Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/07/2026, 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe
- Size 24.1MB
- Sample260703-q5vgpsat21
- SHA256 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6
- MD5 5e8dad881659b6535ece40596f1e02d2
- SHA1 0d2461ca1a3f4bdc4512bcd6c54192e2a1e99656
- SHA512 e8379e955d679f2662d022efe498e9b30acb0eb4b75e5cef70aee019db500826240deeb5c9cfaf24755385e755b1f3487282ae431f8ae5d79f7c9d08dc23077c
- SSDEEP 98304:33XLIuzhFgMw/fy5KrW2DW3yErO4siImgwR/zFls3S/wb8z1qP5E6my+aBMC+6y3:3L/Q3ynfrO4soHsieM1qP5EjVQa5Zh
- TLSH T197475B82F7844ADEC65099798DAA53C23371FC251F27E3D36B09BA3E2D726C59E64700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-BitLocker%4BitLocker Management.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppReadiness%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4AutoPilot.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\System.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AAD%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4CaptureMonitor.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Audit.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Connectivity.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Time-Service%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Application.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4PlaybackManager.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Security.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Key Management Service.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Bits-Client%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-SPP-UX-Notifications%4ActionCenter.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Security.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Dhcp-Client%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Setup.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 9 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Documents and Settings\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\ProgramData\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Users\All Users\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification F:\$Recycle.Bin\S-1-5-21-2370214745-1838013427-2987045292-1000\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened (read-only) \??\F: 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Drops file in System32 directory 27 IoCs
description ioc Process File opened for modification C:\Windows\System32\config\SOFTWARE.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SOFTWARE.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SYSTEM.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\USO_UxBroker 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SAM 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SOFTWARE 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SYSTEM 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\sru\SRUDB.dat 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SAM.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SECURITY.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SECURITY.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan Static Task 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SECURITY 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SAM.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SYSTEM.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\TextServicesFramework\MsCtfMonitor 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Report policies 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\system32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Scan 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\UpdateModelTask 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-16AF9B6E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\inf\setupapi.dev.log 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\ONEDRIVESETUP.EXE-ADFC0EFD.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-D71F3FEA.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\SHUTDOWN.EXE-E7D5C9CC.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\FSQUIRT.EXE-BBD9646E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-033BBABB.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\TAKEOWN.EXE-A80759AD.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\frxmain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-61696F68.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-6378753E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\inf\setupapi.offline.log 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-976DB280.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\TASKHOSTW.EXE-3E0B74C8.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-0521102C.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-23EA2E5B.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-373C0EED.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppCompat\Programs\Amcache.hve.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\msimain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\sysmain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\CONHOST.EXE-1F3E9D7E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\POWERSHELL.EXE-920BBA2A.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-0C84305E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-DB926CB0.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-FFCC5BB3.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\WLRMDR.EXE-C2B47318.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\REG.EXE-E7E8BD26.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-156D43F1.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\SHELLEXPERIENCEHOST.EXE-A3608B1E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-56E309E9.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-AE5EC6E9.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-E8196656.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-C4B5739C.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-DF3D779F.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\AUDIODG.EXE-BDFD3029.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-2C52326A.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-4DE02988.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-98F22970.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\BYTECODEGENERATOR.EXE-C1E9BCE6.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-002D6F84.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-08AF006C.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-7F337F0A.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-3ED30A86.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-99F89D15.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-D2B15AE2.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\pcamain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\FILESYNCCONFIG.EXE-33763EB7.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-7EF4A0DD.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-AED2006F.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\SVCHOST.EXE-2F0E0AF4.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\DLLHOST.EXE-FC981FFE.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-01E21A55.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-32DA767E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppCompat\Programs\Amcache.hve 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-641DCE1C.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-7194EF5E.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-C8D69DC6.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNTIMEBROKER.EXE-BC366267.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\STARTMENUEXPERIENCEHOST.EXE-D80E778C.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\RUNDLL32.EXE-7CB48DE8.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\TEXTINPUTHOST.EXE-4AE33179.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\TASKKILL.EXE-8F5B2253.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\Prefetch\DLLHOST.EXE-5E46FA0D.pf 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 7 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key opened \REGISTRY\MACHINE\Software\Microsoft\Netsh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Netsh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe"C:\Users\Admin\AppData\Local\Temp\70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe"1⤵
- Drops startup file
- Indicator Removal: Clear Windows Event Logs
- Drops desktop.ini file(s)
- Enumerates connected drives
- Remote Services: SMB/Windows Admin Shares
- Drops file in System32 directory
- Drops file in Windows directory
- Event Triggered Execution: Netsh Helper DLL
PID:4932