3afa44e3a1c7c685ecde14e294dee3d135d1f1086a30d0dcf037ea38ed981e7e

Analysis

max time kernel
17s
max time network
21s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
xosscript_patched.exe
Size 162KB
Sample260504-npbcsad13m
SHA256 3afa44e3a1c7c685ecde14e294dee3d135d1f1086a30d0dcf037ea38ed981e7e
MD5 37834c17afdeb27a864171ef638ae134
SHA1 cf95ab82250a622707b6e3dcd3d9d3e570ff9760
SHA512 9d950bf8e908e77dcd438482914ca08e3a027e2b1a20ed1d5039821a6094fad0b30239ef7675e6172313c443adb86f9a72d9cc56f1c8aa8033ea536dcba0c680
SSDEEP 768:342Q1gLq/l+BixaNbXpyPQWCXmoYIONO9ndIUakd:342Qd9qKaNbkPQvXcO9xhd
TLSH
T143F3FD8067E81A19F3BA2F755AB5E635083ABC665C22C54D01E5BC8F3932F91C971B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution lateral_movement persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	xosscript_patched.exe

Modifies boot configuration data using bcdedit 5 IoCs

pid	Process
4712	bcdedit.exe
4764	bcdedit.exe
4100	bcdedit.exe
3040	bcdedit.exe
788	bcdedit.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 29 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntoskrnl.exe	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\audiodg.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntoskrnl.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\audiodg.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dwm.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\audiodg.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lsass.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winlogon.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\services.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntoskrnl.exe\MitigationOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fontdrvhost.exe\MitigationAuditOptions = 222222222222222222222222222222222222222222222222	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	xosscript_patched.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csrss.exe	xosscript_patched.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Welcome = "\"C:\\Users\\Default\\Desktop\\WELCOME TO XOS.txt\""	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\DeleteXOS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\DeleteXOS.bat\""	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\XOS-Service-Configurator = "\"C:\\XOS\\XOS-Service-Configurator.exe\""	xosscript_patched.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\TimerResolution = "C:\\Windows\\timerres.exe --resolution 5070 --no-console"	xosscript_patched.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4784	powershell.exe

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\NextInstance	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	reg.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	reg.exe

Power Settings 1 TTPs 6 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5624	powercfg.exe
6048	powercfg.exe
4808	powercfg.exe
6128	powercfg.exe
4664	powercfg.exe
1124	powercfg.exe

Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs

Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

lateral_movement

SMB/Windows Admin Shares

T1021.002

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\service-backups\xos-default-services.reg	xosscript_patched.exe
File opened for modification	C:\Windows\service-backups\xos-default-services.reg	xosscript_patched.exe
File created	C:\Windows\service-backups\windows-default-services.reg	xosscript_patched.exe
File opened for modification	C:\Windows\service-backups\windows-default-services.reg	xosscript_patched.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4784	powershell.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4456	Reg.exe
3368	Reg.exe
3240	reg.exe
4436	Reg.exe
1412	Reg.exe
3896	Reg.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport\PowerCycleCount	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport\InitialTimestamp	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ContainerID	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport\InitialTimestamp	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LocationInformation	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\Attributes	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A	xosscript_patched.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk\CacheIsPowerProtected = "1"	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ClassGUID	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Address	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk\CacheIsPowerProtected	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	xosscript_patched.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ContainerID	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport\MinimumIdleTimeoutInMS	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumber	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	xosscript_patched.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Device Parameters\Storport	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	xosscript_patched.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	xosscript_patched.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	xosscript_patched.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Disk\UserWriteCacheSetting	xosscript_patched.exe

Modifies Control Panel 5 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Mouse\MouseThreshold1 = "0"	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Mouse\MouseThreshold2 = "0"	xosscript_patched.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Desktop\UserPreferencesMask = 9012038010000000	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Desktop\WindowMetrics\MinAnimate = "0"	xosscript_patched.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Control Panel\Mouse\MouseSpeed = "0"	xosscript_patched.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "210"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4784	powershell.exe
4784	powershell.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	5624	powercfg.exe
Token: SeCreatePagefilePrivilege	5624	powercfg.exe
Token: SeShutdownPrivilege	6048	powercfg.exe
Token: SeCreatePagefilePrivilege	6048	powercfg.exe
Token: SeShutdownPrivilege	6048	powercfg.exe
Token: SeCreatePagefilePrivilege	6048	powercfg.exe
Token: SeShutdownPrivilege	4808	powercfg.exe
Token: SeCreatePagefilePrivilege	4808	powercfg.exe
Token: SeShutdownPrivilege	6128	powercfg.exe
Token: SeCreatePagefilePrivilege	6128	powercfg.exe
Token: SeShutdownPrivilege	4664	powercfg.exe
Token: SeCreatePagefilePrivilege	4664	powercfg.exe
Token: SeShutdownPrivilege	1124	powercfg.exe
Token: SeCreatePagefilePrivilege	1124	powercfg.exe
Token: SeDebugPrivilege	2616	xosscript_patched.exe
Token: SeShutdownPrivilege	3888	shutdown.exe
Token: SeRemoteShutdownPrivilege	3888	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2616	xosscript_patched.exe
2616	xosscript_patched.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2616	xosscript_patched.exe
2616	xosscript_patched.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3940	PickerHost.exe
5236	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 4784	2616	xosscript_patched.exe	81
PID 2616 wrote to memory of 4712	2616	xosscript_patched.exe	84
PID 2616 wrote to memory of 4764	2616	xosscript_patched.exe	86
PID 2616 wrote to memory of 3040	2616	xosscript_patched.exe	88
PID 2616 wrote to memory of 4100	2616	xosscript_patched.exe	90
PID 2616 wrote to memory of 788	2616	xosscript_patched.exe	92
PID 2616 wrote to memory of 3220	2616	xosscript_patched.exe	94
PID 2616 wrote to memory of 1112	2616	xosscript_patched.exe	96
PID 2616 wrote to memory of 1740	2616	xosscript_patched.exe	98
PID 2616 wrote to memory of 3240	2616	xosscript_patched.exe	100
PID 2616 wrote to memory of 4436	2616	xosscript_patched.exe	103
PID 2616 wrote to memory of 1412	2616	xosscript_patched.exe	208
PID 2616 wrote to memory of 3896	2616	xosscript_patched.exe	107
PID 2616 wrote to memory of 4456	2616	xosscript_patched.exe	109
PID 2616 wrote to memory of 3368	2616	xosscript_patched.exe	111
PID 2616 wrote to memory of 5624	2616	xosscript_patched.exe	113
PID 2616 wrote to memory of 5676	2616	xosscript_patched.exe	115
PID 2616 wrote to memory of 5724	2616	xosscript_patched.exe	117
