2057f12bcb213cfdca59ebb1e37b1048df983273b0397f49012bdc0f9007d2c4

Analysis

max time kernel
69s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Size 28.9MB
Sample260629-a84lsaay9m
SHA256 2057f12bcb213cfdca59ebb1e37b1048df983273b0397f49012bdc0f9007d2c4
MD5 ff522b24b3c7d4e7b5f7b3fa016fc293
SHA1 4d1dd6fc6ecc7cf9ab140746a2a3ad845c5ce645
SHA512 3b383e23b0ce85e0936b01917a3b261a639827094537f76a172c55f829a3c687755abb0dcc0f1be8ae900fc66668b299932d613ab66492bafe11cb740ae5fa11
SSDEEP 196608:4eofHXFC0Nutd7iHOmDsm/PdgiiD1h0+wtoV+Q7dqwVjcQ9yoyDaXSl58N5lA7e6:4DkESiayBDQ7d3doaiDQgdsbBJ2l
TLSH
T1B5676B43AD555DE5C8AA9230C76682527B31FC09073223D76AACB5386E327D05FBAF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5252	powershell.exe
5436	powershell.exe
200	powershell.exe
1484	powershell.exe
5220	powershell.exe
4660	powershell.exe
6012	powershell.exe
5792	powershell.exe
5940	powershell.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1148	icacls.exe
5508	icacls.exe
3000	icacls.exe
5976	icacls.exe
3656	icacls.exe
6068	icacls.exe
1368	icacls.exe
1624	icacls.exe
1624	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\CtrlOneExplorerRecover = "C:\\Windows\\explorer.exe"	reg.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mstsc.exe\Debugger = "\"%SystemRoot%\\System32\\systray.exe\""	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe

Executes dropped EXE 14 IoCs

pid	Process
2516	ctrl-pshost.exe
5756	ctrl-pshost.exe
3784	ctrl-pshost.exe
3436	ctrl-pshost.exe
3640	ctrl-pshost.exe
4844	ctrl-pshost.exe
4988	ctrl-pshost.exe
3356	ctrl-pshost.exe
400	ctrl-pshost.exe
1492	ctrl-pshost.exe
1156	ctrl-pshost.exe
4844	ctrl-pshost.exe
2320	ctrl-pshost.exe
1308	ctrl-pshost.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 8 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1536	powershell.exe
5792	powershell.exe
5940	powershell.exe
5240	powershell.exe
5320	powershell.exe
3128	powershell.exe
4552	powershell.exe
3260	powershell.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5864	sc.exe
6004	sc.exe
6072	sc.exe
4768	sc.exe
5864	sc.exe
748	sc.exe
2936	sc.exe
2508	sc.exe
1872	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\AllFilesystemObjects\shell\delete	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shell\delete	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings	explorer.exe

Modifies registry key 1 TTPs 38 IoCs

Modify Registry

T1112

pid	Process
4376	reg.exe
3928	reg.exe
6064	reg.exe
6076	reg.exe
1800	reg.exe
1800	reg.exe
3276	reg.exe
3936	reg.exe
1620	reg.exe
3280	reg.exe
2920	reg.exe
4660	reg.exe
4052	reg.exe
2288	reg.exe
4328	reg.exe
3800	reg.exe
1156	reg.exe
3208	reg.exe
5308	reg.exe
5412	reg.exe
5964	reg.exe
4092	reg.exe
2564	reg.exe
4816	reg.exe
5680	reg.exe
2088	reg.exe
3208	reg.exe
2436	reg.exe
6072	reg.exe
4336	reg.exe
1516	reg.exe
2920	reg.exe
2784	reg.exe
5708	reg.exe
1140	reg.exe
5044	reg.exe
2164	reg.exe
5928	reg.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2516	ctrl-pshost.exe
2516	ctrl-pshost.exe
2516	ctrl-pshost.exe
5756	ctrl-pshost.exe
5756	ctrl-pshost.exe
5756	ctrl-pshost.exe
3784	ctrl-pshost.exe
3784	ctrl-pshost.exe
3784	ctrl-pshost.exe
3436	ctrl-pshost.exe
3436	ctrl-pshost.exe
3436	ctrl-pshost.exe
3640	ctrl-pshost.exe
3640	ctrl-pshost.exe
3640	ctrl-pshost.exe
4844	ctrl-pshost.exe
4844	ctrl-pshost.exe
4844	ctrl-pshost.exe
4988	ctrl-pshost.exe
4988	ctrl-pshost.exe
4988	ctrl-pshost.exe
3356	ctrl-pshost.exe
3356	ctrl-pshost.exe
3356	ctrl-pshost.exe
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
400	ctrl-pshost.exe
400	ctrl-pshost.exe
400	ctrl-pshost.exe
1492	ctrl-pshost.exe
1492	ctrl-pshost.exe
1492	ctrl-pshost.exe
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
1156	ctrl-pshost.exe
1156	ctrl-pshost.exe
1156	ctrl-pshost.exe
4844	ctrl-pshost.exe
4844	ctrl-pshost.exe
4844	ctrl-pshost.exe
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
5436	powershell.exe
5436	powershell.exe
5436	powershell.exe
200	powershell.exe
200	powershell.exe
200	powershell.exe
2320	ctrl-pshost.exe
2320	ctrl-pshost.exe
2320	ctrl-pshost.exe
1484	powershell.exe
1484	powershell.exe
1484	powershell.exe
5320	powershell.exe
5320	powershell.exe
5320	powershell.exe
5320	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
4552	powershell.exe
4552	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	ctrl-pshost.exe
Token: SeIncreaseQuotaPrivilege	2516	ctrl-pshost.exe
Token: SeSecurityPrivilege	2516	ctrl-pshost.exe
Token: SeTakeOwnershipPrivilege	2516	ctrl-pshost.exe
Token: SeLoadDriverPrivilege	2516	ctrl-pshost.exe
Token: SeSystemProfilePrivilege	2516	ctrl-pshost.exe
Token: SeSystemtimePrivilege	2516	ctrl-pshost.exe
Token: SeProfSingleProcessPrivilege	2516	ctrl-pshost.exe
Token: SeIncBasePriorityPrivilege	2516	ctrl-pshost.exe
Token: SeCreatePagefilePrivilege	2516	ctrl-pshost.exe
Token: SeBackupPrivilege	2516	ctrl-pshost.exe
Token: SeRestorePrivilege	2516	ctrl-pshost.exe
Token: SeShutdownPrivilege	2516	ctrl-pshost.exe
Token: SeDebugPrivilege	2516	ctrl-pshost.exe
Token: SeSystemEnvironmentPrivilege	2516	ctrl-pshost.exe
Token: SeRemoteShutdownPrivilege	2516	ctrl-pshost.exe
Token: SeUndockPrivilege	2516	ctrl-pshost.exe
Token: SeManageVolumePrivilege	2516	ctrl-pshost.exe
Token: 33	2516	ctrl-pshost.exe
Token: 34	2516	ctrl-pshost.exe
Token: 35	2516	ctrl-pshost.exe
Token: 36	2516	ctrl-pshost.exe
Token: SeIncreaseQuotaPrivilege	2516	ctrl-pshost.exe
Token: SeSecurityPrivilege	2516	ctrl-pshost.exe
Token: SeTakeOwnershipPrivilege	2516	ctrl-pshost.exe
Token: SeLoadDriverPrivilege	2516	ctrl-pshost.exe
Token: SeSystemProfilePrivilege	2516	ctrl-pshost.exe
Token: SeSystemtimePrivilege	2516	ctrl-pshost.exe
Token: SeProfSingleProcessPrivilege	2516	ctrl-pshost.exe
Token: SeIncBasePriorityPrivilege	2516	ctrl-pshost.exe
Token: SeCreatePagefilePrivilege	2516	ctrl-pshost.exe
Token: SeBackupPrivilege	2516	ctrl-pshost.exe
Token: SeRestorePrivilege	2516	ctrl-pshost.exe
Token: SeShutdownPrivilege	2516	ctrl-pshost.exe
Token: SeDebugPrivilege	2516	ctrl-pshost.exe
Token: SeSystemEnvironmentPrivilege	2516	ctrl-pshost.exe
Token: SeRemoteShutdownPrivilege	2516	ctrl-pshost.exe
Token: SeUndockPrivilege	2516	ctrl-pshost.exe
Token: SeManageVolumePrivilege	2516	ctrl-pshost.exe
Token: 33	2516	ctrl-pshost.exe
Token: 34	2516	ctrl-pshost.exe
Token: 35	2516	ctrl-pshost.exe
Token: 36	2516	ctrl-pshost.exe
Token: SeIncreaseQuotaPrivilege	2516	ctrl-pshost.exe
Token: SeSecurityPrivilege	2516	ctrl-pshost.exe
Token: SeTakeOwnershipPrivilege	2516	ctrl-pshost.exe
Token: SeLoadDriverPrivilege	2516	ctrl-pshost.exe
Token: SeSystemProfilePrivilege	2516	ctrl-pshost.exe
Token: SeSystemtimePrivilege	2516	ctrl-pshost.exe
Token: SeProfSingleProcessPrivilege	2516	ctrl-pshost.exe
Token: SeIncBasePriorityPrivilege	2516	ctrl-pshost.exe
Token: SeCreatePagefilePrivilege	2516	ctrl-pshost.exe
Token: SeBackupPrivilege	2516	ctrl-pshost.exe
Token: SeRestorePrivilege	2516	ctrl-pshost.exe
Token: SeShutdownPrivilege	2516	ctrl-pshost.exe
Token: SeDebugPrivilege	2516	ctrl-pshost.exe
Token: SeSystemEnvironmentPrivilege	2516	ctrl-pshost.exe
Token: SeRemoteShutdownPrivilege	2516	ctrl-pshost.exe
Token: SeUndockPrivilege	2516	ctrl-pshost.exe
Token: SeManageVolumePrivilege	2516	ctrl-pshost.exe
Token: 33	2516	ctrl-pshost.exe
Token: 34	2516	ctrl-pshost.exe
Token: 35	2516	ctrl-pshost.exe
Token: 36	2516	ctrl-pshost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 3656	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	89
PID 552 wrote to memory of 5052	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	90
PID 552 wrote to memory of 2920	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	92
PID 552 wrote to memory of 1368	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	94
PID 552 wrote to memory of 4556	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	96
PID 4556 wrote to memory of 4708	4556	cmd.exe	98
PID 4556 wrote to memory of 4552	4556	cmd.exe	99
PID 4556 wrote to memory of 5600	4556	cmd.exe	100
PID 4556 wrote to memory of 3584	4556	cmd.exe	101
PID 4556 wrote to memory of 1472	4556	cmd.exe	102
PID 4556 wrote to memory of 1564	4556	cmd.exe	103
PID 4556 wrote to memory of 5800	4556	cmd.exe	104
PID 4556 wrote to memory of 2948	4556	cmd.exe	105
PID 4556 wrote to memory of 2436	4556	cmd.exe	106
PID 4556 wrote to memory of 4600	4556	cmd.exe	108
PID 4556 wrote to memory of 1996	4556	cmd.exe	109
PID 4556 wrote to memory of 3052	4556	cmd.exe	110
PID 4556 wrote to memory of 5716	4556	cmd.exe	111
PID 4556 wrote to memory of 5456	4556	cmd.exe	112
PID 4556 wrote to memory of 5412	4556	cmd.exe	113
PID 4556 wrote to memory of 5928	4556	cmd.exe	114
PID 4556 wrote to memory of 5044	4556	cmd.exe	115
PID 4556 wrote to memory of 2500	4556	cmd.exe	116
PID 4556 wrote to memory of 4376	4556	cmd.exe	117
PID 4556 wrote to memory of 2228	4556	cmd.exe	118
PID 4556 wrote to memory of 4824	4556	cmd.exe	119
PID 4556 wrote to memory of 3824	4556	cmd.exe	120
PID 4556 wrote to memory of 1756	4556	cmd.exe	121
PID 4556 wrote to memory of 1952	4556	cmd.exe	122
PID 4556 wrote to memory of 1452	4556	cmd.exe	123
PID 4556 wrote to memory of 3688	4556	cmd.exe	124
PID 4556 wrote to memory of 2668	4556	cmd.exe	125
PID 2668 wrote to memory of 4820	2668	cmd.exe	126
PID 2668 wrote to memory of 5352	2668	cmd.exe	127
PID 4556 wrote to memory of 1276	4556	cmd.exe	128
PID 4556 wrote to memory of 4632	4556	cmd.exe	129
PID 4556 wrote to memory of 4760	4556	cmd.exe	130
PID 4556 wrote to memory of 3088	4556	cmd.exe	131
PID 4556 wrote to memory of 3748	4556	cmd.exe	132
PID 4556 wrote to memory of 356	4556	cmd.exe	133
PID 4556 wrote to memory of 364	4556	cmd.exe	134
PID 4556 wrote to memory of 124	4556	cmd.exe	135
PID 4556 wrote to memory of 236	4556	cmd.exe	136
PID 552 wrote to memory of 5064	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	137
PID 552 wrote to memory of 1620	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	141
PID 552 wrote to memory of 5964	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	143
PID 552 wrote to memory of 1156	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	145
PID 552 wrote to memory of 5864	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	147
PID 552 wrote to memory of 2516	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	149
PID 552 wrote to memory of 4560	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	151
PID 552 wrote to memory of 3328	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	152
PID 552 wrote to memory of 5736	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	157
PID 552 wrote to memory of 5804	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	158
PID 552 wrote to memory of 2436	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	161
PID 552 wrote to memory of 2784	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	163
PID 552 wrote to memory of 5708	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	165
PID 552 wrote to memory of 6072	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	167
PID 552 wrote to memory of 4092	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	169
PID 552 wrote to memory of 2564	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	171
PID 552 wrote to memory of 6076	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	173
PID 552 wrote to memory of 5616	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	175
PID 5616 wrote to memory of 5144	5616	query.exe	177
PID 552 wrote to memory of 1800	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	178
PID 552 wrote to memory of 5232	552	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe	180

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:network-mobilehotspot"	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate\DisableWindowsUpdateAccess = "1"	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe

C:\Users\Admin\AppData\Local\Temp\2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:552
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Admin\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:3656
- C:\Users\Admin\AppData\Local\Temp\2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe
  C:\Users\Admin\AppData\Local\Temp\2026-06-27_ff522b24b3c7d4e7b5f7b3fa016fc293_coinminer_dosia_glassworm_houdini_icedid_poet-rat_quasar-rat_snatch_vidar.exe --watchdog 552
  2⤵
  PID:5052
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2920
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Public\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:1368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ctrlone_undelete.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4556
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\AllFilesystemObjects\shell\delete" /f
    3⤵
    - Modifies registry class
    PID:4708
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\AllFilesystemObjects\shell\delete" /f
    3⤵
    PID:4552
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\*\shell\delete" /f
    3⤵
    PID:5600
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\*\shell\delete" /f
    3⤵
    PID:3584
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\Folder\shell\delete" /f
    3⤵
    PID:1472
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\Folder\shell\delete" /f
    3⤵
    PID:1564
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\Directory\shell\delete" /f
    3⤵
    PID:5800
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\Directory\shell\delete" /f
    3⤵
    PID:2948
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\Directory\Background\shell\delete" /f
    3⤵
    PID:2436
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\Directory\Background\shell\delete" /f
    3⤵
    PID:4600
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\Drive\shell\delete" /f
    3⤵
    PID:1996
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\Drive\shell\delete" /f
    3⤵
    PID:3052
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\exefile\shell\delete" /f
    3⤵
    PID:5716
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\exefile\shell\delete" /f
    3⤵
    PID:5456
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" /f
    3⤵
    PID:5412
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" /f
    3⤵
    PID:5928
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\AllFilesystemObjects\shell\delete" /f
    3⤵
    PID:5044
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\*\shell\delete" /f
    3⤵
    PID:2500
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Folder\shell\delete" /f
    3⤵
    PID:4376
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\shell\delete" /f
    3⤵
    PID:2228
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Directory\Background\shell\delete" /f
    3⤵
    PID:4824
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\Drive\shell\delete" /f
    3⤵
    PID:3824
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\exefile\shell\delete" /f
    3⤵
    PID:1756
- - C:\Windows\system32\reg.exe
    reg delete "HKCR\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" /f
    3⤵
    PID:1952
- - C:\Windows\system32\reg.exe
    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFileDelete /f
    3⤵
    PID:1452
- - C:\Windows\system32\reg.exe
    reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFileDelete /f
    3⤵
    PID:3688
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query HKU | findstr /R "S-1-5-21-[0-9-]*$"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\system32\reg.exe
      reg query HKU
      4⤵
      PID:4820
  - - C:\Windows\system32\findstr.exe
      findstr /R "S-1-5-21-[0-9-]*$"
      4⤵
      PID:5352
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\AllFilesystemObjects\shell\delete" /f
    3⤵
    PID:1276
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\*\shell\delete" /f
    3⤵
    PID:4632
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\Folder\shell\delete" /f
    3⤵
    PID:4760
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\Directory\shell\delete" /f
    3⤵
    PID:3088
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\Directory\Background\shell\delete" /f
    3⤵
    PID:3748
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\Drive\shell\delete" /f
    3⤵
    PID:356
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\exefile\shell\delete" /f
    3⤵
    PID:364
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}" /f
    3⤵
    PID:124
- - C:\Windows\system32\reg.exe
    reg delete "HKEY_USERS\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFileDelete /f
    3⤵
    PID:236
- C:\Windows\system32\reg.exe
  reg.exe add HKU\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce /v CtrlOneExplorerRecover /t REG_SZ /d C:\Windows\explorer.exe /f
  2⤵
  - Adds Run key to start application
  PID:5064
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\Software\CtrlOne\ExcludedUSB
  2⤵
  - Modifies registry key
  PID:1620
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5964
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:1156
- C:\Windows\system32\sc.exe
  sc.exe query icssvc
  2⤵
  - Launches sc.exe
  PID:5864
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';foreach ($n in @('RemoteDesktop-UserMode-In-TCP','RemoteDesktop-UserMode-In-UDP','RemoteDesktop-Shadow-In-TCP')) { if (Get-NetFirewallRule -Name $n -ErrorAction SilentlyContinue) { Set-NetFirewallRule -Name $n -Enabled False -ErrorAction SilentlyContinue }}"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\system32\gpupdate.exe
  gpupdate.exe /target:user /force
  2⤵
  PID:4560
- C:\Windows\system32\gpupdate.exe
  gpupdate.exe /target:computer /force
  2⤵
  PID:3328
- C:\Windows\system32\gpupdate.exe
  gpupdate.exe /target:user /force
  2⤵
  PID:5736
- C:\Windows\system32\gpupdate.exe
  gpupdate.exe /target:computer /force
  2⤵
  PID:5804
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2436
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2784
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5708
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:6072
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4092
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2564
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:6076
- C:\Windows\system32\query.exe
  query.exe session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\qwinsta.exe
    "C:\Windows\system32\qwinsta.exe"
    3⤵
    PID:5144
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:1800
- C:\Windows\system32\gpupdate.exe
  gpupdate.exe /target:user /force
  2⤵
  PID:5232
- C:\Windows\system32\gpupdate.exe
  gpupdate.exe /target:computer /force
  2⤵
  PID:2920
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5756
- C:\Windows\system32\icacls.exe
  icacls C:\ProgramData\CtrlOne\license.bin /inheritance:r /grant:r *S-1-5-18:F /grant:r *S-1-5-32-544:F
  2⤵
  - Modifies file permissions
  PID:1624
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3436
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Application /c:500 /rd:true /f:text
  2⤵
  PID:3012
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3640
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Application /c:1 /rd:true /f:text
  2⤵
  PID:1900
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe System /c:500 /rd:true /f:text
  2⤵
  PID:4336
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe System /c:1 /rd:true /f:text
  2⤵
  PID:5864
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Security /c:500 /rd:true /f:text
  2⤵
  PID:620
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Security /c:1 /rd:true /f:text
  2⤵
  PID:2780
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Setup /c:500 /rd:true /f:text
  2⤵
  PID:2004
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SOFTWARE\Policies\Google\Chrome /v EnterpriseCustomLabel /t REG_SZ /d CtrlOne /f
  2⤵
  - Modifies registry key
  PID:1800
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SOFTWARE\Policies\Microsoft\Edge /v EnterpriseCustomLabel /t REG_SZ /d CtrlOne /f
  2⤵
  - Modifies registry key
  PID:3208
- C:\Windows\system32\reg.exe
  reg.exe add HKLM\SOFTWARE\Policies\BraveSoftware\Brave /v EnterpriseCustomLabel /t REG_SZ /d CtrlOne /f
  2⤵
  - Modifies registry key
  PID:3280
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Setup /c:1 /rd:true /f:text
  2⤵
  PID:5952
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-PowerShell/Operational /c:500 /rd:true /f:text
  2⤵
  PID:4600
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4988
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-PowerShell/Operational /c:1 /rd:true /f:text
  2⤵
  PID:5400
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-IIS-Logging/Logs /c:500 /rd:true /f:text
  2⤵
  PID:4548
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-IIS-Logging/Logs /c:1 /rd:true /f:text
  2⤵
  PID:748
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-WinRM/Operational /c:500 /rd:true /f:text
  2⤵
  PID:4392
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-WinRM/Operational /c:1 /rd:true /f:text
  2⤵
  PID:2700
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3356
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2920
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:400
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:3276
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:3928
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4660
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4844
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -status C:
  2⤵
  PID:1496
- C:\Windows\system32\fsutil.exe
  fsutil.exe fsinfo drivetype C:
  2⤵
  PID:5712
- C:\Windows\system32\fsutil.exe
  fsutil.exe fsinfo drivetype F:
  2⤵
  PID:5136
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -status C:
  2⤵
  PID:3204
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -status F:
  2⤵
  PID:1756
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'UltraViewer.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5436
- C:\Windows\system32\fsutil.exe
  fsutil.exe fsinfo drivetype C:
  2⤵
  PID:236
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2288
- C:\Windows\system32\fsutil.exe
  fsutil.exe fsinfo drivetype F:
  2⤵
  PID:1360
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -status C:
  2⤵
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'UltraViewer_Service.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:200
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -status F:
  2⤵
  PID:2468
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'UltraViewer_Desktop.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1484
- C:\Windows\system32\sc.exe
  sc.exe query UltraViewer_Service
  2⤵
  - Launches sc.exe
  PID:6004
- C:\Windows\system32\sc.exe
  sc.exe query UVService
  2⤵
  - Launches sc.exe
  PID:6072
- C:\Windows\system32\sc.exe
  sc.exe qc UltraViewer_Service
  2⤵
  - Launches sc.exe
  PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Process -Name 'ultraviewer' -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.Id)|$($_.Path)\" }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Process -Name 'ultraviewer_service' -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.Id)|$($_.Path)\" }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Process -Name 'ultraviewer_desktop' -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.Id)|$($_.Path)\" }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Admin\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:1624
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Public\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:1148
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'AnyDesk.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5220
- C:\Windows\system32\sc.exe
  sc.exe query AnyDesk
  2⤵
  - Launches sc.exe
  PID:748
- C:\Windows\system32\sc.exe
  sc.exe qc AnyDesk
  2⤵
  - Launches sc.exe
  PID:2936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Process -Name 'anydesk' -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.Id)|$($_.Path)\" }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:3260
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Admin\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:5508
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Public\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:3000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Add-MpPreference -ExclusionProcess 'rustdesk.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4660
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4816
- C:\Windows\system32\sc.exe
  sc.exe query RustDesk
  2⤵
  - Launches sc.exe
  PID:5864
- C:\Windows\system32\sc.exe
  sc.exe qc RustDesk
  2⤵
  - Launches sc.exe
  PID:2508
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-Process -Name 'rustdesk' -ErrorAction SilentlyContinue | ForEach-Object { \"$($_.Id)|$($_.Path)\" }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:1536
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Admin\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:6068
- C:\Windows\system32\icacls.exe
  icacls.exe C:\Users\Public\Desktop /remove:d *S-1-1-0 /C /Q
  2⤵
  - Modifies file permissions
  PID:5976
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Application "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:996
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe System "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:1324
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Security "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:4588
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Setup "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:4144
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-PowerShell/Operational "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:1364
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-IIS-Logging/Logs "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:1456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-WinRM/Operational "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:4440
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:5844
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' try { Add-Type -AssemblyName System.Device | Out-Null $w = New-Object System.Device.Location.GeoCoordinateWatcher('High') $null = $w.TryStart($false, [TimeSpan]::FromSeconds(5)) # Spin briefly waiting for Ready/Initializing to settle. for ($i=0; $i -lt 30; $i++) { if ($w.Status -eq 'Ready') { break } Start-Sleep -Milliseconds 200 } if ($w.Permission -eq 'Denied') { Write-Output 'DENIED' $w.Stop() return } $loc = $w.Position.Location if ($loc -eq $null -or $loc.IsUnknown) { Write-Output 'UNKNOWN' $w.Stop() return } $acc = $loc.HorizontalAccuracy if ([double]::IsNaN($acc) -or [double]::IsInfinity($acc)) { $acc = 0 } Write-Output (\"OK|{0}|{1}|{2}\" -f $loc.Latitude, $loc.Longitude, $acc) $w.Stop() } catch { Write-Output (\"ERR|{0}\" -f $_.Exception.Message) } "
  2⤵
  PID:4812
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Get-NetAdapter -Physical | Where-Object {$_.Status -eq 'Up'} | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6012
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:3392
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Set-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Wake on Magic Packet' -DisplayValue 'Enabled' -NoRestart -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:5792
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:3936
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:1140
- C:\Windows\system32\netsh.exe
  netsh.exe wlan show networks mode=Bssid
  2⤵
  PID:1472
- C:\Windows\System32\Wbem\wmic.exe
  wmic diskdrive get Index,Model,SerialNumber,Size,InterfaceType,MediaType /format:list
  2⤵
  PID:1988
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\wmi path MSStorageDriver_FailurePredictStatus get InstanceName,PredictFailure,Reason /format:list
  2⤵
  PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Set-NetAdapterAdvancedProperty -Name 'Ethernet' -RegistryKeyword '*WakeOnMagicPacket' -RegistryValue 1 -NoRestart -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  PID:5940
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:2576
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -Command "Enable-NetAdapterPowerManagement -Name 'Ethernet' -WakeOnMagicPacket -ErrorAction SilentlyContinue"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  PID:5240
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:3408
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:6044
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5680
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5044
- C:\Windows\system32\sc.exe
  sc.exe query type= service state= all bufsize= 262144
  2⤵
  - Launches sc.exe
  PID:1872
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\wmi path MSStorageDriver_ATAPISmartData get InstanceName,VendorSpecific /format:list
  2⤵
  PID:6012
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5864
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PhysicalDisk | ForEach-Object { \"$($_.DeviceId)|$($_.BusType)|$($_.MediaType)|$($_.FriendlyName)|$($_.FormFactor)\" }"
  2⤵
  PID:2488
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:6020
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "try { Update-StorageProviderCache -DiscoveryLevel Full -ErrorAction SilentlyContinue | Out-Null } catch {}; for ($attempt = 1; $attempt -le 3; $attempt++) { $rows = @(Get-PhysicalDisk | ForEach-Object { $rel = $_ | Get-StorageReliabilityCounter -ErrorAction SilentlyContinue; \"$($_.DeviceId)|$($rel.Temperature)|$($rel.PowerOnHours)|$($rel.Wear)\" }); $haveTemp = $false; foreach ($r in $rows) { $p = $r -split '\|'; if ($p.Length -ge 2 -and $p[1] -match '^\d+$' -and [int]$p[1] -gt 0) { $haveTemp = $true; break } }; if ($haveTemp -or $attempt -eq 3) { $rows | ForEach-Object { $_ }; break } Start-Sleep -Milliseconds 1500 }"
  2⤵
  PID:2112
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Application "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:3204
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe System "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:5804
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Security "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:5576
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:236
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Setup "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:4168
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-PowerShell/Operational "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:2456
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-IIS-Logging/Logs "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:6116
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-WinRM/Operational "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:3712
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4336
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:1516
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:4064
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v CurrentBuildNumber
  2⤵
  PID:3092
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -status
  2⤵
  PID:4076
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2320
- C:\Windows\system32\reg.exe
  reg.exe query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR
  2⤵
  PID:760
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe qfe get HotFixID,InstalledOn /format:csv
  2⤵
  PID:6044
- C:\Windows\System32\Wbem\wmic.exe
  wmic.exe os get LastBootUpTime /value
  2⤵
  PID:5164
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -protectors -get C: -Type RecoveryPassword
  2⤵
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop' try { $session = New-Object -ComObject Microsoft.Update.Session $searcher = $session.CreateUpdateSearcher() # IsInstalled=0 → pending. Type='Software' → exclude drivers (which # admins typically don't push via WU on managed fleets and which # produce noisy counts on consumer hardware). $r = $searcher.Search(\"IsInstalled=0 and Type='Software' and IsHidden=0\") [int]$r.Updates.Count } catch { Write-Error $_ exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5252
- C:\Windows\System32\manage-bde.exe
  C:\Windows\System32\manage-bde.exe -protectors -get F: -Type RecoveryPassword
  2⤵
  PID:4388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2288
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get serialnumber /value
  2⤵
  PID:916
- C:\Windows\System32\Wbem\wmic.exe
  wmic systemenclosure get chassistypes /value
  2⤵
  PID:2732
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3128
- C:\Windows\System32\Wbem\wmic.exe
  wmic baseboard get serialnumber /value
  2⤵
  PID:3824
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_BaseBoard).SerialNumber"
  2⤵
  PID:252
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:4604
- C:\Windows\System32\Wbem\wmic.exe
  wmic baseboard get manufacturer /value
  2⤵
  PID:1916
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Manufacturer"
  2⤵
  PID:620
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2088
- C:\Windows\System32\Wbem\wmic.exe
  wmic baseboard get product /value
  2⤵
  PID:868
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "(Get-CimInstance -ClassName Win32_BaseBoard).Product"
  2⤵
  PID:5652
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\SecurityCenter2 path AntiVirusProduct get displayName,productState,pathToSignedProductExe,pathToSignedReportingExe,timestamp,instanceGuid /format:list
  2⤵
  PID:1800
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$av = Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct;if ($av) { $av | Select-Object displayName,productState,pathToSignedProductExe,pathToSignedReportingExe,timestamp,instanceGuid | ConvertTo-Json -Compress -Depth 3 }"
  2⤵
  PID:5144
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\cimv2 path Win32_Keyboard get Name,Description,PNPDeviceID,Status,Layout /format:list
  2⤵
  PID:3584
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\cimv2 path Win32_PointingDevice get Name,Description,Manufacturer,PNPDeviceID,Status,HardwareType /format:list
  2⤵
  PID:4392
- C:\Windows\System32\Wbem\wmic.exe
  wmic /namespace:\\root\cimv2 path Win32_Printer get Name,DriverName,PortName,DeviceID,Default,Network,WorkOffline,PrinterStatus /format:list
  2⤵
  PID:5400
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue';$p=$null; $store='ActiveStore';try{$p=Get-NetFirewallProfile -PolicyStore ActiveStore -ErrorAction Stop | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction}catch{};if(-not $p){$store='LocalStore';$p=Get-NetFirewallProfile -ErrorAction SilentlyContinue | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction};if($p){Write-Output \"STORE:$store\"; $p|ConvertTo-Json -Compress -Depth 3}"
  2⤵
  PID:1960
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:2920
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4328
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:4400
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:4844
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:2164
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:3800
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:4388
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3260
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:5524
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Application "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:1308
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe System "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:1208
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Security "/q:*[System[EventRecordID > 0]]" /c:50 /rd:false /f:text
  2⤵
  PID:5756
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Setup "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:264
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-PowerShell/Operational "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:720
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-IIS-Logging/Logs "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:4916
- C:\Windows\system32\wevtutil.exe
  wevtutil.exe qe Microsoft-Windows-WinRM/Operational "/q:*[System[EventRecordID > 0]]" /c:25 /rd:false /f:text
  2⤵
  PID:1200
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:5124
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4052
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5412
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:1872
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:5788
- C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
  C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Get-PnpDevice -PresentOnly -Class USB | Select-Object -ExpandProperty InstanceId"
  2⤵
  PID:2592
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:5928
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:4376
- C:\Windows\system32\reg.exe
  reg.exe query HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR /v Start
  2⤵
  - Modifies registry key
  PID:3208

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
- Modifies registry class
PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity.log

Path C:\ProgramData\CtrlOne\activity.log
Size 5KB
SHA256 b1ff03396b2a2f9d9940b538134781ffaecea987d70990bfb2ccd65292348c4c
MD5 bdac254ae6ca5ed1fd2633daed83d249
SHA1 0cd330c9f3ab5fe878f6f818b9dc82b7d6f66c3b
SHA512 eb2c630a298956c40527f079a60c49df835153c2a3d3883d4cc3a636776d1a9df53c3a57648d546e854bc4d2d393f8fef2ecdf8f1775e0dc197dc11c10dee13a
SSDEEP 48:ohogtq7Xd0v5pcx+2pFgfw7ON2b7SJxCHzX2/g5w3Aw6EDZ44y2XQu2VyGkT6it4:o6iwXdcpI+jh0qI5ZmF6iiJpbHvP
TLSH
T133B1773570B9BFB243AFD106A6787FDF8D00749BE4436A792381108D7139C8D1EA9A39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ctrl-pshost.exe

Path C:\ProgramData\CtrlOne\internal\ctrl-pshost.exe
Size 444KB
SHA256 d3b4b97c2bf97d70e5655ff4c4ca1d8cef9ded51685cfd764247cfda98ee68df
MD5 909a2eec5534f01dff87b7d47e57bff7
SHA1 bb26646b094923f080fc2f2ba363c4c28b33dc07
SHA512 5b5b632eb93d227f81960916d13dd98c6f9cb0494866ceb324e6146254818f323537c39c2b90abc6496aad4b457c0b9b393301ea51157e9f823bd4cd442371dc
SSDEEP 6144:wCo5Sh1yzMWwO9sV1yZywi/PzNKXzJ7BapCK5d3klRzULOnWyjLsPhAQzqO:w6pW2KXzJ4pdd3klnnWosPhnzq
TLSH
T1C5A45A876BD412D5EC3EC435C82344520721BCB9D791A7EB9AD8F2390E712D09E3EA67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

license.bin

Path C:\ProgramData\CtrlOne\license.bin
Size 456B
SHA256 f2ddf45351e697e6a5d5048ab50be8e23338596ea989d9cde896b6ee44049217
MD5 13691ec69d9d43e93ea5d6a1b906e090
SHA1 7cca7809d66789610315d5b96331dcf0f9d1a696
SHA512 c32e29b9d1627aedcb6cc83bb6d5e2f328e470e46deee93a7a7ebaa18b1931801097926c9b2e32394d06e22095889d2ceef1e05ce0dbb91111cc514f1692cd76
TLSH
T14AF0D4020139EED5D700A27875C79610DACA421C147296EA55C185B1CA925014133E9B
MD5 SHA1 SHA512 TLSH

Submit Download