86c145effe236d212d85b3fc269aead4678148612f84bdea64e7da7e12843b73

Analysis

max time kernel
36s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
glowogfn.exe
Size 24.6MB
Sample260627-cbm9msg14q
SHA256 86c145effe236d212d85b3fc269aead4678148612f84bdea64e7da7e12843b73
MD5 43519a64983ee7501820b19f695f9b8b
SHA1 6c54e96b571f05225cf5b5f187b34055872ef28a
SHA512 65cdc18ffa4ec79fcff09685e7c0fe07d39dcc5e88d6ea756ff749dff73bb8d84366a1f2b39b1d3b2e2f9bbd2cb51d88d443efc3e4811e2e1a20cb8e8f7edeba
SSDEEP 786432:KE/vkvwWUdD9YqP7rmDSHWpS39uluRT+QE0+:KQWbQD9/6aqXQE0
TLSH
T1FB4723D296D417E4D3A3CE0886CB239BD3C131A7E79B951D3ACA2C032521D979687D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\Pyrite.dat	glowogfn.exe
File opened for modification	C:\Windows\System32\drivers\Pyrite.dat	glowogfn.exe
File opened for modification	C:\Windows\System32\drivers\Pyrite.dat	svchost.exe
File created	C:\Windows\System32\drivers\Pyrite.dat	update.exe
File opened for modification	C:\Windows\System32\drivers\Pyrite.dat	update.exe
File created	C:\Windows\System32\drivers\Pyrite.dat	Pyrite.dat
File opened for modification	C:\Windows\System32\drivers\Pyrite.dat	Pyrite.dat
File created	C:\Windows\System32\drivers\Pyrite.dat	svchost.exe
File created	C:\Windows\System32\drivers\Pyrite.dat	winlogon.exe
File opened for modification	C:\Windows\System32\drivers\Pyrite.dat	winlogon.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	winlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
1436	update.exe
4924	svchost.exe
2212	winlogon.exe
2056	Pyrite.dat

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	Pyrite.dat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	glowogfn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	glowogfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	Pyrite.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	Pyrite.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	glowogfn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	Pyrite.dat
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	glowogfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	glowogfn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	glowogfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	Pyrite.dat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	glowogfn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	update.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\$Recycle.Bin\\System Volume Information\\winlogon.exe"	Pyrite.dat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\\update.exe"	Pyrite.dat
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\spool\\drivers\\w32x86\\svchost.exe"	glowogfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pyrite = "C:\\Windows\\System32\\drivers\\Pyrite.dat"	Pyrite.dat

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	discord.com
1	discord.com
2	discord.com
3	discord.com
4	discord.com
5	discord.com

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Public\desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	glowogfn.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	Pyrite.dat
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	winlogon.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-537605601-1362463912-856654178-1000\desktop.ini	glowogfn.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-537605601-1362463912-856654178-1000\desktop.ini	glowogfn.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Public\Music\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	winlogon.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	glowogfn.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	Pyrite.dat
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	glowogfn.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	winlogon.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	glowogfn.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	glowogfn.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	winlogon.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	Pyrite.dat
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	winlogon.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	winlogon.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	winlogon.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Pyrite.dat
File opened for modification	C:\Program Files\desktop.ini	glowogfn.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	winlogon.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4856	cmd.exe
3984	cmd.exe
5596	cmd.exe
1308	cmd.exe
4588	cmd.exe
3600	cmd.exe
5332	cmd.exe
4480	cmd.exe
4272	cmd.exe
5132	cmd.exe

Modifies boot configuration data using bcdedit 20 IoCs

pid	Process
2572	bcdedit.exe
5572	bcdedit.exe
3844	bcdedit.exe
3016	bcdedit.exe
4156	bcdedit.exe
1084	bcdedit.exe
3420	bcdedit.exe
1636	bcdedit.exe
5488	bcdedit.exe
3020	bcdedit.exe
4568	bcdedit.exe
2420	bcdedit.exe
900	bcdedit.exe
3888	bcdedit.exe
5412	bcdedit.exe
5056	bcdedit.exe
1668	bcdedit.exe
1472	bcdedit.exe
6100	bcdedit.exe
824	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	glowogfn.exe
File opened for modification	\??\PhysicalDrive0	svchost.exe
File opened for modification	\??\PhysicalDrive0	update.exe
File opened for modification	\??\PhysicalDrive0	winlogon.exe
File opened for modification	\??\PhysicalDrive0	Pyrite.dat

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	winlogon.exe
File opened for modification	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	winlogon.exe
File opened for modification	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	glowogfn.exe
File created	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	svchost.exe
File opened for modification	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	svchost.exe
File created	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	update.exe
File opened for modification	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	update.exe
File created	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	Pyrite.dat
File opened for modification	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	Pyrite.dat
File created	C:\Windows\System32\spool\drivers\w32x86\svchost.exe	glowogfn.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
1552	glowogfn.exe
1552	glowogfn.exe
1436	update.exe
4924	svchost.exe
4924	svchost.exe
1436	update.exe
2212	winlogon.exe
2212	winlogon.exe
2056	Pyrite.dat
2056	Pyrite.dat

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Defender\it-IT\EppManifest.dll.mui	glowogfn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_139.0.3405.125_neutral__8wekyb3d8bbwe\AppxBlockMap.xml	glowogfn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-black\WindowsSecuritySplashScreen.scale-125_contrast-black.png	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js	winlogon.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\zh-Hans\WindowsFormsIntegration.resources.dll	glowogfn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl	glowogfn.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_es_135x40.svg	glowogfn.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Entity.Resources.dll	Pyrite.dat
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\WindowsSecurityWideTile.scale-125.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\ResiliencyLinks\VisualElements\SmallLogoBeta.png.DATA	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Locales\vi.pak	update.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\UIAutomationClientsideProviders.resources.dll	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\EppManifest.dll.mui	glowogfn.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ko\System.Windows.Forms.Design.resources.dll	glowogfn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\mr\LC_MESSAGES\vlc.mo	glowogfn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\skins\default.vlt	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_invite_24.svg	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\da-dk\ui-strings.js	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\ResiliencyLinks\identity_proxy\win11\identity_helper.Sparse.Beta.msix.DATA	winlogon.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\fr-FR\wmlaunch.exe.mui	update.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkDrop32x32.gif	glowogfn.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libsharpen_plugin.dll	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_jpn.xml	Pyrite.dat
File opened for modification	C:\Program Files\Windows Media Player\setup_wm.exe	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecurityWideTile.scale-200_contrast-white.png	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-up-pressed.gif	winlogon.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fi-fi\ui-strings.js	winlogon.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL096.XML	glowogfn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\mfc140u.dll	glowogfn.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\fullscreen-exit-press.svg	update.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe.manifest	winlogon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\gd.pak	glowogfn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ppd.xrm-ms	glowogfn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\es-ES\MSFT_PackageManagement.strings.psd1	svchost.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Exist.ps1	glowogfn.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_rename_18.svg	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\uk-ua\ui-strings.js	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_wer.dll	glowogfn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jfxwebkit.dll	glowogfn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\theme-light\AppAndBrowser.ico	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filter-hover_32.svg	winlogon.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\en-US\hmmapi.dll.mui	update.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Context.ps1	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\root\ui-strings.js	winlogon.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\cstm_brand_preview2x.png	svchost.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipres.dll	svchost.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Runtime.Serialization.dll	glowogfn.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml	update.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcvbs.inc	update.exe
File opened for modification	C:\Program Files\Windows Media Player\uk-UA\wmplayer.exe.mui	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WindowsSecuritySmallTile.scale-100_contrast-white.png	Pyrite.dat
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\fr-FR\MSFT_PackageManagement.schema.mfl	winlogon.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\arrow-left.gif	update.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.DataSetExtensions.dll	glowogfn.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ucrtbase.dll	glowogfn.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Retrospect.thmx	glowogfn.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\Microsoft.Gaming.XboxGameBar.winmd	glowogfn.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\ja-JP\PSGet.Resource.psd1	svchost.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\2d.x3d	winlogon.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\ca-Es-VALENCIA.pak	Pyrite.dat
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	glowogfn.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	winlogon.exe
File opened for modification	C:\Windows\apppatch\de-DE\AcRes.dll.mui	winlogon.exe
File opened for modification	C:\Windows\apppatch\MergeSdbFiles\01DA54B25CE0D000.sysmain.sdb	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationCore.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfc.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\msbuild.exe.config	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_ja_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_es_b03f5f7f11d50a3a\aspnetmmcext.resources.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_it_b03f5f7f11d50a3a\aspnetmmcext.resources.dll	winlogon.exe
File opened for modification	C:\Windows\appcompat\Programs\Amcache.hve.LOG1	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Microsoft.Ink.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.Resources\2.0.0.0_it_b03f5f7f11d50a3a\Microsoft.Build.Engine.resources.dll	winlogon.exe
File opened for modification	C:\Windows\appcompat\Programs\Amcache.hve	winlogon.exe
File opened for modification	C:\Windows\appcompat\Programs\Amcache.hve.LOG2	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\big5.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\normnfkc.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\System.Printing\3.0.0.0__31bf3856ad364e35\System.Printing.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\xjis.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll	winlogon.exe
File opened for modification	C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\__AssemblyInfo__.ini	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\prc.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\AspNetMMCExt.Resources\2.0.0.0_fr_b03f5f7f11d50a3a\aspnetmmcext.resources.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\normnfd.nlp	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Conversion.v3.5\3.5.0.0__b03f5f7f11d50a3a\Microsoft.Build.Conversion.v3.5.dll	winlogon.exe
File opened for modification	C:\Windows\apppatch\it-IT\AcRes.dll.mui	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe.config	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll	winlogon.exe
File opened for modification	C:\Windows\apppatch\AcRes.dll	winlogon.exe
File opened for modification	C:\Windows\apppatch\en-US\AcRes.dll.mui	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\__AssemblyInfo__.ini	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_32\PresentationCore\3.0.0.0__31bf3856ad364e35\wpfgfx_v0300.dll	winlogon.exe
File opened for modification	C:\Windows\assembly\GAC_64\Microsoft.Transactions.Bridge.Dtc\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.Dtc.dll	winlogon.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000_Classes\Local Settings\MuiCache	winlogon.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5720	schtasks.exe
2064	schtasks.exe
2932	schtasks.exe
4548	schtasks.exe
4760	schtasks.exe
2064	schtasks.exe
6096	schtasks.exe
6052	schtasks.exe
4620	schtasks.exe
4700	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1552	glowogfn.exe
1552	glowogfn.exe
4924	svchost.exe
4924	svchost.exe
1436	update.exe
1436	update.exe
2212	winlogon.exe
2056	Pyrite.dat
2056	Pyrite.dat

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 4480	1552	glowogfn.exe	89
PID 4480 wrote to memory of 5652	4480	cmd.exe	91
PID 1552 wrote to memory of 996	1552	glowogfn.exe	92
PID 996 wrote to memory of 5720	996	cmd.exe	94
PID 1552 wrote to memory of 4272	1552	glowogfn.exe	95
PID 4272 wrote to memory of 4212	4272	cmd.exe	97
PID 1552 wrote to memory of 2952	1552	glowogfn.exe	98
PID 2952 wrote to memory of 2064	2952	cmd.exe	100
PID 1552 wrote to memory of 3640	1552	glowogfn.exe	105
PID 3640 wrote to memory of 2572	3640	cmd.exe	108
PID 1552 wrote to memory of 5996	1552	glowogfn.exe	111
PID 5996 wrote to memory of 5572	5996	cmd.exe	114
PID 1552 wrote to memory of 2208	1552	glowogfn.exe	115
PID 2208 wrote to memory of 3844	2208	cmd.exe	117
PID 1552 wrote to memory of 1280	1552	glowogfn.exe	118
PID 4924 wrote to memory of 4856	4924	svchost.exe	119
PID 1436 wrote to memory of 3600	1436	update.exe	120
PID 2212 wrote to memory of 5132	2212	winlogon.exe	123
PID 2056 wrote to memory of 3984	2056	Pyrite.dat	126
PID 4856 wrote to memory of 5800	4856	cmd.exe	128
PID 5132 wrote to memory of 5724	5132	cmd.exe	129
PID 1280 wrote to memory of 3016	1280	cmd.exe	130
PID 3600 wrote to memory of 5784	3600	cmd.exe	131
PID 3984 wrote to memory of 3340	3984	cmd.exe	192
PID 4924 wrote to memory of 5564	4924	svchost.exe	133
PID 2056 wrote to memory of 3000	2056	Pyrite.dat	135
PID 1436 wrote to memory of 1768	1436	update.exe	137
PID 2212 wrote to memory of 2552	2212	winlogon.exe	139
PID 5564 wrote to memory of 6096	5564	cmd.exe	141
PID 3000 wrote to memory of 2932	3000	cmd.exe	142
PID 2552 wrote to memory of 6052	2552	cmd.exe	143
PID 4924 wrote to memory of 5332	4924	svchost.exe	144
PID 1768 wrote to memory of 4620	1768	cmd.exe	146
PID 2212 wrote to memory of 5596	2212	winlogon.exe	147
PID 5332 wrote to memory of 1472	5332	cmd.exe	215
PID 2056 wrote to memory of 1308	2056	Pyrite.dat	150
PID 1436 wrote to memory of 4588	1436	update.exe	152
PID 5596 wrote to memory of 5476	5596	cmd.exe	154
PID 4924 wrote to memory of 5664	4924	svchost.exe	155
PID 1308 wrote to memory of 1904	1308	cmd.exe	157
PID 4588 wrote to memory of 2200	4588	cmd.exe	158
PID 2212 wrote to memory of 904	2212	winlogon.exe	159
PID 5664 wrote to memory of 4548	5664	cmd.exe	160
PID 2056 wrote to memory of 3012	2056	Pyrite.dat	162
PID 1436 wrote to memory of 2944	1436	update.exe	163
PID 904 wrote to memory of 4760	904	cmd.exe	166
PID 2944 wrote to memory of 4700	2944	cmd.exe	167
PID 3012 wrote to memory of 2064	3012	cmd.exe	168
PID 4924 wrote to memory of 4496	4924	svchost.exe	169
PID 4496 wrote to memory of 4156	4496	cmd.exe	172
PID 2212 wrote to memory of 2444	2212	winlogon.exe	173
PID 1436 wrote to memory of 5580	1436	update.exe	175
PID 4924 wrote to memory of 2596	4924	svchost.exe	176
PID 2056 wrote to memory of 1812	2056	Pyrite.dat	179
PID 2444 wrote to memory of 1084	2444	cmd.exe	181
PID 5580 wrote to memory of 3420	5580	cmd.exe	182
PID 2596 wrote to memory of 1636	2596	cmd.exe	183
PID 1812 wrote to memory of 5488	1812	cmd.exe	184
PID 2212 wrote to memory of 1588	2212	winlogon.exe	185
PID 1436 wrote to memory of 5584	1436	update.exe	187
PID 4924 wrote to memory of 1592	4924	svchost.exe	188
PID 2056 wrote to memory of 2436	2056	Pyrite.dat	191
PID 1588 wrote to memory of 3020	1588	cmd.exe	193
PID 5584 wrote to memory of 4568	5584	cmd.exe	194

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\glowogfn.exe
"C:\Users\Admin\AppData\Local\Temp\glowogfn.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
    3⤵
    PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\system32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
    3⤵
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {bootmgr} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {default} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {memdiag} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3016

C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
    3⤵
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1768
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
    3⤵
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {bootmgr} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5584
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {default} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
  2⤵
  PID:5656
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {memdiag} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
  2⤵
  PID:5588
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {current} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1472

C:\Windows\System32\spool\drivers\w32x86\svchost.exe
C:\Windows\System32\spool\drivers\w32x86\svchost.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
    3⤵
    PID:5800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5332
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
    3⤵
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5664
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {bootmgr} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {default} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
  2⤵
  PID:1592
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {memdiag} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
  2⤵
  PID:1312
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {current} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5056

C:\$Recycle.Bin\System Volume Information\winlogon.exe
"C:\$Recycle.Bin\System Volume Information\winlogon.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5132
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
    3⤵
    PID:5724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5596
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
    3⤵
    PID:5476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {bootmgr} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {default} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
  2⤵
  PID:3932
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {memdiag} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
  2⤵
  PID:3660
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {current} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6100

C:\Windows\System32\drivers\Pyrite.dat
C:\Windows\System32\drivers\Pyrite.dat
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /f
    3⤵
    PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\WindowsUpdate\SystemMaintenance" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onstart /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f 2>nul
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\System32\schtasks.exe
    schtasks /delete /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /f
    3⤵
    PID:1904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\System32\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\ApplicationExperience\ProgramCompatibility" /tr "C:\Windows\System32\drivers\Pyrite.dat" /sc onlogon /ru SYSTEM /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {bootmgr} path 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {bootmgr} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {default} path 2>nul
  2⤵
  PID:2436
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3340
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {default} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {memdiag} path 2>nul
  2⤵
  PID:4424
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {memdiag} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue {current} path 2>nul
  2⤵
  PID:5776
- - C:\Windows\System32\bcdedit.exe
    bcdedit /deletevalue {current} path
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

update.exe

Path C:\ProgramData\Microsoft\Windows\Caches\{A3D5F1E2-9B4C-4D2E-8F7A-1B2C3D4E5F6E}\update.exe
Size 24.6MB
SHA256 86c145effe236d212d85b3fc269aead4678148612f84bdea64e7da7e12843b73
MD5 43519a64983ee7501820b19f695f9b8b
SHA1 6c54e96b571f05225cf5b5f187b34055872ef28a
SHA512 65cdc18ffa4ec79fcff09685e7c0fe07d39dcc5e88d6ea756ff749dff73bb8d84366a1f2b39b1d3b2e2f9bbd2cb51d88d443efc3e4811e2e1a20cb8e8f7edeba
SSDEEP 786432:KE/vkvwWUdD9YqP7rmDSHWpS39uluRT+QE0+:KQWbQD9/6aqXQE0
TLSH
T1FB4723D296D417E4D3A3CE0886CB239BD3C131A7E79B951D3ACA2C032521D979687D3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1436-15-0x0000000140000000-0x000000014278B000-memory.dmp

Download

memory/1552-0-0x000000014000A000-0x0000000140EE5000-memory.dmp

Download

memory/1552-2-0x00007FFAAB680000-0x00007FFAAB682000-memory.dmp

Download

memory/1552-1-0x00007FFAAB670000-0x00007FFAAB672000-memory.dmp

Download

memory/1552-4-0x0000000140000000-0x000000014278B000-memory.dmp

Download

memory/1552-3-0x0000000140000000-0x000000014278B000-memory.dmp

Download

memory/1552-5-0x0000000140000000-0x000000014278B000-memory.dmp

Download

memory/1552-22-0x000000014000A000-0x0000000140EE5000-memory.dmp

Download

memory/2056-21-0x0000000140000000-0x000000014278B000-memory.dmp

Download

memory/2212-18-0x0000000140000000-0x000000014278B000-memory.dmp

Download

memory/4924-12-0x0000000140000000-0x000000014278B000-memory.dmp

Download