Analysis
- max time kernel
116s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/06/2026, 04:24
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
sO7owIyUKFh5z.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
sO7owIyUKFh5z.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target sO7owIyUKFh5z.exe
- Size 1.5MB
- Sample260625-e1h3bsht9q
- SHA256 554498d567510eb22da861a223f8a38edfe7891d0ea4f0ccc8f89a0a0aeea194
- MD5 1d8727e0972b62fc38f2c30099c61747
- SHA1 90f66d1b6dde447928a60aaa2750c727f14afff2
- SHA512 f9792c68b6a230537747b74d544e5589d39d6ff8a84c4edae0375901f3e8c474a05f2983be6096e3375bdcc825f1ad2fd479b9ba1a5cf9198ea2c3df8cbaca85
- SSDEEP 24576:nRSfrAEH9XIYpj0BEHBoXPGfjuIb1iN1Eob4lxMoRd:ngTbH94YxV3218T
- TLSH T1CD655A15A6A441B8E0A29578CB5EC933E7767CC60F70968F02D47DA73F33250BA297D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/files/0x000d00000001c4a3-17.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "0" powershell.exe - Modifies Windows Defender notification settings 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1" powershell.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1" powershell.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" powershell.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 2 IoCs
pid Process 2840 UnRAR.exe 3224 Yjzlxkdoi.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Drops file in Program Files directory 12 IoCs
description ioc Process File created C:\Program Files\WindowsOptions\Yjzlxkdoi.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions\run.ps1 sO7owIyUKFh5z.exe File created C:\Program Files\WindowsOptions\UnRAR.exe sO7owIyUKFh5z.exe File opened for modification C:\Program Files\WindowsOptions\sfx.rar sO7owIyUKFh5z.exe File opened for modification C:\Program Files\WindowsOptions\Yjzlxkdoi.exe UnRAR.exe File opened for modification C:\Program Files\WindowsOptions sO7owIyUKFh5z.exe File created C:\Program Files\WindowsOptions\__tmp_rar_sfx_access_check_240711578 sO7owIyUKFh5z.exe File created C:\Program Files\WindowsOptions\install.vbs sO7owIyUKFh5z.exe File opened for modification C:\Program Files\WindowsOptions\install.vbs sO7owIyUKFh5z.exe File created C:\Program Files\WindowsOptions\run.ps1 sO7owIyUKFh5z.exe File opened for modification C:\Program Files\WindowsOptions\UnRAR.exe sO7owIyUKFh5z.exe File created C:\Program Files\WindowsOptions\sfx.rar sO7owIyUKFh5z.exe -
pid Process 2672 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Yjzlxkdoi.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 39 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings sO7owIyUKFh5z.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{F40119D0-106D-4006-853A-D1435558418F} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3655380807-1096177077-1670381078-1000\{397C7518-87DB-49CE-A5BB-0FCC86931859} explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2672 powershell.exe 2672 powershell.exe 2672 powershell.exe 2672 powershell.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe 3224 Yjzlxkdoi.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2672 powershell.exe Token: SeIncreaseQuotaPrivilege 2672 powershell.exe Token: SeSecurityPrivilege 2672 powershell.exe Token: SeTakeOwnershipPrivilege 2672 powershell.exe Token: SeLoadDriverPrivilege 2672 powershell.exe Token: SeSystemProfilePrivilege 2672 powershell.exe Token: SeSystemtimePrivilege 2672 powershell.exe Token: SeProfSingleProcessPrivilege 2672 powershell.exe Token: SeIncBasePriorityPrivilege 2672 powershell.exe Token: SeCreatePagefilePrivilege 2672 powershell.exe Token: SeBackupPrivilege 2672 powershell.exe Token: SeRestorePrivilege 2672 powershell.exe Token: SeShutdownPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeSystemEnvironmentPrivilege 2672 powershell.exe Token: SeRemoteShutdownPrivilege 2672 powershell.exe Token: SeUndockPrivilege 2672 powershell.exe Token: SeManageVolumePrivilege 2672 powershell.exe Token: 33 2672 powershell.exe Token: 34 2672 powershell.exe Token: 35 2672 powershell.exe Token: 36 2672 powershell.exe Token: SeIncreaseQuotaPrivilege 2672 powershell.exe Token: SeSecurityPrivilege 2672 powershell.exe Token: SeTakeOwnershipPrivilege 2672 powershell.exe Token: SeLoadDriverPrivilege 2672 powershell.exe Token: SeSystemProfilePrivilege 2672 powershell.exe Token: SeSystemtimePrivilege 2672 powershell.exe Token: SeProfSingleProcessPrivilege 2672 powershell.exe Token: SeIncBasePriorityPrivilege 2672 powershell.exe Token: SeCreatePagefilePrivilege 2672 powershell.exe Token: SeBackupPrivilege 2672 powershell.exe Token: SeRestorePrivilege 2672 powershell.exe Token: SeShutdownPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeSystemEnvironmentPrivilege 2672 powershell.exe Token: SeRemoteShutdownPrivilege 2672 powershell.exe Token: SeUndockPrivilege 2672 powershell.exe Token: SeManageVolumePrivilege 2672 powershell.exe Token: 33 2672 powershell.exe Token: 34 2672 powershell.exe Token: 35 2672 powershell.exe Token: 36 2672 powershell.exe Token: SeIncreaseQuotaPrivilege 2672 powershell.exe Token: SeSecurityPrivilege 2672 powershell.exe Token: SeTakeOwnershipPrivilege 2672 powershell.exe Token: SeLoadDriverPrivilege 2672 powershell.exe Token: SeSystemProfilePrivilege 2672 powershell.exe Token: SeSystemtimePrivilege 2672 powershell.exe Token: SeProfSingleProcessPrivilege 2672 powershell.exe Token: SeIncBasePriorityPrivilege 2672 powershell.exe Token: SeCreatePagefilePrivilege 2672 powershell.exe Token: SeBackupPrivilege 2672 powershell.exe Token: SeRestorePrivilege 2672 powershell.exe Token: SeShutdownPrivilege 2672 powershell.exe Token: SeDebugPrivilege 2672 powershell.exe Token: SeSystemEnvironmentPrivilege 2672 powershell.exe Token: SeRemoteShutdownPrivilege 2672 powershell.exe Token: SeUndockPrivilege 2672 powershell.exe Token: SeManageVolumePrivilege 2672 powershell.exe Token: 33 2672 powershell.exe Token: 34 2672 powershell.exe Token: 35 2672 powershell.exe Token: 36 2672 powershell.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 5132 sihost.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe - Suspicious use of SendNotifyMessage 40 IoCs
pid Process 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe 5652 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5492 StartMenuExperienceHost.exe 1936 SearchHost.exe 5652 explorer.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5076 wrote to memory of 6096 5076 sO7owIyUKFh5z.exe 90 PID 6096 wrote to memory of 2672 6096 WScript.exe 91 PID 2672 wrote to memory of 4424 2672 powershell.exe 93 PID 2672 wrote to memory of 2840 2672 powershell.exe 95 PID 2672 wrote to memory of 3224 2672 powershell.exe 96 PID 5132 wrote to memory of 5652 5132 sihost.exe 102 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\sO7owIyUKFh5z.exe"C:\Users\Admin\AppData\Local\Temp\sO7owIyUKFh5z.exe"1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\WindowsOptions\install.vbs"2⤵
- Suspicious use of WriteProcessMemory
PID:6096 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File "run.ps1"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- UAC bypass
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\system32\CiTool.exe"C:\Windows\system32\CiTool.exe" -r4⤵PID:4424
-
-
C:\Program Files\WindowsOptions\UnRAR.exe"C:\Program Files\WindowsOptions\UnRAR.exe" x -y -pByeFriend! "C:\Program Files\WindowsOptions\sfx.rar" "C:\Program Files\WindowsOptions\"4⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2840
-
-
C:\Program Files\WindowsOptions\Yjzlxkdoi.exe"C:\Program Files\WindowsOptions\Yjzlxkdoi.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3224
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5132 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5652
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5492
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1936
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\WindowsOptions\UnRAR.exe
- Size 547KB
- SHA256 e785a0c0dcf79385f0483c1eb2242e3937d0447f6b21dd158906e92757b46542
- MD5 8d4630a7958517737dba1ab88045373b
- SHA1 5816798803373fd3dd7bd1823ab8c92a824c441c
- SHA512 99d44318285e53c720400041c2367cf5bc6d421d2cb6f8c0c5eb7478c4997f4e74aba85973fa4b00cb893da1821ecdd2c9c1b7fa04e010454ed15e214f25755b
- SSDEEP 6144:ViSm+owa1lGp1pN/hm7ifjDG0opa9wJEZoaiokUI+2GIqMvpCE4mODiUU9sbHAhi:QXPGp1j/k0SrICIio/KNzAiREOzb4P
- TLSH T1F8C47C5AA7E403BCE0B7D674C9914902FB77BC4907B1AA8F03E444B75F276518E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\Yjzlxkdoi.exe
- Size 378KB
- SHA256 20aa1bd00565f5063b89abf9e3f1919600304be4d43ccacaed7019081164db43
- MD5 a77646c01c6e58064161f641ba11d455
- SHA1 64880d4542e85535c7e22ae16f443ef6b05dc9f5
- SHA512 2bd278772ba1e17cf3ecd1d0f1e5a81d5b930de587cb8440a090ad35ec4fd2fd5a6136d3d7d401fbdc8ab2389ed9f36fd9d08a14c986bcb7a75f4331718127f7
- SSDEEP 6144:rFys64C0aOTl00zF43yJBNgoRUI1oi8QCdIyh1Rr9wO93N6bS0ZhJcnt:rss6AN8zlr9w43NAxZit
- TLSH T13084291B36A68E21D2840233C1D7550283F1654B7A37E70A7A85239B29473FBFE4B797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\install.vbs
- Size 98B
- SHA256 a0110f07fe8d70b8c7f8d6d973f54a2cae6c8fbf09e7ae6b780f5598af903474
- MD5 b95bd766c9aa886726bcaf30577eeb23
- SHA1 ec53efe0d8a5d62d17e2609ed242e476982bcc1d
- SHA512 c27672412c356bbe6dbfb440141328f22f85754484ac9bdf66f0f64dd57f44137d319a4c674bf8af3b58fe5a8e8a0e7150f055590fe821c1364f7cfde631b5ff
- TLSH T17BB01218F504C3EC067BC4EE1175C42C8CA864A9A210875EB37092087248234D365146
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\WindowsOptions\run.ps1
- Size 23KB
- SHA256 4220408adec9f0ff9dd034efa7e71ffd0d6cdf229a147981de240d90f65bdf87
- MD5 b1339765214ee3f26067db1be03faeb7
- SHA1 e3b85c82531cf393ed5d37fbd9ac904f59d39d24
- SHA512 eceaae405c9f96e3698835b5a12110ba32860ed4685f81a42d854f7a92fea481e36e9fb831693ca3c106f744a4829e7c9cefe3027e11dd988fbaa39d44c2f031
- SSDEEP 384:+I43204WryHQ8YvPvF5xpmDCzFLZ0exEZBxy5HRp5lsFY5opRSyFTMrmyAD8PHb0:dA2Dynpxd0LZBxIPD0Voq2Ad
- TLSH T1AFB2D242A7FA0108F1F76B45EA7B08754A37BC55593AC90D519C688E0BF3E1498A2FF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\WindowsOptions\sfx.rar
- Size 198KB
- SHA256 58ec26a3496b3f463ecc470c607f46e0a9a3f21cda6cd1ade59d38bb656ab9ea
- MD5 597c1941aec48ef266148842d1d9bc67
- SHA1 6a4d45ade4c70c495a879d2854cde7401d972e4b
- SHA512 f9e73e0ab280dcb69f3f57803082660c0fac50db9e1b1bb45121e5d998c18dc84eef2ecab6f2b2581ecf8686c7915577526ee5ffb856c316f6efbece258a8e5b
- SSDEEP 3072:KulrF2PEbtkKPOUkaJ8C80hEONK1mZFJYTm6sgPVI4AMcyK64gEWAciJOVJbQ03+:DZFV8CJEEK1kh6sISMPK6kD2bXpfYpT
- TLSH T1E814232C3F5247126DF78E9593700786F58D2D4108965C4E22AB407BD9EBA73E0F6ED1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kkhdyiz2.u0e.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH