Analysis
- max time kernel
15s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 13:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe
- Size 24.1MB
- Sample260703-q5vgpsat21
- SHA256 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6
- MD5 5e8dad881659b6535ece40596f1e02d2
- SHA1 0d2461ca1a3f4bdc4512bcd6c54192e2a1e99656
- SHA512 e8379e955d679f2662d022efe498e9b30acb0eb4b75e5cef70aee019db500826240deeb5c9cfaf24755385e755b1f3487282ae431f8ae5d79f7c9d08dc23077c
- SSDEEP 98304:33XLIuzhFgMw/fy5KrW2DW3yErO4siImgwR/zFls3S/wb8z1qP5E6my+aBMC+6y3:3L/Q3ynfrO4soHsieM1qP5EjVQa5Zh
- TLSH T197475B82F7844ADEC65099798DAA53C23371FC251F27E3D36B09BA3E2D726C59E64700
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\OAlerts.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudFiles-Filter%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Initialization.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageManagement%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\System.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Troubleshooter.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Provisioning-Diagnostics-Provider%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4LogonTasksChannel.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageVolume%4Diagnostic.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4FirewallDiagnostics.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Inventory.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Biometrics%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4CertInUse.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Autopilot.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-MUI%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppxPackaging%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4KeyMgmt.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZSync%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Setup.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\HardwareEvents.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Privacy-Auditing%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-PCW%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Device Management.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Perflib%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Internet Explorer.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 9 IoCs
description ioc Process File opened for modification C:\Users\All Users\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-1086369643-1618123105-2567081378-1000\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification F:\$Recycle.Bin\S-1-5-21-1086369643-1618123105-2567081378-1000\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Users\Admin\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Documents and Settings\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\ProgramData\Start Menu\Programs\Startup\desktop.ini 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened (read-only) \??\F: 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Remote Services: SMB/Windows Admin Shares 1 TTPs 1 IoCs
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LanmanServer\Parameters\NullSessionPipes 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\System32\config\SECURITY.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SECURITY.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SOFTWARE.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SYSTEM.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SAM 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SECURITY 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SOFTWARE 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SAM.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SAM.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SOFTWARE.LOG2 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SYSTEM.LOG1 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\System32\config\SYSTEM 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\inf\setupapi.offline.20240401_072605.log 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\drvmain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\frxmain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\pcamain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\sysmain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\inf\setupapi.dev.log 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\inf\setupapi.offline.log 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\inf\setupapi.setup.log 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe File opened for modification C:\Windows\AppPatch\msimain.sdb 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Event Triggered Execution: Netsh Helper DLL 1 TTPs 7 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key opened \REGISTRY\MACHINE\Software\Microsoft\Netsh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key opened \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Netsh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe"C:\Users\Admin\AppData\Local\Temp\70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6.exe"1⤵
- Drops startup file
- Indicator Removal: Clear Windows Event Logs
- Drops desktop.ini file(s)
- Enumerates connected drives
- Remote Services: SMB/Windows Admin Shares
- Drops file in System32 directory
- Drops file in Windows directory
- Event Triggered Execution: Netsh Helper DLL
PID:5980
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1720
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:4920
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:2008
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH