Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15-12-2024 00:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe
Resource
win7-20240903-en
windows7-x64
24 signatures
150 seconds
General
-
Target
2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe
-
Size
4.7MB
-
MD5
78478e21d3d565bdbad21ea998100989
-
SHA1
1220591d01d37602d4c115fc1aa6595ac9d6c10c
-
SHA256
740c779fb642de8bd9b50dcb1a5669c88d997c8b6eae72f680ae858d06fde292
-
SHA512
a5886bb4cc43b6a1f31b1223178c9a43f160b86bc6dd9916b840103b66fa866c83cb1b43d61071f96abbc1704ac9b5a681d9e5c57020c0a5d2c2997976ca097c
-
SSDEEP
49152:NOSWCbNc7wKlXFJAgYPPhkmS/tajqOwBQ2dP5TROPE46tW5HiD3uZAt:c0csYInifojqNBdP5Ri6A5HiD3qAt
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\system32\Drivers\scdemu.sys setup64.exe File opened for modification C:\Windows\system32\Drivers\scdemu.sys setup64.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Executes dropped EXE 3 IoCs
pid Process 3040 PowerISO8-x64-Full.exe 1032 devcon.exe 4876 setup64.exe -
Loads dropped DLL 2 IoCs
pid Process 3040 PowerISO8-x64-Full.exe 3040 PowerISO8-x64-Full.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\J: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\L: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\V: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\W: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\H: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\M: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\Y: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\E: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\Q: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\R: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\S: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\X: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\I: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\K: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\N: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\O: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\P: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\T: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\U: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened (read-only) \??\Z: 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
resource yara_rule behavioral2/memory/2884-4-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-5-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-3-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-7-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-6-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-8-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-10-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-9-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-1-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-11-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-17-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-16-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-18-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-27-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-26-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-29-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-30-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-31-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-33-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-35-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-37-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-39-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-43-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-44-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-46-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-55-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-57-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-59-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-61-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-63-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-65-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-72-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-75-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-77-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-78-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-80-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-82-0x0000000002900000-0x000000000398E000-memory.dmp upx behavioral2/memory/2884-84-0x0000000002900000-0x000000000398E000-memory.dmp upx -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\PowerISO\Lang\Russian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Bosnian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\piso.exe PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\setup64.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\TradChinese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Turkish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\SimpChinese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Slovak.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\unrar64.dll PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\Korean.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Indonesian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\libFLAC.DLL PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Polish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Slovenian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Belarusian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Finnish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\libvorbis.DLL PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\Hungarian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\danish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\czech.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\German.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Farsi.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\7z-x64.dll PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PWRISOSH.DLL PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Urdu(Pakistan).ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\MACDll.DLL PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\PowerISO.chm PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\Bulgarian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Greek.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\croatian.ini PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PWRISOVM.EXE PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\English.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Italian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Japanese.ini PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\french.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Azerbaijani.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Arabic.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Norsk.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\uninstall.exe PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File opened for modification C:\Program Files\PowerISO\devcon.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Spanish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Thai.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Armenian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Malay.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Romanian.ini PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\Lithuanian.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Swedish.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Portuguese(Brazil).ini PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PWRISOVM.exe PowerISO8-x64-Full.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe File created C:\Program Files\PowerISO\Lang\Burmese.ini PowerISO8-x64-Full.exe File opened for modification C:\Program Files\PowerISO\PowerISO.exe PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\License.txt PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\Vietnamese.ini PowerISO8-x64-Full.exe File created C:\Program Files\PowerISO\Lang\kazakh.ini PowerISO8-x64-Full.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PowerISO8-x64-Full.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs devcon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID devcon.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs devcon.exe -
Modifies registry class 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cif PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.rar PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cdi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.p01 PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pxi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bif PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ima PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wim PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bin PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.c2d PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ncd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cue PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mdf PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bwi PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mds PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fcd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vcd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.img PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.nrg PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.b5i PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ashdisc PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lcd PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.dmg PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.flp PowerISO8-x64-Full.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8658416-7CCB-4c1d-A021-AFF0A2EB8004} 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe Token: SeDebugPrivilege 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 3040 PowerISO8-x64-Full.exe 1032 devcon.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 768 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 8 PID 2884 wrote to memory of 776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 9 PID 2884 wrote to memory of 60 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 13 PID 2884 wrote to memory of 2996 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 51 PID 2884 wrote to memory of 3032 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 52 PID 2884 wrote to memory of 392 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 53 PID 2884 wrote to memory of 3436 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 56 PID 2884 wrote to memory of 3552 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 57 PID 2884 wrote to memory of 3748 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 58 PID 2884 wrote to memory of 3840 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 59 PID 2884 wrote to memory of 3916 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 60 PID 2884 wrote to memory of 4044 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 61 PID 2884 wrote to memory of 3976 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 62 PID 2884 wrote to memory of 312 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 74 PID 2884 wrote to memory of 3744 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 76 PID 2884 wrote to memory of 3604 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 81 PID 2884 wrote to memory of 1776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 83 PID 2884 wrote to memory of 1776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 83 PID 2884 wrote to memory of 1776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 83 PID 2884 wrote to memory of 768 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 8 PID 2884 wrote to memory of 776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 9 PID 2884 wrote to memory of 60 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 13 PID 2884 wrote to memory of 2996 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 51 PID 2884 wrote to memory of 3032 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 52 PID 2884 wrote to memory of 392 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 53 PID 2884 wrote to memory of 3436 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 56 PID 2884 wrote to memory of 3552 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 57 PID 2884 wrote to memory of 3748 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 58 PID 2884 wrote to memory of 3840 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 59 PID 2884 wrote to memory of 3916 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 60 PID 2884 wrote to memory of 4044 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 61 PID 2884 wrote to memory of 3976 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 62 PID 2884 wrote to memory of 312 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 74 PID 2884 wrote to memory of 3744 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 76 PID 2884 wrote to memory of 3604 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 81 PID 2884 wrote to memory of 768 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 8 PID 2884 wrote to memory of 776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 9 PID 2884 wrote to memory of 60 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 13 PID 2884 wrote to memory of 2996 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 51 PID 2884 wrote to memory of 3032 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 52 PID 2884 wrote to memory of 392 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 53 PID 2884 wrote to memory of 3436 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 56 PID 2884 wrote to memory of 3552 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 57 PID 2884 wrote to memory of 3748 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 58 PID 2884 wrote to memory of 3840 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 59 PID 2884 wrote to memory of 3916 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 60 PID 2884 wrote to memory of 4044 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 61 PID 2884 wrote to memory of 3976 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 62 PID 2884 wrote to memory of 312 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 74 PID 2884 wrote to memory of 3744 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 76 PID 2884 wrote to memory of 768 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 8 PID 2884 wrote to memory of 776 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 9 PID 2884 wrote to memory of 60 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 13 PID 2884 wrote to memory of 2996 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 51 PID 2884 wrote to memory of 3032 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 52 PID 2884 wrote to memory of 392 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 53 PID 2884 wrote to memory of 3436 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 56 PID 2884 wrote to memory of 3552 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 57 PID 2884 wrote to memory of 3748 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 58 PID 2884 wrote to memory of 3840 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 59 PID 2884 wrote to memory of 3916 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 60 PID 2884 wrote to memory of 4044 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 61 PID 2884 wrote to memory of 3976 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 62 PID 2884 wrote to memory of 312 2884 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe 74 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:768
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:60
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3032
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:392
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-15_78478e21d3d565bdbad21ea998100989_icedid_nymaim.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2884 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\PWRISOSH.DLL"3⤵
- System Location Discovery: System Language Discovery
PID:1776
-
-
C:\Users\Admin\AppData\Roaming\PowerISO\Upgrade\PowerISO8-x64-Full.exe"C:\Users\Admin\AppData\Roaming\PowerISO\Upgrade\PowerISO8-x64-Full.exe" /sleep=30003⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3040 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s /u "C:\Program Files\PowerISO\PWRISOSH.DLL"4⤵
- System Location Discovery: System Language Discovery
PID:2928
-
-
C:\Program Files\PowerISO\devcon.exe"C:\Program Files\PowerISO\devcon.exe" remove *scdbusDevice4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:1032
-
-
C:\Program Files\PowerISO\setup64.exe"C:\Program Files\PowerISO\setup64.exe" cp C:\Users\Admin\AppData\Local\Temp\nsbA084.tmp "C:\Windows\system32\Drivers\scdemu.sys"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
PID:4876
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3552
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3748
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3916
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4044
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3976
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:312
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3744
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:3604
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD575aa9363a1b7382a127dab05d19f0f57
SHA1c8333227ede62384c81ab49a3ab055d5a996f005
SHA256b2cfbd6fbacad517fe41b09458ffed8465dcb9e684d06723aa927e721b16ca9d
SHA5123093cfd338fab7f8df3253fcb709637accf4153de5be02cfa8ac1c86d986aa8599ad5deb2c6f8ff3ba3e7a4cd3d44947549509bfa57699cd5c96a9a5173f6229
-
Filesize
69KB
MD59d199564b65a91a531b23844649459e9
SHA18d84359ced1c51d14e70cb5ed36a6083c8b914cf
SHA2568dc2490d1d650e3ffbf70922b81ae9800ddd29a644e4d7d29e9616e22a7d0f42
SHA512ae522945d3ddcd7c2d99da14ba62d556928b7e6dfcb07114f13481777878a8ffa448170cebbf76da80d9ae45d0e3a509b0f2a7bd702773c1efcaca26496010d1
-
Filesize
20KB
MD588ac971e8ea0927083875d5338a7361c
SHA135b657bbe00ebd0fdbc142c81422e424a122df07
SHA25610bfde037cdc0bb69f2c5b4a262d3935a90a99ee1509d8795b26c4127cc6633a
SHA51200fcce623a8ba58065be87c1a3935240089199d6e4e6017a88b51610bedc81683cccebf471aa7aa65bc7042ad1f6018390a8c78e769c9a099d2b34902a1d1861
-
Filesize
2KB
MD54198afdeb9ace242c575ee572af22e1f
SHA132784594ec69ca459878010401c3931be8e5e15e
SHA256b4d6704aabfcc8b7cb8f4ee58b162dd124e2d0e4dce20ecf13eebd262dd1e76e
SHA512d4288466d9a669c7735dc788f81fd5581876048644c48a58df5e2f8c70d468464d9de2bcbd295cdfe8510fd77a9a3cc26e3de0a1cf985622fec00baefda7f4cc
-
Filesize
135KB
MD592eae8dec1f992db12aa23d9d55f264a
SHA1add6697b8c1c71980e391619e81e0bada05e38ee
SHA256d01a58e0a222e4d301b75ae80150d8cbc17f56b3f6458352d2c7c449be302eee
SHA512443a12a1a49e388725ee347e650297ba5268d655acd08e623ea988cde07ae08ae861620b600fb223358339eeab926fee1c8377386501310c68a3eb9515649441
-
Filesize
25KB
MD56a45ec125830c244261b28fe97fb9f9d
SHA1f30e65fa3a84c9078bf29af4b4d08ec618a8e44f
SHA256fa8b56b52dc7130d924d0060633b5763c032408385a47ec7438d5e1d481d2fe5
SHA5125387439a2a1f235a2ffe934570db8ab200e2688496d2be39d8f6a47dc7fb55e6e30e957b5b2f6d79799581278bd57c03dc81908afa5e9707375a14ec8a34e4e2
-
Filesize
12KB
MD58cf2ac271d7679b1d68eefc1ae0c5618
SHA17cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA2566950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3
-
Filesize
4.9MB
MD524100c426d2f5ecdf6adcf47bf544789
SHA1339ef04a2b9f24356a27753be8ac6ff96f83e7e4
SHA25688234f55746ce00f73fecdca6b9856fd8afeba840de090d8caa4868f80fd7948
SHA51277c68c6f6999c55a16baa744049802c41261691b273a918bae0a2161675b17b6d73b684f717800148370189d51afee4e18004b89be60258e751a4eb4d544e0ec
-
Filesize
561B
MD565a476590bc4133d3286e18784408444
SHA145ee5ef2b96c77ba38d0cf1516476dd966d22515
SHA256636a60efddd903e92cb30b2880bfb0875adde3e61cc79178effe5ac96cbf66d9
SHA51247823120ad11762d43c5b35bc9022d718d442c6d09e2dab5f26a935df883e184a0cb3da6a17217d0545642f74b87ae02ca057b862ab91b8d28066bd21a1a0485