Overview

overview

10

Static

static

3

2025-04-05...er.exe

windows10-2004-x64

10

Resubmissions

05/04/2025, 04:34

250405-e7dfeszwbs 10

05/04/2025, 04:09

250405-eq156ay1hz 10

Analysis

  • max time kernel
    46s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/04/2025, 04:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-04-05_1fca5df27f8bf3b78eea97b3df9e1f88_amadey_rhadamanthys_smoke-loader.exe

  • Size

    740KB

  • MD5

    1fca5df27f8bf3b78eea97b3df9e1f88

  • SHA1

    b4b791ded649fd4d5c452b86e9860dfb51e707d2

  • SHA256

    aa1d4408e628624a77c0503463d5222f06431264405681e550c30eff4ef4a777

  • SHA512

    cd62d29e1624eca3dc7ce047b3affd9365c4811ff360dd34d2bea19fbfe3d7a6cc5ba4adffba2c48db14a5f47347357551963b4101cca4d48f322ff9a59f23a5

  • SSDEEP

    12288:ouHDmIahzgrC1BobZUweCfPItZta15eRiO617g6FuIXcalaGD9EQ/K:oGDBahMrC1UaCfPEZt+5eBk7g6FudkaT

Score
10/10
salitybackdoordefense_evasiondiscoveryexecutionpersistencetrojanupx

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

Signatures

  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Modifies firewall policy service 3 TTPs 6 IoCs
    defense_evasion
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality
  • Sality family
    sality
  • UAC bypass 3 TTPs 2 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 12 IoCs
    defense_evasiontrojan
  • Blocklisted process makes network request 1 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Windows security modification 2 TTPs 14 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 26 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 5 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe 7 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\fontdrvhost.exe
    "fontdrvhost.exe"
    1⤵
      PID:784
    • C:\Windows\system32\fontdrvhost.exe
      "fontdrvhost.exe"
      1⤵
        PID:792
      • C:\Windows\system32\dwm.exe
        "dwm.exe"
        1⤵
          PID:336
        • C:\Windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:2532
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
            1⤵
              PID:2608
            • C:\Windows\system32\taskhostw.exe
              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
              1⤵
                PID:2744
              • C:\Windows\Explorer.EXE
                C:\Windows\Explorer.EXE
                1⤵
                  PID:3464
                  • C:\Users\Admin\AppData\Local\Temp\2025-04-05_1fca5df27f8bf3b78eea97b3df9e1f88_amadey_rhadamanthys_smoke-loader.exe
                    "C:\Users\Admin\AppData\Local\Temp\2025-04-05_1fca5df27f8bf3b78eea97b3df9e1f88_amadey_rhadamanthys_smoke-loader.exe"
                    2⤵
                    • Modifies firewall policy service
                    • UAC bypass
                    • Windows security bypass
                    • Windows security modification
                    • Checks whether UAC is enabled
                    • Enumerates connected drives
                    • Drops file in System32 directory
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: RenamesItself
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    • System policy modification
                    PID:4148
                    • C:\Windows\SysWOW64\Rundll32.exe
                      Rundll32 C:\Windows\system32\ossvogaa.dll Exbcute
                      3⤵
                      • Checks computer location settings
                      • Loads dropped DLL
                      • Drops file in Program Files directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:1848
                      • C:\Windows\SysWOW64\net.exe
                        net stop WinDefend
                        4⤵
                        • System Location Discovery: System Language Discovery
                        PID:2316
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop WinDefend
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:4828
                      • C:\Windows\SysWOW64\net.exe
                        net stop MpsSvc
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:2576
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop MpsSvc
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:552
                      • C:\Windows\SysWOW64\sc.exe
                        sc config WinDefend start= disabled
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4236
                      • C:\Windows\SysWOW64\sc.exe
                        sc config MpsSvc start= disabled
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:5208
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop ZhuDongFangYu
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:5592
                      • C:\Windows\SysWOW64\sc.exe
                        sc delete ZhuDongFangYu
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:4188
                      • C:\Windows\SysWOW64\sc.exe
                        sc stop 360rp
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:5384
                      • C:\Windows\SysWOW64\sc.exe
                        sc delete 360rp
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:3172
                      • C:\Windows\SysWOW64\sc.exe
                        "C:\Windows\System32\sc.exe" stop PolicyAgent
                        4⤵
                        • Launches sc.exe
                        • System Location Discovery: System Language Discovery
                        PID:1900
                    • C:\Windows\SysWOW64\Rundll32.exe
                      Rundll32 C:\Windows\system32\uqiwogaa.dll Exbcute
                      3⤵
                      • Modifies firewall policy service
                      • UAC bypass
                      • Windows security bypass
                      • Blocklisted process makes network request
                      • Loads dropped DLL
                      • Windows security modification
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Enumerates connected drives
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • System policy modification
                      PID:1936
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                    2⤵
                      PID:5008
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                      2⤵
                        PID:5172
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                        2⤵
                          PID:4756
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                          2⤵
                            PID:5476
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                            2⤵
                              PID:628
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                              2⤵
                                PID:2892
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                2⤵
                                  PID:5700
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                  2⤵
                                    PID:5196
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                    2⤵
                                      PID:4052
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                      2⤵
                                        PID:2284
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                        2⤵
                                          PID:1964
                                        • C:\Windows\system32\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                          2⤵
                                            PID:6136
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                            2⤵
                                              PID:3140
                                            • C:\Windows\system32\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                              2⤵
                                                PID:5564
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                2⤵
                                                  PID:3676
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                  2⤵
                                                    PID:4844
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                    2⤵
                                                      PID:3548
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                      2⤵
                                                        PID:1420
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                        2⤵
                                                          PID:4828
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                          2⤵
                                                            PID:2740
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                            2⤵
                                                              PID:1164
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                              2⤵
                                                                PID:4900
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                2⤵
                                                                  PID:1192
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                  2⤵
                                                                    PID:3960
                                                                  • C:\Windows\system32\cmd.exe
                                                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                    2⤵
                                                                      PID:1032
                                                                    • C:\Windows\system32\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                      2⤵
                                                                        PID:2800
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                        2⤵
                                                                          PID:4476
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                          2⤵
                                                                            PID:556
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                            2⤵
                                                                              PID:1864
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                              2⤵
                                                                                PID:6128
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                2⤵
                                                                                  PID:2232
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                  2⤵
                                                                                    PID:4268
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                    2⤵
                                                                                      PID:1640
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                      2⤵
                                                                                        PID:3596
                                                                                      • C:\Windows\system32\cmd.exe
                                                                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                        2⤵
                                                                                          PID:3932
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                          2⤵
                                                                                            PID:3316
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                            2⤵
                                                                                              PID:704
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                              2⤵
                                                                                                PID:4612
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                2⤵
                                                                                                  PID:1532
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                  2⤵
                                                                                                    PID:1608
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                    2⤵
                                                                                                      PID:6028
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                      2⤵
                                                                                                        PID:1256
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                        2⤵
                                                                                                          PID:6132
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                          2⤵
                                                                                                            PID:2740
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                            2⤵
                                                                                                              PID:1828
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                              2⤵
                                                                                                                PID:3720
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                2⤵
                                                                                                                  PID:5312
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                  2⤵
                                                                                                                    PID:4188
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                    2⤵
                                                                                                                      PID:1192
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                      2⤵
                                                                                                                        PID:2140
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                        2⤵
                                                                                                                          PID:1148
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                          2⤵
                                                                                                                            PID:1848
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                            2⤵
                                                                                                                              PID:4404
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                              2⤵
                                                                                                                                PID:5396
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                2⤵
                                                                                                                                  PID:748
                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                  2⤵
                                                                                                                                    PID:3788
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                    2⤵
                                                                                                                                      PID:5364
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                      2⤵
                                                                                                                                        PID:928
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                        2⤵
                                                                                                                                          PID:4268
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                          2⤵
                                                                                                                                            PID:2108
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                            2⤵
                                                                                                                                              PID:5488
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                              2⤵
                                                                                                                                                PID:1984
                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                                2⤵
                                                                                                                                                  PID:3384
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Windows\system32\system.exe
                                                                                                                                                  2⤵
                                                                                                                                                    PID:6064
                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                                  1⤵
                                                                                                                                                    PID:3628
                                                                                                                                                  • C:\Windows\system32\DllHost.exe
                                                                                                                                                    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                                                                                                                                    1⤵
                                                                                                                                                      PID:3836
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3920
                                                                                                                                                      • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3992
                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                          1⤵
                                                                                                                                                            PID:4088
                                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                            1⤵
                                                                                                                                                              PID:3520
                                                                                                                                                            • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                              C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5220
                                                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3896
                                                                                                                                                                • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:3008
                                                                                                                                                                  • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:1536
                                                                                                                                                                    • C:\Windows\system32\BackgroundTaskHost.exe
                                                                                                                                                                      "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:1944
                                                                                                                                                                      • C:\Windows\system32\backgroundTaskHost.exe
                                                                                                                                                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:ShellFeedsUI.AppXnj65k2d1a1rnztt2t2nng5ctmk3e76pn.mca
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:5648
                                                                                                                                                                        • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:2828
                                                                                                                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                                                                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:4064

                                                                                                                                                                            Network

                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                            Reconnaissance

                                                                                                                                                                            Resource Development

                                                                                                                                                                            Initial Access

                                                                                                                                                                            Execution

                                                                                                                                                                            System Services

                                                                                                                                                                            2
                                                                                                                                                                            T1569

                                                                                                                                                                            Service Execution

                                                                                                                                                                            2
                                                                                                                                                                            T1569.002

                                                                                                                                                                            Persistence

                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                            1
                                                                                                                                                                            T1547

                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                            1
                                                                                                                                                                            T1547.001

                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                            3
                                                                                                                                                                            T1543

                                                                                                                                                                            Windows Service

                                                                                                                                                                            3
                                                                                                                                                                            T1543.003

                                                                                                                                                                            Privilege Escalation

                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                            1
                                                                                                                                                                            T1548

                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                            1
                                                                                                                                                                            T1548.002

                                                                                                                                                                            Boot or Logon Autostart Execution

                                                                                                                                                                            1
                                                                                                                                                                            T1547

                                                                                                                                                                            Registry Run Keys / Startup Folder

                                                                                                                                                                            1
                                                                                                                                                                            T1547.001

                                                                                                                                                                            Create or Modify System Process

                                                                                                                                                                            3
                                                                                                                                                                            T1543

                                                                                                                                                                            Windows Service

                                                                                                                                                                            3
                                                                                                                                                                            T1543.003

                                                                                                                                                                            Defense Evasion

                                                                                                                                                                            Abuse Elevation Control Mechanism

                                                                                                                                                                            1
                                                                                                                                                                            T1548

                                                                                                                                                                            Bypass User Account Control

                                                                                                                                                                            1
                                                                                                                                                                            T1548.002

                                                                                                                                                                            Impair Defenses

                                                                                                                                                                            5
                                                                                                                                                                            T1562

                                                                                                                                                                            Disable or Modify System Firewall

                                                                                                                                                                            1
                                                                                                                                                                            T1562.004

                                                                                                                                                                            Disable or Modify Tools

                                                                                                                                                                            3
                                                                                                                                                                            T1562.001

                                                                                                                                                                            Modify Registry

                                                                                                                                                                            6
                                                                                                                                                                            T1112

                                                                                                                                                                            Credential Access

                                                                                                                                                                            Discovery

                                                                                                                                                                            Peripheral Device Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1120

                                                                                                                                                                            Query Registry

                                                                                                                                                                            2
                                                                                                                                                                            T1012

                                                                                                                                                                            System Information Discovery

                                                                                                                                                                            4
                                                                                                                                                                            T1082

                                                                                                                                                                            System Location Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1614

                                                                                                                                                                            System Language Discovery

                                                                                                                                                                            1
                                                                                                                                                                            T1614.001

                                                                                                                                                                            Lateral Movement

                                                                                                                                                                            Collection

                                                                                                                                                                            Command and Control

                                                                                                                                                                            Exfiltration

                                                                                                                                                                            Impact

                                                                                                                                                                            Service Stop

                                                                                                                                                                            2
                                                                                                                                                                            T1489

                                                                                                                                                                            Replay Monitor

                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                            Downloads

                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\9BB3.tmp
                                                                                                                                                                              Filesize

                                                                                                                                                                              4.3MB

                                                                                                                                                                              MD5

                                                                                                                                                                              6c7cdd25c2cb0073306eb22aebfc663f

                                                                                                                                                                              SHA1

                                                                                                                                                                              a1eba8ab49272b9852fe6a543677e8af36271248

                                                                                                                                                                              SHA256

                                                                                                                                                                              58280e3572333f97a7cf9f33e8d31dc26a98b6535965ebd0bde82249fc9bf705

                                                                                                                                                                              SHA512

                                                                                                                                                                              17344e07b9e9b2cd6ae4237d7f310732462f9cbb8656883607d7a1a4090e869265f92a6da1718dee50b1375b91583de60c6bd9e7e8db6b6e45e33f4b894365d6

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • C:\Windows\SYSTEM.INI
                                                                                                                                                                              Filesize

                                                                                                                                                                              257B

                                                                                                                                                                              MD5

                                                                                                                                                                              15af0186a075da50d8ed1809cf9f4a7a

                                                                                                                                                                              SHA1

                                                                                                                                                                              713f826940f0b37181d7c7ae24ea08b9e989d7d3

                                                                                                                                                                              SHA256

                                                                                                                                                                              e5299c621109b9f3efebbf069569c69dd8fd5ee9b5d7fa51220c77b3a5e5c7dd

                                                                                                                                                                              SHA512

                                                                                                                                                                              bad268aa59413108a5753e80ac49a32f078199baae7cc9c60f8547dd02f3115fef0c8da1702a49ee1734e4f38fb5dfd3393af272d0b4472622a4e45a3d96dab1

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • C:\Windows\SysWOW64\ossvogaa.dll
                                                                                                                                                                              Filesize

                                                                                                                                                                              77KB

                                                                                                                                                                              MD5

                                                                                                                                                                              02fc7f52c9bc1141c0897c985fea35a6

                                                                                                                                                                              SHA1

                                                                                                                                                                              eba3456099c844eaa2b912c5af9ff3329d887b67

                                                                                                                                                                              SHA256

                                                                                                                                                                              0018ee5ad65eda4843d24464fc41ecda9ae3e051aab404f3e6c4215940168c21

                                                                                                                                                                              SHA512

                                                                                                                                                                              cd586c85b2652bbcd1a41ff2c4c5fbf06a28791139e9e0306d6b8f934cf4df0ea78dbd1ddbe56cfaf5409767dea9b009f39454abf1c9ee1959f965153811ea7a

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • C:\Windows\SysWOW64\uqiwogaa.dll
                                                                                                                                                                              Filesize

                                                                                                                                                                              24KB

                                                                                                                                                                              MD5

                                                                                                                                                                              66ed0210db83ddb4b2ba9128d19fdd2a

                                                                                                                                                                              SHA1

                                                                                                                                                                              a512e102bae54b299c90de3f3fb01184ad0bfd2e

                                                                                                                                                                              SHA256

                                                                                                                                                                              6e7c04e90d3c42bc9af95eb5b03c60664fc812a62129a578906aa3d9b9be1664

                                                                                                                                                                              SHA512

                                                                                                                                                                              6fda543bdacecacd6aa1eb66a4b84a9aa49a23f212c4e0c36dcbf725a0739c5843c29465daca248679368057bfa208b67d764e9cd3844ba39a94c7283c5d7de0

                                                                                                                                                                              Download Submit

                                                                                                                                                                            • memory/1848-14-0x0000000001360000-0x0000000001361000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1848-50-0x0000000001350000-0x0000000001352000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1848-26-0x0000000001350000-0x0000000001352000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1848-22-0x0000000001350000-0x0000000001352000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1936-66-0x0000000002E70000-0x0000000002E71000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/1936-67-0x0000000002DE0000-0x0000000002DE2000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-25-0x0000000003410000-0x0000000003412000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-63-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-6-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-60-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-62-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-61-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-27-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-15-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-12-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-10-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-9-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-21-0x0000000003410000-0x0000000003412000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-8-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-0-0x0000000000400000-0x0000000000437000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              220KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-29-0x0000000004670000-0x0000000004671000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              4KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-24-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-64-0x0000000003410000-0x0000000003412000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-4-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-23-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-11-0x0000000003410000-0x0000000003412000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              8KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-68-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-69-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-71-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-72-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-73-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-75-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-81-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-83-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-84-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-87-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-90-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-131-0x0000000000400000-0x0000000000437000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              220KB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-132-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download

                                                                                                                                                                            • memory/4148-2-0x0000000002210000-0x00000000032CA000-memory.dmp

                                                                                                                                                                              Filesize

                                                                                                                                                                              16.7MB

                                                                                                                                                                              Download