PID 2616 wrote to memory of 5772	2616	xosscript_patched.exe	119
PID 2616 wrote to memory of 6012	2616	xosscript_patched.exe	121
PID 2616 wrote to memory of 6060	2616	xosscript_patched.exe	123
PID 2616 wrote to memory of 3644	2616	xosscript_patched.exe	125
PID 2616 wrote to memory of 392	2616	xosscript_patched.exe	127
PID 2616 wrote to memory of 2604	2616	xosscript_patched.exe	129
PID 2616 wrote to memory of 6100	2616	xosscript_patched.exe	131
PID 2616 wrote to memory of 1132	2616	xosscript_patched.exe	133
PID 2616 wrote to memory of 904	2616	xosscript_patched.exe	135
PID 2616 wrote to memory of 3780	2616	xosscript_patched.exe	137
PID 2616 wrote to memory of 4380	2616	xosscript_patched.exe	139
PID 2616 wrote to memory of 460	2616	xosscript_patched.exe	141
PID 2616 wrote to memory of 3924	2616	xosscript_patched.exe	143
PID 2616 wrote to memory of 4848	2616	xosscript_patched.exe	145
PID 2616 wrote to memory of 4116	2616	xosscript_patched.exe	147
PID 2616 wrote to memory of 5004	2616	xosscript_patched.exe	149
PID 2616 wrote to memory of 3908	2616	xosscript_patched.exe	151
PID 2616 wrote to memory of 4616	2616	xosscript_patched.exe	153
PID 2616 wrote to memory of 4504	2616	xosscript_patched.exe	155
PID 2616 wrote to memory of 2432	2616	xosscript_patched.exe	157
PID 2616 wrote to memory of 5192	2616	xosscript_patched.exe	159
PID 2616 wrote to memory of 5268	2616	xosscript_patched.exe	161
PID 2616 wrote to memory of 132	2616	xosscript_patched.exe	163
PID 2616 wrote to memory of 2880	2616	xosscript_patched.exe	165
PID 2616 wrote to memory of 2132	2616	xosscript_patched.exe	167
PID 2616 wrote to memory of 1292	2616	xosscript_patched.exe	169
PID 2616 wrote to memory of 4140	2616	xosscript_patched.exe	171
PID 2616 wrote to memory of 3968	2616	xosscript_patched.exe	173
PID 2616 wrote to memory of 5160	2616	xosscript_patched.exe	175
PID 2616 wrote to memory of 5280	2616	xosscript_patched.exe	177
PID 2616 wrote to memory of 5352	2616	xosscript_patched.exe	179
PID 2616 wrote to memory of 2564	2616	xosscript_patched.exe	181
PID 2616 wrote to memory of 3692	2616	xosscript_patched.exe	183
PID 2616 wrote to memory of 4352	2616	xosscript_patched.exe	185
PID 2616 wrote to memory of 5032	2616	xosscript_patched.exe	187
PID 2616 wrote to memory of 4112	2616	xosscript_patched.exe	189
PID 2616 wrote to memory of 3952	2616	xosscript_patched.exe	191
PID 2616 wrote to memory of 5088	2616	xosscript_patched.exe	193
PID 2616 wrote to memory of 5636	2616	xosscript_patched.exe	195
PID 2616 wrote to memory of 5436	2616	xosscript_patched.exe	197
PID 2616 wrote to memory of 5472	2616	xosscript_patched.exe	199
PID 2616 wrote to memory of 5524	2616	xosscript_patched.exe	201
PID 2616 wrote to memory of 5588	2616	xosscript_patched.exe	203
PID 2616 wrote to memory of 5620	2616	xosscript_patched.exe	205
PID 2616 wrote to memory of 3240	2616	xosscript_patched.exe	207
PID 2616 wrote to memory of 5688	2616	xosscript_patched.exe	209

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\xosscript_patched.exe
"C:\Users\Admin\AppData\Local\Temp\xosscript_patched.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies Control Panel
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" ForEach($v in (Get-Command -Name "Set-ProcessMitigation").Parameters["Disable"].Attributes.ValidValues){Set-ProcessMitigation -SYSTEM -Disable $v.ToString() -ErrorAction SilentlyContinue}
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4784
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4712
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4764
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3040
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /timeout 10
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4100
- C:\Windows\System32\bcdedit.exe
  "C:\Windows\System32\bcdedit.exe" /set {current} description "XOS-W11-015-25H2"
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:788
- C:\Windows\SYSTEM32\label.exe
  "label" C: XOS
  2⤵
  PID:3220
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\DmaGuard\DeviceEnumerationPolicy" /v "value" /t REG_DWORD /d "2" /f
  2⤵
  PID:1112
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKLM\SOFTWARE\Microsoft\PolicyManager\default\DmaGuard\DeviceEnumerationPolicy" /v value /t REG_DWORD /d 2 /f
  2⤵
  PID:1740
- C:\Windows\SYSTEM32\reg.exe
  "reg.exe" query "HKLM\SYSTEM\CurrentControlSet\Services" /s /f DmaRemappingCompatible
  2⤵
  - Maps connected drives based on registry
  - Remote Services: SMB/Windows Admin Shares
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3240
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pci\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4436
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\storahci\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1412
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\stornvme\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3896
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Usb4HostRouter\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4456
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBXHCI\Parameters" /v DmaRemappingCompatible /t REG_DWORD /d 0 /f
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3368
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -import "C:\Windows\imribiy.pow" c06825f9-80a0-4beb-9c81-de332809e623
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" behavior set disable8dot3 1
  2⤵
  PID:5676
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" behavior set disabledeletenotify 0
  2⤵
  PID:5724
- C:\Windows\SYSTEM32\fsutil.exe
  "fsutil" behavior set disablelastaccess 1
  2⤵
  PID:5772
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes" /ve /t REG_SZ /d ".None" /f
  2⤵
  PID:6012
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\.Default\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:6060
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\.Default\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3644
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\AppGPFault\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:392
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\AppGPFault\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2604
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CCSelect\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:6100
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CCSelect\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1132
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ChangeTheme\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:904
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ChangeTheme\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3780
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Close\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4380
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Close\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:460
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3924
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4848
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4116
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceConnect\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5004
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3908
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceDisconnect\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4616
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceFail\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4504
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\DeviceFail\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\FaxBeep\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5192
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\FaxBeep\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5268
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:132
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\LowBatteryAlarm\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2880
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MailBeep\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2132
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MailBeep\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1292
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Maximize\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4140
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Maximize\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3968
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuCommand\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5160
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuCommand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5280
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuPopup\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5352
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MenuPopup\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2564
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MessageNudge\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3692
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\MessageNudge\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4352
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Minimize\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5032
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Minimize\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4112
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Default\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3952
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Default\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5088
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.IM\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5636
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.IM\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5436
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Mail\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5472
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Mail\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5524
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Proximity\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5588
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Proximity\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5620
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Reminder\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1412
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.Reminder\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5688
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.SMS\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5736
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Notification.SMS\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5816
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Open\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5852
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\Open\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5880
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\PrintComplete\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5920
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\PrintComplete\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5976
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ProximityConnection\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:6072
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ProximityConnection\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:704
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreDown\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:6044
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreDown\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1264
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreUp\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2124
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\RestoreUp\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:6120
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ShowBand\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4188
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\ShowBand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:420
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemAsterisk\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1912
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemAsterisk\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1476
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemExclamation\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1884
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemExclamation\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1376
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemHand\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1268
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemHand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2996
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemNotification\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2040
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemNotification\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2476
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemQuestion\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4864
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\SystemQuestion\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2224
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5208
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\.Default\WindowsUAC\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4052
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\ActivatingDocument\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:232
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\ActivatingDocument\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4588
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\BlockedPopup\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:3380
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\BlockedPopup\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:1628
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4984
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5128
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5240
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\FeedDiscovered\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5356
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\MoveMenuItem\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5400
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\MoveMenuItem\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2140
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.Current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4092
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\Navigating\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4976
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\SecurityBand\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4856
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\Explorer\SecurityBand\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:2112
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:828
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5408
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOffSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5444
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOffSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOnSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5560
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubOnSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5584
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:4456
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\HubSleepSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5700
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5712
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\MisrecoSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5796
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\PanelSound\.current" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5824
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Apps\sapisvr\PanelSound\.None" /ve /t REG_SZ /d "" /f
  2⤵
  PID:5924
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKCU\AppEvents\Schemes\Names\.None" /ve /t REG_SZ /d "No Sounds" /f
  2⤵
  PID:5940
- C:\Windows\SYSTEM32\Reg.exe
  "Reg.exe" add "HKLM\Software\Microsoft\Windows\CurrentVersion\Authentication\LogonUI\BootAnimation" /v "DisableStartupSound" /t REG_DWORD /d "0" /f
  2⤵
  PID:6016
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -h off
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:6048
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /change /disable /TN "\Microsoft\Windows\Input\syncpensettings"
  2⤵
  PID:4088
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /change /disable /TN "\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem"
  2⤵
  PID:3984
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" /s c06825f9-80a0-4beb-9c81-de332809e623
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4808
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -setacvalueindex scheme_current sub_processor CPMINCORES 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:6128
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -setacvalueindex scheme_current sub_processor CPMINCORES1 100
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\SYSTEM32\powercfg.exe
  "powercfg" -setactive scheme_current
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:1124
- C:\Windows\SYSTEM32\shutdown.exe
  "shutdown" -r -t 5 /c "Rebooting XOS"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3888

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3940

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a0855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Power Settings

T1653

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Remote Services

T1021

SMB/Windows Admin Shares

T1021.002

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_gjrsndwk.dg1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gjrsndwk.dg1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

windows-default-services.reg

Path C:\Windows\service-backups\windows-default-services.reg
Size 2KB
SHA256 a8af17ce1bb654c9eb68a521fc3523b87b5826ed4d9718e7e7036092021dad6b
MD5 4689bd815c12bba2433fa066744ec6da
SHA1 fe8ecdf3cd82e7ac03972b7eed9df8594e2e81cb
SHA512 7ef20387bf36345e69c9fa6bb32e46846dfc708b09a67dffeb2dac7733ab778df5694131efc6659d867c73dd4a96dcb3a939d6b96532aa767708031914656825
TLSH
T1BA4146751CB783BBE1B662001B22F6E03025BAA29ACECA5154E84C0131E3C9AA0CE44F
MD5 SHA1 SHA512 TLSH

Submit Download

windows-default-services.reg

Path C:\Windows\service-backups\windows-default-services.reg
Size 2KB
SHA256 0967eb5c89ffb24b7151d7978521c81ee0c510ec3a68db72d8b0123dc8d24afe
MD5 efa1a25c32432219e8bd925256e5a6e7
SHA1 9d763237177cedeb591f013b391a0ceef71b99c8
SHA512 44ce10baec8767e858690b2f9170442b3d0bde510a2c5530c2f3943a2df9be52833a09c2c794f98c0ca6867977b600f691b47c2bf50ca1fe7c03bc6a53e51bec
TLSH
T1485139751CB783FBE1B662041F23F6E13035BAA69ACEDA5154E84C0131D3C96A4DE45F
MD5 SHA1 SHA512 TLSH

Submit Download

windows-default-services.reg

Path C:\Windows\service-backups\windows-default-services.reg
Size 4KB
SHA256 33ac908643fca1dccbcef19484425509e88cd2621580fc9c3c01d2528772b6a6
MD5 b76057aaa8f82850febd26b6ab21b7ff
SHA1 e6a4757f5623841de142ddf763480d59c040eb98
SHA512 b8f9a36ef3a8208b226357436d8f8e92a80d71dafcd0ff41d7267f95ba71b47a08994a3dbc979eb78c289886c3b1ee5d4479565a99f08a085285acdd8e52b83d
SSDEEP 48:9JDed6us1ivzhKvzlG5plP3/C7vGV9tO2RJDVXTBnEj4rCzZ4VdViwgyiapEbf:PFlHq3e
TLSH
T1529146751CB783BBE1B622041F23F6E13035BAA69ACEDA5154E84C0131E3C9AA4DF45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xos-default-services.reg

Path C:\Windows\service-backups\xos-default-services.reg
Size 5KB
SHA256 b3838acd969cf9d9c200944df4bb865bfc6af112bb8b061ff00232def644dfae
MD5 07077ddf8b4cb43834096b5370e7bc6a
SHA1 3f51d253d57b76a8555ef8f7089efb9b2d0c11d2
SHA512 07a1d08e1512a9cc65509c4801ae7cc8d70d8e7ce8c22613a27af6bac8f0bd2e8461b7de1445057f22e91ffb2c25d69d53fe71c80c77a9df4a098eb55097bca7
SSDEEP 48:9JDed6us1ivzhKvzlG5plP3/C7vGV9tO2RJDVXTBnEj4rCzZ4VdViwgyiapEbEBF:PFlHq3dF
TLSH
T14AB146750CB383FBE1B222051F23F6E03025BAA69ACEDA5154E84C0131E3C9AA4DF45F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log.txt

Path C:\log.txt
Size 1KB
SHA256 3edc5eca412f8326703a90ae985477c7e6e2b2b271dab652dd7bb4166f154c05
MD5 9afe3785f640eeafdc3f106188b68a63
SHA1 973763127783270dd26099d1324182c934d1454f
SHA512 28219340264c753548b8495b48720d345c5ff968f5d0256248d29710a6a9d4b318014ba70c9c1e61e6c4ef5a2b2a4cc9bdb75865bf204e0b0d5fe9a760d719eb
TLSH
T16B210595A9808C99FB67C362A39333342FBAF70522F4773D2695C8499258CB003D6328
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\log.txt
Size 2KB
SHA256 23bc9c507493df3b8d311a006a4328ee9dce1419e3fb408712ca3d4ed7055ada
MD5 42e1b25d29eb0bf495767e08fc8e6c9f
SHA1 f42df6c46a636063e62c4c2f7992f20a9184736b
SHA512 239b9408562196db229f453dbf0b72a7b7a6baeaa98e2b244b226df7f1738c70b041052476d0afadefaa60f774ba07b53ffaf96f12bc620651b99c44edcb4c15
TLSH
T1275121465A864AA8E353938377C233322D3AF76531F4227E1988890963CBC788A97301
MD5 SHA1 SHA512 TLSH

Submit Download

log.txt

Path C:\log.txt
Size 9KB
SHA256 8f096ae4e6485114f37eab878d2f6813e11ae91761989b696f8a30c995355604
MD5 77e70bc09a05b95899bc58ce657bccab
SHA1 c7eaace3975594787be5ab3d7ebfe1523036e8fb
SHA512 0bbe616b9c39152898d045d9ef961f618c1a8212dcea8cc5be2c254c18cc19e1ed8a1aa06f97e3ecacb44dc0779d755fbb72ba5039104239cec23152b0dae4ff
SSDEEP 192:mPynn9eucFTyr3HtytBsE/vn7DUlXcaAemfyNDoDQT1agBiOxWZEBJyxgkOynyLE:m6HcFTyr3HtytBsEnn7DUlXcaAemfyNE
TLSH
T13D22AF265B94652BA875D703A14E62315E2B7D8F1370E36024CA137DB00B17EFAFB6E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2616-1536-0x000001F3FF390000-0x000001F3FF3A0000-memory.dmp

Download

memory/2616-1-0x000001F3FF390000-0x000001F3FF3A0000-memory.dmp

Download

memory/2616-1660-0x000001F3E51A0000-0x000001F3E51D1000-memory.dmp

Download

memory/2616-1661-0x000001F3E5220000-0x000001F3E522C000-memory.dmp

Download

memory/2616-1649-0x000001F3E51A0000-0x000001F3E51D1000-memory.dmp

Download

memory/2616-1650-0x000001F3E5220000-0x000001F3E522C000-memory.dmp

Download

memory/2616-0-0x000001F3E4DA0000-0x000001F3E4DCE000-memory.dmp

Download

memory/3888-1658-0x000001D212660000-0x000001D212691000-memory.dmp

Download

memory/3940-1662-0x000001F8961F0000-0x000001F896221000-memory.dmp

Download

memory/4784-9-0x0000029D32900000-0x0000029D32910000-memory.dmp

Download

memory/4784-8-0x0000029D32900000-0x0000029D32910000-memory.dmp

Download

memory/4784-16-0x0000029D32810000-0x0000029D32832000-memory.dmp

Download

memory/4784-17-0x0000029D32900000-0x0000029D32910000-memory.dmp

Download

memory/4784-18-0x0000029D32900000-0x0000029D32910000-memory.dmp

Download

memory/4784-23-0x0000029D1A240000-0x0000029D1A252000-memory.dmp

Download

memory/4784-22-0x0000029D189D0000-0x0000029D189DC000-memory.dmp

Download

memory/4784-21-0x0000029D188E0000-0x0000029D18911000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads