Analysis
- max time kernel
150s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 10:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
WinSysHelper.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
33 signatures
150 seconds
Behavioral task
behavioral2
Sample
WinSysHelper.exe
Resource
win11-20260130-en
windows11-21h2-x64
14 signatures
150 seconds
General
- Target WinSysHelper.exe
- Size 9.6MB
- Sample260504-mbr8pscs4l
- SHA256 860386e3623ad3bbab4701ea455a46bcfa6b46e201c5c3a24769fcd5441d0c83
- MD5 097bade22f4b8e8695b7340db8254e68
- SHA1 afeace1db6f878cc4d9c42d0665c70cb519e8447
- SHA512 dd9857222634e1cd60661594a5a73bb3918739cf3e5fc733d046a637cae40d3f601e13fe9762ec454717477babceb0e643e0f39f8242ba8aca5914718118da44
- SSDEEP 196608:n9wpKdysCN8+ZjE2a4qAf+f3uKYIU/gpYbeEevzzPOVYLGQjRDTitfLuaVwujTds:nSCE97aFG+WKJU/UzTOV3YRDWtaaVbG/
- TLSH T18EA6D1A5A4AEA4F0C59FBB71D935795BDB3518224F5A21EB07103E840EB3394CDB8F90
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/764-6-0x00000000024D0000-0x0000000002532000-memory.dmp family_sheetrat_v1 behavioral1/memory/2248-247-0x0000000002BD0000-0x0000000002C32000-memory.dmp family_sheetrat_v1 -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 12.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 12.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" Program.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 12.exe - Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DoSvc\ImagePath = "C:\\Windows\\System32\\svchost.exe -k NetworkService -p" Process not Found - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Process not Found - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation Program.exe - Executes dropped EXE 37 IoCs
pid Process 764 Program.exe 1180 Process not Found 672 Process not Found 1376 Process not Found 1168 Process not Found 1764 Process not Found 1148 Process not Found 1320 Process not Found 4512 Process not Found 2544 Process not Found 928 Process not Found 1504 Process not Found 4244 Process not Found 4056 Process not Found 5036 Process not Found 1668 Process not Found 3444 Process not Found 3036 Process not Found 3044 Process not Found 2832 Process not Found 1356 Process not Found 2628 Process not Found 60 Process not Found 1048 Process not Found 2824 Process not Found 2088 Process not Found 616 Process not Found 1020 Process not Found 1632 Process not Found 3800 Process not Found 2816 Process not Found 1796 Process not Found 788 Process not Found 2572 Process not Found 3812 Process not Found 3048 12.exe 2248 12.exe - Loads dropped DLL 64 IoCs
pid Process 3248 Process not Found 1372 Process not Found 2924 Process not Found 4608 Process not Found 3376 Process not Found 3248 Process not Found 2980 Process not Found 672 Process not Found 1180 Process not Found 1764 Process not Found 1376 Process not Found 1372 Process not Found 1168 Process not Found 1320 Process not Found 2248 12.exe 4512 Process not Found 2544 Process not Found 2924 Process not Found 1148 Process not Found 1356 Process not Found 928 Process not Found 1504 Process not Found 4056 Process not Found 5088 Process not Found 5036 Process not Found 3444 Process not Found 1668 Process not Found 4392 mousocoreworker.exe 4244 Process not Found 2088 Process not Found 3044 Process not Found 2628 Process not Found 2832 Process not Found 4608 Process not Found 3036 Process not Found 2824 Process not Found 616 Process not Found 60 Process not Found 3800 Process not Found 1048 Process not Found 2816 Process not Found 1632 Process not Found 1020 Process not Found 1796 Process not Found 788 Process not Found 2572 Process not Found 3812 Process not Found 3248 Process not Found 1180 Process not Found 1376 Process not Found 1372 Process not Found 1764 Process not Found 2980 Process not Found 1168 Process not Found 672 Process not Found 2544 Process not Found 1320 Process not Found 4512 Process not Found 1356 Process not Found 2924 Process not Found 1148 Process not Found 3048 12.exe 928 Process not Found 1504 Process not Found - Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" Program.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" 12.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Program.