Overview

overview

8

Static

static

3

glowogfn.exe

windows10-2004-x64

8

glowogfn.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/06/2026, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    glowogfn.exe
  • Size 24.5MB
  • Sample260627-b5drmags4t
  • SHA256 10f8eb860eb2da70583575be836cf831efe29453e087dc0663b0e2d8f2641055
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
bootkitcredential_accessdefense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Signatures

  • Drops file in Drivers directory 10 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 32 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 64 IoCs
  • Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Modifies boot configuration data using bcdedit 20 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 10 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\glowogfn.exe
    "C:\Users\Admin\AppData\Local\Temp\glowogfn.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
      2⤵
      • Indicator Removal: Clear Persistence
      • Suspicious use of WriteProcessMemory
      PID:5904
      • C:\Windows\system32\schtasks.exe
        schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
        3⤵
          PID:964
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
          3⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4532
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
        2⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:6172
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
          3⤵
            PID:6288
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1308
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
            3⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5468
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3944
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {bootmgr} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:6512
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {default} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:1280
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:5588
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {memdiag} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:4800
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4744
          • C:\Windows\system32\bcdedit.exe
            bcdedit /deletevalue {current} path
            3⤵
            • Modifies boot configuration data using bcdedit
            PID:3368
      • C:\$Recycle.Bin\System Volume Information\winlogon.exe
        "C:\$Recycle.Bin\System Volume Information\winlogon.exe"
        1⤵
        • Drops file in Drivers directory
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Writes to the Master Boot Record (MBR)
        • Drops file in System32 directory
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:6284
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
          2⤵
          • Indicator Removal: Clear Persistence
          • Suspicious use of WriteProcessMemory
          PID:5336
          • C:\Windows\System32\schtasks.exe
            schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
            3⤵
              PID:6764
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:3332
            • C:\Windows\System32\schtasks.exe
              schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
              3⤵
              • Scheduled Task/Job: Scheduled Task
              PID:5504
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
            2⤵
            • Indicator Removal: Clear Persistence
            • Suspicious use of WriteProcessMemory
            PID:2328
            • C:\Windows\System32\schtasks.exe
              schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
              3⤵
                PID:5716
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:6936
              • C:\Windows\System32\schtasks.exe
                schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:5488
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4672
              • C:\Windows\System32\bcdedit.exe
                bcdedit /deletevalue {bootmgr} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:4780
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:4424
              • C:\Windows\System32\bcdedit.exe
                bcdedit /deletevalue {default} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:792
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:6300
              • C:\Windows\System32\bcdedit.exe
                bcdedit /deletevalue {memdiag} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:2928
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:6436
              • C:\Windows\System32\bcdedit.exe
                bcdedit /deletevalue {current} path
                3⤵
                • Modifies boot configuration data using bcdedit
                PID:6324
          • C:\Windows\System32\drivers\Pyrite.dat
            C:\Windows\System32\drivers\Pyrite.dat
            1⤵
            • Drops file in Drivers directory
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops desktop.ini file(s)
            • Writes to the Master Boot Record (MBR)
            • Drops file in System32 directory
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:4696
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
              2⤵
              • Indicator Removal: Clear Persistence
              • Suspicious use of WriteProcessMemory
              PID:1368
              • C:\Windows\System32\schtasks.exe
                schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                3⤵
                  PID:6736
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:5024
                • C:\Windows\System32\schtasks.exe
                  schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                  3⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:3904
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                2⤵
                • Indicator Removal: Clear Persistence
                • Suspicious use of WriteProcessMemory
                PID:6808
                • C:\Windows\System32\schtasks.exe
                  schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                  3⤵
                    PID:5948
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6232
                  • C:\Windows\System32\schtasks.exe
                    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                    3⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5668
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3092
                  • C:\Windows\System32\bcdedit.exe
                    bcdedit /deletevalue {bootmgr} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:2264
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4224
                  • C:\Windows\System32\bcdedit.exe
                    bcdedit /deletevalue {default} path
                    3⤵
                    • Modifies boot configuration data using bcdedit
                    PID:5884
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                  2⤵
                    PID:2296
                    • C:\Windows\System32\bcdedit.exe
                      bcdedit /deletevalue {memdiag} path
                      3⤵
                      • Modifies boot configuration data using bcdedit
                      PID:5416
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                    2⤵
                      PID:1728
                      • C:\Windows\System32\bcdedit.exe
                        bcdedit /deletevalue {current} path
                        3⤵
                        • Modifies boot configuration data using bcdedit
                        PID:3952
                  • C:\Windows\System32\spool\drivers\w32x86\svchost.exe
                    C:\Windows\System32\spool\drivers\w32x86\svchost.exe
                    1⤵
                    • Drops file in Drivers directory
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops desktop.ini file(s)
                    • Writes to the Master Boot Record (MBR)
                    • Drops file in System32 directory
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of WriteProcessMemory
                    PID:4552
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
                      2⤵
                      • Indicator Removal: Clear Persistence
                      • Suspicious use of WriteProcessMemory
                      PID:6776
                      • C:\Windows\System32\schtasks.exe
                        schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                        3⤵
                          PID:6812
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3832
                        • C:\Windows\System32\schtasks.exe
                          schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                          3⤵
                          • Scheduled Task/Job: Scheduled Task
                          PID:3344
                      • C:\Windows\system32\cmd.exe
                        C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                        2⤵
                        • Indicator Removal: Clear Persistence
                        • Suspicious use of WriteProcessMemory
                        PID:2848
                        • C:\Windows\System32\schtasks.exe
                          schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                          3⤵
                            PID:4332
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3192
                          • C:\Windows\System32\schtasks.exe
                            schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                            3⤵
                            • Scheduled Task/Job: Scheduled Task
                            PID:6852
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4772
                          • C:\Windows\System32\bcdedit.exe
                            bcdedit /deletevalue {bootmgr} path
                            3⤵
                            • Modifies boot configuration data using bcdedit
                            PID:5508
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2156
                          • C:\Windows\System32\bcdedit.exe
                            bcdedit /deletevalue {default} path
                            3⤵
                            • Modifies boot configuration data using bcdedit
                            PID:4404
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3576
                          • C:\Windows\System32\bcdedit.exe
                            bcdedit /deletevalue {memdiag} path
                            3⤵
                            • Modifies boot configuration data using bcdedit
                            PID:5168
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5264
                          • C:\Windows\System32\bcdedit.exe
                            bcdedit /deletevalue {current} path
                            3⤵
                            • Modifies boot configuration data using bcdedit
                            PID:4764
                      • C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
                        C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
                        1⤵
                        • Drops file in Drivers directory
                        • Drops startup file
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops desktop.ini file(s)
                        • Writes to the Master Boot Record (MBR)
                        • Drops file in System32 directory
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:6176
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
                          2⤵
                          • Indicator Removal: Clear Persistence
                          • Suspicious use of WriteProcessMemory
                          PID:5492
                          • C:\Windows\System32\schtasks.exe
                            schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
                            3⤵
                              PID:2596
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                            2⤵
                              PID:2404
                              • C:\Windows\System32\schtasks.exe
                                schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:3988
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
                              2⤵
                              • Indicator Removal: Clear Persistence
                              PID:6132
                              • C:\Windows\System32\schtasks.exe
                                schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
                                3⤵
                                  PID:5428
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                                2⤵
                                  PID:6716
                                  • C:\Windows\System32\schtasks.exe
                                    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
                                    3⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:1248
                                • C:\Windows\system32\cmd.exe
                                  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
                                  2⤵
                                    PID:1136
                                    • C:\Windows\System32\bcdedit.exe
                                      bcdedit /deletevalue {bootmgr} path
                                      3⤵
                                      • Modifies boot configuration data using bcdedit
                                      PID:3404
                                  • C:\Windows\system32\cmd.exe
                                    C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
                                    2⤵
                                      PID:3264
                                      • C:\Windows\System32\bcdedit.exe
                                        bcdedit /deletevalue {default} path
                                        3⤵
                                        • Modifies boot configuration data using bcdedit
                                        PID:4952
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
                                      2⤵
                                        PID:6596
                                        • C:\Windows\System32\bcdedit.exe
                                          bcdedit /deletevalue {memdiag} path
                                          3⤵
                                          • Modifies boot configuration data using bcdedit
                                          PID:2700
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
                                        2⤵
                                          PID:1980
                                          • C:\Windows\System32\bcdedit.exe
                                            bcdedit /deletevalue {current} path
                                            3⤵
                                            • Modifies boot configuration data using bcdedit
                                            PID:6288

                                      Network

                                            MITRE ATT&CK Enterprise v16

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Scheduled Task/Job

                                            1
                                            T1053

                                            Scheduled Task

                                            1
                                            T1053.005

                                            Defense Evasion

                                            Indicator Removal

                                            1
                                            T1070

                                            Clear Persistence

                                            1
                                            T1070.009

                                            Modify Registry

                                            1
                                            T1112

                                            Pre-OS Boot

                                            1
                                            T1542

                                            Bootkit

                                            1
                                            T1542.003

                                            Credential Access

                                            Credentials from Password Stores

                                            2
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Windows Credential Manager

                                            1
                                            T1555.004

                                            Unsecured Credentials

                                            1
                                            T1552

                                            Credentials In Files

                                            1
                                            T1552.001

                                            Discovery

                                            Browser Information Discovery

                                            1
                                            T1217

                                            Query Registry

                                            1
                                            T1012

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            1
                                            T1005

                                            Command and Control

                                            Web Service

                                            1
                                            T1102

                                            Exfiltration

                                            Impact

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            winlogon.exe
                                            • Path C:\$Recycle.Bin\System Volume Information\winlogon.exe
                                            • Size 24.5MB
                                            • SHA256 10f8eb860eb2da70583575be836cf831efe29453e087dc0663b0e2d8f2641055
                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                            Submit Download

                                            memory/1216-0-0x000000014000A000-0x0000000140ED9000-memory.dmp
                                            Download

                                            memory/1216-1-0x00007FFFAAE30000-0x00007FFFAAE32000-memory.dmp
                                            Download

                                            memory/1216-2-0x00007FFFAAE40000-0x00007FFFAAE42000-memory.dmp
                                            Download

                                            memory/1216-3-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download

                                            memory/1216-4-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download

                                            memory/1216-21-0x000000014000A000-0x0000000140ED9000-memory.dmp
                                            Download

                                            memory/1216-22-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download

                                            memory/4552-16-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download

                                            memory/4696-10-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download

                                            memory/6176-20-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download

                                            memory/6284-13-0x0000000140000000-0x0000000142765000-memory.dmp
                                            Download