71faa19d55772e9454eb747f6325535f4ae25c21f146e9addc2438ca05b37eb6

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Size 3.2MB
Sample260704-vqaafaat81
SHA256 71faa19d55772e9454eb747f6325535f4ae25c21f146e9addc2438ca05b37eb6
MD5 d990e3335bca7f7aa3f93fd7d34cd8ee
SHA1 29a2184d4688f0b2387bf4ccab55b77ef6e6f3b5
SHA512 323c8c41c8e118597b26c968e5e9ca0e7a016bba364be9e6e2d4abaa4660868a52b249c061bcef1bbe79c9e7b5b3c8b8565fa0d542ad24657d5363aea0ff3ca7
SSDEEP 49152:x7FB7BplKQ8Y+Bi6v1vZRM0d7IqnJUOKtC5Nm:RgFDJ7FBJUntC5
TLSH
T150F5E024C7995972D829D03C48864BDE4735ED4ACE8117CF13EC25B08C861EEADFA6DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence spyware stealer trojan

Malware Config

Signatures

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Windows security bypass 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 18 IoCs

resource	yara_rule
behavioral2/memory/7148-16-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-36-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-37-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-48-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-49-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-51-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-52-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-54-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-55-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-60-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-61-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-63-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-64-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-81-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-82-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-87-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-88-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/7148-91-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/memory/7148-16-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Executes dropped EXE 3 IoCs

pid	Process
7148	waitfor.exe
1432	MsDevSvc.exe
1356	waitfor.exe

Loads dropped DLL 3 IoCs

pid	Process
7148	waitfor.exe
7148	waitfor.exe
1356	waitfor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1749168396-1890032557-311772428-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinAppVerifier = "C:\\ProgramData\\Microsoft\\WinAppVerifier\\waitfor.exe wnk8rUYXM"	waitfor.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdBoot\Start = "4"	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Kills process with taskkill 19 IoCs

defense_evasion

pid	Process
2796	taskkill.exe
1228	taskkill.exe
5080	taskkill.exe
4628	taskkill.exe
5700	taskkill.exe
6180	taskkill.exe
5908	taskkill.exe
7008	taskkill.exe
5136	taskkill.exe
2936	taskkill.exe
1248	taskkill.exe
5632	taskkill.exe
7012	taskkill.exe
6868	taskkill.exe
3548	taskkill.exe
2336	taskkill.exe
5524	taskkill.exe
3208	taskkill.exe
2036	taskkill.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe
7148	waitfor.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5136	taskkill.exe
Token: SeDebugPrivilege	2796	taskkill.exe
Token: SeDebugPrivilege	1228	taskkill.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	5080	taskkill.exe
Token: SeDebugPrivilege	4628	taskkill.exe
Token: SeDebugPrivilege	2336	taskkill.exe
Token: SeDebugPrivilege	5700	taskkill.exe
Token: SeDebugPrivilege	5524	taskkill.exe
Token: SeDebugPrivilege	2036	taskkill.exe
Token: SeDebugPrivilege	3208	taskkill.exe
Token: SeDebugPrivilege	2936	taskkill.exe
Token: SeDebugPrivilege	1248	taskkill.exe
Token: SeDebugPrivilege	6180	taskkill.exe
Token: SeDebugPrivilege	5632	taskkill.exe
Token: SeDebugPrivilege	7012	taskkill.exe
Token: SeDebugPrivilege	5908	taskkill.exe
Token: SeDebugPrivilege	7008	taskkill.exe
Token: SeDebugPrivilege	6868	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 5136	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	91
PID 5792 wrote to memory of 2796	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	94
PID 5792 wrote to memory of 1228	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	96
PID 5792 wrote to memory of 3548	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	98
PID 5792 wrote to memory of 5080	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	100
PID 5792 wrote to memory of 4628	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	102
PID 5792 wrote to memory of 2336	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	104
PID 5792 wrote to memory of 5700	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	106
PID 5792 wrote to memory of 5524	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	108
PID 5792 wrote to memory of 2036	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	110
PID 5792 wrote to memory of 3208	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	112
PID 5792 wrote to memory of 2936	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	114
PID 5792 wrote to memory of 1248	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	116
PID 5792 wrote to memory of 6180	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	118
PID 5792 wrote to memory of 5632	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	120
PID 5792 wrote to memory of 7012	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	122
PID 5792 wrote to memory of 5908	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	124
PID 5792 wrote to memory of 7008	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	126
PID 5792 wrote to memory of 6868	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	128
PID 5792 wrote to memory of 7148	5792	2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe	130
PID 1432 wrote to memory of 1356	1432	MsDevSvc.exe	140

C:\Users\Admin\AppData\Local\Temp\2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d990e3335bca7f7aa3f93fd7d34cd8ee_akira_cobalt-strike_icedid_rusty-stealer_satacom.exe"
1⤵
- Modifies security service
- Windows security bypass
- Modify Registry: Disable Windows Driver Blocklist
- Windows security modification
- Modifies Security services
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MsMpEng.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5136
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM MpCmdRun.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM NisSrv.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SecurityHealthService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3548
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SecurityHealthSystray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5080
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM smartscreen.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM SgrmBroker.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM HipsTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5700
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM wsctrl.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5524
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM usysdiag.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2036
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM HipsDaemon.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3208
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM QQPCTray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM QQPCRTP.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1248
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM QQPCMgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6180
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 360Tray.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5632
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM 360Safe.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7012
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM ZhuDongFangYu.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM avp.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:7008
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:6868
- C:\ProgramData\Microsoft\WinAppVerifier\waitfor.exe
  "C:\ProgramData\Microsoft\WinAppVerifier\waitfor.exe" wnk8rUYXM
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  PID:7148

C:\ProgramData\Microsoft\WinAppVerifier\MsDevSvc.exe
C:\ProgramData\Microsoft\WinAppVerifier\MsDevSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432
- C:\ProgramData\Microsoft\WinAppVerifier\waitfor.exe
  C:\ProgramData\Microsoft\WinAppVerifier\waitfor.exe wnk8rUYXM
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.svctime

Path C:\ProgramData\Microsoft\WinAppVerifier\.svctime
Size 14B
SHA256 414a8803682635e28217c6e3a707e4ab5202db5dd47cebe5c5bef1eeb8e639ee
MD5 07fe49376bed1a2514c467c7ade26dcc
SHA1 eac3a75838980a353c19d86d439ee786a3424979
SHA512 ccdd59b93cc36f1d0f3f56cfcd607388a6b0926b613a0201ee1dd4c995983c2334e83dcf6b30f29b2aae52bf092136b9ca7bfe0b5740090ceb20967cde19aef1
MD5 SHA1 SHA512

Submit Download

MsDevSvc.exe

Path C:\ProgramData\Microsoft\WinAppVerifier\MsDevSvc.exe
Size 192KB
SHA256 cffdeef92e2498c491ad15330bed539dac7a7a38b6a8276018756f355bdc9878
MD5 5f4f56bc84a9c82972188b52e56a1cbf
SHA1 f0871ff09ea16d1a5041c3333c4d5c0449ced5ca
SHA512 ff025c9e8afbbe1b82c3dcfb58ae93a6cc3c6bfb4cb58ac63203eea208945d3bfac18636f94fbd89f37d8e8e12bd36322deacb7d595bb285011990d40a1f9c71
SSDEEP 3072:u7G/St5vl8hQAdM4hWLN9+xmh2U/gUY6dLQ86ALNqDRO7aktjU:Cd8hQAC4e+Uh2zwdLxD4DN
TLSH
T11B147C12739454FCE167C038C6514A52A77674860B226EFF03A44339AF27AE6BF3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VERSION.dll

Path C:\ProgramData\Microsoft\WinAppVerifier\VERSION.dll
Size 11KB
SHA256 2da721efe5a34428a76c8a0d5a4b56ff377bfd9e86b99b76119e1b7ea1b8c488
MD5 3900697d1062f52b2945447857efe732
SHA1 6a29b285236f7769570ed19a3795a3d063bcae28
SHA512 a1e7316d66a7a6d1a62158837cb4dc200590eaa0a87558f3b421aa0bf94418d624793138bc86596989c250826c914ecdec8724f2e90914763b86720d0a6036ba
SSDEEP 192:FY+/eDDUPvrmQ9AECA2OkcPcwxCsORSj5XGcL+iWc3F5783xmM47mPCwRoLErue:FjC79EfcoCsvhn5V5IBmMmmPCwCwr7
TLSH
T171322B16D78904F5C0B383BBADA3141127F5329461FDB83B12F9415C7AD3BAD2B29784
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cache.db

Path C:\ProgramData\Microsoft\WinAppVerifier\cache.db
Size 544KB
SHA256 6a6ec725260de799ed8cb71fccd7c892b8b6f75a30dd08a7e6430b9cde5c0d77
MD5 6a37942abd46e6642e93fe5a7b1dc07e
SHA1 e5b435a2f1778fc2962e7e794867df6fa8d2e824
SHA512 1c73074b3d62d7a02f3b8391a9d35651cf4e6d1c7a55f0b244f6ce12a039a20617224ecb2631e557ebba8c89b8339ff1cd8d628aed185d9c0bace4aa54b5484d
SSDEEP 12288:sKJiOl03xbp8nSu7gbZK8h5Tcg7Ib05R2NvLnjkc6:sKAOlgxbp8nSu71y2I5R2Nv/6
TLSH
T151C4E164A7665E3E1F272FEDD04E48DB564FDE9317C5001A27F086E5CA702A0881FE6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metrics.bin

Path C:\ProgramData\Microsoft\WinAppVerifier\metrics.bin
Size 379KB
SHA256 3e115d21b4d29fd26e6548774fb0acb36170e7b6c5fcc2bc3d1ed192307669be
MD5 e26a6b2e7f3ae35e87ed5c6e5285ac24
SHA1 6f89df329ccba9c744bab2f7af5dee8df9df013b
SHA512 59748130903f65609e1d61b85e1d014534346fb272724c46cfc31da23f190d44033948e38f305ad026d6352f601d7bc20f36a1e9795fb7a756dfc23854325455
SSDEEP 6144:5hHDNsqvxdQfMXJoqEQWc3vUp3WG5SRNjZCVCz0PDTJ+fCjobJFYk4pKRa/W1d5:5pDNsqvOMPEQWOvUplqaV9vJ+8OFYk4o
TLSH
T1EF84D030E7A75CFFAFB326C8BC7BA5F611CAC5B661E20623BA7551C452612344CC7682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

waitfor.exe

Path C:\ProgramData\Microsoft\WinAppVerifier\waitfor.exe
Size 39KB
SHA256 4c2f9efa10013d1e95810973dc5a47795c0b62af923165e4cc232399a89e5767
MD5 e6f52af752157757ea5b0b1f1c997314
SHA1 b1f46293696764c26bfb2f6bd172fa2fbdd95740
SHA512 76cb0ecdc1a867a3785c8a9ffef74154e3eca3e86d65a70205ccafb16ecd85342ac9f50e4dc4564fe3de4514161dcc90987d6832c7b32522bdaf59f387987809
SSDEEP 768:Yf98nv2Ciy9wn0bgdr5g+L3Rcy95XX6GgHKePKx6nUM8:Uoevjn6lHKVx6N8
TLSH
T15A033A4963A800F9F83A923CC855560BD771B4126772A6CF53B4CB562F53AE7B13EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ms3878b434.tmp

Path C:\Users\Admin\AppData\Local\Temp\ms3878b434.tmp
Size 379KB
SHA256 1b846a1d1b5e2c5bf02b0f64a069623672b7d4476a8769a6244e75265b858621
MD5 3c02d9856954d4889713290b6689c412
SHA1 1751ba14c371d542a5346411794cd64567f6b2ee
SHA512 d7ada8226e953d433188e805d270c43dbe5baab547410ffd7743c247c1bcf5ec951b09aa0f75bfa05f2ac8b946bdd2e05032b995a7f2f1745bb405591afee7b9
SSDEEP 6144:9yGYze5qYqDjRtjCGCQJ0TUYDQva1oWcHmzhb7pYARfO7HedCrKhgQ8cA/k:9nYzecRADPcvKpcHm9HpMHediPH8
TLSH
T1E284CF05F7D404B9E93785BC818B4696D66BB8AB07D9C25F13F087D20E623D4943EF2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/7148-52-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-60-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-48-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-49-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-51-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-36-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-54-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-55-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-16-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-37-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-61-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-63-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-64-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-81-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-82-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-87-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-88-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download

memory/7148-91-0x000001CCDB4E0000-0x000001CCDB55A000-memory.dmp

Download