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: Process not Found - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com - Drops file in System32 directory 15 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\12 Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A78F3FA67C4AE1391DAF255794995271 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A Process not Found - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4472 sc.exe 2592 sc.exe 3816 sc.exe 3756 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service Process not Found - Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 mousocoreworker.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information Process not Found - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates Process not Found Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02fpocojuxpejvhm Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02uktzmsoyqgzamk Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ytkcnqnlihofqo\Provision Monday, May 04, 2026 10:18:04 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAACfrq12OMDTJP8kwNu5rlpaWBwfmJOOUElbAHAeBNqqfgAAAAAOgAAAAAIAACAAAABtu7ybu/j2ih6LJSDBoYumjL56m2lUY1bcOccA6nFhHSAAAAApwGOvrM/Zhc2v64Yl+gtdEVZ6MLa9+dRUDZ6OvzMXPUAAAAA0FsV9S9YQAmUgdmd3sRjkYmLFcOECkDuZD5wur6CTD3HQwfjb/UiH//0vZ+7eRvLl9zXPNMC528VFbmzURngu" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02fpocojuxpejvhm\Provision Monday, May 04, 2026 10:18:07 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAACdFosWo+uQxYFaWg6x3JSLyS+IEwCn+8uT9mcyGCII8wAAAAAOgAAAAAIAACAAAABDuauk+yNJRa806/6uDk2XO32ayZ/5EKRCZwgmYoM+syAAAACDG+Nwbg+uvl3e5xNa5FoyF2vay04+fIu+sH9AjloOHUAAAACKQFEdEMkZfhH40oCUuLjUUTgFL7JEXVVCHUChK3SK6YgBdBSsUJ2O7h2UqiL2SOqKWNJdjEIh+m7zdk+uq67h" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1777889961" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bqtheehyefqhhf Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02mjenyvczxexlaf Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02ytkcnqnlihofqo Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02thagmpacyqxylq Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02mjenyvczxexlaf\Provision Monday, May 04, 2026 10:18:03 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAABSNO8Cn+3oL/PRji9/1KHUXGz+EKGqEd/m1cWjAQ+1AQAAAAAOgAAAAAIAACAAAACpcVDHu8+l5p7ZnGGuEPo4g8tNbnuEQIwIYryqDU7WKSAAAAAZ/V/jMxzW5CwPHoHcEapQ0VB3u5+DUlCLtBe7pwhN/UAAAADNmGWXawMNaG6CNQPB5+PWlJA4MvJHKB+l+sJPZNewwi0bNFD8dYUeVkffN6tiNJue7imhT6k2he06/fQkDAWi" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02fzjngmiateslpm\Provision Monday, May 04, 2026 10:18:03 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAAD8HCWQQzf905Wxz48hkaCBlxn8v6j9izA36qmWd+g4RwAAAAAOgAAAAAIAACAAAADLgs3pr99UKzjL1IkHAVcTVftm0idnMetS/QJfYO6QISAAAAA68p5Kil43HjooRVJ6ad54ObjBaNUvyYQOClMoGllKhkAAAADhLqGQXfnVRtC7lNPaA4qwukIcn2R6K2Rx0NsmyWPBttNI7An6Uug4kk3rz0j7gYavc3Szxn/ByXG6S0VMPYmu" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02thagmpacyqxylq\Provision Monday, May 04, 2026 10:18:08 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAACHjZNf/e1CoVSVevsqW14t9BlgQvPIrcsbiDdWubHRyQAAAAAOgAAAAAIAACAAAAATSbNquPET55/1B+J7sxKqx0X47v7r0VH/DbaG60zjkyAAAAAXST5SmDicC4QIhLmN8CQC6UT8fp29+H0mbPOwLpFMVEAAAAAuGalNi3s8RyQPqUdCF9M63CNxCyf/BDBHgcJ7zd2HdBoakxQ5yGhb1miIPID/1mhDe7M02P8Yo1y2INoxDORE" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02clnojqloyepcmk\Provision Monday, May 04, 2026 10:18:03 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAADjzuI8Xu8N9kW1JGqoMNnUD9f2l7RTOSCQs73iWNRS1AAAAAAOgAAAAAIAACAAAADt9i1Pjn9K0DwHaAwY0OfZk0/RaEwBIltMmTdUnjfc7SAAAACP/SpnPDFd0ZvZxJ0Lfeb69vaqgOiuUKvSO7Z8CffTeEAAAAANfOc+yIoVJN+iF0DsqN90TpyiQxHlmJoD57mvI5yFc09NnzXHVVtZe1r1yhwqMJRrL5blmUgfjv1N1WB4luWu" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02uktzmsoyqgzamk\Provision Monday, May 04, 2026 10:18:29 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAABSr+u1Vy4lF+pDm4IuGyd1JdLCtwT7a0q3lIDlrp+ihwAAAAAOgAAAAAIAACAAAACBPfEqC7g8OLxaq7pwh80an11Hd7j+IQik7tKbx0mTEiAAAAA9hHK+mkIlDHMIApE9wcwSKrhys5cJGmkRspDk88U+SkAAAABHI7Sj3YgkS7KWATn6d3fAIYBUMJ5CBFqTWdLUj/hsZYt4GoEpS74LAoQSAU9lpAwRHF/EduUrA2cpb5gyTAL8" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02fzjngmiateslpm Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\Logs\02bqtheehyefqhhf\Provision Monday, May 04, 2026 10:18:29 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA9ZnKIAac906RbI9zp6kxaAAAAAACAAAAAAAQZgAAAAEAACAAAADUBWguLUN5R6T+p+88qWtWndrECVoO14CzuDGJSa8etQAAAAAOgAAAAAIAACAAAADesJmiXGL9AqH15m4mR9VeiBoI95uM9pQ7ATLoKoGF+SAAAACE34PsssZLIGHmNhYclgU1U8d8z180wPWF96wyYlvVGUAAAACqMTt05qvlNQ2evz4P7Owb+n+sLypxzaxs4ZIp1YtPvwJ0IjRlivHfMJ3jXwbDbCekDbXIFdgULazJq0C5mETG" Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION Process not Found - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4708 schtasks.exe - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 764 Program.exe 764 Program.exe 764 Program.exe 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 2588 Process not Found 3048 12.exe 3048 12.exe 3048 12.exe 2248 12.exe 2248 12.exe 2248 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe 3048 12.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3248 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 764 Program.exe Token: SeShutdownPrivilege 3248 Process not Found Token: SeCreatePagefilePrivilege 3248 Process not Found Token: SeAssignPrimaryTokenPrivilege 2544 Process not Found Token: SeIncreaseQuotaPrivilege 2544 Process not Found Token: SeSecurityPrivilege 2544 Process not Found Token: SeTakeOwnershipPrivilege 2544 Process not Found Token: SeLoadDriverPrivilege 2544 Process not Found Token: SeSystemtimePrivilege 2544 Process not Found Token: SeBackupPrivilege 2544 Process not Found Token: SeRestorePrivilege 2544 Process not Found Token: SeShutdownPrivilege 2544 Process not Found Token: SeSystemEnvironmentPrivilege 2544 Process not Found Token: SeUndockPrivilege 2544 Process not Found Token: SeManageVolumePrivilege 2544 Process not Found Token: SeAssignPrimaryTokenPrivilege 2544 Process not Found Token: SeIncreaseQuotaPrivilege 2544 Process not Found Token: SeSecurityPrivilege 2544 Process not Found Token: SeTakeOwnershipPrivilege 2544 Process not Found Token: SeLoadDriverPrivilege 2544 Process not Found Token: SeSystemtimePrivilege 2544 Process not Found Token: SeBackupPrivilege 2544 Process not Found Token: SeRestorePrivilege 2544 Process not Found Token: SeShutdownPrivilege 2544 Process not Found Token: SeSystemEnvironmentPrivilege 2544 Process not Found Token: SeUndockPrivilege 2544 Process not Found Token: SeManageVolumePrivilege 2544 Process not Found Token: SeAssignPrimaryTokenPrivilege 2544 Process not Found Token: SeIncreaseQuotaPrivilege 2544 Process not Found Token: SeSecurityPrivilege 2544 Process not Found Token: SeTakeOwnershipPrivilege 2544 Process not Found Token: SeLoadDriverPrivilege 2544 Process not Found Token: SeSystemtimePrivilege 2544 Process not Found Token: SeBackupPrivilege 2544 Process not Found Token: SeRestorePrivilege 2544 Process not Found Token: SeShutdownPrivilege 2544 Process not Found Token: SeSystemEnvironmentPrivilege 2544 Process not Found Token: SeUndockPrivilege 2544 Process not Found Token: SeManageVolumePrivilege 2544 Process not Found Token: SeAssignPrimaryTokenPrivilege 2544 Process not Found Token: SeIncreaseQuotaPrivilege 2544 Process not Found Token: SeSecurityPrivilege 2544 Process not Found Token: SeTakeOwnershipPrivilege 2544 Process not Found Token: SeLoadDriverPrivilege 2544 Process not Found Token: SeSystemtimePrivilege 2544 Process not Found Token: SeBackupPrivilege 2544 Process not Found Token: SeRestorePrivilege 2544 Process not Found Token: SeShutdownPrivilege 2544 Process not Found Token: SeSystemEnvironmentPrivilege 2544 Process not Found Token: SeUndockPrivilege 2544 Process not Found Token: SeManageVolumePrivilege 2544 Process not Found Token: SeAssignPrimaryTokenPrivilege 2544 Process not Found Token: SeIncreaseQuotaPrivilege 2544 Process not Found Token: SeSecurityPrivilege 2544 Process not Found Token: SeTakeOwnershipPrivilege 2544 Process not Found Token: SeLoadDriverPrivilege 2544 Process not Found Token: SeSystemtimePrivilege 2544 Process not Found Token: SeBackupPrivilege 2544 Process not Found Token: SeRestorePrivilege 2544 Process not Found Token: SeShutdownPrivilege 2544 Process not Found Token: SeSystemEnvironmentPrivilege 2544 Process not Found Token: SeUndockPrivilege 2544 Process not Found Token: SeManageVolumePrivilege 2544 Process not Found Token: SeAssignPrimaryTokenPrivilege 2544 Process not Found - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3248 Process not Found - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1692 wrote to memory of 764 1692 WinSysHelper.exe 90 PID 764 wrote to memory of 2592 764 Program.exe 92 PID 764 wrote to memory of 4472 764 Program.exe 94 PID 788 wrote to memory of 4392 788 Process not Found 97 PID 788 wrote to memory of 4392 788 Process not Found 97 PID 764 wrote to memory of 4332 764 Program.exe 98 PID 764 wrote to memory of 2424 764 Program.exe 99 PID 764 wrote to memory of 1208 764 Program.exe 101 PID 764 wrote to memory of 3816 764 Program.exe 104 PID 2424 wrote to memory of 4984 2424 CMD.exe 106 PID 1208 wrote to memory of 4708 1208 cmd.exe 107 PID 764 wrote to memory of 3756 764 Program.exe 108 PID 3248 wrote to memory of 4716 3248 Process not Found PID 3248 wrote to memory of 4716 3248 Process not Found PID 764 wrote to memory of 2248 764 Program.exe 112 PID 3048 wrote to memory of 4252 3048 12.exe 113 PID 4252 wrote to memory of 536 4252 CMD.exe 115 PID 788 wrote to memory of 3580 788 Process not Found 117 PID 788 wrote to memory of 3580 788 Process not Found 117 PID 3248 wrote to memory of 3484 3248 Process not Found PID 3248 wrote to memory of 3484 3248 Process not Found - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 12.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Program.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 12.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\WinSysHelper.exe"C:\Users\Admin\AppData\Local\Temp\WinSysHelper.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exeC:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:764 -
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
PID:2592
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
PID:4472
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\12.exe" enable=yes & exit3⤵PID:4332
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵PID:4984
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:4708
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
PID:3816
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
PID:3756
-
-
C:\Users\Admin\AppData\Roaming\12.exe"C:\Users\Admin\AppData\Roaming\12.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2248
-
-
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
PID:4392
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3048 -
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵PID:536
-
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
PID:3580
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵PID:4664
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
4Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\OneSettings\config.json
- Size 6KB
- SHA256 6aeb047c25f849092a6bb615e14c4ea8842609bfa83a991ee46f8ed3778eed12
- MD5 a9c01b18a710b159de1ff983fbb03fd3
- SHA1 dd1ad1253fdbcff74895db1703d871e2ede79f2c
- SHA512 e2bf8226ca1867566e52951a302027f0c9cdaf0e2d59a466b4c4627ce854e06e034bf8c6ad6b0199aea0631172791fd0922c18c4784a57bfa67f61b72a41f873
- SSDEEP 192:nGDCcIouMgRXUhWwpoTQ/eKIO2CE4cA1RdrPLjT:nG5IouMgRXUhWwpoTQ/eKL2tXWRVPLjT
- TLSH T1A4E1750DB184CC7E5FAB61E6644AB900C6687B279DC44CE9E5C28D1DD49F74C711CBE8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Program.exe
- Size 3.8MB
- SHA256 ae87ca9d7ae9d186021d8e4222416c775398aa64f4d3245a5f4b5ff79009527d
- MD5 925f8034d20b057ba03ce29fe64ee0a3
- SHA1 65f488491b8f502cd8cffe6d1e4e786cd96e7ab3
- SHA512 b7d6c1357d884d0e92289b64c7e23d6ab6e6e0b17695f9ec91d9167ab537bb00a4e03a8ea5f5d7c209ddc326bdba5525d0551bbe3a68507c9b3451ba882c4005
- SSDEEP 6144:1pS6we7lT44CD8tra9PTIOFA/znnnhN7jYKsdKyPMtDAvlTaC5MaWD3ff/9X2B7V:1YX/yYXERCfd+/CE9qtYs+gzvKqhgYX
- TLSH T1350623A702F4EB8CC766CB3444E3E4F15F7B6112562B4F6E4C985478018AE688EE1B5F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\f0d05de1-2f39-477e-9f49-a3a24098a602.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
- MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
- SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
- SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
- TLSH T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
- MD5 7d612892b20e70250dbd00d0cdd4f09b
- SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
- SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
- TLSH T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
- MD5 1e8e2076314d54dd72e7ee09ff8a52ab
- SHA1 5fd0a67671430f66237f483eef39ff599b892272
- SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
- TLSH T1CD51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- TLSH T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH