Analysis
- max time kernel
150s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
vm.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
34 signatures
150 seconds
Behavioral task
behavioral2
Sample
vm.exe
Resource
win11-20260513-en
windows11-21h2-x64
30 signatures
150 seconds
General
- Target vm.exe
- Size 33.2MB
- Sample260608-xtbc1se19j
- SHA256 356a4e5c3ca7b2d7033af9e0b1436604c36416a5acadb56586e52c90275d0a72
- MD5 04e4185dc1341de59d256a9d9034e3af
- SHA1 f454ea30f8e4d340f8d4f8bc6f19d0594b9360a4
- SHA512 c47fecf58995afe9aaa96039f058aa2d5e287efc349888df92b1dc5236998cc826aa07431aca968da95529869fff577b711dc8fc42e9c64fa414ea7dd3b93005
- SSDEEP 786432:A8G41CEN8uDfWpOiSX/TjslDce3kZ+RrIs:RnCEN8ZpOiSTjskZyIs
- TLSH T1017733831472E9BCE368C8B2069FD9F085DB561815A7DF502E4D227C3981E29BED346F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral2/memory/1892-2-0x000000001C260000-0x000000001C2C2000-memory.dmp family_sheetrat_v1 behavioral2/memory/1600-253-0x0000000000F00000-0x0000000000F62000-memory.dmp family_sheetrat_v1 - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSystem32\\Defender.exe," vm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" MalwareDef.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Defender.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" vm.exe - UAC bypass 3 TTPs 16 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Defender.exe - Executes dropped EXE 37 IoCs
pid Process 3212 Process not Found 3736 Process not Found 3340 Process not Found 1964 Process not Found 688 Process not Found 2596 Process not Found 2532 Process not Found 2924 Process not Found 640 Process not Found 2696 Process not Found 1116 Process not Found 1292 Process not Found 2704 Process not Found 2712 Process not Found 1928 Process not Found 2268 Process not Found 3648 Process not Found 3844 Process not Found 1644 Process not Found 3800 Process not Found 1820 Process not Found 4380 Process not Found 1020 Process not Found 1204 Process not Found 816 Process not Found 2196 Process not Found 3364 Process not Found 3764 Process not Found 796 Process not Found 2572 Process not Found 1380 Process not Found 396 Process not Found 1036 Process not Found 2344 Process not Found 4828 Defender.exe 1900 Defender.exe 1600 MalwareDef.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 3 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx Process not Found File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx Process not Found File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx Process not Found - Loads dropped DLL 64 IoCs
pid Process 4152 Process not Found 1900 Defender.exe 3212 Process not Found 1964 Process not Found 3736 Process not Found 688 Process not Found 3340 Process not Found 2596 Process not Found 3252 Process not Found 640 Process not Found 2532 Process not Found 2924 Process not Found 1928 Process not Found 2704 Process not Found 2712 Process not Found 2696 Process not Found 1116 Process not Found 1900 Defender.exe 1292 Process not Found 2268 Process not Found 4620 Process not Found 3844 Process not Found 1644 Process not Found 3800 Process not Found 1036 Process not Found 3648 Process not Found 1820 Process not Found 4380 Process not Found 1020 Process not Found 2196 Process not Found 1600 MalwareDef.exe 816 Process not Found 1204 Process not Found 3764 Process not Found 3364 Process not Found 1388 Process not Found 2572 Process not Found 796 Process not Found 396 Process not Found 1380 Process not Found 2344 Process not Found 3188 CMD.exe 3212 Process not Found 1964 Process not Found 3736 Process not Found 3340 Process not Found 688 Process not Found 4828 Defender.exe 2596 Process not Found 2924 Process not Found 2344 Process not Found 2704 Process not Found 2712 Process not Found 1928 Process not Found 2532 Process not Found 3252 Process not Found 2696 Process not Found 1116 Process not Found 1292 Process not Found 2268 Process not Found 3800 Process not Found 3844 Process not Found 1644 Process not Found 3648 Process not Found - Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" vm.exe - Checks whether UAC is enabled 1 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vm.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Defender.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Defender.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDef.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vm.