Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
135s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
12/01/2025, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
Luxury Shield 12.8.9.zip
Resource
win10ltsc2021-20241211-en
General
-
Target
Luxury Shield 12.8.9.zip
-
Size
9.6MB
-
MD5
8067ac7cd02c1a3bb18b2a6a56597c3a
-
SHA1
1df850e23a06480dcd3a1af122a2e14382a4578f
-
SHA256
201f9fbaaa715f934e0f89d07aba1fa080fe17839ea64b776e1e69ce11451783
-
SHA512
1286bfab21376c45317c870c266ad65a64ddba4d949c2f96541ace359210a76c2957ba6d5a2b888ec3e63aad919b4c8ee5e06f606e83aa0b41bd4f306131b779
-
SSDEEP
196608:AxMKs19qZm4Lvx8fMF6J8zD6sL+oPI6vkCsu90NQ1VL9rm0AbBwbtr6LHYVjHnA:A7GEm4Lv2fM8wD5+H6DuK1VI0Al4A
Malware Config
Extracted
xworm
3.1
according-psp.at.ply.gg:38979
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Signatures
-
Detect Xworm Payload 1 IoCs
resource yara_rule behavioral1/memory/3764-67-0x0000000000400000-0x0000000000418000-memory.dmp family_xworm -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/memory/1504-37-0x00000000006D0000-0x0000000000726000-memory.dmp family_redline behavioral1/memory/4104-181-0x0000000000D30000-0x0000000000D86000-memory.dmp family_redline -
Redline family
-
Xworm family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2372 powershell.exe 1784 powershell.exe 3840 powershell.exe -
Checks computer location settings 2 TTPs 23 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Safe Mode.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe Key value queried \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\Control Panel\International\Geo\Nation Luxury Shield.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Safe Mode.lnk Safe Mode.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Safe Mode.lnk Safe Mode.exe -
Executes dropped EXE 64 IoCs
pid Process 1656 Luxury Shield.exe 1504 build.exe 4628 Luxury Shield.exe 1552 Luxury Shield.exe 4516 Safe Mode.exe 3764 Safe Mode.exe 236 Luxury Shield.exe 3080 Safe Mode.exe 1344 Safe Mode.exe 1684 Luxury Shield.exe 4652 Safe Mode.exe 3684 Safe Mode.exe 3712 Luxury Shield.exe 4104 Safe Mode.exe 2388 Safe Mode.exe 2924 ILMerge.exe 4636 Luxury Shield.exe 2432 Safe Mode.exe 5000 Safe Mode.exe 3824 Luxury Shield.exe 2792 Safe Mode.exe 2544 Safe Mode.exe 4104 crack.exe 904 Luxury Shield.exe 3756 Safe Mode.exe 436 Safe Mode.exe 456 Luxury Shield.exe 4332 Safe Mode.exe 3336 Safe Mode.exe 628 Luxury Shield.exe 3456 Luxury Shield.exe 660 Safe Mode.exe 2016 Safe Mode.exe 3844 Safe Mode.exe 4736 Safe Mode.exe 4628 Luxury Shield.exe 2584 Safe Mode.exe 2372 Safe Mode.exe 4124 Luxury Shield.exe 2816 Safe Mode.exe 1180 Safe Mode.exe 1632 Luxury Shield.exe 1460 Safe Mode.exe 4844 Safe Mode.exe 3612 Safe Mode.exe 4352 Luxury Shield.exe 4360 Safe Mode.exe 3888 Safe Mode.exe 456 Luxury Shield.exe 1364 Safe Mode.exe 5088 Safe Mode.exe 2328 Luxury Shield.exe 3052 Safe Mode.exe 4560 Safe Mode.exe 3100 Luxury Shield.exe 2076 Safe Mode.exe 3996 Safe Mode.exe 1096 Luxury Shield.exe 3604 Safe Mode.exe 2924 Safe Mode.exe 992 Luxury Shield.exe 3888 Safe Mode.exe 2984 Safe Mode.exe 3840 Safe Mode.exe -
Adds Run key to start application 2 TTPs 22 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Safe Mode.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe Set value (str) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Safe Mode = "C:\\ProgramData\\Safe Mode.exe" Luxury Shield.exe -
Suspicious use of SetThreadContext 21 IoCs
description pid Process procid_target PID 4516 set thread context of 3764 4516 Safe Mode.exe 104 PID 3080 set thread context of 1344 3080 Safe Mode.exe 107 PID 4652 set thread context of 3684 4652 Safe Mode.exe 112 PID 4104 set thread context of 2388 4104 Safe Mode.exe 115 PID 2432 set thread context of 5000 2432 Safe Mode.exe 123 PID 2792 set thread context of 2544 2792 Safe Mode.exe 130 PID 3756 set thread context of 436 3756 Safe Mode.exe 135 PID 4332 set thread context of 3336 4332 Safe Mode.exe 138 PID 660 set thread context of 4736 660 Safe Mode.exe 144 PID 2584 set thread context of 2372 2584 Safe Mode.exe 148 PID 2816 set thread context of 1180 2816 Safe Mode.exe 151 PID 1460 set thread context of 3612 1460 Safe Mode.exe 155 PID 4360 set thread context of 3888 4360 Safe Mode.exe 158 PID 1364 set thread context of 5088 1364 Safe Mode.exe 161 PID 3052 set thread context of 4560 3052 Safe Mode.exe 165 PID 2076 set thread context of 3996 2076 Safe Mode.exe 168 PID 3604 set thread context of 2924 3604 Safe Mode.exe 171 PID 3888 set thread context of 3840 3888 Safe Mode.exe 175 PID 3052 set thread context of 4636 3052 Safe Mode.exe 179 PID 2696 set thread context of 2600 2696 Safe Mode.exe 183 PID 2312 set thread context of 1296 2312 Safe Mode.exe 186 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language crack.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Safe Mode.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Luxury Shield.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 7 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 taskmgr.exe Set value (data) \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-1006597246-3150276181-3318461161-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU taskmgr.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4724 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3764 Safe Mode.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1784 powershell.exe 1784 powershell.exe 3840 powershell.exe 3840 powershell.exe 2372 powershell.exe 2372 powershell.exe 3764 Safe Mode.exe 660 Safe Mode.exe 660 Safe Mode.exe 660 Safe Mode.exe 660 Safe Mode.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 1460 Safe Mode.exe 1460 Safe Mode.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 3888 Safe Mode.exe 3888 Safe Mode.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 3052 Safe Mode.exe 3052 Safe Mode.exe 2696 Safe Mode.exe 2696 Safe Mode.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4908 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 4908 7zFM.exe Token: 35 4908 7zFM.exe Token: SeSecurityPrivilege 4908 7zFM.exe Token: SeSecurityPrivilege 4908 7zFM.exe Token: SeDebugPrivilege 3764 Safe Mode.exe Token: SeDebugPrivilege 1344 Safe Mode.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeDebugPrivilege 3684 Safe Mode.exe Token: SeIncreaseQuotaPrivilege 1784 powershell.exe Token: SeSecurityPrivilege 1784 powershell.exe Token: SeTakeOwnershipPrivilege 1784 powershell.exe Token: SeLoadDriverPrivilege 1784 powershell.exe Token: SeSystemProfilePrivilege 1784 powershell.exe Token: SeSystemtimePrivilege 1784 powershell.exe Token: SeProfSingleProcessPrivilege 1784 powershell.exe Token: SeIncBasePriorityPrivilege 1784 powershell.exe Token: SeCreatePagefilePrivilege 1784 powershell.exe Token: SeBackupPrivilege 1784 powershell.exe Token: SeRestorePrivilege 1784 powershell.exe Token: SeShutdownPrivilege 1784 powershell.exe Token: SeDebugPrivilege 1784 powershell.exe Token: SeSystemEnvironmentPrivilege 1784 powershell.exe Token: SeRemoteShutdownPrivilege 1784 powershell.exe Token: SeUndockPrivilege 1784 powershell.exe Token: SeManageVolumePrivilege 1784 powershell.exe Token: 33 1784 powershell.exe Token: 34 1784 powershell.exe Token: 35 1784 powershell.exe Token: 36 1784 powershell.exe Token: SeDebugPrivilege 2388 Safe Mode.exe Token: SeDebugPrivilege 3840 powershell.exe Token: SeIncreaseQuotaPrivilege 3840 powershell.exe Token: SeSecurityPrivilege 3840 powershell.exe Token: SeTakeOwnershipPrivilege 3840 powershell.exe Token: SeLoadDriverPrivilege 3840 powershell.exe Token: SeSystemProfilePrivilege 3840 powershell.exe Token: SeSystemtimePrivilege 3840 powershell.exe Token: SeProfSingleProcessPrivilege 3840 powershell.exe Token: SeIncBasePriorityPrivilege 3840 powershell.exe Token: SeCreatePagefilePrivilege 3840 powershell.exe Token: SeBackupPrivilege 3840 powershell.exe Token: SeRestorePrivilege 3840 powershell.exe Token: SeShutdownPrivilege 3840 powershell.exe Token: SeDebugPrivilege 3840 powershell.exe Token: SeSystemEnvironmentPrivilege 3840 powershell.exe Token: SeRemoteShutdownPrivilege 3840 powershell.exe Token: SeUndockPrivilege 3840 powershell.exe Token: SeManageVolumePrivilege 3840 powershell.exe Token: 33 3840 powershell.exe Token: 34 3840 powershell.exe Token: 35 3840 powershell.exe Token: 36 3840 powershell.exe Token: SeDebugPrivilege 5000 Safe Mode.exe Token: SeDebugPrivilege 2372 powershell.exe Token: SeIncreaseQuotaPrivilege 2372 powershell.exe Token: SeSecurityPrivilege 2372 powershell.exe Token: SeTakeOwnershipPrivilege 2372 powershell.exe Token: SeLoadDriverPrivilege 2372 powershell.exe Token: SeSystemProfilePrivilege 2372 powershell.exe Token: SeSystemtimePrivilege 2372 powershell.exe Token: SeProfSingleProcessPrivilege 2372 powershell.exe Token: SeIncBasePriorityPrivilege 2372 powershell.exe Token: SeCreatePagefilePrivilege 2372 powershell.exe Token: SeBackupPrivilege 2372 powershell.exe -
Suspicious use of FindShellTrayWindow 58 IoCs
pid Process 4908 7zFM.exe 4908 7zFM.exe 4908 7zFM.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe 4956 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3764 Safe Mode.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1656 wrote to memory of 1504 1656 Luxury Shield.exe 99 PID 1656 wrote to memory of 1504 1656 Luxury Shield.exe 99 PID 1656 wrote to memory of 1504 1656 Luxury Shield.exe 99 PID 1656 wrote to memory of 4628 1656 Luxury Shield.exe 101 PID 1656 wrote to memory of 4628 1656 Luxury Shield.exe 101 PID 4628 wrote to memory of 1552 4628 Luxury Shield.exe 102 PID 4628 wrote to memory of 1552 4628 Luxury Shield.exe 102 PID 4628 wrote to memory of 4516 4628 Luxury Shield.exe 103 PID 4628 wrote to memory of 4516 4628 Luxury Shield.exe 103 PID 4628 wrote to memory of 4516 4628 Luxury Shield.exe 103 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 4516 wrote to memory of 3764 4516 Safe Mode.exe 104 PID 1552 wrote to memory of 236 1552 Luxury Shield.exe 105 PID 1552 wrote to memory of 236 1552 Luxury Shield.exe 105 PID 1552 wrote to memory of 3080 1552 Luxury Shield.exe 106 PID 1552 wrote to memory of 3080 1552 Luxury Shield.exe 106 PID 1552 wrote to memory of 3080 1552 Luxury Shield.exe 106 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3080 wrote to memory of 1344 3080 Safe Mode.exe 107 PID 3764 wrote to memory of 1784 3764 Safe Mode.exe 108 PID 3764 wrote to memory of 1784 3764 Safe Mode.exe 108 PID 3764 wrote to memory of 1784 3764 Safe Mode.exe 108 PID 236 wrote to memory of 1684 236 Luxury Shield.exe 110 PID 236 wrote to memory of 1684 236 Luxury Shield.exe 110 PID 236 wrote to memory of 4652 236 Luxury Shield.exe 111 PID 236 wrote to memory of 4652 236 Luxury Shield.exe 111 PID 236 wrote to memory of 4652 236 Luxury Shield.exe 111 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 4652 wrote to memory of 3684 4652 Safe Mode.exe 112 PID 1684 wrote to memory of 3712 1684 Luxury Shield.exe 113 PID 1684 wrote to memory of 3712 1684 Luxury Shield.exe 113 PID 1684 wrote to memory of 4104 1684 Luxury Shield.exe 131 PID 1684 wrote to memory of 4104 1684 Luxury Shield.exe 131 PID 1684 wrote to memory of 4104 1684 Luxury Shield.exe 131 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 4104 wrote to memory of 2388 4104 Safe Mode.exe 115 PID 3764 wrote to memory of 3840 3764 Safe Mode.exe 117 PID 3764 wrote to memory of 3840 3764 Safe Mode.exe 117 PID 3764 wrote to memory of 3840 3764 Safe Mode.exe 117 PID 3712 wrote to memory of 4636 3712 Luxury Shield.exe 121
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9.zip"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4908
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\Luxury Shield.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:904 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:456 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:456 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
PID:992 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"21⤵
- Checks computer location settings
- Adds Run key to start application
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"22⤵
- Checks computer location settings
- Adds Run key to start application
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield.exe"23⤵PID:1668
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"23⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2312 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"24⤵
- System Location Discovery: System Language Discovery
PID:1296
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"22⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2696 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"23⤵PID:4568
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"23⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"21⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3052 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"22⤵PID:4404
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"22⤵
- System Location Discovery: System Language Discovery
PID:4636
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"20⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3888 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"21⤵
- Executes dropped EXE
PID:2984
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"21⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3840
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"19⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3604 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"20⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2924
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2076 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"19⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3996
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"17⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3052 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"18⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4560
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"16⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1364 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5088
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"15⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4360 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3888
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"14⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1460 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"15⤵
- Executes dropped EXE
PID:4844
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"15⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3612
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2816 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1180
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"12⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2584 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"13⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2372
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:660 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"12⤵
- Executes dropped EXE
PID:2016
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"12⤵
- Executes dropped EXE
PID:3844
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4736
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:4332 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"11⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3336
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3756 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"10⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:436
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2792 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2544
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2432 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5000
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2388
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
-
-
-
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\ProgramData\Safe Mode.exe"C:\ProgramData\Safe Mode.exe"4⤵
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Safe Mode.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Safe Mode.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\Safe Mode.exe'5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Safe Mode" /tr "C:\ProgramData\Safe Mode.exe"5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4724
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\ILMerge.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\ILMerge.exe"1⤵
- Executes dropped EXE
PID:2924
-
C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\crack.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\crack.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4104
-
C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\Luxury Shield.exe"C:\Users\Admin\AppData\Local\Temp\Luxury Shield 12.8.9\Luxury Shield.exe"1⤵
- Executes dropped EXE
PID:628
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4956
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
344KB
MD57f1d18abc9cb29cea2a58984130219ee
SHA1acae2b67948f6788a0bc437b45b31e98bad62bd8
SHA256d8589a65b5ac7a916e559d88baee20af9debdf69d211c7902d584d407c62a63c
SHA5120ae46e0a44eb25426befeb3d9af5aaa2e359e4cab2507d167ac193d3cba6375d7c6cfe75402ef7c999c9e83c458afc20064f08cb82ee57f23ebe41b496b43f6c
-
Filesize
654B
MD511c6e74f0561678d2cf7fc075a6cc00c
SHA1535ee79ba978554abcb98c566235805e7ea18490
SHA256d39a78fabca39532fcb85ce908781a75132e1bd01cc50a3b290dd87127837d63
SHA51232c63d67bf512b42e7f57f71287b354200126cb417ef9d869c72e0b9388a7c2f5e3b61f303f1353baa1bf482d0f17e06e23c9f50b2f1babd4d958b6da19c40b0
-
Filesize
321B
MD537b6461a5da2584ecce397b94e471597
SHA13cca08ac93f8176ca2bea0169bf6e8f8c202840e
SHA2563ba942b35984b7ab4390cd8b3d7ea584dc6d0a98b76d9093cb33da263f368fcf
SHA5125d8cd5d368a40c0f35687b07112ca4ab3114a7a46b3551751ee63711046668b52dfa4bd2b8f9112ac353e630d1fa85be39f62a1bca882562360974137eb1b7cb
-
Filesize
2KB
MD5f811272c20ff6decbbd16ff364334427
SHA1cb31be66c972daa61d45920fa2fa824c1dfb194d
SHA256730aff8c9e430a9f9e5e44f1c376e57f42fa5adc744824df2f69855009473592
SHA5125c68bf3a41c3607cad5abe94f2bb3816f3e69426fa7d43bf7c9787c4e9ce6660b1843a2e505a22a93d7008b76fc564078513fe9ef47051e5b6fc344ab9d0a528
-
Filesize
21KB
MD52bec30423c6b5155a10caa2167feaa80
SHA161f0c94d7df8d67c636cbd0c8be5a9ecdec3b71c
SHA2563eff96e89e234afb5a073f8d0074e43c98b11b2f62510c58e07d71bc01910f0a
SHA5125e5f591a84b6a765f7e22b70f6890ea668965895eee0cc9675900c0e0921c545e6f45916dd060498b9cc48ec83c82aa568d2b1126db7d028eb766c31c7e12a9b
-
Filesize
21KB
MD581658445dc2138e157565242fccbfc37
SHA179765e5a5b1f1e4d29c39f60fb22789b9565a876
SHA256e9305733c076307288d6b441504851087fb03990ddfb7ac9359179bf716f7733
SHA512fdf2e059035a6db8fb2659d6b9ae80431dfe9e606345df8de0184a5d1e5deb1361a7353142764681567ec3e7cad04bf8e548f5522fe94810de8d74ca1e2cb680
-
Filesize
668KB
MD52bb6322885e6ca0986206de174e842c9
SHA1c5ea70169106d32bc513d28ea76ae8ea1e49380b
SHA2568110d740b485bcb06ff406b17001714c3a146fe6517098c9dc90d812b83389fd
SHA5129750180c54a5bd8f0e1fa8a8f529364430f2ef444efbf8ac51e8d2a0aaa4e3d21fe553865ba8567c7c19e4ae84d04b20464f391743e88c52c00cac0bf20fc2a7
-
Filesize
9.9MB
MD57643fc25c660a6dfb42fe9a7c047159f
SHA1079bab6472d00fa034497b52e7348acccb2ccdd3
SHA2569e8089879ce079ffcf4fbe7882df57de0ac1218a4c3119bda16f738480eeda5b
SHA512f98e1e3a58b8a75f45fa6ed7af6c5f076c170c902ef31d6b8f6570218300b34ff454b4127ae2a11645bd031a2b3dac873ff069a6b60a7ba3d78efc7749d4cf66
-
Filesize
9.2MB
MD5a7c50079c7d88e96dc4abdbe00add204
SHA10d3a76eea76817974860cb3517664776a3bc01a7
SHA2566420e68415e70378cd4677bfea8bfca9de5861bd15896550c78a6d2f0880889e
SHA512554843892b21eaa8fe2160fefed249cad789ad43f4a0a1b4421f07fdd94fe4093d6d07dda406a9e7080584c4e71a21263990481e554fc36754090d2f28098d9b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
506KB
MD5e5fb57e8214483fd395bd431cb3d1c4b
SHA160e22fc9e0068c8156462f003760efdcac82766b
SHA256e389fc5782f754918a10b020adcd8faa11c25658b8d6f8cbc49f9ac3a7637684
SHA512dc2ed0421db7dd5a3afeacb6a9f5017c97fc07d0b2d1745b50ede50087a58245d31d6669077a672b32541dbfa233ef87260a37be48de3bd407d8c587fc903d89
-
Filesize
682B
MD58abec2be982b4161a2994bdf8c08c814
SHA1e688ebcba669bdf92457a858567a3062178a861f
SHA256d8582024cc609917d3bfe2139246e6b44f5ce76b0c7d20e92e90cdeb88688ee6
SHA51286089899c29de87345f110efef430886a588e1394903303435b18bccba20220aebe2ecd11c0e023fab6e50f04ddcdcc95140d412bcb12372361f750110f5769b