3afa44e3a1c7c685ecde14e294dee3d135d1f1086a30d0dcf037ea38ed981e7e

Analysis

max time kernel
26s
max time network
28s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/05/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
xosscript_patched.exe
Size 162KB
Sample260504-npbcsad13m
SHA256 3afa44e3a1c7c685ecde14e294dee3d135d1f1086a30d0dcf037ea38ed981e7e
MD5 37834c17afdeb27a864171ef638ae134
SHA1 cf95ab82250a622707b6e3dcd3d9d3e570ff9760
SHA512 9d950bf8e908e77dcd438482914ca08e3a027e2b1a20ed1d5039821a6094fad0b30239ef7675e6172313c443adb86f9a72d9cc56f1c8aa8033ea536dcba0c680
SSDEEP 768:342Q1gLq/l+BixaNbXpyPQWCXmoYIONO9ndIUakd:342Qd9qKaNbkPQvXcO9xhd
TLSH
T143F3FD8067E81A19F3BA2F755AB5E635083ABC665C22C54D01E5BC8F3932F91C971B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lateral_movement persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	xosscript_patched.exe

Modifies boot configuration data using bcdedit 5 IoCs

pid	Process
2308	bcdedit.exe
4412	bcdedit.exe
2188	bcdedit.exe
344	bcdedit.exe
2296	bcdedit.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 29 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntoskrnl.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\audiodg.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\audiodg.exe	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntoskrnl.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntoskrnl.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\audiodg.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TimerResolution = "C:\\Windows\\timerres.exe --resolution 5070 --no-console"	xosscript_patched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Welcome = "\"C:\\Users\\Default\\Desktop\\WELCOME TO XOS.txt\""	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\DeleteXOS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\DeleteXOS.bat\""	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\XOS-Service-Configurator = "\"C:\\XOS\\XOS-Service-Configurator.exe\""	xosscript_patched.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4848	powershell.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	reg.exe

Power Settings 1 TTPs 6 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2448	powercfg.exe
4796	powercfg.exe
4868	powercfg.exe
3060	powercfg.exe
1620	powercfg.exe
1944	powercfg.exe

Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

lateral_movement

SMB/Windows Admin Shares

T1021.002

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\service-backups\windows-default-services.reg	xosscript_patched.exe
File opened for modification	C:\Windows\service-backups\windows-default-services.reg	xosscript_patched.exe
File created	C:\Windows\service-backups\xos-default-services.reg	xosscript_patched.exe
File opened for modification	C:\Windows\service-backups\xos-default-services.reg	xosscript_patched.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4848	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2672	Reg.exe
4020	reg.exe
1224	Reg.exe
4248	Reg.exe
3348	Reg.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumber	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Address	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\DefaultRequestFlags	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport\PowerCycleCount	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\Attributes	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport\MinimumIdleTimeoutInMS	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport\InitialTimestamp	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Storport\InitialTimestamp	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ClassGUID	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport\InitialTimestamp	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	xosscript_patched.exe

Modifies Control Panel 5 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Desktop\WindowMetrics\MinAnimate = "0"	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseSpeed = "0"	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseThreshold1 = "0"	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Mouse\MouseThreshold2 = "0"	xosscript_patched.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\Desktop\UserPreferencesMask = 9012038010000000	xosscript_patched.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "158"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4848	powershell.exe
4848	powershell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	2448	powercfg.exe
Token: SeCreatePagefilePrivilege	2448	powercfg.exe
Token: SeShutdownPrivilege	4796	powercfg.exe
Token: SeCreatePagefilePrivilege	4796	powercfg.exe
Token: SeShutdownPrivilege	4796	powercfg.exe
Token: SeCreatePagefilePrivilege	4796	powercfg.exe
Token: SeShutdownPrivilege	4868	powercfg.exe
Token: SeCreatePagefilePrivilege	4868	powercfg.exe
Token: SeShutdownPrivilege	3060	powercfg.exe
Token: SeCreatePagefilePrivilege	3060	powercfg.exe
Token: SeShutdownPrivilege	1620	powercfg.exe
Token: SeCreatePagefilePrivilege	1620	powercfg.exe
Token: SeShutdownPrivilege	1944	powercfg.exe
Token: SeCreatePagefilePrivilege	1944	powercfg.exe
Token: SeDebugPrivilege	4464	xosscript_patched.exe
Token: SeShutdownPrivilege	4724	shutdown.exe
Token: SeRemoteShutdownPrivilege	4724	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4464	xosscript_patched.exe
4464	xosscript_patched.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4464	xosscript_patched.exe
4464	xosscript_patched.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3844	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 4848	4464	xosscript_patched.exe	85
PID 4464 wrote to memory of 2308	4464	xosscript_patched.exe	88
PID 4464 wrote to memory of 4412	4464	xosscript_patched.exe	90
PID 4464 wrote to memory of 2188	4464	xosscript_patched.exe	92
PID 4464 wrote to memory of 344	4464	xosscript_patched.exe	94
PID 4464 wrote to memory of 2296	4464	xosscript_patched.exe	96
PID 4464 wrote to memory of 1564	4464	xosscript_patched.exe	98
PID 4464 wrote to memory of 4100	4464	xosscript_patched.exe	100
PID 4464 wrote to memory of 4092	4464	xosscript_patched.exe	102
PID 4464 wrote to memory of 4020	4464	xosscript_patched.exe	104
PID 4464 wrote to memory of 1224	4464	xosscript_patched.exe	108
PID 4464 wrote to memory of 4248	4464	xosscript_patched.exe	110
PID 4464 wrote to memory of 3348	4464	xosscript_patched.exe	112
PID 4464 wrote to memory of 2672	4464	xosscript_patched.exe	152
PID 4464 wrote to memory of 2448	4464	xosscript_patched.exe	223
PID 4464 wrote to memory of 2044	4464	xosscript_patched.exe	118
PID 4464 wrote to memory of 1836	4464	xosscript_patched.exe	120
PID 4464 wrote to memory of 3532	4464	xosscript_patched.exe	122
PID 4464 wrote to memory of 2856	4464	xosscript_patched.exe	195
PID 4464 wrote to memory of 2988	4464	xosscript_patched.exe	126
PID 4464 wrote to memory of 4688	4464	xosscript_patched.exe	128
PID 4464 wrote to memory of 376	4464	xosscript_patched.exe	232
PID 4464 wrote to memory of 4888	4464	xosscript_patched.exe	132
PID 4464 wrote to memory of 816	4464	xosscript_patched.exe	134
PID 4464 wrote to memory of 4832	4464	xosscript_patched.exe	136
PID 4464 wrote to memory of 3188	4464	xosscript_patched.exe	233
PID 4464 wrote to memory of 1784	4464	xosscript_patched.exe	140
PID 4464 wrote to memory of 4664	4464	xosscript_patched.exe	142
PID 4464 wrote to memory of 4724	4464	xosscript_patched.exe	144
PID 4464 wrote to memory of 3536	4464	xosscript_patched.exe	146
PID 4464 wrote to memory of 216	4464	xosscript_patched.exe	234
PID 4464 wrote to memory of 4776	4464	xosscript_patched.exe	150
PID 4464 wrote to memory of 2672	4464	xosscript_patched.exe	235
PID 4464 wrote to memory of 4084	4464	xosscript_patched.exe	154
PID 4464 wrote to memory of 4628	4464	xosscript_patched.exe	156
PID 4464 wrote to memory of 2624	4464	xosscript_patched.exe	158
PID 4464 wrote to memory of 4000	4464	xosscript_patched.exe	160
PID 4464 wrote to memory of 3960	4464	xosscript_patched.exe	162
PID 4464 wrote to memory of 3484	4464	xosscript_patched.exe	164
PID 4464 wrote to memory of 3732	4464	xosscript_patched.exe	166
PID 4464 wrote to memory of 4380	4464	xosscript_patched.exe	168
PID 4464 wrote to memory of 3640	4464	xosscript_patched.exe	170
PID 4464 wrote to memory of 1556	4464	xosscript_patched.exe	172
PID 4464 wrote to memory of 3692	4464	xosscript_patched.exe	258
PID 4464 wrote to memory of 4124	4464	xosscript_patched.exe	176
PID 4464 wrote to memory of 2328	4464	xosscript_patched.exe	178
PID 4464 wrote to memory of 4600	4464	xosscript_patched.exe	180
PID 4464 wrote to memory of 1956	4464	xosscript_patched.exe	182
PID 4464 wrote to memory of 1568	4464	xosscript_patched.exe	256
PID 4464 wrote to memory of 3448	4464	xosscript_patched.exe	186
PID 4464 wrote to memory of 4588	4464	xosscript_patched.exe	257
PID 4464 wrote to memory of 1888	4464	xosscript_patched.exe	190
PID 4464 wrote to memory of 4940	4464	xosscript_patched.exe	192
PID 4464 wrote to memory of 4080	4464	xosscript_patched.exe	194
PID 4464 wrote to memory of 624	4464	xosscript_patched.exe	196
PID 4464 wrote to memory of 5112	4464	xosscript_patched.exe	198
PID 4464 wrote to memory of 4904	4464	xosscript_patched.exe	200
PID 4464 wrote to memory of 5080	4464	xosscript_patched.exe	202
PID 4464 wrote to memory of 2304	4464	xosscript_patched.exe	204
PID 4464 wrote to memory of 3200	4464	xosscript_patched.exe	206
PID 4464 wrote to memory of 2616	4464	xosscript_patched.exe	208
PID 4464 wrote to memory of 4680	4464	xosscript_patched.exe	210
PID 4464 wrote to memory of 220	4464	xosscript_patched.exe	212
PID 4464 wrote to memory of 1336	4464	xosscript_patched.exe	214

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xosscript_patched.exe
"C:\Users\Admin\AppData\Local\Temp\xosscript_patched.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" ForEach($v in (Get-Command -Name "Set-ProcessMitigation").Parameters["Disable"].Attributes.ValidValues){Set-ProcessMitigation -SYSTEM -Disable $v.ToString() -ErrorAction SilentlyContinue}
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4848
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2308
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4412
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2188
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /timeout 10
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:344
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {current} description "XOS-W11-015-25H2"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2296
- C:\Windows\SYSTEM32\label.exe
  "label" C: XOS
  2⤵
  PID:1564
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\DmaGuard\DeviceEnumerationPolicy" /v "value" /t REG_DWORD /d "2" /f
  2⤵
  PID:4100
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\DmaGuard\DeviceEnumerationPolicy" /v value /t REG_DWORD /d 2 /f
  2⤵
  PID:4092
- C:\Windows\SYSTEM32\reg.exe
  "reg.exe" query "HKLM\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible
  2⤵
  - Maps connected drives based on registry
  - Remote Services: SMB/Windows Admin Shares
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4020
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1224
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4248
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3348
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2672
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -import "C:\Windows\imribiy.pow" c06825f9-80a0-4beb-9c81-de332809e623
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" behavior set disable8dot3 1
  2⤵
  PID:2044
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" behavior set disabledeletenotify 0
  2⤵
  PID:1836
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" behavior set disablelastaccess 1
  2⤵
  PID:3532
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
  2⤵
  PID:2856
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\.Default\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2988
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\.Default\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4688
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\AppGPFault\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:376
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\AppGPFault\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4888
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CCSelect\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:816
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CCSelect\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4832
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ChangeTheme\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3188
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ChangeTheme\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1784
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Close\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4664
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Close\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4724
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3536
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:216
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4776
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2672
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4084
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4628
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceFail\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2624
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceFail\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4000
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\FaxBeep\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3960
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\FaxBeep\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3484
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3732
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4380
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MailBeep\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3640
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MailBeep\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1556
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Maximize\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3692
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Maximize\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4124
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuCommand\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2328
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuCommand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4600
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuPopup\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuPopup\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1568
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MessageNudge\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3448
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MessageNudge\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4588
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Minimize\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1888
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Minimize\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4940
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Default\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2856
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Default\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:624
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.IM\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5112
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.IM\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4904
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Mail\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5080
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Mail\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2304
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Proximity\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3200
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Proximity\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2616
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Reminder\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4680
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Reminder\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:220
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.SMS\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1336
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.SMS\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4764
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Open\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2876
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Open\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3840
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2448
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\PrintComplete\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1644
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\PrintComplete\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2284
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ProximityConnection\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3192
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ProximityConnection\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4184
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreDown\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3188
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreDown\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2672
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreUp\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4408
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreUp\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3488
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ShowBand\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2636
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ShowBand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4596
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemAsterisk\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2792
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemAsterisk\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1900
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemExclamation\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1420
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemExclamation\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3844
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemHand\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1084
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemHand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2820
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemNotification\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1568
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3692
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemNotification\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4412
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemQuestion\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3020
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemQuestion\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1904
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1716
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4844
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\ActivatingDocument\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3364
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\ActivatingDocument\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:116
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\BlockedPopup\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3028
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\BlockedPopup\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3428
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:468
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3276
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4216
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1008
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\MoveMenuItem\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4608
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\MoveMenuItem\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5064
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3484
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4300
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\SecurityBand\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3724
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\SecurityBand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:220
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1644
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2772
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOffSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4504
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOffSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4484
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOnSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3776
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOnSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4784
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4440
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2636
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:408
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3396
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\PanelSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4696
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\PanelSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2776
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Names\.None" /ve /t REG_SZ /d "No Sounds" /f
  2⤵
  PID:4340
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation" /v "DisableStartupSound" /t REG_DWORD /d "0" /f
  2⤵
  PID:2724
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4796
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /change /disable /TN "\Microsoft\Windows\Input\syncpensettings"
  2⤵
  PID:772
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /change /disable /TN "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
  2⤵
  PID:4880
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /s c06825f9-80a0-4beb-9c81-de332809e623
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4868
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3060
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -setacvalueindex scheme_current sub_processor CPMINCORES1 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1620
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- C:\Windows\SYSTEM32\shutdown.exe
  "shutdown" -r -t 5 /c "Rebooting XOS"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4588

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3914055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_eaolvbkf.5j2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eaolvbkf.5j2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

windows-default-services.reg

Path C:\Windows\service-backups\windows-default-services.reg
Size 5KB
SHA256 dc7ce39d51194cce7f26145892ae1ac6f518026bfce46e699f35b72e77d8c0a6
MD5 cb130c767065404dbef9c6bd7c8e8419
SHA1 f58f12ee5869c5befb1fe9e15683daaa0816ed6f
SHA512 801ee5e15bbc13dd062d7ca2022d293f5669d8e09a74e73ffb734856a8c8d0d9d1c997c2793f18a659f9ea3a591f02a57bc20e535d702a2795d35ca67ce84206
SSDEEP 48:9JDed6vs1ivzhKvzlG5plP3/C7vGV9tO2RJVXTBnEj4rCzZ4VdViwgyiapEbEBQC:PSlJq3ys
TLSH
T17EB135751CB383FBE1B622051F23F6E03025BAA69ACEDA5155E84C0131E3C9AA4DF55F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xos-default-services.reg

Path C:\Windows\service-backups\xos-default-services.reg
Size 848B
SHA256 451c50e09812425e5874a9fcbeae589d3233964b6dd0c269737ff263c6b0cce3
MD5 baba60cbdbc95565facfdf9cdd754210
SHA1 7686aa7c6a61cdc3c4612ac74dd87303c03c37dc
SHA512 9ccde52cb08f6ce9d46487222dd91db4da1e80686e6a530eb13091a02e73b28461f5fab936142bbed0c5e99fbbd0b7bba54d872df305f9d62e956784cfcb1d3c
TLSH
T1B90139791CB383BBE1B662001F23F6A13075B6A69ACECA5194E84C0031D3C96A0DF15F
MD5 SHA1 SHA512 TLSH

Submit Download

xos-default-services.reg

Path C:\Windows\service-backups\xos-default-services.reg
Size 3KB
SHA256 b33a24386003dd2cb42c5afc8d603b72eee8389184e8c17e1321ee32b6ca0b88
MD5 6abe0ec8664195a8bace0a6a89fd90f8
SHA1 3b3046d210b868daa1444c04d09887a8562d4dae
SHA512 aaf2ce99799a357c9bb8197bdbd4c7eea9110e98af74297ed00293a417c13fbf87b54339ceeb4da77d5687c51bfa4a3c0bf927dabd5012fa8c9029453947fffa
TLSH
T13C8147751CB783BBE1B622051F23F6E03025BAA69BCEDA5154E84C0131E3C9AA4DF55F
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\log.txt
Size 3KB
SHA256 23b08941c47c86775c54f493c7528272f3804e37fd9ba141de52078af95b118a
MD5 92079d78b0c6c03d693649846d47067b
SHA1 7900a5c42cd4eb3c7481d7d5c4048242d86d74c5
SHA512 f70762d71daf0bebd22c77bcc5ec2da7b6109b4b92957b7f8ddf399f144210dde1c8dd5870215bdc288d36ea553a9824124bce02d53a15735e49123cc3a483c3
TLSH
T1686122195B4509A8E373D383B6C233322D6BF69571F4637929884619739BC7C9AD7301
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\log.txt
Size 330B
SHA256 61b685a901907a66f47f6de0b8769727e0bf72995c6a8ee3909bab86d11a6323
MD5 d0e4fa233295dfdebb80cd74bb0b9826
SHA1 d5e60db7eb56e9e0688cd05b6042a057b73c4486
SHA512 446284fa7d5bab133e153abdc16c6eb360da26267213804a6b22e29acecfe781d7659304c9be8fc7b9f9a4f8cec926da9342456d9a17f669842757f3713a230f
TLSH
T1C9E086BE9BA101F72EB64707E61B69384C577D0D5355A36833DE564E310907139F21C0
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\log.txt
Size 4KB
SHA256 3856c3de814ba9f9a9670be1d39be1e15c5ef38fc09688d57828a525af662a1a
MD5 82151d0b8e93ea5c6cbd2f683f5d1ba5
SHA1 baa4f2a133e6825b9fd0ec5e9b9cde9d1e3a2084
SHA512 74e05795f3f526cda4e42c06f9043d6f74c64c9da113ebc8f764e3cb0718073c8432388b9fb9755dd572f84ef7ef1be633d188a00515d13f0ac0c396002893ff
SSDEEP 96:KrlyGwYT+cCxFEpDUczlAKJ9G22luzIBg20M0e20q0k/0y0Iv0Io0s0s0VK:Mlyen9eucNTyr3HtytBsK
TLSH
T14D9155155B8415A9E673E743B68633312E2BFA8A21F0A37424C9062D728BC7C99EB351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4464-130-0x0000022A99410000-0x0000022A9941C000-memory.dmp

Download

memory/4464-1-0x0000022AB37B0000-0x0000022AB37C0000-memory.dmp

Download

memory/4464-1622-0x0000022A99410000-0x0000022A9941C000-memory.dmp

Download

memory/4464-0-0x0000022A99050000-0x0000022A9907E000-memory.dmp

Download

memory/4464-129-0x0000022AB37B0000-0x0000022AB37C0000-memory.dmp

Download

memory/4848-9-0x0000023A57170000-0x0000023A57180000-memory.dmp

Download

memory/4848-21-0x0000023A3EA70000-0x0000023A3EA7C000-memory.dmp

Download

memory/4848-18-0x0000023A57170000-0x0000023A57180000-memory.dmp

Download

memory/4848-15-0x0000023A571C0000-0x0000023A571E2000-memory.dmp

Download

memory/4848-8-0x0000023A57170000-0x0000023A57180000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads