Analysis
- max time kernel
150s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 09:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EverythingCheker.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
42 signatures
150 seconds
Behavioral task
behavioral2
Sample
EverythingCheker.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
45 signatures
150 seconds
General
- Target EverythingCheker.exe
- Size 5.7MB
- Sample260703-lap7aaev4t
- SHA256 bd9aee63cbeb690f27982871729b90dc591e705408a5b1eba9313a11897f46f9
- MD5 26dd5139084a1418d50ade3c3dc44bd3
- SHA1 254ad3637629e5c3e56c6985bab71c5636072224
- SHA512 71a94f0785c8b32dfa2a3dbdec6f342bf27744b4209d2a90454ab8c54c4269cae0a14f130f781771b8ee95e3e2f55121558dd889b2696a1a99254a455f7a6737
- SSDEEP 12288:dYFlYFH7ddzVKthnrB/5In+ae0HEVZlMsk3n9AoxB7c:AqnCoxa
- TLSH T17956DF4727F8C51DE3BEDA7498B3D0F04A77A426A91BDF091C8624B82A21F509DD076F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Sheetrat Payload 3 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
resource yara_rule behavioral1/memory/4864-37-0x0000000002DA0000-0x0000000002E02000-memory.dmp family_sheetrat_v1 behavioral1/memory/856-283-0x0000000001D50000-0x0000000001DB2000-memory.dmp family_sheetrat_v1 behavioral1/memory/1824-390-0x00000000027F0000-0x0000000002852000-memory.dmp family_sheetrat_v1 - Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\SestemA.exe," rbewveh1anj4oyjq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" SestemA.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" SestemA.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "3" rbewveh1anj4oyjq.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" rbewveh1anj4oyjq.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Process not Found - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation EverythingCheker.exe Key value queried \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation rbewveh1anj4oyjq.exe - Executes dropped EXE 38 IoCs
pid Process 4864 rbewveh1anj4oyjq.exe 2096 Unix.exe 588 Process not Found 2160 Process not Found 784 Process not Found 1564 Process not Found 2548 Process not Found 3528 Process not Found 2932 Process not Found 1004 Process not Found 2128 Process not Found 1144 Process not Found 2908 Process not Found 1328 Process not Found 2392 Process not Found 772 Process not Found 672 Process not Found 1288 Process not Found 1872 Process not Found 64 Process not Found 3408 Process not Found 2812 Process not Found 4776 Process not Found 2760 Process not Found 1020 Process not Found 1604 Process not Found 792 Process not Found 2788 Process not Found 4376 Process not Found 2116 Process not Found 2260 Process not Found 2804 Process not Found 1792 Process not Found 3752 Process not Found 4532 Process not Found 4736 Process not Found 856 SestemA.exe 1824 SestemA.exe - Loads dropped DLL 64 IoCs
pid Process 3268 Process not Found 2924 Process not Found 1572 Process not Found 1228 Process not Found 1524 Process not Found 1916 Process not Found 2800 Process not Found 5108 TiWorker.exe 1776 Process not Found 3236 CMD.exe 856 SestemA.exe 3268 Process not Found 588 Process not Found 2800 Process not Found 672 Process not Found 2160 Process not Found 784 Process not Found 1564 Process not Found 2548 Process not Found 3528 Process not Found 2932 Process not Found 2924 Process not Found 1004 Process not Found 2128 Process not Found 1144 Process not Found 1824 SestemA.exe 2908 Process not Found 2392 Process not Found 1328 Process not Found 772 Process not Found 1288 Process not Found 1872 Process not Found 2812 Process not Found 64 Process not Found 1572 Process not Found 3408 Process not Found 4776 Process not Found 1228 Process not Found 2760 Process not Found 4376 Process not Found 1604 Process not Found 2788 Process not Found 1020 Process not Found 2116 Process not Found 792 Process not Found 5108 TiWorker.exe 1792 Process not Found 2804 Process not Found 1524 Process not Found 1916 Process not Found 3752 Process not Found 4736 Process not Found 1776 Process not Found 4532 Process not Found 3236 CMD.exe 2260 Process not Found 3268 Process not Found 588 Process not Found 2800 Process not Found 784 Process not Found 2160 Process not Found 1564 Process not Found 2548 Process not Found 3528 Process not Found - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" rbewveh1anj4oyjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" rbewveh1anj4oyjq.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Unix.exe Key opened \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Unix.exe Key opened \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Unix.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rbewveh1anj4oyjq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SestemA.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SestemA.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\F: Process not Found - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 icanhazip.com 5 ip-api.com - Drops file in System32 directory 19 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml Process not Found File opened for modification C:\Windows\System32\Tasks\12 Process not Found File opened for modification C:\Windows\System32\Tasks\1 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Process not Found File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F Process not Found File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF Process not Found - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Scsooct rbewveh1anj4oyjq.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1008 sc.exe 3056 sc.exe 4856 sc.exe 1528 sc.exe 3324 sc.exe 4556 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 2092 netsh.exe - Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000\LogConf Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Mfg Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc Process not Found Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000\LogConf Process not Found - Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Unix.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Unix.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Process not Found - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier Process not Found Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Process not Found Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU Process not Found - Modifies data under HKEY_USERS 14 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR Process not Found Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,944 15,943 6,1329 15,1329 100,1329 6,943 10,943 15,944 6,940 50,941 15,941 10,941 6,942 15,942 10,942 6,944 100,944 10,944 50,940 6,940 100,940 10,940 15" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={86D53DDD-CA21-42FF-9D1C-1D8DD80DBE44}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry Process not Found Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "577889346,5804129,17110992,7202269,9179409,24262478,41484365,17110988,7153487,508368333,17962391,17962392,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,7202265,507286179,41816131,20502174,6308191,18407617,39125643,539756558,504928405,504928410,24262477,25036127,24262473,9179410,6104718,9179411,51475283,41185282,39389248,539756557,528570079" Process not Found Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Process not Found Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1783070495" Process not Found Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Wed, 01 Jul 2026 00:17:50 GMT" Process not Found - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\$Extend\$Quota:$Q:$INDEX_ALLOCATION Process not Found - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3816 schtasks.exe 2168 schtasks.exe - Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 2096 Unix.exe 2096 Unix.exe 2096 Unix.exe 2096 Unix.exe 4864 rbewveh1anj4oyjq.exe 4864 rbewveh1anj4oyjq.exe 4864 rbewveh1anj4oyjq.exe 4864 rbewveh1anj4oyjq.exe 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 1400 Process not Found 1824 SestemA.exe 1824 SestemA.exe 1824 SestemA.exe 1824 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe 856 SestemA.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3268 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4864 rbewveh1anj4oyjq.exe Token: SeDebugPrivilege 2096 Unix.exe Token: SeDebugPrivilege 2096 Unix.exe Token: SeDebugPrivilege 2096 Unix.exe Token: SeAssignPrimaryTokenPrivilege 2160 Process not Found Token: SeIncreaseQuotaPrivilege 2160 Process not Found Token: SeSecurityPrivilege 2160 Process not Found Token: SeTakeOwnershipPrivilege 2160 Process not Found Token: SeLoadDriverPrivilege 2160 Process not Found Token: SeSystemtimePrivilege 2160 Process not Found Token: SeBackupPrivilege 2160 Process not Found Token: SeRestorePrivilege 2160 Process not Found Token: SeShutdownPrivilege 2160 Process not Found Token: SeSystemEnvironmentPrivilege 2160 Process not Found Token: SeUndockPrivilege 2160 Process not Found Token: SeManageVolumePrivilege 2160 Process not Found Token: SeAssignPrimaryTokenPrivilege 2160 Process not Found Token: SeIncreaseQuotaPrivilege 2160 Process not Found Token: SeSecurityPrivilege 2160 Process not Found Token: SeTakeOwnershipPrivilege 2160 Process not Found Token: SeLoadDriverPrivilege 2160 Process not Found Token: SeSystemtimePrivilege 2160 Process not Found Token: SeBackupPrivilege 2160 Process not Found Token: SeRestorePrivilege 2160 Process not Found Token: SeShutdownPrivilege 2160 Process not Found Token: SeSystemEnvironmentPrivilege 2160 Process not Found Token: SeUndockPrivilege 2160 Process not Found Token: SeManageVolumePrivilege 2160 Process not Found Token: SeAssignPrimaryTokenPrivilege 2160 Process not Found Token: SeIncreaseQuotaPrivilege 2160 Process not Found Token: SeSecurityPrivilege 2160 Process not Found Token: SeTakeOwnershipPrivilege 2160 Process not Found Token: SeLoadDriverPrivilege 2160 Process not Found Token: SeSystemtimePrivilege 2160 Process not Found Token: SeBackupPrivilege 2160 Process not Found Token: SeRestorePrivilege 2160 Process not Found Token: SeShutdownPrivilege 2160 Process not Found Token: SeSystemEnvironmentPrivilege 2160 Process not Found Token: SeUndockPrivilege 2160 Process not Found Token: SeManageVolumePrivilege 2160 Process not Found Token: SeAssignPrimaryTokenPrivilege 2160 Process not Found Token: SeIncreaseQuotaPrivilege 2160 Process not Found Token: SeSecurityPrivilege 2160 Process not Found Token: SeTakeOwnershipPrivilege 2160 Process not Found Token: SeLoadDriverPrivilege 2160 Process not Found Token: SeSystemtimePrivilege 2160 Process not Found Token: SeBackupPrivilege 2160 Process not Found Token: SeRestorePrivilege 2160 Process not Found Token: SeShutdownPrivilege 2160 Process not Found Token: SeSystemEnvironmentPrivilege 2160 Process not Found Token: SeUndockPrivilege 2160 Process not Found Token: SeManageVolumePrivilege 2160 Process not Found Token: SeAssignPrimaryTokenPrivilege 2160 Process not Found Token: SeIncreaseQuotaPrivilege 2160 Process not Found Token: SeSecurityPrivilege 2160 Process not Found Token: SeTakeOwnershipPrivilege 2160 Process not Found Token: SeLoadDriverPrivilege 2160 Process not Found Token: SeSystemtimePrivilege 2160 Process not Found Token: SeBackupPrivilege 2160 Process not Found Token: SeRestorePrivilege 2160 Process not Found Token: SeShutdownPrivilege 2160 Process not Found Token: SeSystemEnvironmentPrivilege 2160 Process not Found Token: SeUndockPrivilege 2160 Process not Found Token: SeManageVolumePrivilege 2160 Process not Found - Suspicious use of UnmapMainImage 14 IoCs
pid Process 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 3268 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found 2752 Process not Found - Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 2316 wrote to memory of 4864 2316 EverythingCheker.exe 85 PID 2316 wrote to memory of 2096 2316 EverythingCheker.exe 86 PID 2096 wrote to memory of 1396 2096 Unix.exe 87 PID 2096 wrote to memory of 2092 2096 Unix.exe 89 PID 4864 wrote to memory of 3324 4864 rbewveh1anj4oyjq.exe 98 PID 4864 wrote to memory of 1528 4864 rbewveh1anj4oyjq.exe 100 PID 4864 wrote to memory of 3236 4864 rbewveh1anj4oyjq.exe 103 PID 4864 wrote to memory of 4732 4864 rbewveh1anj4oyjq.exe 104 PID 4864 wrote to memory of 1984 4864 rbewveh1anj4oyjq.exe 105 PID 4864 wrote to memory of 4556 4864 rbewveh1anj4oyjq.exe 109 PID 4732 wrote to memory of 1184 4732 CMD.exe 112 PID 1984 wrote to memory of 3816 1984 cmd.exe 111 PID 4864 wrote to memory of 1008 4864 rbewveh1anj4oyjq.exe 113 PID 3268 wrote to memory of 456 3268 Process not Found PID 3268 wrote to memory of 456 3268 Process not Found PID 4864 wrote to memory of 3056 4864 rbewveh1anj4oyjq.exe 117 PID 784 wrote to memory of 5108 784 Process not Found 119 PID 784 wrote to memory of 5108 784 Process not Found 119 PID 4864 wrote to memory of 4856 4864 rbewveh1anj4oyjq.exe 120 PID 4864 wrote to memory of 3852 4864 rbewveh1anj4oyjq.exe 122 PID 3852 wrote to memory of 2168 3852 cmd.exe 124 PID 4864 wrote to memory of 1824 4864 rbewveh1anj4oyjq.exe 125 PID 3268 wrote to memory of 4312 3268 Process not Found PID 3268 wrote to memory of 4312 3268 Process not Found PID 856 wrote to memory of 3252 856 SestemA.exe 127 PID 3252 wrote to memory of 4964 3252 CMD.exe 129 PID 3268 wrote to memory of 4392 3268 Process not Found PID 3268 wrote to memory of 4392 3268 Process not Found - System policy modification 1 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "1" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" rbewveh1anj4oyjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" SestemA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" SestemA.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Unix.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Unix.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\EverythingCheker.exe"C:\Users\Admin\AppData\Local\Temp\EverythingCheker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\bnd_16441027\rbewveh1anj4oyjq.exe"C:\Users\Admin\AppData\Local\Temp\bnd_16441027\rbewveh1anj4oyjq.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864 -
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
PID:3324
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
PID:1528
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\SestemA.exe" enable=yes & exit3⤵
- Loads dropped DLL
PID:3236
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵PID:1184
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\SestemA.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\SestemA.exe"4⤵
- Scheduled Task/Job: Scheduled Task
PID:3816
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
PID:4556
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
PID:1008
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
PID:3056
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
PID:4856
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "1" /tr "C:\Windows\Scsooct" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "1" /tr "C:\Windows\Scsooct" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
PID:2168
-
-
-
C:\Users\Admin\AppData\Roaming\SestemA.exe"C:\Users\Admin\AppData\Roaming\SestemA.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:1824
-
-
-
C:\Users\Admin\AppData\Local\Temp\bnd_16441027\Unix.exe"C:\Users\Admin\AppData\Local\Temp\bnd_16441027\Unix.exe"2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
PID:2096 -
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan export profile key=clear folder="C:\Users\Admin\AppData\Local\Temp\UnixStealerWifiExport_65eb374e6ac047e79c1a66c004edce5b"3⤵
- Event Triggered Execution: Netsh Helper DLL
PID:1396
-
-
C:\Windows\SYSTEM32\netsh.exe"netsh" wlan show profiles3⤵
- Event Triggered Execution: Netsh Helper DLL
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2092
-
-
-
C:\Users\Admin\AppData\Roaming\SestemA.exeC:\Users\Admin\AppData\Roaming\SestemA.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:856 -
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵PID:4964
-
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:5108
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵PID:5060
Network
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
4Modify Registry
7Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
1Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\$77temp\4f0c0cca-7f79-47ea-9995-a062e8540406.dll
- Size 147KB
- SHA256 ff95571a4b3880be2807cad8875ee6ccd0b2b705caf0d4d0d0f56950dd78ee5a
- MD5 6295c384c45ef898b40608f7af8155db
- SHA1 75111839c370518271e1b625f506062f7ab31c3a
- SHA512 eea64a94234dff73912699c59e1356579509e2bcffe22b066f65843d230875a7d9fb5f6c75a7a0c81395cdd14e0f6e72bff3a7f39ca455f3d7026edd54b4c801
- SSDEEP 3072:n3+8MsFRgZM1a+UwrL0vxmQ4ktFN6y3Fb1:n3KpSL0pD
- TLSH T11FE30807B6E500FBD8B6813585536A19B7BAF4540322EBEB825449FD0F2BBD1ED39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bnd_16441027\Unix.exe
- Size 255KB
- SHA256 aeadfe079751d05331206e32fe5bbbb727adc39db0335f1234184e572b472a08
- MD5 409bf0ad3990f44825a0c75885ef6200
- SHA1 ffb63019398e5d193edb50dc517648024a082c71
- SHA512 02b7db4d6a87d78918477165f738cf1ef3c80be6c8c2b7d15deda1f952875e9b24bb9d701a0d2f38093f77b4982e8dba858e9500f34a39450b91d76c144c320f
- SSDEEP 3072:MRYyGJwDsUAoyV0CdWvHDYdoTSBEegmIWZu1V1XnWO8j9XQIvn5bfIQ7SairKDy1:MRYfaDsh7WbYq2n9AoxgrKD7/XOv
- TLSH T1914419443BF95619F3BF5F75A8B050504AB6F92BAD2AD30D1C8620EC2E31B51EE50B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bnd_16441027\rbewveh1anj4oyjq.exe
- Size 5.5MB
- SHA256 1b8946b853e335c9df07e284f0a657b72d5b2d8087ea120b26d8147e472369a6
- MD5 cab248f9af0098c4d81fc1270f60dc10
- SHA1 0ef399ad3d6c59aad8243e1a15b50781a064bc3e
- SHA512 547065cdf0ee884ca7d8f45241789475e454ddc01590ef3a0717807f1f2a243317d30955a0066b17f7738cd7235173dc4a1c54d7b5133df323b54052fd80b3c8
- SSDEEP 6144:eCpG8eYjwbFNSsQIqiEcJ7QoCUjIN+XLecdG257p+WhoV5+trr13X0g3BwqWD6yV:6YFlYFH7ddzVKthnrB/5In+ae0HEVZ
- TLSH T16746234BB6B1E19ED314C4781CA7E8F905A71452A14F7F837CCE1D3056AAD8A2CE41AF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 98c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
- MD5 ceb7caa4e9c4b8d760dbf7e9e5ca44c5
- SHA1 a3879621f9493414d497ea6d70fbf17e283d5c08
- SHA512 1eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
- TLSH T12951455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work
- Size 2KB
- SHA256 727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
- MD5 7d612892b20e70250dbd00d0cdd4f09b
- SHA1 63251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
- SHA512 f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
- TLSH T15151455367EE1108F2F76B2CAEB620218EA77D455D39C46D00AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 55f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
- MD5 1e8e2076314d54dd72e7ee09ff8a52ab
- SHA1 5fd0a67671430f66237f483eef39ff599b892272
- SHA512 5b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
- TLSH T1CD51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work
- Size 2KB
- SHA256 a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
- MD5 0b990e24f1e839462c0ac35fef1d119e
- SHA1 9e17905f8f68f9ce0a2024d57b537aa8b39c6708
- SHA512 c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
- TLSH T18C51355367EE1108F2F76B2CAEB620218EA77D455D39C46D01AC240DCBF7E6289607B7
- MD5 SHA1 SHA512 TLSH