Overview

overview

10

Static

static

3

pidor.exe

windows7-x64

10

pidor.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    118s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2025, 20:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pidor.exe
  • Size 558KB
  • Sample250127-zr2hjawkbr
  • SHA256 39c7df86de29b721dc37a0bf283bd7fa70c5b53cdeb3303eb0ac331e1ba51b58
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

    persistenceprivilege_escalation
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 33 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    defense_evasion
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 30 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 49 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\pidor.exe
    "C:\Users\Admin\AppData\Local\Temp\pidor.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks computer location settings
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Program Files\xdwdTrello Host.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4656
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Publisher" /tr "C:\Program Files\xdwdTrello Host.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2744
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3424
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2420
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Camtasia" /tr "C:\Users\Admin\Documents\xdwdSpybot - Search & Destroy.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4552
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "Camtasia" /tr "C:\Users\Admin\Documents\xdwdSpybot - Search & Destroy.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1852
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1180
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3176
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1340
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2776
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4528
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4860
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1736
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3660
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4952
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4416
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1968
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1540
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2220
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4176
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3108
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1012
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:516
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2164
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4756
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
      2⤵
        PID:4172
        • C:\Windows\system32\schtasks.exe
          SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1680
      • C:\Windows\SYSTEM32\CMD.exe
        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
        2⤵
          PID:3444
          • C:\Windows\system32\schtasks.exe
            SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:748
        • C:\Windows\SYSTEM32\CMD.exe
          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
          2⤵
            PID:4680
            • C:\Windows\system32\schtasks.exe
              SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:2944
          • C:\Windows\SYSTEM32\CMD.exe
            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
            2⤵
              PID:4284
              • C:\Windows\system32\schtasks.exe
                SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:924
            • C:\Windows\SYSTEM32\CMD.exe
              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
              2⤵
                PID:1972
                • C:\Windows\system32\schtasks.exe
                  SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3396
              • C:\Windows\SYSTEM32\CMD.exe
                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                2⤵
                  PID:1484
                  • C:\Windows\system32\schtasks.exe
                    SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:3000
                • C:\Windows\SYSTEM32\CMD.exe
                  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                  2⤵
                    PID:2432
                    • C:\Windows\system32\schtasks.exe
                      SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                      3⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:3600
                  • C:\Windows\SYSTEM32\CMD.exe
                    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                    2⤵
                      PID:2092
                      • C:\Windows\system32\schtasks.exe
                        SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                        3⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:4072
                    • C:\Windows\SYSTEM32\CMD.exe
                      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                      2⤵
                        PID:4240
                        • C:\Windows\system32\schtasks.exe
                          SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:1784
                      • C:\Windows\SYSTEM32\CMD.exe
                        "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                        2⤵
                          PID:1860
                          • C:\Windows\system32\schtasks.exe
                            SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:2808
                        • C:\Windows\SYSTEM32\CMD.exe
                          "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                          2⤵
                            PID:1676
                            • C:\Windows\system32\schtasks.exe
                              SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                              3⤵
                              • Scheduled Task/Job: Scheduled Task
                              PID:3936
                          • C:\Windows\SYSTEM32\CMD.exe
                            "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                            2⤵
                              PID:1516
                              • C:\Windows\system32\schtasks.exe
                                SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:4588
                            • C:\Windows\SYSTEM32\CMD.exe
                              "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                              2⤵
                                PID:1856
                                • C:\Windows\system32\schtasks.exe
                                  SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                                  3⤵
                                  • Scheduled Task/Job: Scheduled Task
                                  PID:4276
                              • C:\Windows\SYSTEM32\CMD.exe
                                "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST & exit
                                2⤵
                                  PID:3644
                                  • C:\Windows\system32\schtasks.exe
                                    SchTaSKs /create /f /sc minute /mo -1 /tn "Corel VideoStudio Upgrade" /tr "C:\Program Files\xdwdTrello Host.exe" /RL HIGHEST
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1484
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Microsoft Publisher" & exit
                                  2⤵
                                    PID:920
                                    • C:\Windows\system32\schtasks.exe
                                      schtASks /deLeTe /F /Tn "Microsoft Publisher"
                                      3⤵
                                        PID:3008
                                    • C:\Windows\SYSTEM32\CMD.exe
                                      "CMD" /C taskkill /im explorer.exe /f
                                      2⤵
                                        PID:3424
                                        • C:\Windows\system32\taskkill.exe
                                          taskkill /im explorer.exe /f
                                          3⤵
                                          • Kills process with taskkill
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3356
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe" /c schtASks /deLeTe /F /Tn "Camtasia" & exit
                                        2⤵
                                          PID:3084
                                          • C:\Windows\system32\schtasks.exe
                                            schtASks /deLeTe /F /Tn "Camtasia"
                                            3⤵
                                              PID:4492
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp42EB.tmp.bat""
                                            2⤵
                                              PID:1680
                                              • C:\Windows\system32\timeout.exe
                                                timeout 5
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:3092
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                3⤵
                                                • Boot or Logon Autostart Execution: Active Setup
                                                • Enumerates connected drives
                                                • Checks SCSI registry key(s)
                                                • Modifies registry class
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:1872
                                              • C:\Windows\system32\taskkill.exe
                                                taskkill /im xdwdTrello Host.exe /f
                                                3⤵
                                                • Kills process with taskkill
                                                PID:4416
                                              • C:\Windows\system32\timeout.exe
                                                timeout 3
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:556
                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                            1⤵
                                            • Loads dropped DLL
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:1872
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1084
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                            • Boot or Logon Autostart Execution: Active Setup
                                            • Enumerates connected drives
                                            • Checks SCSI registry key(s)
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:5108
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                            • Suspicious use of SetWindowsHookEx
                                            PID:5004
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                            • Modifies Internet Explorer settings
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1292
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                            • Boot or Logon Autostart Execution: Active Setup
                                            • Modifies registry class
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SendNotifyMessage
                                            PID:3908
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:3532
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:4876
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:876
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:5068
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:1760
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:1988
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:5108
                                                        • C:\Windows\explorer.exe
                                                          explorer.exe
                                                          1⤵
                                                            PID:1072
                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                            1⤵
                                                              PID:4592
                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                              1⤵
                                                                PID:468
                                                              • C:\Windows\explorer.exe
                                                                explorer.exe
                                                                1⤵
                                                                  PID:1044
                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                  1⤵
                                                                    PID:2992
                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                    1⤵
                                                                      PID:3028
                                                                    • C:\Windows\explorer.exe
                                                                      explorer.exe
                                                                      1⤵
                                                                        PID:408
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                          PID:1628
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                          1⤵
                                                                            PID:1180
                                                                          • C:\Windows\explorer.exe
                                                                            explorer.exe
                                                                            1⤵
                                                                              PID:4476
                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                              1⤵
                                                                                PID:1444
                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                1⤵
                                                                                  PID:3660

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v15

                                                                                      Reconnaissance

                                                                                      Resource Development

                                                                                      Initial Access

                                                                                      Execution

                                                                                      Scheduled Task/Job

                                                                                      1
                                                                                      T1053

                                                                                      Scheduled Task

                                                                                      1
                                                                                      T1053.005

                                                                                      Persistence

                                                                                      Boot or Logon Autostart Execution

                                                                                      3
                                                                                      T1547

                                                                                      Active Setup

                                                                                      1
                                                                                      T1547.014

                                                                                      Registry Run Keys / Startup Folder

                                                                                      1
                                                                                      T1547.001

                                                                                      Winlogon Helper DLL

                                                                                      1
                                                                                      T1547.004

                                                                                      Event Triggered Execution

                                                                                      1
                                                                                      T1546

                                                                                      AppInit DLLs

                                                                                      1
                                                                                      T1546.010

                                                                                      Scheduled Task/Job

                                                                                      1
                                                                                      T1053

                                                                                      Scheduled Task

                                                                                      1
                                                                                      T1053.005

                                                                                      Privilege Escalation

                                                                                      Boot or Logon Autostart Execution

                                                                                      3
                                                                                      T1547

                                                                                      Active Setup

                                                                                      1
                                                                                      T1547.014

                                                                                      Registry Run Keys / Startup Folder

                                                                                      1
                                                                                      T1547.001

                                                                                      Winlogon Helper DLL

                                                                                      1
                                                                                      T1547.004

                                                                                      Event Triggered Execution

                                                                                      1
                                                                                      T1546

                                                                                      AppInit DLLs

                                                                                      1
                                                                                      T1546.010

                                                                                      Scheduled Task/Job

                                                                                      1
                                                                                      T1053

                                                                                      Scheduled Task

                                                                                      1
                                                                                      T1053.005

                                                                                      Defense Evasion

                                                                                      Modify Registry

                                                                                      4
                                                                                      T1112

                                                                                      Credential Access

                                                                                      Discovery

                                                                                      Peripheral Device Discovery

                                                                                      2
                                                                                      T1120

                                                                                      Query Registry

                                                                                      4
                                                                                      T1012

                                                                                      System Information Discovery

                                                                                      4
                                                                                      T1082

                                                                                      Lateral Movement

                                                                                      Collection

                                                                                      Command and Control

                                                                                      Exfiltration

                                                                                      Impact

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                      • Size 471B
                                                                                      • SHA256 489b72d5dae88c38017aea37be6fea088ffaa50e10b584c0685c3bcb5a847a32
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
                                                                                      • Size 412B
                                                                                      • SHA256 fdb284a2240ae6888836f6dc268bf4ffadc507b08161c00adf6a87ad338f3486
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                                      • Size 2KB
                                                                                      • SHA256 c0a604ba7dfb1927b96af3c3cd01bf612013ccf0045f3b4a76099c73bfb6f4c1
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      microsoft.windows[1].xml
                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml
                                                                                      • Size 97B
                                                                                      • SHA256 f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      tmp42EB.tmp.bat
                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\tmp42EB.tmp.bat
                                                                                      • Size 224B
                                                                                      • SHA256 49fda3b5b9d92821c6e4e996afbb0fe6d221ef777763a04882988659294e2d16
                                                                                      • MD5 SHA1 SHA512
                                                                                      Submit Download

                                                                                      xdwd.dll
                                                                                      • Path C:\Windows\xdwd.dll
                                                                                      • Size 136KB
                                                                                      • SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                      Submit Download

                                                                                      memory/408-1551-0x0000000004530000-0x0000000004531000-memory.dmp
                                                                                      Download

                                                                                      memory/468-1263-0x000001E477430000-0x000001E477450000-memory.dmp
                                                                                      Download

                                                                                      memory/468-1286-0x000001E477800000-0x000001E477820000-memory.dmp
                                                                                      Download

                                                                                      memory/468-1275-0x000001E4773F0000-0x000001E477410000-memory.dmp
                                                                                      Download

                                                                                      memory/1044-1405-0x0000000004D50000-0x0000000004D51000-memory.dmp
                                                                                      Download

                                                                                      memory/1072-1256-0x0000000004030000-0x0000000004031000-memory.dmp
                                                                                      Download

                                                                                      memory/1180-1553-0x000001C7BD540000-0x000001C7BD640000-memory.dmp
                                                                                      Download

                                                                                      memory/1180-1552-0x000001C7BD540000-0x000001C7BD640000-memory.dmp
                                                                                      Download

                                                                                      memory/1180-1557-0x000001C7BE4A0000-0x000001C7BE4C0000-memory.dmp
                                                                                      Download

                                                                                      memory/1180-1588-0x000001C7BEA80000-0x000001C7BEAA0000-memory.dmp
                                                                                      Download

                                                                                      memory/1180-1574-0x000001C7BE460000-0x000001C7BE480000-memory.dmp
                                                                                      Download

                                                                                      memory/1292-813-0x0000025555CE0000-0x0000025555D00000-memory.dmp
                                                                                      Download

                                                                                      memory/1292-832-0x00000255560B0000-0x00000255560D0000-memory.dmp
                                                                                      Download

                                                                                      memory/1292-824-0x0000025555CA0000-0x0000025555CC0000-memory.dmp
                                                                                      Download

                                                                                      memory/1760-1108-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-797-0x00007FFC30340000-0x00007FFC30E01000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-1-0x0000000000A70000-0x0000000000B02000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-2-0x00007FFC30343000-0x00007FFC30345000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-35-0x00007FFC30340000-0x00007FFC30E01000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-0-0x00007FFC30343000-0x00007FFC30345000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-121-0x00007FFC30340000-0x00007FFC30E01000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-691-0x000000001CF80000-0x000000001CFF6000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-692-0x00000000012A0000-0x00000000012AC000-memory.dmp
                                                                                      Download

                                                                                      memory/2760-693-0x00000000012D0000-0x00000000012EE000-memory.dmp
                                                                                      Download

                                                                                      memory/3028-1415-0x000001D8AE790000-0x000001D8AE7B0000-memory.dmp
                                                                                      Download

                                                                                      memory/3028-1407-0x000001D0AC700000-0x000001D0AC800000-memory.dmp
                                                                                      Download

                                                                                      memory/3028-1443-0x000001D8AEBA0000-0x000001D8AEBC0000-memory.dmp
                                                                                      Download

                                                                                      memory/3028-1406-0x000001D0AC700000-0x000001D0AC800000-memory.dmp
                                                                                      Download

                                                                                      memory/3028-1411-0x000001D8AE7D0000-0x000001D8AE7F0000-memory.dmp
                                                                                      Download

                                                                                      memory/3660-1701-0x000002CBF8600000-0x000002CBF8700000-memory.dmp
                                                                                      Download

                                                                                      memory/3660-1719-0x000002CBF9480000-0x000002CBF94A0000-memory.dmp
                                                                                      Download

                                                                                      memory/3660-1735-0x000002CBF9AA0000-0x000002CBF9AC0000-memory.dmp
                                                                                      Download

                                                                                      memory/3660-1706-0x000002CBF94C0000-0x000002CBF94E0000-memory.dmp
                                                                                      Download

                                                                                      memory/3660-1702-0x000002CBF8600000-0x000002CBF8700000-memory.dmp
                                                                                      Download

                                                                                      memory/4476-1700-0x0000000004E40000-0x0000000004E41000-memory.dmp
                                                                                      Download

                                                                                      memory/4876-958-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
                                                                                      Download

                                                                                      memory/5068-965-0x0000015487100000-0x0000015487120000-memory.dmp
                                                                                      Download

                                                                                      memory/5068-960-0x0000015486300000-0x0000015486400000-memory.dmp
                                                                                      Download

                                                                                      memory/5068-977-0x00000154870C0000-0x00000154870E0000-memory.dmp
                                                                                      Download

                                                                                      memory/5068-988-0x00000154876E0000-0x0000015487700000-memory.dmp
                                                                                      Download

                                                                                      memory/5068-961-0x0000015486300000-0x0000015486400000-memory.dmp
                                                                                      Download

                                                                                      memory/5108-806-0x00000000036A0000-0x00000000036A1000-memory.dmp
                                                                                      Download

                                                                                      memory/5108-1116-0x0000024B23E60000-0x0000024B23E80000-memory.dmp
                                                                                      Download

                                                                                      memory/5108-1122-0x0000024B23E20000-0x0000024B23E40000-memory.dmp
                                                                                      Download

                                                                                      memory/5108-1147-0x0000024B24220000-0x0000024B24240000-memory.dmp
                                                                                      Download