5996f2a9d9aa9e3\netr28ux.inf cmd.exe File opened for modification C:\Windows\System32\en-US\Locator.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\dmpushroutercore.dll.mui cmd.exe File opened for modification C:\Windows\System32\cemapi.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\batmeter.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\c_scmdisk.inf_loc cmd.exe File opened for modification C:\Windows\System32\de-DE\l3codeca.acm.mui cmd.exe File opened for modification C:\Windows\System32\en-US\mciseq.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\newdev.dll.mui cmd.exe File opened for modification C:\Windows\System32\downlevel\api-ms-win-core-stringloader-l1-1-1.dll cmd.exe File opened for modification C:\Windows\System32\es-ES\WMVDECOD.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\AuditPolicyGPInterop.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\scrptadm.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\thumbcache.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\iaLPSS2i_GPIO2_SKL.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\MTConfig.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\remotepg.dll.mui cmd.exe File opened for modification C:\Windows\System32\ExplorerFrame.dll cmd.exe File opened for modification C:\Windows\System32\fr-FR\dot3ui.dll.mui cmd.exe File opened for modification C:\Windows\System32\CapabilityAccessManager.dll cmd.exe File opened for modification C:\Windows\System32\dafDockingProvider.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\PlayToStatusProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\dui70.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\msports.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_783312763f8749c7\l260x64.sys cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\netmlx4eth63.inf_loc cmd.exe File opened for modification C:\Windows\System32\fr-FR\label.exe.mui cmd.exe File opened for modification C:\Windows\System32\fr-FR\nduprov.dll.mui cmd.exe File opened for modification C:\Windows\System32\DesktopSwitcherDataModel.dll cmd.exe File opened for modification C:\Windows\System32\en-US\raserver.exe.mui cmd.exe File opened for modification C:\Windows\System32\en-US\sessenv.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_proximity.inf_loc cmd.exe -
Processes:
resource yara_rule behavioral1/memory/4400-0-0x00007FF61F8E0000-0x00007FF61F93A000-memory.dmp upx behavioral1/memory/4400-2-0x00007FF61F8E0000-0x00007FF61F93A000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
Processes:
cmd.exedescription ioc Process File opened for modification C:\PROGRA~1\WindowsApps\MI9463~1.0_X\Assets\CONTRA~2\SPLASH~3.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI36E3~1.0_X\LensSDK\Assets\THIRDP~1\THIRDP~1.HTM cmd.exe File opened for modification C:\PROGRA~1\COMMON~1\MICROS~1\ink\en-US\mshwLatin.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MI7D4E~1.SCA\Assets\PHADE1~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0311~1.0_X\Images\CONTRA~1\POWERA~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0311~1.0_X\Images\CONTRA~1\PO1194~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0311~1.0_X\Images\PO6EAB~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI369D~1.0_X\Assets\SnipSketchAppList.targetsize-16_altform-lightunplated.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\CONTRA~2\AppIcon.targetsize-96_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\CONTRA~2\APD4AC~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.9_X\DASHBO~1\WEBCON~1\NODE_M~1\@FLUEN~1\theme\NODE_M~1\@UIFAB~1\UTILIT~1\LIB-CO~1\dom\GETCHI~1.JS cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI25F8~1.0_X\MICROS~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI3116~1.0_X\images\CONTRA~1\HX311D~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\APPICO~3.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.0_X\Assets\Store\AppIcon.altform-unplated_targetsize-16.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI91CD~1.0_X\Assets\CONTRA~2\PaintAppList.targetsize-16.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI369D~1.0_X\Assets\CONTRA~1\SN12C5~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI7115~1.0_X\Assets\ThankYou\GENERI~1.JPG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI914F~1.0_X\wt.exe cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\WINDOW~1.100\ACTIVA~1.DAT cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0311~1.0_X\APPXSI~1.P7X cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI98F9~1.0_X\RESOUR~1.PRI cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIF169~1.0_X\MICROS~1.EXE cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIFEE6~1.0_X\Assets\NotepadAppList.targetsize-60.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.9_X\DASHBO~1\WEBCON~1\NODE_M~1\@FLUEN~1\react\lib\Keytips.js cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\UEV\INBOXT~1\MicrosoftOutlook2016CAWin64.xml cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MI128C~1.SCA\Assets\CONTRA~1\APPPAC~2.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIC0CF~1.0_X\Images\FILEPD~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI854A~1.0_X\MFC140~3.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI98F9~1.0_X\Assets\LargeTile.scale-125.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI9463~1.0_X\APPXMA~1.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI2937~1.SCA\Win10\CONTRA~1\MICROS~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI369D~1.0_X\Assets\SnipSketchAppList.targetsize-20.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI69C6~1.0_X\VCOMP1~1.DLL cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI1864~1.0_X\Assets\CONTRA~2\ORIENT~4.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Should.ps1 cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\MIECD6~1.XML cmd.exe File opened for modification C:\PROGRA~1\WI54FB~1\fr-FR\wmpnssci.dll.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIF8B8~1.0_X\Assets\CONTRA~1\SmallTile.scale-150_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI7115~1.0_X\Assets\FeedbackHubAppList.targetsize-16_altform-lightunplated.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI0171~1.0_X\MICROS~1.MEC\Assets\OFFLIN~1\Scripts\Me\MECONT~1\offline\WEBVIE~1.JS cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MI9E53~1.100\ACTIVA~2.LOG cmd.exe File opened for modification C:\PROGRA~1\WI8A19~1\es-ES\ImagingDevices.exe.mui cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIC0CF~1.0_X\Images\APPWOR~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI369D~1.0_X\Assets\SnipSketchAppList.targetsize-40.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI01ED~1.SCA\Assets\CONTRA~1\FEEDBA~1.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICB88~1.0_X\Assets\AppTiles\AppIcon.targetsize-30.png cmd.exe File opened for modification C:\PROGRA~3\MICROS~1\Windows\AppRepository\Packages\MIA51D~1.0_X\ACTIVA~1.DAT cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\DELETE~1\MICROS~4.SCA\Assets\CONTRA~1\PaintAppList.scale-125.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.SCA\Assets\AppTiles\CONTRA~2\WEATHE~4.PNG cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI7454~1.SCA\APPXSI~1.P7X cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.9_X\DASHBO~1\WEBCON~1\NODE_M~1\@FLUEN~1\theme\NODE_M~1\@FLUEN~1\DOM-UT~1\lib\ISVIRT~1.JS cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.9_X\DASHBO~1\WEBCON~1\NODE_M~1\@FLUEN~1\theme\NODE_M~1\@UIFAB~1\MERGE-~1\lib\IKEYFR~1.JS cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI7115~1.0_X\Assets\CONTRA~2\FeedbackHubAppList.targetsize-32_altform-lightunplated.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~1.9_X\DASHBO~1\WEBCON~1\NODE_M~1\@FLUEN~1\react\LIB-CO~1\COMPON~1\GROUPE~1\GROUPH~4.JS cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIBB2A~1.SCA\APPXMA~1.XML cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI3116~1.0_X\images\LinkedInboxSmallTile.scale-125.png cmd.exe File opened for modification C:\PROGRA~1\REFERE~1\MICROS~1\FRAMEW~1\v3.0\de\ReachFramework.resources.dll cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MICROS~3.SCA\Assets\AppTiles\CONTRA~2\WeatherSplashScreen.scale-100_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI686B~1.0_X\Assets\TipsAppList.targetsize-64_altform-unplated_contrast-white.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MIF8B8~1.0_X\Assets\CONTRA~1\AppList.targetsize-40_altform-unplated_contrast-black.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI8E4F~1.0_X\Win10\CARDFL~1.DAT cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI16AF~1.SCA\Assets\CONTRA~2\PeopleBadgeLogo.scale-100.png cmd.exe File opened for modification C:\PROGRA~1\WindowsApps\MI3116~1.0_X\images\Snooze.scale-64.png cmd.exe -
Drops file in Windows directory 64 IoCs
Processes:
cmd.exedescription ioc Process File opened for modification C:\Windows\servicing\INBOXF~1\metadata\LAC889~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI12B1~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI0B48~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI3790~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI818D~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM2428~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM7C62~1.132\f\EXPLOR~1.ADM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM280A~1.184\f\UPDATE~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI681E~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM3325~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM2F07~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM6758~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI59A4~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI62D2~1.MUM cmd.exe File opened for modification C:\Windows\diagnostics\system\DeviceCenter\de-DE\DiagPackage.dll.mui cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it\Microsoft.Activities.Build.resources.dll cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AME67C~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MIC186~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\WO45AF~1.MAN cmd.exe File opened for modification C:\Windows\servicing\Packages\MI1F6F~1.MUM cmd.exe File opened for modification C:\Windows\servicing\Packages\MI891F~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI3955~1.CAT cmd.exe File opened for modification C:\Windows\PolicyDefinitions\Servicing.admx cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM6DCD~1.469\f\wbiosrvc.dll cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\HYD220~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI38F4~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MIA543~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI43AE~1.CAT cmd.exe File opened for modification C:\Windows\Boot\EFI\en-GB\bootmgfw.efi.mui cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\sysglobl.resources.dll cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI4610~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\WIE6BD~1.CAT cmd.exe File opened for modification C:\Windows\INF\UGTHRSVC\0407\gthrctr.ini cmd.exe File opened for modification C:\Windows\servicing\Packages\MI4D6B~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM9F29~1.MAN cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMB1AC~1.493\f\FILEEX~1\Assets\images\CONTRA~2\THEME-~1\WI6CEA~1.SVG cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\COCA42~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI4D21~1.MUM cmd.exe File opened for modification C:\Windows\en-US\bootfix.bin cmd.exe File opened for modification C:\Windows\servicing\Packages\MI1BC6~1.CAT cmd.exe File opened for modification C:\Windows\diagnostics\system\WindowsUpdate\cl_windowsupdate.ps1 cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\X8C213~1.MAN cmd.exe File opened for modification C:\Windows\servicing\Packages\HYBD9A~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\HYF091~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI7690~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\HY060E~1.CAT cmd.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\de\System.ServiceModel.Internals.resources.dll cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MIC172~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI5B1F~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\X86_MI~4.-RS\f\license.rtf cmd.exe File opened for modification C:\Windows\servicing\Packages\MIA934~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI4C6D~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\CO6448~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMB1AC~1.493\f\Assets\CONTRA~1\GEE480~1.PNG cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI1994~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AMDE24~1.120\f\W32UIR~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\WOF154~1.184\f\FIXMAP~1.MUI cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\X8801C~1.348\f\CHSPIN~2.LEX cmd.exe File opened for modification C:\Windows\servicing\Packages\MI388B~1.CAT cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\AM2F24~1.120\f\RS_DIS~2.PSD cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI925B~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\MIEA55~1.MUM cmd.exe File opened for modification C:\Windows\servicing\LCU\PACKAG~1.3\MI9A92~1.CAT cmd.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-PeerToPeer-Full-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
takeown.exedescription pid Process Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe Token: SeTakeOwnershipPrivilege 1696 takeown.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Optimizer.execmd.execmd.execmd.exedescription pid Process procid_target PID 4400 wrote to memory of 1056 4400 Optimizer.exe 78 PID 4400 wrote to memory of 1056 4400 Optimizer.exe 78 PID 1056 wrote to memory of 4920 1056 cmd.exe 79 PID 1056 wrote to memory of 4920 1056 cmd.exe 79 PID 1056 wrote to memory of 1036 1056 cmd.exe 80 PID 1056 wrote to memory of 1036 1056 cmd.exe 80 PID 4400 wrote to memory of 4816 4400 Optimizer.exe 81 PID 4400 wrote to memory of 4816 4400 Optimizer.exe 81 PID 4816 wrote to memory of 1696 4816 cmd.exe 82 PID 4816 wrote to memory of 1696 4816 cmd.exe 82 PID 4400 wrote to memory of 4212 4400 Optimizer.exe 83 PID 4400 wrote to memory of 4212 4400 Optimizer.exe 83 PID 4212 wrote to memory of 4584 4212 cmd.exe 84 PID 4212 wrote to memory of 4584 4212 cmd.exe 84 PID 4400 wrote to memory of 2552 4400 Optimizer.exe 85 PID 4400 wrote to memory of 2552 4400 Optimizer.exe 85 PID 4400 wrote to memory of 3532 4400 Optimizer.exe 86 PID 4400 wrote to memory of 3532 4400 Optimizer.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\Optimizer.exe"C:\Users\Admin\AppData\Local\Temp\Optimizer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chcp 65001 && cls && title PC FUCKER OPTIMIZER && color 0B && mode 145,302⤵
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Windows\system32\chcp.comchcp 650013⤵PID:4920
-
-
C:\Windows\system32\mode.commode 145,303⤵PID:1036
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c takeown /f C:\ /r /d y2⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\system32\takeown.exetakeown /f C:\ /r /d y3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1696
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\ /grant administrators:F /t2⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\system32\icacls.exeicacls C:\ /grant administrators:F /t3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4584
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q D:\2⤵PID:2552
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c rd /s /q C:\2⤵
- Drops file in Drivers directory
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3532
-