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: Process not Found - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com - Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\MachineCore Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\WappCrashNvTew Process not Found - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\xdwdSystem32\Defender.exe vm.exe File created C:\Windows\xdwdWeb\MalwareDef.exe vm.exe - Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2220 sc.exe 2056 sc.exe 3348 sc.exe 4308 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs Process not Found - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found - Modifies data under HKEY_USERS 54 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1780945798" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates Process not Found Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Mon, 08 Jun 2026 19:09:59 GMT" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,41484365,17110988,7153487,39965824,17962391,508368333,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={829B24F3-B7FD-4735-BC3A-F7808D7BF3F9}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6" Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust Process not Found Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs Process not Found - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION Process not Found - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2608 schtasks.exe 3392 schtasks.exe - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1892 vm.exe 1892 vm.exe 1892 vm.exe 1892 vm.exe 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 2640 Process not Found 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe 1900 Defender.exe 1900 Defender.exe 1900 Defender.exe 1600 MalwareDef.exe 1600 MalwareDef.exe 1600 MalwareDef.exe 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe 4828 Defender.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3212 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1892 vm.exe Token: SeAssignPrimaryTokenPrivilege 2696 Process not Found Token: SeIncreaseQuotaPrivilege 2696 Process not Found Token: SeSecurityPrivilege 2696 Process not Found Token: SeTakeOwnershipPrivilege 2696 Process not Found Token: SeLoadDriverPrivilege 2696 Process not Found Token: SeSystemtimePrivilege 2696 Process not Found Token: SeBackupPrivilege 2696 Process not Found Token: SeRestorePrivilege 2696 Process not Found Token: SeShutdownPrivilege 2696 Process not Found Token: SeSystemEnvironmentPrivilege 2696 Process not Found Token: SeUndockPrivilege 2696 Process not Found Token: SeManageVolumePrivilege 2696 Process not Found Token: SeAssignPrimaryTokenPrivilege 2696 Process not Found Token: SeIncreaseQuotaPrivilege 2696 Process not Found Token: SeSecurityPrivilege 2696 Process not Found Token: SeTakeOwnershipPrivilege 2696 Process not Found Token: SeLoadDriverPrivilege 2696 Process not Found Token: SeSystemtimePrivilege 2696 Process not Found Token: SeBackupPrivilege 2696 Process not Found Token: SeRestorePrivilege 2696 Process not Found Token: SeShutdownPrivilege 2696 Process not Found Token: SeSystemEnvironmentPrivilege 2696 Process not Found Token: SeUndockPrivilege 2696 Process not Found Token: SeManageVolumePrivilege 2696 Process not Found Token: SeAssignPrimaryTokenPrivilege 2696 Process not Found Token: SeIncreaseQuotaPrivilege 2696 Process not Found Token: SeSecurityPrivilege 2696 Process not Found Token: SeTakeOwnershipPrivilege 2696 Process not Found Token: SeLoadDriverPrivilege 2696 Process not Found Token: SeSystemtimePrivilege 2696 Process not Found Token: SeBackupPrivilege 2696 Process not Found Token: SeRestorePrivilege 2696 Process not Found Token: SeShutdownPrivilege 2696 Process not Found Token: SeSystemEnvironmentPrivilege 2696 Process not Found Token: SeUndockPrivilege 2696 Process not Found Token: SeManageVolumePrivilege 2696 Process not Found Token: SeAssignPrimaryTokenPrivilege 2696 Process not Found Token: SeIncreaseQuotaPrivilege 2696 Process not Found Token: SeSecurityPrivilege 2696 Process not Found Token: SeTakeOwnershipPrivilege 2696 Process not Found Token: SeLoadDriverPrivilege 2696 Process not Found Token: SeSystemtimePrivilege 2696 Process not Found Token: SeBackupPrivilege 2696 Process not Found Token: SeRestorePrivilege 2696 Process not Found Token: SeShutdownPrivilege 2696 Process not Found Token: SeSystemEnvironmentPrivilege 2696 Process not Found Token: SeUndockPrivilege 2696 Process not Found Token: SeManageVolumePrivilege 2696 Process not Found Token: SeAssignPrimaryTokenPrivilege 2696 Process not Found Token: SeIncreaseQuotaPrivilege 2696 Process not Found Token: SeSecurityPrivilege 2696 Process not Found Token: SeTakeOwnershipPrivilege 2696 Process not Found Token: SeLoadDriverPrivilege 2696 Process not Found Token: SeSystemtimePrivilege 2696 Process not Found Token: SeBackupPrivilege 2696 Process not Found Token: SeRestorePrivilege 2696 Process not Found Token: SeShutdownPrivilege 2696 Process not Found Token: SeSystemEnvironmentPrivilege 2696 Process not Found Token: SeUndockPrivilege 2696 Process not Found Token: SeManageVolumePrivilege 2696 Process not Found Token: SeAssignPrimaryTokenPrivilege 2696 Process not Found Token: SeIncreaseQuotaPrivilege 2696 Process not Found Token: SeSecurityPrivilege 2696 Process not Found - Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1892 wrote to memory of 2220 1892 vm.exe 81 PID 1892 wrote to memory of 2056 1892 vm.exe 83 PID 1892 wrote to memory of 3188 1892 vm.exe 85 PID 1892 wrote to memory of 3896 1892 vm.exe 86 PID 1892 wrote to memory of 3116 1892 vm.exe 88 PID 1892 wrote to memory of 3348 1892 vm.exe 91 PID 3896 wrote to memory of 1836 3896 CMD.exe 93 PID 3116 wrote to memory of 2608 3116 cmd.exe 94 PID 1892 wrote to memory of 4308 1892 vm.exe 95 PID 3212 wrote to memory of 3732 3212 Process not Found PID 3212 wrote to memory of 3732 3212 Process not Found PID 1892 wrote to memory of 1972 1892 vm.exe 99 PID 1972 wrote to memory of 3392 1972 cmd.exe 101 PID 1892 wrote to memory of 1900 1892 vm.exe 102 PID 3212 wrote to memory of 3808 3212 Process not Found PID 3212 wrote to memory of 3808 3212 Process not Found PID 4828 wrote to memory of 1324 4828 Defender.exe 105 PID 1324 wrote to memory of 1012 1324 CMD.exe 107 - System policy modification 1 TTPs 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" vm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" Defender.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" MalwareDef.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vm.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\vm.exe"C:\Users\Admin\AppData\Local\Temp\vm.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1892 -
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
PID:2220
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
PID:2056
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\xdwdSystem32\Defender.exe" enable=yes & exit2⤵
- Loads dropped DLL
PID:3188
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Microsoft\Windows\WappCrashNvTew" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Microsoft\Windows\WappCrashNvTew"3⤵PID:1836
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Microsoft\Windows\WappCrashNvTew" /tr "C:\Windows\xdwdSystem32\Defender.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Microsoft\Windows\WappCrashNvTew" /tr "C:\Windows\xdwdSystem32\Defender.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2608
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend2⤵
- Launches sc.exe
PID:3348
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand2⤵
- Launches sc.exe
PID:4308
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\xdwdWeb\MalwareDef.exe" /RL HIGHEST & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\xdwdWeb\MalwareDef.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
PID:3392
-
-
-
C:\Windows\xdwdSystem32\Defender.exe"C:\Windows\xdwdSystem32\Defender.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1900
-
-
C:\Windows\xdwdSystem32\Defender.exeC:\Windows\xdwdSystem32\Defender.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4828 -
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "Microsoft\Windows\WappCrashNvTew" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Microsoft\Windows\WappCrashNvTew"3⤵PID:1012
-
-
-
C:\Windows\xdwdWeb\MalwareDef.exeC:\Windows\xdwdWeb\MalwareDef.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1600
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
4Indicator Removal
1Clear Windows Event Logs
1Modify Registry
7Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\d8097a65-1b6d-4888-97e5-50dea67e655b.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\xdwdSystem32\Defender.exe
- Size 33.2MB
- SHA256 356a4e5c3ca7b2d7033af9e0b1436604c36416a5acadb56586e52c90275d0a72
- MD5 04e4185dc1341de59d256a9d9034e3af
- SHA1 f454ea30f8e4d340f8d4f8bc6f19d0594b9360a4
- SHA512 c47fecf58995afe9aaa96039f058aa2d5e287efc349888df92b1dc5236998cc826aa07431aca968da95529869fff577b711dc8fc42e9c64fa414ea7dd3b93005
- SSDEEP 786432:A8G41CEN8uDfWpOiSX/TjslDce3kZ+RrIs:RnCEN8ZpOiSTjskZyIs
- TLSH T1017733831472E9BCE368C8B2069FD9F085DB561815A7DF502E4D227C3981E29BED346F
- MD5 SHA1 SHA512 SSDEEP TLSH